From 9b9a99bb9e6fa1624e2f4155c574a0976811da11 Mon Sep 17 00:00:00 2001 From: CristiMacovei Date: Mon, 8 Sep 2025 20:07:07 +0300 Subject: [PATCH 1/4] Introduce automated testing for SandBlaster Implement a testing framework including all necessary utilities to run automated tests and add one working test for iOS 9.3 (13E237). Signed-off-by: CristiMacovei --- .github/workflows/tests.yml | 18 + Dockerfile | 16 + sb_parser/.clang-format | 7 + sb_parser/Makefile | 16 + sb_parser/block.cpp | 147 + sb_parser/block.hpp | 30 + sb_parser/hasher.cpp | 35 + sb_parser/hasher.hpp | 19 + sb_parser/parser | Bin 0 -> 207808 bytes sb_parser/parser.cpp | 220 ++ sb_parser/string_utils.cpp | 16 + sb_parser/string_utils.hpp | 5 + tests/build_logs/.dummy | 0 .../iPhone5__1_9.3_13E237/inputs/sandbox.kext | Bin 0 -> 520192 bytes tests/iPhone5__1_9.3_13E237/logs/.dummy | 0 .../rev_profiles/AGXCompilerService.sb | 386 ++ .../rev_profiles/AGXCompilerService.sb.xml | 40 + .../references/rev_profiles/AdSheet.sb | 1508 +++++++ .../references/rev_profiles/AdSheet.sb.xml | 39 + .../references/rev_profiles/AirTraffic.sb | 135 + .../references/rev_profiles/AirTraffic.sb.xml | 24 + .../references/rev_profiles/BTServer.sb | 654 +++ .../references/rev_profiles/BTServer.sb.xml | 41 + .../references/rev_profiles/BlueTool.sb | 399 ++ .../references/rev_profiles/BlueTool.sb.xml | 40 + .../references/rev_profiles/CFNetworkAgent.sb | 173 + .../rev_profiles/CFNetworkAgent.sb.xml | 41 + .../references/rev_profiles/CVMServer.sb | 235 ++ .../references/rev_profiles/CVMServer.sb.xml | 40 + .../references/rev_profiles/CommCenter.sb | 436 ++ .../references/rev_profiles/CommCenter.sb.xml | 44 + .../references/rev_profiles/DataActivation.sb | 860 ++++ .../rev_profiles/DataActivation.sb.xml | 41 + .../rev_profiles/EscrowSecurityAlert.sb | 238 ++ .../rev_profiles/EscrowSecurityAlert.sb.xml | 40 + .../rev_profiles/IDSCredentialsAgent.sb | 305 ++ .../rev_profiles/IDSCredentialsAgent.sb.xml | 40 + .../IDSRemoteURLConnectionAgent.sb | 495 +++ .../IDSRemoteURLConnectionAgent.sb.xml | 40 + .../rev_profiles/IMDPersistenceAgent.sb | 305 ++ .../rev_profiles/IMDPersistenceAgent.sb.xml | 39 + .../IMRemoteURLConnectionAgent.sb | 493 +++ .../IMRemoteURLConnectionAgent.sb.xml | 40 + .../rev_profiles/IMTranscoderAgent.sb | 617 +++ .../rev_profiles/IMTranscoderAgent.sb.xml | 39 + .../references/rev_profiles/Lowtide.sb | 1260 ++++++ .../references/rev_profiles/Lowtide.sb.xml | 45 + .../rev_profiles/MTLCompilerService.sb | 186 + .../rev_profiles/MTLCompilerService.sb.xml | 40 + .../rev_profiles/MailCompositionService.sb | 1171 ++++++ .../MailCompositionService.sb.xml | 40 + .../references/rev_profiles/MobileBackup.sb | 9 + .../rev_profiles/MobileBackup.sb.xml | 21 + .../references/rev_profiles/MobileCal.sb | 875 ++++ .../references/rev_profiles/MobileCal.sb.xml | 41 + .../references/rev_profiles/MobileMaps.sb | 970 +++++ .../references/rev_profiles/MobileMaps.sb.xml | 41 + .../rev_profiles/MobileSlideShow.sb | 1154 ++++++ .../rev_profiles/MobileSlideShow.sb.xml | 43 + .../references/rev_profiles/PasteBoard.sb | 178 + .../references/rev_profiles/PasteBoard.sb.xml | 51 + .../rev_profiles/SafariSafeBrowsing.sb | 192 + .../rev_profiles/SafariSafeBrowsing.sb.xml | 40 + .../rev_profiles/ScreenshotService.sb | 195 + .../rev_profiles/ScreenshotService.sb.xml | 40 + .../rev_profiles/StreamingUnzipService.sb | 201 + .../rev_profiles/StreamingUnzipService.sb.xml | 40 + .../references/rev_profiles/WebSheet.sb | 1118 ++++++ .../references/rev_profiles/WebSheet.sb.xml | 40 + .../references/rev_profiles/accessoryd.sb | 202 + .../references/rev_profiles/accessoryd.sb.xml | 43 + .../references/rev_profiles/afcd.sb | 416 ++ .../references/rev_profiles/afcd.sb.xml | 40 + .../references/rev_profiles/appconduitd.sb | 433 ++ .../rev_profiles/appconduitd.sb.xml | 40 + .../references/rev_profiles/apsd.sb | 381 ++ .../references/rev_profiles/apsd.sb.xml | 44 + .../references/rev_profiles/assertiond.sb | 241 ++ .../references/rev_profiles/assertiond.sb.xml | 43 + .../references/rev_profiles/cloudphotod.sb | 19 + .../rev_profiles/cloudphotod.sb.xml | 37 + .../com.apple.AssetCacheLocatorService.sb | 455 +++ .../com.apple.AssetCacheLocatorService.sb.xml | 40 + .../rev_profiles/com.apple.GSSCred.sb | 185 + .../rev_profiles/com.apple.GSSCred.sb.xml | 40 + .../com.apple.WebKit.Databases.sb | 114 + .../com.apple.WebKit.Databases.sb.xml | 42 + .../com.apple.WebKit.Networking.sb | 327 ++ .../com.apple.WebKit.Networking.sb.xml | 42 + .../com.apple.WebKit.WebContent.sb | 764 ++++ .../com.apple.WebKit.WebContent.sb.xml | 42 + .../com.apple.assistant.assistantd.sb | 683 ++++ .../com.apple.assistant.assistantd.sb.xml | 39 + .../references/rev_profiles/com.apple.bird.sb | 629 +++ .../rev_profiles/com.apple.bird.sb.xml | 42 + .../rev_profiles/com.apple.cloudd.sb | 600 +++ .../rev_profiles/com.apple.cloudd.sb.xml | 39 + ...apple.datadetectors.AddToRecentsService.sb | 210 + ...e.datadetectors.AddToRecentsService.sb.xml | 40 + .../rev_profiles/com.apple.homed.sb | 724 ++++ .../rev_profiles/com.apple.homed.sb.xml | 39 + .../rev_profiles/com.apple.nehelper.sb | 491 +++ .../rev_profiles/com.apple.nehelper.sb.xml | 41 + .../com.apple.nesessionmanager.sb | 466 +++ .../com.apple.nesessionmanager.sb.xml | 46 + ...com.apple.quicklook.QLThumbnailsService.sb | 466 +++ ...apple.quicklook.QLThumbnailsService.sb.xml | 40 + .../rev_profiles/com.apple.rtcreportingd.sb | 494 +++ .../com.apple.rtcreportingd.sb.xml | 40 + .../rev_profiles/com.apple.sandboxd.sb | 67 + .../rev_profiles/com.apple.sandboxd.sb.xml | 43 + ...om.apple.siri.ClientFlow.ClientScripter.sb | 207 + ...pple.siri.ClientFlow.ClientScripter.sb.xml | 40 + .../rev_profiles/com.apple.snhelper.sb | 139 + .../rev_profiles/com.apple.snhelper.sb.xml | 40 + .../references/rev_profiles/com.apple.tccd.sb | 450 +++ .../rev_profiles/com.apple.tccd.sb.xml | 41 + .../rev_profiles/com.apple.tzlinkd.sb | 140 + .../rev_profiles/com.apple.tzlinkd.sb.xml | 40 + .../references/rev_profiles/com.apple.ubd.sb | 527 +++ .../rev_profiles/com.apple.ubd.sb.xml | 43 + .../references/rev_profiles/container.sb | 3520 +++++++++++++++++ .../references/rev_profiles/container.sb.xml | 29 + .../rev_profiles/containermanagerd.sb | 411 ++ .../rev_profiles/containermanagerd.sb.xml | 40 + .../rev_profiles/coresymbolicationd.sb | 170 + .../rev_profiles/coresymbolicationd.sb.xml | 40 + .../references/rev_profiles/cplogd.sb | 173 + .../references/rev_profiles/cplogd.sb.xml | 41 + .../references/rev_profiles/dataaccessd.sb | 512 +++ .../rev_profiles/dataaccessd.sb.xml | 44 + .../references/rev_profiles/debugserver.sb | 166 + .../rev_profiles/debugserver.sb.xml | 46 + .../references/rev_profiles/deleted.sb | 251 ++ .../references/rev_profiles/deleted.sb.xml | 40 + .../references/rev_profiles/duetexpertd.sb | 337 ++ .../rev_profiles/duetexpertd.sb.xml | 39 + .../references/rev_profiles/findmydeviced.sb | 654 +++ .../rev_profiles/findmydeviced.sb.xml | 40 + .../references/rev_profiles/fmfd.sb | 592 +++ .../references/rev_profiles/fmfd.sb.xml | 39 + .../rev_profiles/ftp-proxy-embedded.sb | 137 + .../rev_profiles/ftp-proxy-embedded.sb.xml | 42 + .../references/rev_profiles/gamed.sb | 591 +++ .../references/rev_profiles/gamed.sb.xml | 40 + .../references/rev_profiles/geocorrectiond.sb | 19 + .../rev_profiles/geocorrectiond.sb.xml | 37 + .../references/rev_profiles/geod.sb | 483 +++ .../references/rev_profiles/geod.sb.xml | 41 + .../references/rev_profiles/gizmoappd.sb | 483 +++ .../references/rev_profiles/gizmoappd.sb.xml | 41 + .../references/rev_profiles/gputoolsd.sb | 394 ++ .../references/rev_profiles/gputoolsd.sb.xml | 50 + .../references/rev_profiles/healthd.sb | 515 +++ .../references/rev_profiles/healthd.sb.xml | 39 + .../references/rev_profiles/iapd.sb | 559 +++ .../references/rev_profiles/iapd.sb.xml | 43 + .../rev_profiles/identityservicesd.sb | 576 +++ .../rev_profiles/identityservicesd.sb.xml | 41 + .../references/rev_profiles/itunesstored.sb | 569 +++ .../rev_profiles/itunesstored.sb.xml | 40 + .../references/rev_profiles/keyboard.sb | 419 ++ .../references/rev_profiles/keyboard.sb.xml | 32 + .../references/rev_profiles/librariand.sb | 353 ++ .../references/rev_profiles/librariand.sb.xml | 41 + .../rev_profiles/limitadtrackingd.sb | 170 + .../rev_profiles/limitadtrackingd.sb.xml | 41 + .../references/rev_profiles/lockdownd.sb | 347 ++ .../references/rev_profiles/lockdownd.sb.xml | 41 + .../rev_profiles/lsuseractivityd.sb | 293 ++ .../rev_profiles/lsuseractivityd.sb.xml | 41 + .../references/rev_profiles/mDNSResponder.sb | 131 + .../rev_profiles/mDNSResponder.sb.xml | 52 + .../references/rev_profiles/mediaanalysisd.sb | 612 +++ .../rev_profiles/mediaanalysisd.sb.xml | 39 + .../references/rev_profiles/mediaserverd.sb | 852 ++++ .../rev_profiles/mediaserverd.sb.xml | 43 + .../rev_profiles/mobile-house-arrest.sb | 435 ++ .../rev_profiles/mobile-house-arrest.sb.xml | 40 + .../references/rev_profiles/mobileassetd.sb | 507 +++ .../rev_profiles/mobileassetd.sb.xml | 42 + .../references/rev_profiles/nanomaild.sb | 422 ++ .../references/rev_profiles/nanomaild.sb.xml | 40 + .../references/rev_profiles/nanomapscd.sb | 616 +++ .../references/rev_profiles/nanomapscd.sb.xml | 40 + .../references/rev_profiles/nanomapsgd.sb | 543 +++ .../references/rev_profiles/nanomapsgd.sb.xml | 40 + .../references/rev_profiles/navd.sb | 532 +++ .../references/rev_profiles/navd.sb.xml | 40 + .../references/rev_profiles/network-filter.sb | 296 ++ .../rev_profiles/network-filter.sb.xml | 32 + .../references/rev_profiles/nfcd.sb | 314 ++ .../references/rev_profiles/nfcd.sb.xml | 40 + .../references/rev_profiles/nlcd.sb | 68 + .../references/rev_profiles/nlcd.sb.xml | 41 + .../references/rev_profiles/nointernet.sb | 6 + .../references/rev_profiles/nointernet.sb.xml | 20 + .../references/rev_profiles/nsurlsessiond.sb | 569 +++ .../rev_profiles/nsurlsessiond.sb.xml | 40 + .../references/rev_profiles/nsurlstoraged.sb | 384 ++ .../rev_profiles/nsurlstoraged.sb.xml | 41 + .../rev_profiles/online-auth-agent.sb | 304 ++ .../rev_profiles/online-auth-agent.sb.xml | 40 + .../references/rev_profiles/passd.sb | 786 ++++ .../references/rev_profiles/passd.sb.xml | 41 + .../references/rev_profiles/pfd.sb | 160 + .../references/rev_profiles/pfd.sb.xml | 40 + .../references/rev_profiles/printd.sb | 459 +++ .../references/rev_profiles/printd.sb.xml | 41 + .../references/rev_profiles/ptpd.sb | 239 ++ .../references/rev_profiles/ptpd.sb.xml | 43 + .../references/rev_profiles/quicklookd.sb | 1151 ++++++ .../references/rev_profiles/quicklookd.sb.xml | 40 + .../references/rev_profiles/racoon.sb | 120 + .../references/rev_profiles/racoon.sb.xml | 42 + .../references/rev_profiles/replayd.sb | 355 ++ .../references/rev_profiles/replayd.sb.xml | 40 + .../rev_profiles/reversetemplated.sb | 197 + .../rev_profiles/reversetemplated.sb.xml | 40 + .../references/rev_profiles/revisiond.sb | 271 ++ .../references/rev_profiles/revisiond.sb.xml | 41 + .../references/rev_profiles/routined.sb | 654 +++ .../references/rev_profiles/routined.sb.xml | 41 + .../references/rev_profiles/seld.sb | 547 +++ .../references/rev_profiles/seld.sb.xml | 40 + .../references/rev_profiles/sharingd.sb | 895 +++++ .../references/rev_profiles/sharingd.sb.xml | 39 + .../rev_profiles/social-services.sb | 821 ++++ .../rev_profiles/social-services.sb.xml | 39 + .../rev_profiles/softwareupdated.sb | 222 ++ .../rev_profiles/softwareupdated.sb.xml | 40 + .../rev_profiles/streaming_zip_conduit.sb | 367 ++ .../rev_profiles/streaming_zip_conduit.sb.xml | 40 + .../references/rev_profiles/studentd.sb | 501 +++ .../references/rev_profiles/studentd.sb.xml | 40 + .../references/rev_profiles/suggestd.sb | 310 ++ .../references/rev_profiles/suggestd.sb.xml | 39 + .../references/rev_profiles/syncdefaultsd.sb | 416 ++ .../rev_profiles/syncdefaultsd.sb.xml | 44 + .../references/rev_profiles/syslog_relay.sb | 135 + .../rev_profiles/syslog_relay.sb.xml | 41 + .../references/rev_profiles/test-common.sb | 131 + .../rev_profiles/test-common.sb.xml | 40 + .../references/rev_profiles/transitd.sb | 83 + .../references/rev_profiles/transitd.sb.xml | 40 + .../references/rev_profiles/userfs_helper.sb | 344 ++ .../rev_profiles/userfs_helper.sb.xml | 40 + .../references/rev_profiles/userfsd.sb | 386 ++ .../references/rev_profiles/userfsd.sb.xml | 41 + .../rev_profiles/vibrationmanagerd.sb | 276 ++ .../rev_profiles/vibrationmanagerd.sb.xml | 39 + .../references/rev_profiles/vpn-plugins.sb | 417 ++ .../rev_profiles/vpn-plugins.sb.xml | 53 + .../references/rev_profiles/webinspectord.sb | 251 ++ .../rev_profiles/webinspectord.sb.xml | 40 + .../rev_profiles/wifiFirmwareLoader.sb | 217 + .../rev_profiles/wifiFirmwareLoader.sb.xml | 41 + .../references/sandbox_bundle | Bin 0 -> 425970 bytes .../references/sandbox_profiles.txt | 121 + tests/iPhone5__1_9.3_13E237/references/sb_ops | 125 + tests/test.py | 278 ++ 261 files changed, 60506 insertions(+) create mode 100644 .github/workflows/tests.yml create mode 100644 Dockerfile create mode 100644 sb_parser/.clang-format create mode 100644 sb_parser/Makefile create mode 100644 sb_parser/block.cpp create mode 100644 sb_parser/block.hpp create mode 100644 sb_parser/hasher.cpp create mode 100644 sb_parser/hasher.hpp create mode 100755 sb_parser/parser create mode 100644 sb_parser/parser.cpp create mode 100644 sb_parser/string_utils.cpp create mode 100644 sb_parser/string_utils.hpp create mode 100644 tests/build_logs/.dummy create mode 100644 tests/iPhone5__1_9.3_13E237/inputs/sandbox.kext create mode 100644 tests/iPhone5__1_9.3_13E237/logs/.dummy create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb create mode 100644 tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb.xml create mode 100644 tests/iPhone5__1_9.3_13E237/references/sandbox_bundle create mode 100644 tests/iPhone5__1_9.3_13E237/references/sandbox_profiles.txt create mode 100644 tests/iPhone5__1_9.3_13E237/references/sb_ops create mode 100755 tests/test.py diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml new file mode 100644 index 0000000..0ee3415 --- /dev/null +++ b/.github/workflows/tests.yml @@ -0,0 +1,18 @@ +name: Sandblaster tests +on: + workflow_dispatch: # Manual trigger + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Set up Python 3.10 + uses: actions/setup-python@v3 + with: + python-version: "3.10" + - name: Run test script + run: python3 tests/test.py diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..1e7039e --- /dev/null +++ b/Dockerfile @@ -0,0 +1,16 @@ +FROM debian:bullseye + +RUN set -xe; \ + apt-get -yqq update; \ + apt-get install -y libstdc++6 python2.7 python3 python3-pip; \ + pip3 install lief; + +COPY helpers /sandblaster/helpers/ +COPY reverse-sandbox /sandblaster/reverse-sandbox +COPY sb_parser /sandblaster/sb_parser + +WORKDIR /sandblaster/sb_parser + +# apparently if you remove the 'make clean' line it goes bang :) +RUN make clean +RUN make diff --git a/sb_parser/.clang-format b/sb_parser/.clang-format new file mode 100644 index 0000000..d731bc1 --- /dev/null +++ b/sb_parser/.clang-format @@ -0,0 +1,7 @@ +BasedOnStyle: LLVM +IndentWidth: 4 +TabWidth: 4 +UseTab: Always +BreakBeforeBraces: Stroustrup +AllowShortIfStatementsOnASingleLine: false +IndentCaseLabels: false diff --git a/sb_parser/Makefile b/sb_parser/Makefile new file mode 100644 index 0000000..3bda41c --- /dev/null +++ b/sb_parser/Makefile @@ -0,0 +1,16 @@ +CXXFLAGS=-std=c++17 + +default: parser + +block.o: block.hpp block.cpp + +hasher.o: hasher.hpp hasher.cpp + +string_utils.o: string_utils.hpp string_utils.cpp + +parser: block.o hasher.o string_utils.o parser.cpp + +.PHONY: clean + +clean: + rm -rf parser *.o diff --git a/sb_parser/block.cpp b/sb_parser/block.cpp new file mode 100644 index 0000000..b9e60b7 --- /dev/null +++ b/sb_parser/block.cpp @@ -0,0 +1,147 @@ +#include +#include + +#include "block.hpp" +#include "hasher.hpp" +#include "string_utils.hpp" + +Block::Block(StringHasher &hasher) +{ + this->m_name = 0; + + this->m_hasher = &hasher; +} + +void Block::set_name(std::string str) +{ + this->m_name = this->m_hasher->hash(str); +} + +void Block::add_attr(std::string attr) +{ + this->m_attributes.push_back(this->m_hasher->hash(attr)); +} + +void Block::add_child(Block *other) { this->m_children.push_back(other); } + +std::string Block::to_string() +{ + std::string name = this->m_hasher->reverse_hash(this->m_name); + + std::string ans = "{\"name\": " + quote_string(name); + + ans += ", \"attributes\": ["; + if (!this->m_attributes.empty()) { + for (int attribute : this->m_attributes) { + ans += quote_string(this->m_hasher->reverse_hash(attribute)) + ","; + } + + ans.pop_back(); + } + ans += "], \"children\": ["; + if (!this->m_children.empty()) { + for (Block *child_block_ptr : this->m_children) { + ans += child_block_ptr->to_string() + ","; + } + ans.pop_back(); + } + ans += "]"; + + ans += "}"; + return ans; +} + +// todo maybe add comparator options here +int Block::compare_to(Block *other, bool skip_print) +{ + //* check name first + if (this->m_name != other->m_name) { + if (!skip_print) { + std::fprintf(stderr, "Block names differ: '%s' vs '%s'\n", + this->m_hasher->reverse_hash(this->m_name).c_str(), + other->m_hasher->reverse_hash(other->m_name).c_str()); + } + + return this->m_name - other->m_name; + } + + //* check attributes + //* check size first, if this fails, no need to sort + if (this->m_attributes.size() != other->m_attributes.size()) { + if (!skip_print) { + std::fprintf(stderr, + "Block attribute lengths differ: '%lu' vs '%lu'\n", + this->m_attributes.size(), other->m_attributes.size()); + } + + return ((int)(this->m_attributes.size())) - + ((int)(other->m_attributes.size())); + } + + //* check attribute values, sort first because order doesn't matter + std::sort(this->m_attributes.begin(), this->m_attributes.end()); + std::sort(other->m_attributes.begin(), other->m_attributes.end()); + + for (int i = 0; i < (int)(this->m_attributes.size()); ++i) { + if (this->m_attributes[i] != other->m_attributes[i]) { + if (!skip_print) { + std::fprintf( + stderr, "Block attribute #%d differs: '%s' vs '%s'\n", i, + this->m_hasher->reverse_hash(this->m_attributes[i]).c_str(), + other->m_hasher->reverse_hash(other->m_attributes[i]) + .c_str()); + } + return this->m_attributes[i] - other->m_attributes[i]; + } + } + + //* check children + //* check size first, if this fails, no need to sort + if (this->m_children.size() != other->m_children.size()) { + if (!skip_print) { + std::fprintf(stderr, + "Block children lengths differ: '%lu' vs '%lu'\n", + this->m_children.size(), other->m_children.size()); + } + return ((int)(this->m_children.size())) - + ((int)(other->m_children.size())); + } + + auto block_comparator = [](Block *i, Block *j) -> bool { + return i->compare_to(j, true) < 0; + }; + + std::sort(this->m_children.begin(), this->m_children.end(), + block_comparator); + std::sort(other->m_children.begin(), other->m_children.end(), + block_comparator); + + for (int i = 0; i < (int)(this->m_children.size()); ++i) { + int result = + this->m_children[i]->compare_to(other->m_children[i], skip_print); + + if (result != 0) { + if (!skip_print) { + std::fprintf( + stderr, + "Block child #%d differs: '%s' vs '%s' (see above error)\n", + i, + this->m_hasher->reverse_hash(this->m_children[i]->m_name) + .c_str(), + other->m_hasher->reverse_hash(other->m_children[i]->m_name) + .c_str()); + } + return result; + } + } + + //* if all checks pass, objects are equal + return 0; +} + +Block::~Block() +{ + for (Block *child_block_ptr : this->m_children) { + delete child_block_ptr; + } +} diff --git a/sb_parser/block.hpp b/sb_parser/block.hpp new file mode 100644 index 0000000..734b749 --- /dev/null +++ b/sb_parser/block.hpp @@ -0,0 +1,30 @@ +#pragma once + +#include +#include + +#include "hasher.hpp" + +class Block { + public: + int m_name; + std::vector m_attributes; + std::vector m_children; + + StringHasher *m_hasher; + + public: + Block(StringHasher &hasher); + + ~Block(); + + void set_name(std::string str); + + void add_attr(std::string str); + + void add_child(Block *child); + + std::string to_string(); + + int compare_to(Block *other, bool skip_print = false); +}; diff --git a/sb_parser/hasher.cpp b/sb_parser/hasher.cpp new file mode 100644 index 0000000..2c9eab5 --- /dev/null +++ b/sb_parser/hasher.cpp @@ -0,0 +1,35 @@ +#include "hasher.hpp" + +#include +#include +#include + +StringHasher::StringHasher() +{ + this->m_clean_id = 1; + this->m_hashmap = std::unordered_map(); + this->m_rev_hashmap = std::vector(); + + this->m_rev_hashmap.push_back("default-name"); // reverse hash of 0 +} + +int StringHasher::hash(std::string str) +{ + if (!this->m_hashmap.count(str)) { + this->m_hashmap[str] = this->m_clean_id; + this->m_rev_hashmap.push_back(str); + ++(this->m_clean_id); + } + + return this->m_hashmap[str]; +} + +std::string StringHasher::reverse_hash(int hash) +{ + if (hash > this->m_rev_hashmap.size()) { + throw std::runtime_error("cannot reverse " + std::to_string(hash) + + " : invalid hash"); + } + + return this->m_rev_hashmap[hash]; +} diff --git a/sb_parser/hasher.hpp b/sb_parser/hasher.hpp new file mode 100644 index 0000000..d4c1ebc --- /dev/null +++ b/sb_parser/hasher.hpp @@ -0,0 +1,19 @@ +#pragma once + +#include +#include +#include + +class StringHasher { + public: + int m_clean_id; + std::unordered_map m_hashmap; + std::vector m_rev_hashmap; + + public: + StringHasher(); + + int hash(std::string str); + + std::string reverse_hash(int hash); +}; diff --git a/sb_parser/parser b/sb_parser/parser new file mode 100755 index 0000000000000000000000000000000000000000..33eb25278a913eb16e637f607606413c70e0968e GIT binary patch literal 207808 zcmeFad3;sH88?0dg2AeZJEbmH)CyHG2_XcR8qlj31&v@VE*L@x5``otH;7df4QaWJ zSL1@>+PG9{ZEI>>qE-y3+|;^6Yb7p~RIQ%d&>EF$YN`2szt7B^Gv_WKyzl4z{QfX4 z&Y5Rso_Xfk=9%T3dsS%K$wRWTh6eQC(7+D^S$OWBpa3NrzU&aUN}wcA9M}#2Jva~y z3`hA+_-E=Rr#(YZh(D8Nt89SS*lwgoo1E^i>zR}^@sBCnW%{cdr%Fs3$W?i^8^*^x zl}}FZ`LlwX)NUvJGdT^SjDJD-Zy=D|ZkBGBoSvlXo0NU|w>^vkic4~p@W)5`)wmIXQqGwu1zp^&XCU;XjU%TJqoVMuYdjG*M~0J^~B%5 zJN_?|K5N;3!i~o-M^VPV*LMp9_DoayHU^are!z(I@K8>Ac+sxu;rC_eH+z@#^^e&( zJ^Z8$^jrhQPDlU48Q`~N!1L$tq{p*I2KdGd<9cwf^mzI*z%PSRq@(}E4E(tQijl7V zXBqJS4+@*E{&zCS@xtBH*MB!d{on18zJ3EbP1o;w=wLedybSa|odLdU2EOf?K@XQ? zfDdM%e{UFNIyz6zK>u$u(D_CNJg;Vu%Z3bmyFPo92 zXa1A{zBU7Xh%4>5f*Jh7ks0d$Cj*@)XRyc1Gt@83;D>L|0ME`q=ev;0=wx9b-wOC1 z0jyqb;>f+Y@N4jg@DdF-%ZY~oKRB>oV405lM@p+e;AM>`sOy6a`Fj-e-RMA0;Aitx z{$mXfl$T$)sJ5oOAyQEvDK8I{Pd#gT`Mj$7stc}F>sj~DX z=bk<@lAkxfdSO+=WoWmkxV~y(MWlLhRcOX(r_U^(SYBSaWJ!L0VO>RJL1^Z9^urbg zoL?}vqM^DHMATQ;TsXB7xbiC(RMeM8>MN=v4O1&aGb`|)Q2zMxndOzWb(fX1v>{Yl zS$bOK%!xaQt+3(Jin`E@nT2dWGqSK@YHGhIj^vM5)YXE#s)|KZE6*wq&74qP$uXR^ z{evi4SXFZ&xUg7yEyyb`k1VLKy|i3`%d6_^YwIzr9pli1%7s-G^%{3QIJfm7LB=wq zv&zrP!=Q@FXY8x3F}vqLR9KQob$9H z$T*@Cb?;Wo?d#k_U|X@V&jOfpWn+BymDpTF!%h4 zUai`?NOf%uY!&0q6Xk{l&x138$rV=B%v-oE9W`d>>gbMXMt%X+3zS6a8!IDIVPT=r z;6K^Z@1WZRac3x>=~MP^ z=)#K{8s}2c7ij}eN9xwq%~%?SS*Vy=JwLN;g+MMR39z_)YHdUL8Ff`Pixs0d81ykT+qrS;@mJ#|h`{Iv_=4^Eyjvv#Iy z02UvM5Q{__8`4D%J7|(VIzSw>A+tRqQmIf=@-{>~?`+qMh|tXAb1UYRS1epuTPc!9 zi8VCC$gK;cu8sl`I_4q{tHG=osaybR&SHe(cNJQ@4B~Gpq4CsW6@e61!YgYu>1ego znKrbjZXx2sg;j9=l?y|qr^AU&5U6%#+e=BsOxK-Qv)4EDCdGBNbx_#Ki(Q5Z=PM#` zq)RHRWa?pryJSf@G_awzreYz2i}J;JTC{#%8imhbMZyTkd3yQ$>Y91zAW~J+fVs_B z&-RX7d8S34Sul>UJjV9oE0pld_?zu*Jwd{6trG>sK5eeAuehwdrpm;qTCumchob75 zhN}8VXwkO4XMQ2L+)xK$l~*pRi!|&gi;cftw4=fLger7@nd%;D0k+Jmid0lDMA%+h z&-uE(YC%QAg7UiBh1Hdp3E4GORr53$vz$zGXt}-2a>HrO>~A#J83mSr@}z3KOV#{dJ^sR~$d1y1c}-8V{)x%h$o6w}5@SHDcp`{^C>rsx^;NO}Q!Zh9 z<>a#5lkoOM-Uh)A=t$+_txRM)%5?a6m|j&xuSd;7Oy+Vdx}n>3k@~5OS+{#$%g-x6 zsk)w94RF}gPM-wFT+=8U0|n*NYAY|+Run1-xo&X#MGU3!loxBtFwJxBWs$0e($f~3 zsB?Rz49c;(t!}8RZE%C7|Mwg@0}J#WobL-8s(&n$i^gN}cVmhjh=N5$5a3iG65xv8 zxTrJ=VFeG$s}!ismV5|bZ+p~Uh@GGRvt1AW+Ag%?-d@5jGoI~Ml7jNdjQh$LRAU1T z!!51UbGtBoetnfMDk-bElwrh-s)oizRe?oSix$-`#ViY%(Cm{&C~ zfCUcrhqS|j`&v>RajVMC-J*)>8q`9^^?~_y*hY)Y*R>I>AnN(Cbb-l~J;A&K=mym* zk2r#7)J4o*Sc!g_%V(}q!B08y#Padu@&cz!n>yvh@`7>W3%tid_pxBy1ob>?7HSuc z%P$U`IBVAADO1by$BiF1$yZh|$tv@gOl77C~OuPRYBhUhX6+pf}bXW(Q# zw&b&-VK~m{x#%Fh;{3m3($!yv{d{s>V+7&Ve7g?Xv^_!5%U3^KZext=Pfd zHE^n~f7xpfqrY7O=a{^dj|j}y`9D8=F-}H?2O4$$5-A@RSf=xfCBIYPdYx|+d_x0w z>wIMFjo6YN5_kxC>0j?(n|D0loDt zh}tZ;eGa+Wf*+{5l>fF{@S`kvhXtQu!83n9aMEP{iY>U2J`%BII?s9 z=2&nXb-I5GEI5wT+`l>tjw5LIZ;1srHp#+e792;5?%xUv4l{QDS}nLXEh$@N!S``% z2Lf#td|wN`+Jf(A!P_mkIcs8ZhXwzxRln1MkFwxh7W{h_yxW4CJA5qevET<-^?NP& zK^EMx;6V%CZ@~|?-~$%icP@8>r~ijo^|LMbp%y&Xf*)qVM_TajTkxO-KiqnTCtt1S3L3s0K`FSg*TE%+o0-fqEp{X2HW2T!$1=T57@1 zuaVciKeFJh7JQZkUuD71 zvEXeM{9FsZ+Jc{N!P_nP1s1%+f|pzHP76NAf_GW)3JczC!RK1=Zy*2v#es0srtEOb zu*b@?0^#P)$dJMAaMSbI&$&bnPIwVTgNMC@|K=Q2f+yxB;!N}o;_t9^%yV*0bW8pz z<{3&RIwk)I^9&&q?UMf$^9&smZIZv2d4`OMR>|MaJVV9AGRfb_Jl$5JPVzrvo}po4 zj^wXlo*`kPRPsM&o}pl(MDq2_GXzZJN&X_{8TuuHlAp^wL%u|=o}pZ# zRq~^lX9$;ACiy*?XXuuwll(5sGh|E5k^B(m8LA~pCI8h0$TLJslt}(F<{6qL@+AKc z<{6SDf|7rqd4^(%T*<%9JeNv|faG6io*`MH|9>3+i_8a^@0I*I<_~7RTk=ma&(JH; zDfvg3XULUkm;A4oXQ-8Ell;BRGsH@?O8$1{8CoTlN&ZIW8B!(cB>yw!8A>JQNd6k; z8A2sWCI4gQ89F6OBwx=wL#9NYFVV^}=l0TRE)0q!Qeg^XlArk#xiTs&o=#c1@ z{1oOHG90-oS zZ_Yu>Sot}fqW*1Cf5MGS#(o`+_J`O0>xA&yfuZ57_2JjPj_eHt(=~$Z!QS~f2SFQ5 z`_FR@{A$_pk6}!K#v{tYO~-#W3yuaC5 z6oqAIGr4T?Su?{|Zz>iP&vd|_g`JNz~Sg~lb=C(Al%Z-l5li=IJ(j4 zn8RN0$_A!zi%Me6KV&W%cQ(K=gkviu8*ApY5svM)u7@pNVfiO;e_>sq(EXn13?%Lh zhh&g7_--W~vF3j1KJNSs-WKSkZv%akcqhY6#zXIdSRy+?Q!`ajBiUGUH<844o8(bb zp{Oy{e}K*s4-El|mS)9~xN{3&D?;xqTl&tJ$S(Nr*qmlw5JxA14qe|5U(nQ_wY)QD z`5(}I)6#dd8p|x2M}xF*%Se!|2x#Wy8;%Ous|RFw3L@OSAE6~0D@fe=5*08m&=lyK z0n|epr&*}um@Is#=Xj{6E7S@isGn4*6(sK5sVbOZ?1q7&C(4_HZ9G*e!UO*yv1t|I zVMNDJgf3z0N|k6y$>4s2sVxDuv}~3}qz6x0 zp=G**|9wGGF)Pg6GMh-5jXN{G^n^53gmj`cn$gJ^+cd_96h>qP<0!H-7D6`e1c1>Z z`4R}BZ=aksW$$R98uLGhK&vX4(&UU3-mEjQtZw33j`1pPHXllRaBbEw#pQmp;Z}Rz*XU~3)E|cz(?|_7(&lHO`Kb9xS$}vn@ zVgigc*CF>5?Nxic|B;=sl>~z=3{187XN+WlhJ+kEN*(k+8Zk1|o1iwY{zs#veyJc@ zX%%cxh!iC5Y^GhS*6m*F)v9%gYHby~r&=pW+<6?W6ZdkMv1aKC^voc}Xs9>bf`7>8 zBIec_#pMlZb^@&$bZob`Uk6Be`w;!BZuBw&_i%I_D))O-eTC>A%wcnX!5&x^h#slR zac6g|BXmb3VK6rkSpH7rDv$4_P&k|K&6KC^`%LM3E!qdEma&zrtZ6LUED$MZY0mR# zn@{3(3-lO6kI1T)apy{8`)b_oL+y6oBdosv!XZY{H}o@B)~ zx#)^gE@%MI_|7;>#A|YojG3J`|+4~Tx@|pp-y)_ZR#9J=DbJHq~{tB1yG#t%WfU) z9;iA`sXCFJJF)_xcvuJi3z0>3k%z?F$i+jO2m~95J61ZfCA2BLO6G|T&g!6aOHiez zMI_%UaFNmO&=(Km3ZQBVZOSrqPeR2>p-nk=b}sL1yel4ZP#)+zRY;b;9JjCIP!&UL zfqRm^Fed5iP=QNd_d+)4YiFUp@1UlT!;WO|-3PHFM|IRD!?js@^``JnME^_&gFHl^ zOj=@+i#7LRu6imPlxd532gpz=l`xs3u3h>JN@0$wAk5=uw2M0{U}j{*)4&r*G!a{D z<*V#Rb)biH@Mnaqd_@%yw=T#=LC)jSBIogDmKU#!>@3*&iVY68w^8U#`^9?kGeV|E z%~!w{eU4_Vx`;a?|7DR9cSax^?di)`+HWd-{!ecPBUd=EjeuzrI*Y_xntJu7S*dJ| zu3XJgx!mne;_gyxYk1u4L|vP^EYX`b$|cG`ighKbLX5V-S)t*v zVFBF+zy<w+-m<_#?!kC_WWSP_@ z^P=182H+E=oBWLMFcy<}N(B%0#M6r1uBYi%(4}!|b(lFtD;tjqyA4}GkKOP`Xs8!^ zv1S%h$u2c5BiWPJh_f0#c?}6*Oqhc%OvOt^zz4h|Ak*sw0EL!+5jh=P{rE-0UuU}F zZ;7Zcg8>-`1KK1-tvocq)QVJ1~N*!V4Qfw%q zAJgh&;PbOm>e?ZUj$KB2tnAcX9tOYau~IkeN1@HiUD42GB@4;QBTdUptTYwB50|G| zX?ooYAj8T#|7ciw*EGe-fA_HmvQp?#tZXyDVL#Cgz{)=Xs9E_7dI;qLMO~&wU+Bx7 z7X8H82s*<}eOXhRUKkl}e&@12)M|&l`)fU!T5Bb1LBGU78L^50IwimoES$=8x8Ycr zk9nS;R;fTt;Su+*t?6=vpThOXq0o(Ix(o;I5QB?5pZ|m7qJAc>hMDVafCR74w1nQ} z#HGfd(Q!vu9IP=SMj5sMPh+%*FqM`ci>VmoZSA+_L#lZf zqRm-uHzF4mIojQPsBAo__@=@d)6F16j&4k>vj@6C52~snOgWn0yR4}IYhH+>n)tD0 zrz+*>Nl-a3f2Xpc0%|IxZggH3QfYXzGzMtPU1+Mfs;0YP#;*t!Q0XgRj!pl~YTQ{0 z`i4n0!#9+lugY_pH$f0h*jYfC@Cap(V+AoO^sYn(In8HN2{2ljSK>}>ltS#Gqe)yT zLhMmO6x~t-zYhp(A%>ROtc@z0R}!4QEF3j_eNen{2#~n*2iO3^E6PqVd$J3;*p=-3 z(ftt$yOPFq1n36)RD~UoxO0J6*h(1_lt_fEB_~!<>XY2)^+s~*!%A`oI$Cn6V}DRq zGqPteQiMp!efEMD=LYA4kGCPYb+D4HN$y@-KUrEKB3JR|Z+&qa2JTY+tCbWR19zK;+E-KDrLwdB#Rb*QPO-CEq)^mow` zuuOrv0ZCC0DAfnq4J-Zrr3tF@S#ljf`60yHi9L88V*XJ(AO zfiCeQfGtG*+O03~5E*Y>r4jAnA~Me6G?Yw@zMHs@ER)5pvG078^zEl$qAD200fgx_ zk0>%=BNT?dc~VuW@xRee-*E~cn)e|ANyxehOF~AEX<)|mM&dLOB=!x(Shpd@CRo9? z#W-8l0%uKEVo@C5hh89OWI6&cEx9Wx#H*iY+$MW4lP^%aFgTUXjV|31Z5(J?x+Sae z*sGVqkgy|O02{dDWMw&VeV12k{*q4)4m0I-Fs@8UE*#22CBjDVD znLu^ZLA_Rwt+StN<^B(re*<{tqfQ73w}b}5InQ*4oBB_PuIo4f&Bk_zS7~BdA==oF zO8puF^4ZL}6`y)2AXHqb%#!(`SY1UN~ZUPp$O?h|v6{#Dr5@tu+(X;2xGb z;1^a4v$3R5n@yK<#^sc{(Rmvb0*rmJSwSh*l*^>7s&*hnwa!6W`;ue^Vp__;dFlL>jhboX5y4ICK(`c~NXs8(c!<&MNd_x+{Ztr|R%GF5 zS&v{6CJUxZMcM?D5dym9y(Hv+ku_fr#qtBiZIEd?aOIJzn+G8TORK>?#(ha0OUE`! z#kHB+7|ua3$yO`9`tbc;>F@t(P3Xe0p@GKX?6mJJ{1?_6ck&oUMzN};a}aLzDAn#a zn!LYNLzG);$!3PeQN)Q}hO!M05Q8A3C#3-B!c~B4U@u0~sY78XbO-Fd9rfEu=+%Fv zLWDXY@-DzSd7wHC4_)D=fx*a>a7$w+xZ4$uVV^0!7A!;UxO2otq_OGUsMujggM-+T zK)9jyq#gk3zA>!ACLiK#M5&@K{;BjV+OkFQro++}?eB9Q$JF4?3BWbrckYA``)DY~ zaam%2X+8P5@1|Ha6glVdk};SW_5~JsK5l4a7xUbA0H28a*D`4I6H|SikG$cjU#lC% zCp-yS0(u7qJNOu8dbLI6G7v9vUjuDW3$KG^NS;F9@0R#>G1D1>Prd1$#n1Tpk!pRP zWFpXqjnmz#hNj0<#R}t5cRDZ1z9H9|V;nO4d5fEVWf2DEwR`?Na$yGAM z{`9&AI)?tfod_|SY-VZQ*%YkaQuIleeT}tErm~knTuPaeFH}p>5LJone?gv2>$0`N zJ&XlZdbPB@={>58bkaFDQ)~pe?z@$;v{dWSwjm}?84=5xI!kDYkD^>y%kd!J;pYHm zJAIn{ov8L=XDO0fvDD7kxRaEG7C$OR-XeFg~KiU4M+bBK>(Gk&tG|yn5SdL~TxM7&{cm)x>;bT8X?LIz3)f-6$0^jfGe*e>1BpAo;r2Q&LGYNLvL=x- z`+-my!}DBI=s-(|e;EEj2U-Vm(3#?(e&WBM{EXVs!Z<>793b3At!@PyV2fYr=OnE) z){h$hk+TX;Fhi(Nq8ZWBY^@hYmmOIHNVum&Tk#jtO}!OKzfaykX_gXmmSvV@k zQ4bg`&NMdKZMJmm`JL~Aa80!5GC>{vR6i{w*=45lJv&*P*c;DjeFk{&{Y+&orR)#g z;&K?&pj$46MU?<>P9VlFa_xsFQ`xw~n{1hS`kM6&g0R9sa~C9^SV%7Mtj-@hkeX86 zup}33h~z604K}!Mg^pk0RYkC?m~I2n_Kh}_zAw~3&CL`pWPAarMSoDdrH*mhr3Glf z{3z!SRI(q5^+PN%71TzNPdER!2pymw?Lmj4&Cn&`%^bAUnuk&QdcM(gqA59FIGDOkKr{U;}Fh#Hg8ZMesrXxdYb{IqJf@XI{vG)7}Y>)BlMh@v-@ih#0 zv8yUQaR*uO!L(nck6J}X$1507UJEJPh^BZJAGj~VTZ3uA8+evDS?vY%yr%QOeB7TA z>rPc0MbhoDtgMz@xuif03?a5^dNqz$%%T=#$DM_*yVd_jdlUmp=L2CeN|E(E50yjw zo}(lXAgbRf6VO%^R5Itl$UEWe(;Sp$p|#q~%)<+WB*nw~g;^;)JPXT?3_N_DH-5A< z4h5fV9^Txo^B{Zx{PgkgOOGip2|MYeTpk{eb2}do$50-M<#&mwxDZXxL-h8!=)diO zY5A$vBAkQ%3Fj`+Zpg!{`HLxncIj#FDQ-=lJA=D+cH;S*Yp8;^$dZ|k06gCy9&7Da zL&F^}zoh=cIS;Q(*#v`Cz!2#(;M{tLaOPUui_5QF?)r(eVkC|I(Xve(A2e0B8)%uQ5&PFPXLj}DBtf+W~wUjB`C|)XMPex1P z{Y)H2w_A(b*K74Ad56-gYJ88X$u3o5s7HtHN+wxznk^&;;MqvW3K?=9r|0X(20`&U ztmDku%BrE%KiBLao9J0ICdE%q1&>TGO`A#}$Q}r?TZOT*HG*f6#a==<+$Viz(?HJR z6R;D)T#tS0Vk%u(lnw=Wq}?emQ&ut~8_@Hp)Q79=tV2EK{E7Q_sMv~{J&?Gg8waTy zdfBl%6@WpkAq(#JRVSNJeZwfJo8uung)8oS3eW8ME1xZ23@N6!(BrUWZv}0j)ABd| z9Q+9wE)u6jj07Vw1_t&jpllK)ch^M`$x1jmTq#j6S@0(@3AYxHzI4!8fLdUVtHIho zDtb&*3wC;U$Mz7`p*;il+1-YVU&$0T5`n)Hh#Y93d}Tt34ODYlbNc@%(y(WbpbSdK zD~}KlLp>27TE(586Qq_$z?)%Z*#?tN%Tp5{8K%h$57IfGKCtV)4V+zRYV$MUnrIy$Jjj@Zn1@b&OMQhh5fEJE^z&Gv}_g1R)=Hz%v}u^%p)mE z?kMSyih?o`Dis%xCD{;gk36H=E2Hu{XuUy z`WB%tC}MD07V6Aa2ocfyTfV_M7-mZuh-&Q7En7@WH4F@8MsD~BoGWl<!sO|lJ zzvZB%t8&VvQEmO|_64}@+J)(vLh_=t4=4~%W3&x`t`yyR(ydALO?Gq+`TwX?8HvVV zSls!AWO-v1la-GLJ|8?9M~d#)y3m*bZZ@4uJhYiwn)CRuR}Rm@z9_aHu{nA$=|!>A z651RMAw~!HVn%nnXU7<%RywOtj1^_+%S-GvPmf5pX2Ct3b%Tf-hT9zJ% z$}*&0$|5Qqg;nf_fs2K{p`^qn*|5qnXn`WEP@$x%?fuf$b@0z@hAzpz4C9q{>^wbFMP zdSW*+m!H5{$dwaZqB|qnopS-{SHhdDc6L015#Ftelu!SE;I}6w_Xl=GyH=EKS|RQa zW5S5VtOs%)2UM-+@#w559idrmy{DnBq(2sQQ(Tu$5v0pp^qcb z3)AxmmxDxpzcU{*o@x$A@!!`CBlFoB4^Z=4nOPec_R_PhKas_K!W ztAy9C1tn?UdblUcJNkUm<8)n7+PP7GfiNrf?fQA-19EAV{jFfvtP?N6%_-$r@vH)l zbP=e#`<1PF5>ImTR_N-?ROVj~%I@AUGXUT2-t8Qj3@h&34&k{R@I{p=v5?=Uf2PPt zUf4r&U>7E9(}&oT=t~qJ?L3mi&}^3kt=L(N;&OUPH`Ej#yg)$ofT)pc`kdiHQOPK}#lXGKdA8y@<=X9{6 ziM;1C(|K#41Xm+oHo`e)H1;5>^{2DKm8Lvj7V ztQLm0TC+3}rkihE{KdeJ_GZDT&W9#(0+X#iK|PJxvCnaWW5_4`0K4!?G2_CxbMhLo z7^xfdH{CeSmhuAPvy0TBYVB+B<3_>WU8=6P+zMQCVzi>m};nYuBw&YNK~N>sW6N^f1n4%`sa zPl}$Nu+sxQf|vB^ZZ-%qUWKe%0Mx57iZ(2WRsktjAiZ~3E0BZGKnruVvULm+)#z!h z707(Kb&i`A{uRg{5h9{mw`xK@2|sUCNV@>;LUAY3Rn)ixg=U`abSLc-av-Q1+jWSb z;+c>5V_7xF{mYRr_(~hpTrWpj*jY;+kg~sCy{MR?NRZ{o7=;tY=5KkXv_xaya)d0@ zM1u`w_%}l>N20HV*ZyZ{_$g~2^fgfmMe09^Tv!J}B#>eAPR5}~!5ZJjs2;Gy&8tzz zEL4=Xxa$QKo$QWl@F0l`6YsPnE*E;>`SfYYP|&>QeH6<5Wz6*`huN3*DDAUEgdShh6&G>uvN7kY#A zI;MUkESzTSK(&2XD6j*Pj|ibKOqFZhDhOg_A7>}H(7wGe7VRvAs^6m8wx^cwp{c0_ zKl06IuKm4+X$4tCx9;h{;gU_!0ppG64q~Mc2N|5p#P6R_Zh1GKr(+W=-+UfS)BqdD zqJS({&RgaRc>`Ha){N92q7^nR?F}@((rS3I^|j8cXaP}Extt`g_%@3AvW#DZTKeM6 zlN8r%%fo=-0fA|QOuSs+rh_+g9S>NM-QoUTS zUJ8d`Mc%#$MkHGJ%oEn4Uxw}2m$ z^GEd5u=t%4-*et0 zu<7|A?v*QI*ufav2PtgppB=+kOpZ&ufaxk8lcb9H)__P>O${eF8950!qyH^oQ% zMO->oalk*bjo|sgpsLs0Z+JBtDjl|brRlNI!s#3g2W)d1> zsN3EA9WK!j7c9K+Ngaih#x$LbT3L<>f4v=ctx8;;b1CS#bIvY!8eYTa6qiNZ> zvm6qKG&?!)Sr~W+2HuW=;~($X%E+qFC-)+DXCw%)JCYyE=t53{@3n%^4ltJEe^}4m zD^$bfSF>0So^a!ZlQ3-iFA{B%ft|XWM|q@(S}ywU33`UVWE7~8fFME+=q-#^K|=PT z6!(GUf|Q*6JZMfy0ltBUmwPx_Jk8RP^^X-2@iOa#^D<)OWyH55&f|#3fP%j7sX!ED zVm(D1>e%xRn7MWzTK)1|CnUY#?)CxBwQ@qo*){GAQ=Q5)bq;Lq1?k93r-wJ@Ma-BCwWl-)nueK z%wDyX9CuC=vfRzr(UKKONQpn(y8xxO=LJGAK`*(QI`iQ5`mv>*^Ej`LV^iAm^Tnvz zBerSo0)iD~(iz=}npA#4-bSffAL{{5XAN0Ah<*Yrs>I)LR<-c;8$6r4w4Z6gq-)T4wcs=)*Mxar?)__hM*n-E80Ahz<73#Szdk{9)N4bC=Ve>Lsl!bkNX?P|8s^>(G7E(t*I0 z2MNF22uOSdq$UD>uwA;tqRQP+#N^WLa>&QKi$rbW4rj-t8X3YI&c~|eHo}}0sAz>b zmq|~qvFMI5j&3i^;qMc>VUDqCSA9^opK^ShC&@0cc_MHVX2r@jz;*VbDnu^qSVo*W zHt#z@O+eGR;>2w=sjvZWC_;E6ar*#m8LVSfr(LET&FBrt>rqe7j!;PPUO$0GAvFJ$ z<-L6R(ucRd70s(bW zfyrn_sL@=GjxY+b{Ed2`|H4!z167l-8N^W_Ex|XTbraYJ@AwHez9+4lkSC_eSD-qv zLN&o~T=@Hd_cf%!)1dHRe~QC*>vKo4@5D5up6J!L`@M$sx%Q;nGsG+c&{GFL|98b$ zP!HeRP{g90$lf@^cL0U}-!fv#Vh3y_iuSpv4k;Esnnn+}jZoxGWtSn)Qm>xyRfPe_ z-aptEh)t7oB2Xk2!a*rDPM%@JUA5pgm9?n7LbAStPh}z6V={*ucU|pKA8%)TVWZoOrPoH|JESQwa|DO)F4ouA0x66BxA5&6wPJ+Gq01Eag9{9xv zjSWFdeKgnMr6n^QzhL~iq-Nihp?a3(MiTBO0I5QRF<$-Q4RvrqPZwX{4J71~BaB1- zL_IVTPVPQ=lrUf1izKGB5ypJ=H(W;;BQQ+o(fio}yiw9#EKcJxae<~-jFI%Xfn^j1 zq4u?%zGLu&65K+R)rC82?;}~NPN!$%<47yMyD$d-amGl?V?*7IxGxTgxe+AKxL1j` zJ+lOk58pJZlVs%rCb5+Q#0S>|D6&0?yThCa@9yNfBnP^hw%-0~7nu_ULUU&bDYMqA zBmxsgtXXv{s2}4TtGt3Zji2{3A9o7hW6CIcnO3m9a2l+#cpb|vZP%s$=HYA%AJmZ9 zwh=w)Uhqi}`I?4$IdmshYr+LNe0c;c2=wiO4Phrsf1ZSW#huX+G=w@6h~KZ2s9C_ODam1maHU6SVNQMvEjXv&fAQx96Cz-n2r5vvdU% z0t6{}L}MZk!#ms`VSAwc&R?05QLUO4|4?M2dE6=0wf>HSOqpU_u1NptwU__Mfj!&9 z|4T)pgI1VF~wlwpd%v~zDLX6@1=OiC|j*Zk$aO#|KGAbKC zpMS63EABkdqx)Iu^FlJ@&!rBIUt{VB_OCJth_SUj%OQgBs2XNVvrI8f z=o&ii%?$j`YS&Cv4RG({IYD>59rWP}xS|P82Hf5&&QM zBL~xr?7OPXYP4C+HbcFUtzV-@CSy^fGrWcakO?w$JsW-fBx^Q{w2?hu`lEks*D7=D z)2I+zdc8M$srgtSSll^RVMH73VLk;vDsN`$dFf~XwC`LFTep0tF+;uBSx3L^ zhCe9=N7eU5fn(swlPpU44Wa3F5g1~fv5;l*>pN;nLOs!uR}-GqZqFv`PnJ~mkQCXN| z-%@2jyn!I2Opv|uadK{@#GOBX%zWHg@E4}EQZ95%?Wa}k9)NmS>lad6>}CP(>?pfI z*O|JPf@4D+R~9CbF;@^HG&C>Vh~Hww2g~<;a)H5Iu}Dz`IM2S3j?g_7q3-0m3^N{MoBxeJlf!_ghjbJk_VBY08_uY26Y4~@>da{ z9ljUJAen)_qu}^@#{e1X$DLQX;fQ*;6F?ZmpyWt8EQ0&3_bRCozOm=^umnaBa_@19(b%EloH6<4yg3g$k)1CLG5m$>Jp z?&{ERFjg7_qJAyh#}JEJ6DU8Uj*t9y$+692olIKfgWLS!|^$-|g&6*@HB^d6d@>GVHijdQ;W+DVBPI=V1;{lcD8* zFPh4hQ_k`uNwQrEeH7)zR|eQYwAqniP@m(@YYNm0P+}cbC8ml|bPQPB0=DB0yf)fb4xLTc=BJR#_PlN-tDMIU08$!m_{Dl#mf|nr5N-^d7y@cg>u?3 z3SJu%0xswJno$tfl(BuL32DN(NBP0aSQ*@&(j-;Cj|A(e>8h3T+)nm2$g`pc*{`Ir z`7sYghV=If6p%sXeg@6+>EK%tmqAC6@kW>TS?3k(i2_jV{vyL?H)GiMaoCuFyq{Zm z2jIR&1v8?K6Q)1(XXO2R3uc7=bHeoRCbV*p*LjuHM6%Qc7$(J?Y8U1aR|c4N6fasM z^}JTfI!T?z_Ur935eW8)0^WDU=;yB9q`u+(Otz@$V*w=5?iI~jL@SyJh0|zhCcGtp zYpcuO0uFqnn-#Q<{hBOORkW{>+VnL+!76=^o=9bIKk54K8#x}#^wNiJr@J%1%OdUm zQ6%k31XJ93M%rPL8}`9wN($TH6F#lyQ@jIo1e`5OjZFOmZlZ>{-R{n;>XUaG)VOk^ zU1Pfw1KbkQ4oc~gNcsXJBrfi438Gp-q_(<3z#?xc4ZHX=R4dyw z9Y4DhD@yUoO=xk8gjcNUiB>h}c{^;(vn?d|={ zKu+@|p52-N>$SH?xuwKGI-;iub=ki)C6?;fx=6GV3v{tSsl;c0N%E3BfEZF;Eh*py3y73* zU-t=>+fmAWW)1o>%6-2mwA!oeVtq}-AMlKq4iiseNKNvq6h=LRL_KrE;2`%O_$wGW z&9_25#Z4!EMh-we#@A#12O=}42DP^@7s4bqc|#148O#ImrnU0IR;au0cu*(Ao+pQF z7$A46X7}O~@A%a^tV^&ZH@K!mhQ85RM;dg4UGWkt3^lY@n}l$R+tyiCU6_SI^REahd&687V#h+E-?B6l;wta5W@*H*sT7I)ww%yI|A z%(EA>Tf57iKnLmXvhPi!-|oBYn;9aTyXoKHF8lL#{iM6>?{Ezeh5O`2y$I-N(u6H2 z_bz*fTcuw+q+Ix|l)LO-T5R0*&cZ=-v9XlvmA3-yE-3AjHvjd?&;CRq+nbWeh#Jcf zh6}~;p!W635m=FkwOiLK|H=R#-cq*5X*P1bvPNjLsy!~%xJSd4OSf?0Rp(;y_(t!| z4grwJZBW~c?m18`7ha?CflT+-;%q^TOOdy;M9|BXiC6WqZ!NmOHqcx&5-a~H55%C{ zEkLMNLcJ_<@$Dw~AWhzw;dmr`y_mK2S<9KyawMrBq9Q>!5;qAG!D++rr?I`U)ZY2vwreLrTqak{yE99$ekn6r8D?) zw2a$#QE8d<<6Ts0=Z{CZ7nSZs4vioz-$kX<+(sz!l%W{4w{}q}LTp;K`EIbjsATQu z1??FFQzji$53S}NCXVbyIx4I<%=i_uR$mxVB4nF)TKyBirwneqI}SHNVsH(l0^V78 z@Tvsg*s0{{Uz*zu0}%Xx>R;-=&iIr^cbdZeg(TeY6iQj-@<+U^yp90ujX=W}$yb)$RhQ zi?#m!Bx}p1cte&G z1RB`2P+Xv7P3=uNel8SAZ6m%;3?%*Op%kP$zPm#ZLfw4FcV*yLy5qYN>VUbQq*nD9 zj!occiojmf>g6z2a^S zmnbBeyy68G9;J!r0;1hL)H>*@eU#A{gA4@fU?Y0R$-?DIOIPp)qNYY+>AeCF5a*tm z5|O*?@04C;R)fF6ucWIyCNf{B!k>NeB%(2hn}j8b*}TJs(v6Xu*N^`@X1{Z5k`=Vr zkwTHWDJxX`TB^{BdP&q>lHJC8#5=Kf-`y}_n25#unih#dtwuNw;UXDJ(j)iFaI=Je{KQ8OYJ6@74>dETnLpff* z8E<}Nd?T7meAnJJA6?3l1xxcV9N9aGBkqV&C7J2lVE@7TV(&ZTi6Pv$soJE83R5 zo#NKaXm3-bimSZiB`eB%Go~H#e-CU4MdvoQOSt5R4GF-(@$saA_-Zk0t9uEam z_t`#Sv0u>_flON;K#6v)$;trc`EEAR>v^8lwWcKefAZBz!l`7rL1fAO5v^~c68Crw zsbLFXhO6E96rl}Hl!wl;zL6pxF$#<2LW8!$Azw|5=m=O-o@y85l9ce5G*+_=^sNw}1RE8xF0{U)Wbm$SQU3p|BrALGoJPBlj({WuGTR-;0F^>$;^M-VFjuF z1-M=%H@ummQ?g*1_i-VN*R{Fr*cN^pCX#+zc$gXvA{=fwe$!8!9D{&md$xslvFj&o z3l|6ll!tN35*m@`h_^BNxRc{n0n4$}+u$4r6;9a}J{;9tt4|4wd>Q~eGO-`k=w2Dq z!qcvT@)-l`gd#LT!DKfU>H25UalmQR=Pi0U-Z#MO0#W-rT5Mm8_C09djrOzzJmY4T z7$04}WJjav*1p=Xe*;xQ)&1g2Jj-k$O+S__?92b9td_gjBKfNgPq8uifZsSyi4pC}cR&jD@|+N^5(OSR;4 zfLo|Mwg(8hDw@PKdBksGuOfqcpm&=fFjBpD} zQjZZFX&AWxjl_puhZQ*0o}VsIch*qg9wHP8HrT%J5TTc&jNy74+RbIVk%}_ha0a$0 zj}TtERz@OSY*E$adGK?<{YMD=HF*x@4D|I)ju0+UsG&)5=N^Sxp6^$vVQ#LYI$Kby zBLsh}WmYUQm#Odkrj>ZO|nU!xVeqMq-A}ctAO;8sYfPVY@;@A(;t~UfvG9e zk;#p?!KK(8cMkhZB#S;=_7|i0n;n_(-BG1vTn}N1r}>*N9r%t+%4s7zd}NY9#FgR5 z<+t$i+qT~AK9T0`#bSk$^(}nFVpHP;vzvxKJjeA@=6L_> z&Q8yNr?%C*8Zpx9Eeo%dEan2b=XG+Sbc7eoU1rH$EI&Wdvoqm3W6Za-vG3UJ+Jnm z`iY=w^;103bsjq69`_p`(+`rYkLePpYY(Xwb!O-)cyJ@NxU>CSbQjbem@D{qkW8YQ zxW_~ci2D7DR_8j>>_##^+BCueV-d=Tu|GmoY2O`I{SKa>-yMFr8t)D-S->99F@N0# zoLz8{yQ^&`3wM3%_s7cLo3E3gG2D*t>m>5euce0c*kJ`#MPpI)y6fu+|?X z9ZWOv4$E3OG5Ko@(vR~6Y!2uf9G2~+qFe@6GQ%IgiS6UgR49}QC?rxSCLmim4DY0D z9F>(rHYa6m{*$s46+DfG;lxElSyPnRu4sjaU1D zf6BXSj8TQX?@3m!8EydUEQ9r{TDs^$FH`!^&WbGFr35@@_A;{G8?ma8i$7?TM4n%= zx*cSswQtWy9R-5ZdRA|w+J0Z-H7!rF>m=)wY#J`=P;6UVJm+o-$mQaxk`*piVLUs+ z#jDWH;$j`y;&HJ8S&xgV(B@(btJ_?JCsJ{vj(k?5f{rMuHLk<+G-Uw_AaC#KnFNWkEoL;Mj$a7XX3i7>~ z+IY#fM_;BW;nJ#`lw76X{AanLDeruf#< zRq}i@;e|w-o#DLnRYY~RCMK`B(S9=+MUO?_(MyCM5J2U3qPggB3t_JsSg-xTb){Vr zkKw*4y~uXFPg)62mTrBcRzbImR1ocrMeu_+JO@M;Ug+14NW*O%gxWe#Tk0v&xbq?> z5O_qn`>00sgn(pNJQmVK-{V3t^jt5d^^NRW`HqK2EV~=py}#hJ39T*t-qd%1Aj3_v=G~BmspXT zzDh~o{tz4k=RU$4mZGGcC^40rRApC5e}l@dZFOSgovD`+qL2g&(w%CL7koU`eiU_9 zYqtFch6h)W@>1#)szNOED9Jk|9eE!j3J@=)r?=gOyi~Q{n#{`4xy$u!3HW}gY*z37 z+IoxlXCD|Nl6Q*k>~xXmxyowd)+4|wQE(lpMe;LWQ4D48B#z{u#}i48wfl)lGzE8HGc9j`~dK5{>HFiXt1 zSrYv=#{gEW;T8ibp;Qmp*#*UUNj)$>=abHyvGT?Xk~$#C85>$QKj%%pgXg|J|62=_ z94hM)*)9G%3%$Avmk$mqtf4mIX@^F&vG03)NJ!mqvF24xdxtO+3XlI?YPS72*PE_Ke_t2fnO!J#ZauW)lGOfLkBD+3Sf{fUo_Zl z17DI>0(t&DH1OWxeAz4M->6HJsQyKU>&r;%*o(eU^SFBMCRM-UbIY(lKS}hs$u#V? zC-@{c(!LgfVFX~59?~k!?CBf~>bLMSIpT&tJs09Wi7}t(3DRkJLko58P+hLTtgy^`x7tinux9*#kaVkmPx40n8B^5v`v&=5{w^J0a3FCT z*?i2U5}qw_e|CO0=8;|uKz?mrts(K)rH2C}V>Gw3gqD5h%ADiY)y+&@`UKD2kK^}7 zvjp+6p`QBNgoZu_c~A%6mm}Xh$G;NB)cVbjdVhyrT~8dOCyq9Lh=?M69wCH6smFHFG9JIj16>_|Jexy5J==kiY^Vy8s zwj%uNL?706>|C7_r*iRqu~(ff_=CC_@i=>%eG;Tz(1lt3Bl}8!?7% zug2#&dtlIL{CQ4pXftxKV`5U*Ie;o@1yz#mwar-5#6#Tb!|ezcOVWyk=Y$B#%uJi> zjswhniOzzQ;CbJz)EmB)vimI@o#r`Ks%As+WHL}rNzzqQCrF4pzZB*Q6L2+Fm+^hM zVSg#+`{#M4HQYL)m_9^)yN_HAOBC<-MqD$Y6 zHul6rTR0>vz;hn%6eaJ065@B3q22<7I${VR2boEscN>PagtqjZ+!A{C*w8>jHZoZK z^%Y5ev(69c`#$n=wx}u$?b`Aiawt(3TCZ7I-wiqEM?;!3hPSv3!f#>z5RL)EIM74FXj!nR$jvY(SI>}@DQiWX_jWEm(C z3;Tz^UeJhceQ1!>iYMYPII8Il9z>L{Ut!SR4AV{8cC=7`yCH;tajvUYman`EP--O#=kT1tm=$FkLrAg#)4{MGg#>N9V8tp zPmhjuu{eHYB_-BuMVAhR)n#FpoBD`PNOvhy8RKKWB>nD@>I0IMJ;8e@Y(0+0)U&kM z12p=Ns5Rd`P8NfcU9!^WEhkxeh$0Tkmwpti{;4xEh!a*>7%59;b!^NZjd^C8ZnxSe^&thiKVOSh9f?)jrVx z7DA0XtH^U$2YS#u0^Ds`02!=;3|i3?DVn#G@!6nxNm|LUgW_Pk$BC?*zDgDyA=dcQdxn z8%J|ABCkGz!7{?&g#M3P)r$R1LUv^tQu($+mDT+8Y~LfLOIl zjk47k_!JD>y<(z%@s=_|8P=U@2OEzi*?6V^WUPhX5gv4ai})96(;6{FfxA^}j6x|& zjRJQ8+yyM1NTCSW-W6_8tN9^1dv4iIt61Dkf|)W;U>@`KM#ThZLvUOvvQg8jTv3(bXHQ^B989#IjRme+NNdo z%1by+&*ysIXModDbTDqvpS`-Drv=Po^+o@rpJjO=&nascZkCv8vR3gdE@hN+T}?Jz zxquKcK5eCTn*m6wUytNGRP-?CfjJNoUsPAq;;&_!U5+;~QepTRf*QLt-Z9{D1o4Mx zB;=P`V|{q--qAC*gRNrUw5dZ)B}B^;z0RmXRIgw7rBpA+LzBtBy#E8szl@j3Xq*1! z4OK1Kzr3%&$^K<`H4$}zF6h4JUk)-PZ^gfiV4WoYvgZm8l{;kOU-pp+F;DDVf))7| z!Apu3zklgLY-P24hjrjZ{r*MnX(=*kviO(QzwCPha4Diu007WhSh`cplgrSZdP{(%kh!kH2lKRg%^4kyCT)c^!pLpfn zE)8|{;ai#zg_tbACC*auRQv@zG#J6+#9g#6IV!=oN|dchAL^HXATxC{5rY?n{vEo; zjhSDV&aOnh?|d*&cOaD(5s!*7992=kKT%-V2g6>rXr!%3cdMj~FID#Fo}T9*X0(4teaTX85~ z48J~kwpp>+a%d^Z#?*lyDN-XvBMf*(wie=En4UeqItK)!KXv41eUesxz9;U~ZxZWp zpa$S3Sw{t45|p$>mML8l1+`3H4S_n>oPvYAwb<^XG!Pl(JRa(XW{-o0^(aa>K2iGn z)QHF*fJ7g^_@DIF2~c}D7S2NpT`Vo$Q7zh&=6U`ajiRSyB#eu@2S7;LpwVK$g8U&) z26AsXRpxL;I#4e6rft{%t6BPNBjun^$`onzy=Q|k7w0~llwhZQvhpKZlrj7WN3pc;qxui(@3z9FwW9-no2%H5>FRt>W z#yRjHG)*kdZDryzOGYZcLb&7{IEekMb@HQtqN^EgTWx%hRq%B9wGQck)Zh$Q z%;riBk-%3@5!GIXwSSQdYXkAH0vWX{`{OZcqmf2Kq=t-Ptz1;aloB0+N`8xCEl{&B z5V%~hd+BHCo~fm}-Eg}kPke!y+s&b!d@@Gng4o|VMVtQpwbg}HcoL%(eB+ooPGAfJ z8uf|fN^;4JjqJz27~j6-Dne~=kmSp;yM{?j{oL0)sRd-1V-J&O)OaWcpBTB+EF+-Me~;Z|ur!Bvjmo?DS~AiH>Az>ZfXJyc;hfpoeFUmENRw zqcr9YN{{}kuN;g1^bTwS>~n%3b{0u0qqvukP0!~^bmh*#w8Jq;3fT*kj<&W4y2l5I z(DfA6HD)l`pNE43lO)caf%`koeLqw^{#R1zF^@fZ5w)?&DEBO=l1SwxXv#MIec3dM z4&6Ln=u0sHaWv>SH$yReGIq0*5m_!iX9Fdn}t9K|J; zyDO2dV+^us9aKG+p{@7p*Y1u*s+YPIyA|oY6e!p*wNym}Ie`sn)Ulw5W_T@{3%v7Grfy zDm9!;`&)o-R0E&Pw-{~Qc|o$ALBR-f8|YqM0>N(q2Js&!C`?ZCTY&!Vl~v>d2)y0~ z%|?&bbQ;Fsd{F?(#TW8i z$NQZj*c*ydqG|CtGzNN4QJx3AInRsMN8_|EPJY8#I22;wMQ`PSUIY?2Ax;2dN*}6xFY>77I@Vryg*r5!IPmdp z!4Y@%AkL_JSi6yo`=9jO!^a41)r(z?j74hrz8~DFl1rNSS*~UE63J{K3P0c|TaB_- zJu;7YLr%OTh{B}zO_c1#I#Oq39IDv5;JQ9HlGLeFtxn4}TGJE^K<>nxZ*3>rt*vCv2C zxu0GpR`wC{knwI;%SRVQw|Ae#5>@MM#o;zvJHAht+OQUF89rX}?R}@9mAHa6i+SZV zup;#FvZWu7Zrp=?tPw_`<1fd_O}dW>RQ~GkfS9J0XbQ60RbCW!AAoRjaW5pj8m|F& zJ~f&wS0To9Jhl=OhZF-IoSk5f(A4iQl!^*|N{y8gsXCWks%v^1M3;H|Yc@T6Y8X}5 z0~sf}_WkHl<}#r5d5NDxw7#o=U!#`pqe1ln17jbU5jSPS_hml^>c9Q_mIL2%;9CxS z%Ykn>@GS?v<-oTb_?83Ta^PDI{NLa}R)DKQ^~b0B+S*7UFs@;4psbyY zZM`(CsaRAMTvXk#s3KCiKq{SHTXU4g+5jZ;=U3Ge!%WqY2MTDELgd_vhU&`lhDd#N z&4tGVD{E`;h>ogjYl8FZYZnD;8W%1MRyPD|Y9m1*GO$>PJLZ`3>E-oR6$=;ER+d-S zG*s0`_-=>%T|Sz`jmB7y434gd0QcO+NL2#>=LL=o%m%P>LG{9U^;IrcF_4T#&V|UpK8)cmHs^(WTE{q&Sjsz+zYRLck zs>N0H4OLK~V}jLMWfoL4EMSBGn{o^UmYpC(r1?)?US57)LEiYh!n_H2MR^nRit{Gr z=jG?;7vzu6FU+5iUz9&Fzc_zVL0&7ZntZFDfjWP*hYjv8cFc(!{)p`4bB!j-OaKal*u+i4!LlPn=YoSDas5P&~f4 zuy{goQSrp$;^Ik@K;k5HKMANOq1hyW%+R>8!N2Y2Um%e6y`jeja5{Gt483rFY_sBd zGrkELLAulE!NL8J{u62O_X2_7n8CsOk?w!w;NVM0Yq3+&k90kDMMmx)2>cma8NEm! zz-i-I#|HufNFzvhJ7#e3THqOp^w&s(NMAyF1kz1N3y|)L-=~;~l)q_Og>)LyRY(^i zeH7`nNPCgKgmhP&g7+gWK$^R6ATSGQ9?~n3mLly%8bLbmxWU0YkzR|m6X^p;dy)PP zX#o3VBaR;&3?eN+T7vW@qzjO4M%s#W6pqo`k(MCsMtTv_exx@e%^ivR)kyP@7M_59 zkuFABhjcXV6Rjc~X$R6NNPCdZMLK|#_l-v4cXVDvT8#8dq_dDtojf?W1Zh3eRY+GM z?LfK?X%EuBA{{`wFYeNf92E$ZA}vN*k8~E&8;~wR`g^3SkiL$z1L@aDdytO8{lEdF zMMy_NZZnY1LwX(3H+WK;U+yMD%X3Z$jDr+6n) z-uCQ7+Jp2%q{DETV<-HoR36epkw;E9$A8B#v;Naee1On$GEkqhYdKS{VkuE{{lQSW2q-{t$kUoX92Wc150i$pTtK-4+ku}2`-98Ca;To4{4zZ6Bwcf)9dw!KUL#_X{bfU=cV190e{1XM&G{OTlg6I`D)~knZ4l z;C^sA*qSYa)nIq6QAG{eX2cHAyfv2zo zwgT)3ZUj@{PViG;4)4b;0^5Nr!T#U|upE2=oCod(SAZXx#Qk6ga3?qz%wfN8D%cLZ zAM6kQ1Dp)@olL%iCstD5z>k5O!5VN6cr)0HzwxvJ>;&!wOTert^he+Ta3T0ExCXrZ zdddwrw~BlNUjkbf(oan#-@pOj7;qFg6PySx1=oY?!QX=0!70;-cNfYH*be*(*dN>u zmV@tt^T6iSJU2K3+z5^bcY@D=IYrbTupL-f!~NhWupGP@oCp3ETm@#`Kz#uhfxE#y zVAHPnucN+zo4|o!PCe-cwgVS{72qmx4Y(P+YdZA>Tn0Ap=6UPDeDEc3IJgI_0Z*Gj zzW|N_*MPO)7VuthFZc-9{1ToQ%mZzA1#c;0NV9k>qc4?YK$gZXoKZm=9&1=fO_ zz=hy$a243JCx5#d>;V1-90;SF@2ZA5E znft*db9rv?Ti_aS2e<|7cq`8hb_bjHqC9~4;6iXX_yAY~t_2r?&w^{f#M1x7><3N;w}K16@t-67D?IP3;3#m^V(JMv=05TZd>9-! zi1u;`_ks6;3&8K*Pr8D&OG!`gS#bDZ&Jln$;8#9R{7cXupxpzTeSv%)%6J9r5B3Dh z!P(&CVbsGfa^IDFJO^9^KK&r+Fr0Mz66J?AyBUlP<03QZ-hz@$asTW_Se*`ZDdxJB;@!%40F8DQYIrtX10qpn?_k)8$k93|2 z=7CGW-rzcLF1QU`4(UlD8{7jf08d;+ zK7y^mP2gB?H~1&8Ddl74*U`bRgPXv0;BIg~*mMB>!^5=K;9tNJu>Ch^uffUSLhuoA zH8^fH^#}X{xL5EI@|W`U7B~~^{3z`LI2=3x&Ia2IWc&^G2CE(;oxn}tTyW1C(g|Gg zP0|_M0qy|XJWe`O9w&kAz>j>3c!Q(BW|YebU?=bqa515+yFLTM|{Dy zphrDe0L}v+0#|@ffE&RFo+Q1&U0_q{Nu#Hz&tN_{5S#`s1UG=I!Pmjf;EC($SHXc` zGwRa>uoHOC_o$~*zreNN9&jso=F>bk_*t+!_0Ib~qA z9KydDYzIC7_6OTO$NgYWa2_}sTmjaC8^JGtV~A(FA5pHrW#Dpf-X_u=Tm^7x zus8SsI39c&oD2R6Tn-L+iEzOc;7)KGm@|g*4z>eF|D1S()4_7^c5oiJ9$W#I{DS%e zE(CXjOJAluTub=`JAu2v60qef)O&C|xDcETt_GKbTfn?+)C+Jl*k&yC@m2Za3{D2JmHsw`*Gp}b^>n!OTfp$DsTh15Znc>2KRxR!E?8BKbQ|T z8%OwHCvXl}0)7{)0ylvR!RD`XKR5#143>j?z!_k(Pf#AfPT=EU3HS@J3fvDa1V{Xe z{vMnOZUG+z_k!!d=GQSV1oOeY;Bc_*ugPz4Ke$MK-@*N0CvXec6Wj|91e>Rb510?m z{SD~`z5&hyoBo#k0{4TPz_!05zrfyL)A97LUUYcSt-v8b^X2i{}RK`vcDn zZUYyAJ$Ccl;1%E&a2>c0d=6|`Mt%Du?GjiHjsfR_Gr>LJQt-4ls3+jF;7;(AKT*!h z8TWwgz+PZ~a4}d8J_ODKp8!{YTfvRsd*DuR^=C z!0&-uz-{1Oa1YpgBJJB-=9np%;s5VHfz#!QC5@Y!nfhS z9VZ_=c&^z9#M{%(q51YrXy0=A<&@?FPH8>()RS&(I@i1Wj7vLqY3I9<`}_0XO#C(l z-6i)@yuDfHA3S)HkbO>RK0mwP$&CjPA$}Eo4*!*-Hv!Xn-#}jmU6SGc_2`#mxPLo( zTl90lwEuB|{{zrxqn{SmhX%U*)$11Mg<*Yap!Y&=hkj;QA06o9(DTqQ3hNUCUFfXY z!%O^}YVw7TRnlE*esLd~o7PK%Fm|AykwKU3A&Fz$ z{du^|LvN2hA?&~S_D0!bGz^L3X8x0WoCoGy5Q?YR%~rcSw0-=y0lN#t?$nUogdo0) z2yY`cXJC_lo~r|W4f@mQmxlEjfxZR(RrC&Fy)4l8qW>mAmuFc@dcA>O%Fj8~R|avA zXSqiGh@GVSdF{>ans~c5*o|*QJ-{w5eMO&(J|Tm?9DOqSh1jOkqda(?4d}HQ^d0DP zGU#3oV=wd>VgK1T_yI`#^3b=V_X+EBf^^tKdcKFg8a*e)z|fUZNw0^3cuvO8Z5JFo z*dpwwB+wV2*Q1{j)&~W;yiPR%{p_$lHqbYjo>XpjqmSc$hP*)>vj_SPOlhHqv;r<2YKdG%; zh2EC?6Q3Xbj12m2^i~PFr{#@7T8%=_Cam^h-P+`Ka0dvZz8UjT>SoTvp|A$t-l);rjeJLW*e%1)z~%=J z%AeB;*Q-W@vV0ryHIV1JvBklI*I<+LwTQ35fn5!DD^ELk@MN*OKVs*pojjX-U#5y@ zOG@W_^vN0Y;ppWV^cwW>8T3WyQco`?F6n2UqG{U!syk`&C!XWyC-5A*m{7a2I_$1S zpUqjAdwb(X8&1Gno@G0}dgE(A*jIKR-1NwNSg$8=Hr) zNou#oqc6&!&qco(y(k<;wLY)JaXI?E=y7F9^bP1s(HlG?ag-)H4}Ayv)94J@gS3)o z2=%EsC$gTN5Qdbo)ufY0d0r0W{9#Z-KTCqRmf&Y5cB8OM=S%jLzCj+;KK!gkm+@52 zBOyOFrV<$*0>E{Twhvn$6p4STy*eYLD)}K z5Rc91tI^L7>*E7`5BlTiaq*D!Xm&E|o9GvX?+=xmPUz2}cMj{7f&UWpt>_)YdPSgD zq5lf~lCWN@dLCR$;`c7PUuJ$njdpEYsLZUvN2^ZBWp@jDTlA!|JCiWZKxfIt%eg)j zM)pWQB9aa*Y0QRU6IZSzzt-bpGWuHaaZ$*JhjKx__R@gWdr>X`H_Wy)SxP8<$6%_M(@d-y0oM zE(peeEm;tG^5TOB`-Y$4lfg3-p>IdWRgeau{&^JoPtn_l_0r(}di1U6N$vDv^w-ei zor+dFVyx`RFUc z_e))QAb7?x*sQ_ktgwx(nMfEj(H}vt4(r)kP(@#gejp(ZqOU`L13jsnY(w9No>b2F zqwhseD(9_Rl7{F><-9w(gr8K-$Dn%!@%3E#5RdR%qsy0eavJvz%8|^09tq0ga{N48 z82=o3xEY9_mFSX}Ij=BMa(!kfKX>9|4>ljgCas6&_Bp3B{>>1^YQm5=@`p+oH-^Iq z)(-~aBd<$*nUVaOjD8AwQhqH!Z;f6Mj$>$SvkLt}^rSMq3H?0u5#jr@gY}8s=vSl1 zjXflOOOT_)XACFChSIEgdSHP^W^zI%w8M%rttGgoqjr~)19y>EJ|*-O3*JsPl`ho`dIWX z;V^70BYCh8eJXlkSP!i?uSTDXo|Fcg(Wjxu_3`3=5BhcJacLlWv)0VLGx+a>J~)G3 zg5DiHu5Zf2e--)&^zTOdp2vdvz6hJ$U6bcLYtWl?i*NfSj4kNrqDx&(*LBIqenCF& z!)6FJ_k?Y-7y1U04lO^z7#DqE1O1M)UWDG^lH{^F3cWLWQeCJ={|I_gU095M0eVvZ zwidlFdR{nw9}k{ytLaJo^FH*V4DoA8Ba??tHyNa%HYNVPO%eKO=*$QM-4a;RZxnh@ zbY^lPy>B}G>d_~lC-qH>(XT`A8ooa?hFXhWho00{Y(<}io|OLk(96+j5`y?$6{KHF zA~qHsvp^56mlUCoLQkrPqtGRPlJ2iZ?}eV!)-OgMik?)D*V_H(hT|7ntKEuz8TX$T z)~^emZy$Oe^tiq#k9%5@i9^sEjN`9Z*y#2g-2st2?#@4VV$&dxsb?}w6dz;IA4kvB zp3cE$bob=;a2a|fdQyA19(@jaQa)@)pMsuLP7a{gpqCKebX$>qMY^1}p`l!co>Y%| zp??;g8DZ%D-v0f0P~*@aM}I7=OI!5SATQ=(b6F3*x)Zj^?(ZAOIH?11oP^#-#z_ae z1>xYQ(Ir8`6aUmf-@X)z>7i-p+i$0jbnBrS?~hWF4H@N-Uf!?ei0Iqx1;oLtl%Y{>#zlqsw$UT~2jN#UG1pK$raK8`eW@$qw{o8N!!CCU>G=AHF|Z z7riC_^3Z>gaDN_pZ}cCa-w?iE+Vx4AhSF~DArG4O<_t*|?echFy#KF=ntVMm5X)g%g~d`%C=t=cvKl=R{ z{I{k;%R7ik^`<-emonTx2K@o_q%rtR^!XX|rRef5WYQRU9s0Zs;cr8~IfK3*eI|NR zy=r}dmVs-+`IkMyFVs>N<=wciaR2Sultp=QDqN;#WczlKkK^(4UjO7d_gwUUq9?6Q zEk|!!96vr3{~OQ?(c{Xh=sVE!(38rM*MaqF^q$zJpCL5v%R?{9;J-Kexf%SAM{kpG ze;z^3ML!X}KXp1CzKm^q2K9LbHXR2fr_o0AOVE?jU?+Ne^rX6&b0PCp^agEMwl2O& z8n#0peBiyrwYC1}bI?!6HvJ64wf&R(%h9KlCfC(@=o2&OE6^uo&^My*Aq@wG!w=0N zs(AiZJYO|>PLqp*I7&NhdstGY7h`uFb_>MrZAN#lOl#ZbpZb#LDMET0ySVY6_}Px1 zP3Vns@bjIJA8GI3)$=XlXAaVe!SQum{Iuh_oMx=+Y zI(YC2eoouSv#k#DU^g~B$0zTbHYHj5qQ|wT62=jp{>5qNR zppZ>yFS3Sk7GRUqt}R0UJo+Gfq@Ts|QqpV<`m^YL!n&Qu6MYN%PIQ{5;Qr7a_+Iok z(1~iGht3l=@5DPd=$D3d($ej%gkU(_4h~k{};y&=2DOim;v?tPL$f zZ;$_^@YkUC%@F<;(-|rR&lg(z*o$7w{Uk%6hxYiJ(-05O;6EQ--sMiZe>i%6hWl$w zPim_cp||D!xN_*{Kl&NyN&WH`^bY7Jg`Y39Ke-pZC3@Ge9$H&#j^mE#N%6}^Z;ejr z4$?2Q4?Z0I+=Tn{xTOZYIr@t5{Zdy$duNNWS%ghe8D5LN1U;z?Z$e=+(K_)p5i zwdh|)=P`otLwnR)(H}!+h!g0gK^@$O{%!OgVcph(^59xBw0;3S(;jhmY*CQuKl74dykJ6StqU4t)yxJ>h2vt>JG&|0Vju270iDzaRaNCCTBp zrh(puo>ULJqyHQ|Df}_${mJ8`@MofLB7Q)SM>^#2=XFaFUPV7OtPc+IaGl-XJFJsF za(XNeZX5b;?%x#A!~0nWuvu81y#CsTh1V~kC#}EsLU`eR{T+Jeyf=yGi4Rm7LGJnq|o{uOjDGJec{H%P0U*xWKPd2KX@4Y_vYWl}ub zp$|gO6wiU!Oe2iT!_P8X;~?>zjJ_5hInj9jBZ%ihY!*{yMudHY_Hb9D4<-zz(?OZ} zL~#FR^b+*AwmFYm_MneOFALuvS(j_hAo)IQ?he~z2kUP6=sA;;*WHGr_eM`zcdJ3~ zKRJ2bZ4vr*^rW_X4f=lcUg7vrX5<)M9^4l6mX(>;)%Ia?DK?Ksd}OZ*(y}!j3U*d6^u(r9lqj=O?5j>G0Pd?fW}bI|3xI!SR{hJFHi zQXJQ#w?dDLqvXSO^dj^#_&MEf*gk$9)B*I)=od$y;r!qk@+j;*rX|OrH~Kq6mItF3P!zMdJ7%R}5qhE}_^m9n1C75Wd+PYvsXgXdU? zz7{<$zw@}Ki060){j2<(^Vim)FqZpH#AXaOee3jDbAA!Bp?=C1vBX2ZlQR*UR{Wff zXZZZb$C$gICyld;(62*}>l4NQDD=tbr-l88&d=1Nk467*Sl6XxKb;q&k3c^&tcUjO z)}jx~pl?MVjLy<;@O%@3bl!Iu|MHz6@jowof3_}S$@3MVKb|4{QRt6m(Cg73&Y&+w zUx^-n=1h|csfxIZ+vtw(VKNoksjJ{-Lp`q^Q9Y>?(PrcVm% zI!^aXp!isf&1`&J7q-dPmuN&^i@pw>X>1UO(BAS^^v&pr>woAkp^pjQAAbL7Jt>Vwq5lp43^9ZFh1M7A(VKJsBFaoU4W+!y56bsaZ05{KUQbzvz6`xt z)JJyUV>>qUK6&t9+i*NW?;;&QzYU$Gz#tx>vmb3(5V{vVZagCC&=t<*G`HtFi=#o!4FE$V2P^#sn9sF{9Y{KT2a2SL1opk$5gO`Uk9A9}iACwb< zUd|mMU$SunC-K>XuR?78#n0(<&))AFh~8`f`EpD0dvcx7TcF3~dk5~{N*p}&SwK#c zP#lK1ceAtoR#3v4iLYVUp2g4UxY!ze9@J9w67)@BUD~gwgXdX~&0cKI58H(Hy0)YL z6`d*{gn;E9e`RM0` z!w>Bx_Cha3KR2w~dTbutIP`M#v0+`xaOiBnTx=e|CaH`pM_-PfRK_=;uSAb)VQ2!HmlJ|(xXUQycXLwx9QqaPAX(8c^YbW z_SVHcO?dH9j?aApT--hgr9#{6{e)(o(K6=M+ z7`9KF2PfZ>?1^3$)-?|PAzJYv-c63Ai9TseOM2jqn(Ui zf*#k-OFPt@IF3MnjGuGlz|$e^Q1+Kx+aTXpeHmMdZ(x^wg~)zfEiI-U0uogmud^(MO@TLQnEvkA5P0+}KaE4hiwFH=@Y6xQ7ke*uarHZodk>&5M5l{r=%aVwBkwBKx)S0d zaqW%19z7{7#-l%+5C^$`F8T`er24TO{r4H}-+;aYJt?hspl?mMKacRe5$tuKw~(J* znX@sLP?FxONvEf<$(KIz3ps%u>D{Qk-xT5n)M_+~1wxZEA86KR?&>*E~8=Ebd8QBXc)2_CA~4 z`Kcz}E7`fPH})QHl*`YrHOl=|6YnpLa{t`edo)LwEjhUlH}Q7m&hlczQ>v%K-Sw`X}@k8|9P z$M5&)?E4#euV?4ZZ{$7JNYlmLf6^maxg^&+Sp)s>nsq|HI(M@7Ni{p^FIl;dXL~=l zWIO4(tlZycdGp<`WXSJwy!|<9-0T9d8|AOuelGxff4IV%t-lvv3XaNswTV}s`}4-$ zvaEZue%Qo&COh};Cf;wdbN|`c`$u-}9~yfHS+_uVAUAhy6K_p!?pK<4%Nw_a`EwI> z)Z+$_$Nl`t-m6);pE}w5a-;8OQ|%k){^(?HYvbG}PWE;+eFf&$X1RYo+52X*+@1V; zGRr?!D-Jmt(?sM7RlI+}XXM49=LbaM9zb(qjU6Jj5DJ%DL+1{_SSd+$4)2njF zcvCe-QHSwa-TZ?4DXp($<$gNbdr;C)>h2fL&pM;SSUzx^m3vpCEI*}RZ*W_RLG!}gce1>DvPLY-_U_1L;41bF%5gI(Vm)$uQ*3 zq5ryx^4~eiBA5HUslSjH{NBobZ>DB!>gW$A+wV&o>75_3-zR@ofA{yh;F=rnuYvOO zOw(oUQ7)E@{p+vq>Fa3AS^JTT$+3UQ_k`tYtl;f1{Y3lyI~G5Gj|Q%_@thoMaM^9% z?z=U9takX<0*ipT@mTrxFaK;LKkYtWe|P+FS&-y%@s_{WA=e2C>G1z)uh&8QrtjJB zml&=ze8TWK z!+iaXgI@gzTpzXm4;6kK44IA@rm0Yb1+Z%Q>9AG%waH8Q1!}*3w z3|AUHVfdWk%Z9rQ-!*JpWZ@gOH|%COz;LwTM8g?|^9`36t~7kY@HxYm4R;y7YuK1~ ziR5Z!*xs<4;Q+(Yh7%2E7|u6bVz|=q3B%_MUpCax*!%EbQgy%acd+{P>zUV~f5n8# z(rI}Gg`EpK=YO=I=%Vt92?d4I3obM&u#f&E%}I{;=YvsR+LtVpIo4q0nZbv^ID6Uq z&-PCB-=8v5AM%VJ9_b$>8^u1_Z*b&*aNBspSvHr;nmg}m|L0ce_S_fwXAb{~AJ-o_ zegQvZd8d1>e{lTQ_#rO-kNfs5yr#_?hP%c16C(Uu#-AABPviD1uZ4F~gfBF{nencj zz1HX3cvnT9cQU*@*S*%ijvzd_r2QBF2O|DoGJDq_pRVR!M>?KN&+Ey@g}C%z&UO1g zxA3weynEj42=AV^QG_odT#0}GFZ%91Yqq?J#t;0e@)s$1uNhxwymeb%G38JEEHS>? z>|ZrLccl{kek4C$Ou~wNOXJ2UaKN^3l z@$Jn2Vg@W?|J84(;X1Sb7y}pKuUoCeaO0mh{!!yEG=4AxF|mKec<1LWJtv*2_U(=DZGP@IexmVv?Rh`eTj_5zeNkRpKiSWz7i(iHa=>9_GxPWurw500~Ne)z{l0ECldIi_VY*BXYrBn zMYCN^v;crO|G&VVQvu$d4>h#k?fYr%MaM^f_W3i?<5B0m2@yJ%e7VbdfR-lQW&DBp zO1OOQh=JI5y-Rtk_TH1m|Mq6(2brJKX^6!BoyV1M^|7DvtDjb0`UAP98Go677=yD9 zN_&4Ye(4QLxbgk8R+0**dRy;T-i3Q7yoCGw)yn&4v-xqe@$W2A{-X-sSq#9%{-H5S zlp9}beE%zzXm9+3#$WdtCHfk_)A-Wcl;~`{d@EY~ciX0fD?dw&UpZ5Gs-b`R-*v{m z_GSIuwTFAnzVBY;U3>;HArk)^v$Q<8e7wi_(SK9>G6he*i7fWze^;WT@wbq$!q5M` z677s%PR0qp;L}RDeEga5#Z#1b@oC0{OYEJ`<4IH0YmM>yhw1MwUrwhW#l^n|yrj?kSJmE<)$30I5PtLsJi=xdd5@!4X0v^-ykfuCR1YVXqRbH+bv_1f_-8b4;1+Pi1`EeR-o z&b4rhEIxfZC|_?CBJIcc`@W}!bT|I>p7ArS!*uOWdlE$a|HHy{ekK~fd9mI<$o#x! zeE&O@aDFbP0E?dkmcM|4Mn+9{$VtCC0mO zKZb$$dCl6Z0=>=aaB+OOy$)XNyH8R>=jR6F-?V~k$>%l7SNna{YVXqLJOXlM#)9;r z4qp5Z+@S2`CO!(^+&k0TdvC-3_uC168dDMC{P%$u|9xLo$F9D2qC*tE>O0Dl-TpPy z_+MLpajEf789%5>341)RF9lxw4BMi-|L!+Geg{4-J|}in`xRDBTzsa&$Ju|?><3<_ z{$E${ns-w_zqRu0%EJ`nTiv6Eu3cSee49wW_J;A>tUc^+{u^DQ{+C$#xb~;3@!PIZ zLsuTEjDP423WmhL%~~ZWmi{%? z_;L1JF5T7{|4yaax%TH@#!t9k`5P3xTY9Pg`7bC@V*H0FH+j^HZIOC$=Ev0jjW^ZM z#dDGIMOHptIeEhP#*uvdmGLL;Q$H^Loi5{DE&k_4=GT|POFAstrS=qi|9a5)oA1=$ z&ousd<9GZ@3FrS`RDAJs*JkBgn*9a6m7n%qC0uzfHvY98%CAuH9yR{DMM}8mZQV!x ztlQs^UkESb+s7?KJCe=&ZC)gyOryJEG! zV}m)ibXa11$)A*W>6tSiKHTZ>5^mlowRicu%J^r;D^EA=U%xT_fqMPj*%w@)epVc4 z$UkEIo#o2^LBTtHpxR$&eoi(13gd5Eti)NyuQR^0rT-Y?--Z7&<-DIPyl`1Ec+DAL z`04oxHFW({k?}d}m3R4akMR$_t-O1##)IS2?L2t#e~PukF2DLE*x!@D|HAz2n5f~p z{OU18{a4LZeuRSe3*(y&Q^M7+(`axcKHJtR&oI)zE;hd74*lId*GivPF8uE^@UD!7 z`BR3*^XDY+Meq`zm8I&1V(een8^74VMu7%I7I~6OAvmhM#WK zzq$~f#Pg*J{oRVY_c`Mi{z>^;6uh=0)xJ}e60V%jG5)Fr$`3L7ea8Q_MhRC=ZX9Ld zT0C7joM-&lNc&lTwc0nEs(w0~{~sEE+3iZWbjTX5_R)2K(Z*kUliGJQKX)3xs7whL zpA%_+CH=ooyC|3Z{bspN^?Cg{{O{-lem12-o3`RH-h1Tf4yk@@5mpyT)l2N zR{gJ@t-MSB8;zfTpYksL-!=ZN{mPG1@Lu}3rgJk3@IWIKhGHP;FvsFaGwxpx8~^0% z`nzSPmqWWL_Ft=0-nEmzq25S7zS>QBIl?X1^=4md<=@5g$HsS_qjsAVycXA~{}W$R z!j+S|jqhd=InV6Z!pF5szcTwfzomvWBmVWC@#lO-e|PD5E%_nOb-?nshuMF{_%AJ1 z;-kjzGyY!dS=@6C9j|__qu$8XUcp;9Ui+gR)*n4@{6=^QccQfe&i)JSt$`Vt@M47TISWvVV3Jyo6i0OYKNT|0<(C3qQ=t ztxJcc#@}V>+12cSX8eYOO1So6G!3Kpd3vt$F8#l3{Qf(Ycje)a#{ZReSFR2U-szMx z@w0!f5}`9YsEzM)A=6#y}akZy;^snB{E_`Z=+GX`R}iW#KL|e*Ev1 zaP9v|)71W4`V+Za{&q5c1NB3$wF=&RE zHU11sw>$j<<5|+Ry7LmlB^n=yJJqz8n4=+MnGvFK()`_YJcj z^?fCZjc-doBz}f3Qo^P48sl>K)^oS^w+8y<)ohU-U_}FH!IwGJf+9mFQ)B_Kf)QKL%dn*~$t|p4l%;u>Ygk zXOC7x*B-XKQTJX4?>PH83H&m633mtmiCp~^yf?%?ySeAizZvcAHT%C=dFyP#MYGjU zJF9RmJ|m5v7J1%RjeljmI#_6auA-bteBN8Dgli|OjDPnj9F7ISKIS;G5bc8r#SmteE!h=zAwN_JfF7maFO}>rtvpgyXWHh;>~K`>vc6OF#8U- zC?9QCzifQdx75(}JMy6-3Ae*{l<#VOI?q-9T^mPrG=8@6KeqVLUHaF3x2pXFYsd18 zf6@3SwkhG#f4{RIsr+iQZ+DyeSz`Is$N0X+N7qq5Zu}bu)o_*BzXczc{^#7T{vZ8> z8oGKn$oS~~&V$CUzeep{dDw1z+pCl>wQw8Fix0OSyrlD#@oMPu>r=)@_YGf2@YC*7 z>SxE>>c_R)dVTsXO+0r`2Guwr(VkC{LC}{*$U-d z`?<~d6aS|Cxe8wAPphBi=yJJyeAM`E6P0)6`CrCI`|-ASnx8Rhf3bpBWPHXKxOxPO`aQ{7i|oleZZk9j~r4{=iSv&nXse^Ly1#^XrwU zG=41nY4&p%9ya^ve&0dk|2|Z$PqLfZeop;w`)xLe?xvsoV z`R+T^@XKcZW8;_ADsh(ar_n)6`b5_mYT@Ia>sw|YUEg@c_$Pj>j$OK)f4};Vmd|e( zKY5heTXJ}RfR}RB`}4}n-+GcOXQ}$h{gM9e@^_5!CA4#Lx%O>7d|dp$WcJbhqaP&L zcOxE>KGA*E2aO+K{W!(Ozgj+^_R)RtdgHghqjs*|UH%2Nf7;61W#;F8uewzUH!kh=p!%6|rScQZew^`bhbeK6 z@so_7YmP58{&U99AEShe|1XWdtVVg4@A+TSaG$GEzN7i6HvXbpl<1SCn6+H(?_a0C zU#j4h7{A%#d6Dte#{d4eO7t*(7yN1Va~RJ1vie_3|09?4|5@W_S~SP>J7@fa=Ut^+ROKwDFn`z6M&wQ-Ki zuNL2k_dnG5=)TE3__%WW`2_xH^D|(o#>cYXJ9)K+d+!wGT{}=LTI27sa^m9u z5`0{I&VNMx5B`k$cjJMp;p6PTn!rDsz@Po7`Hz&_8;y^)W8XJ^WhDL2cuf6lvV6?f z=z6n^@ANk%IvW3)@x85`9AJE-HR@;EQ%bo0y07uxpOhbB_Ni~ir^BQ0Qf{|ey(=*L z9SQb-H~Z**_qfO7{XYXQ{`>Ax$Nw__?|m!Ye%M;IUv2ZX!Dj!a@zHs~HQ!eI74N8F zTeIJ0d~`nhyC>9s&Qvw*Zub3XALGi&a(IbWq)h2Oof!b^GW!tCjF^@hqTRN;+IOTK&8Bs?7MCf73AB8SB+Px}UPd z_~<_7IZvy7)92KWE9bL}&$DxJr>N|G3tsx8M%h_Dlds_Y!|XTyQw>Ya{_5|m|L8fW z&%?((@7reoo)vJat$(fE5O4o3yrj>)!`1Fm1@GKvl;8d%C0zVR8z0@bU2FVL$!EEG zD0uG}A1&u2o>l+d-&VseX8*YH+drv}lbSGCq2q=hwzBw0^`r z@8v&MKhgc5$;LMxp^n>||0TvR-loL4#(&@V-_|Sf-7LjRf1>_-T041?*-wX;denBQ z64l0k&+H!r<;wH_#!{Ui@tPl=AJ2|G96k zT=?JfURC=)TfMu;#2&^+*V(>ne6*gv2`}|4&+1oG7YO+w@rll7+ZrD|Z+x}!Rn{+G zZ+>1g{>j-&oMHTsU#kD;I{BxKzwSF~=+bk&@w;wP{tENcg88qUOOKwvZ3{2)UmnSq zTI0WE`Rn4-_;s~kHeMaO^4!Px%~vWv&%#{+-<)(CWACvV?S0+s|1@41moKOOD!%-W zftPqj_rF#e|F!R`AJ=X_ZTzF-l<%+L{o44Ktem@g(e&5qfA2aqbm=+3`0{s@chCD> zcqyMvdn-TE%AvPI{Y*1I7pm;FG5$lJQNsDJHh%PN%Acg*Z7_a?wUf@i^KaDu_sQmgi^++Jh+ z?y<^`GXHChkDiO(YJ4f>MK0&((!J{cKKf6&Hu(RtKVZDf^W=I=!P@~Z?P_%XyT|OS zs2_5AwhG!W~|(_AcGF8NYO)@)NAxn7B{vpMO^QyA`}`@X~JIwN!}( z#^+JKeg9TYPBZ@Eca>l9X(i4ueuME(ScbcL-Q;g-zsmA=k;Uf$(~c$2r$_*T{~4K@2d|5QKG`Q1&%zxhcu zEH?X74ygU*!<2CO)ynwG?o+;}*?-CSA)AzN>F|{Cv+q&<471Pum--)Zs}ffm|A6t2 zbDvypoOAAbYQM_-T%)pggYmcW9CGzl@Ln)}<0K_qd`=+UC0|y2NBI?I-^2K5zT9Jc z=bxxyk=eg({7bYqaykFEv5x7Nb1M(>_g>^0PJ1f+`Sx7S{!7M>eNpX3D0qEXw-WpJ z)+teK{3_$4{mYxi_x_O@I{)W${!jc2nXSAl|26O~PtCOtKQ;S#mLaa4X_2FTCj42g zU3*fPtNex6DSx&(y9++f|3hZ~=x5aMdb8hU{QBQ0A%Evju6G)%|LFVRWliG!-<-fd z2rucddAs`UuHdb1s(f@E^*!Uys#n88v%lm7wV(4TCB_;5L*uu+rGy**eE3AQm%oo7 zmrMTv#z)7c_ZxqTwHq!Uy_4dfcNn}p*FuY@v%lZ?1(v|Bod41IDjR6Hc%I6DQ2czv z+8^iV3ggF5*7&=2<}u^j+WMO-C-R5#;`03tUZ4~IJHMxXteNoE82?FYSKYX4r}6LD zIHZN%=Jh*8{q&01*BHO_DK)&@>=zpU@b8sy<@4lI)z8qi$`3O8j~oBtVM;VH{(j?6 z8Ks1a&(p>~WA(ztzYFg}%JY8R;_uqMRmMmA<+J#phuBBgH_D8E!|HXZ#pg4|cd_>5 z2IKb{f5EqvxYYQbr^V;XRqzsSbY1Qq;|p(A2alPbe7<`k{d=p=E8)f)1L4Kba%-5+ zH2cNIpF36wSN`8Nezx`duDo5)QvJNKOYO&)p9hUU?fXi&cK%i4|3P~%mrLiKr>md8 zzNNggf5G@x)_=Khd$dyfp0m{6KL68Jo`3BzP~$*&n-RQ60O(6^hP=()I8eEYBm{rN4k zA3j`vzrajR|44kf>I^UCA^M$%r;LxDC;5%>+amSl@-x&=XRCLv{@!eSuV*zPt{kp5 zJ~~hThw;&Q-vByjiRV8isvlP#zF~ZH{P~XY(eqa)ouz)F<^LM^xc2a2vw!Uw4cE0- zZyUeD^1ZjpUc0vHKl;Ag3gfp~J#zJ{+u3R#Jy-J?>Xh{nIZ{|IzjBMeuR)-){CD4yu1QZtvSc{aiIn`9e#FGUMwvE8*JndyIel z2IYI2{dVL3Y30P(e~1BOTzpdSl3(**RR?Z~%@ysK}U-oC^T|Sq&*zN)!Sl*5R`42iQu~(ID&g|+8u+;Qf5+^j?^m|`sQS7374>tf`9I6} zzJE}{mH&G9JhKVIUGQuEEU#r%xejPCW^FLDF^|S3dYkWH2uY8dOvcmWr%l9V6 zZ#F(UPe1Qs^)u_cYS`KAM;rgh?Mk?Gn`!*JbCmC5_Rqk}{zC81W%&%lF#mc5KJIxx zl&|4N-z!{de7Aq;{jR(@I4*@d@Q!I*f!r$NR81_p@r)T4irKd|Z5guOYoY=X{E3c@nm{eI;Us0Q? zpPDMGs-9L+hh=$nYEo78gwm>1d3|+lU8;2YOs}kZYE4x|eMNca{CJDh#L8)vsnXio z(pjmBY4x?Uyot4?Q!7&C)2B|I#Vw)VQdrhEFs&)At*fZ*Tvk)#rN$2HmP*ys)mQbX zm|0Oay}q(~TH%a>k}h=>HxwtUct}=zpr)oz%jltNp!Z0nCQX~3Dw{d8q_BYGsF+wf zy{bM{Rb6&{s;0WCvTT+FHL|{>dn#2~Ef2%5MOfC=m)2L7`HxpwT2(ol->RpjN~e|M zqprSodYS)wer2UR$H@AE{E3xS6?L=7fT@?HB)ozGT$WeVmsVC4bj5jHs;qiiedVO- z)zj++4IffgOu$!^T-moz34u+YkQ$UqjVyLh76xCJN)(;vMq+J1zG_AUJD#fUh5>`r48Z>;k zIv!cyZAL|zFeAI9MwZII#atvxVX8r(2os745-Utn#WO~wM)paK%1=oO24Rs_)irem z6dVbPM4MXU|1>D!NeUZ!Egr^$kl=$F-aLv(jqD~t5nmGg{Xd|DV{ttsw8KAqvH$q} z?eRy}7fr36Q88#l!ZYUUGZv&q7D&onDFv=uZH3&Es;!tv)t^>YF^Fd@s-IO;QGDgd zuJMT)6Vcex5lPd21;rzaH0}I+p-HHg6r>te*SybiQgz(Yaa4guv9OR9s&bl?Rho%f zzn=bw<@ce*{aACRFvyuAn%Ytxmk0lkdEAjf2`{7#nLcgO^wQe$igJyqpEWg=GpgTj zWAlE?5G_%E`M)+sQn_e-{!a6}8bq*9YBN^4Se6;<>R@3X0Rzqu?O zPQz@LeqP!!iQ|7nD2KRG;P!f?4xX{g_hY-z|@rrmh%vb*gxvkpugW@KXJ+9oA>) zpnmD)kt+ub7+FkZ>(jTS*e}UL$alK0X%#o7N~>7h@Yf@l69)?}`6*cnVa=kvVi1$- zn$pVJK|`=`OEU$9x~!tHi(6D-C4-ff;>zNZ2?esAK|vczXEZZaS2??)c!u_&$2jsy zST7=)^^=Q30|?q*)>EX#)Be2Sas$gvb^gjoF^R+YLjRxcJCCM=I_?pYp|&3*>yw5J z3EJz}k<*dJAhg6(Q&n6gOGgxj!qjMg2`WXdRt%~n)hfxcG+W7fXa7P!(~_+vf2}lC z6i-b%PSvs2CKJ~BT84eG>wJaXYgyc^t*c};ro57$Sqz(%UMORv(7&=)))ULFFD?o7 z$;7WDvN2UKeo)EOg5tr$6TUxe%B&+ywEhL@;u5p68*(C@6#armz^#O4%CKUo(}koqEy~ECMIqz6xX0+0 zZq?i(FZbZ{s9P@r$uF-+m+BFet>Gk?U%F{Ti=>@CHpeU&6JuRwOlXbcmc+G*lY%ZS zs3cQlExWL)9>-aS-?8YPv7AhO55zboz@DmMMnMTXW)de-{V z2~`!xRC3b2F?mwy*M;s31;PnWo%UCY3hL@ z<*C}zX_J^G5;4XazEDW3YkNJuSnjJ%8eUt;c2;eL+~Kx?e0P@wPv@$hG)5&8^4&Oq z)sCU5>2(!#3piVqORBTU zX;$2z%5_OsxuBM7ljPSu9qAC4qi=28aF}MNk_y2lT~dW(u_#^P_*rb@>sukUGWHM{m7ye%kXlqKa7{T$JZ1>C6^u>r3R&29ENJidAs9VmoS7cB1Y6PdM_*Fmj$hmx#MZB8>HIkEO?`23 z<_U7<`M+!AWES?{KA&Jfm72iGy=m#v%(8~RR3jyj1)%)*zX0U-|E|QP3q^7z&6jzZ zjttY|uj90g>W^qbWhdIn(X@vg@Rnvy=8=aiJ^A+Ua|nG*$aXb6J}`)*N5BU6wj1-nX!_sEH}1i3hCBd(nZXf-+bw9t@$BaZmQ%IdTGc9{Rn?l7! zG}|-MP4@BY#F;MJR)%DWKVnV~+>UV#*p;JjvbcuCpQ#-C%BoAmgrx*sUq(EJr31gC zAe!`!{sJ3kQ_3r5G9Ek3x`5lcNotVGN6VP5AQhfOcP{MaHYj(JAW1c$>K)|? zwoG*>sV_KmuRpZ4m)=RUg)!-C{>x`FG|5Am2fOuYD&buC%)T1fIE=Kj(1ofE?YSQpz@PA|LoGm@AW3^_4lD;O-E9A-<8 z)FgUt@5Pm4YfXCiXGZ1BQSp`j8=Qw5<{fG23+)=p7_CAFrHAwGmS=)e9NNvETItTY zvCA5BV#?oRl0_g&U55RbVwuW>_DB7*D#>kt%-Sq}yQdEe6xH3xdYJ4QA5!3XB}rb6 z9W>Y<=}fDxPqAVs?GCj-kDgUkUhlu7DDfoSqjP>DkYq^^=-O!ILDhLwdTJDg&ECn%2tV?hVd~ zO3`V!K;W|5%5u7mNgq|98zhZtDl5t={N^K_N~!uxXAn3PrziNl)SxR_4=t~pCP!7u z{dvqGu{fqAA4)`jMY+=$mxF zp>OgD2VaUmP=vd~pME%kam;YHtQA+-=yW3olcm7Llu9dRsID=5UnQWhg0XUG83&+f zMXB~uEd1eP{~C_TNRbOwNogIbsLC9qoxt}BI2-YP7vQ?_)GU`<`x?q_Td+OuD}Fr) zkY3w`Sx{sz>DTE&0DqA)Lvz|C6@5!z_s1Ky4DT;T!b^u%)1)kPna=qs`94HB$4z<9 z@feyyx@}v`Bb!O=hKKT~bLo{pIn|fm9VBpC-TKM3)i+X1INK|y^&70R*!Z-YE#?I0 z4yecy_oSH=VMLC$cHwAip&pt#?7hKZ@N_Fd-#W}cwjmu-`tWw}V8@hd!NEZ)A8n(Y zwMuW`G(5|6xFN!^gdf!Oa0eEQC&H=QO+I)rox@kM!0Nh6J*^lw{q}Pwop=o&%aw&= ziE{dV3ztRVX&8AF)6mKeszhGLT9lcie|ekY?b^ijA<59(!Cua9IC-F(IduN;Kh^j& z*luvSbEGe^_;ZLE{$3`h(wN^$wbZpyT^dczsI0h=JvR5XoCC}e8opyBZ~ zJ@##GUB5l_@Ee13GDKgI`S-Qj>DeUT7An;fBOEcTFPj`X>t>y4!y$z=XrX1Tqb-(Q z?QBKEwn2ACGE{H6{-N?Amhx1^%=(IHb$k;by2IkuODVtd=8k{p;W%tX(;dkMk-q<= z?aKT5WJc!Fnr`comY(9fkAANE2ns04AfG;ptf@0}kiLi^z5m*1&3@HR7bUgGqzXG1x^tLETlgrqRJfwZer3%;Hw+xlkbJT0f=I<~Jv~?#2r=l^-3X`-=jD{MkH8gQ;_Odku*D;?|p}rH8yTmZ>~bx?E+D7aQpDyV~@+KkiK>>wX|}YUnPt9-azbOVVY;^tFCcW z+sQAT&(Um$=P@>3O`j#Jm|0d)BcCseOsgc*j?Zx5(Diz0E5je-I`U7b#m{Ebd)|l4 z805$~J){5sf8XL&WaV7S+aXEm%35gnow<%=JSWRrq3JIS9PNOuUjd80iR)uC^dJts zLi%eB?DX3XeOdK%KCN*i-}rDRQ{q~48Xj4M%}-^1iAKJGp_M=n#AIrg5{7GspU`F4 z=FAixuQE5>0{w63G^Ch^-eA`ELJ#u_b3vD~>MHp(rvJU?I)4-CXbY^gb#CyIF;iq% zBQr}r6{kxFQVoyi$e6jhdmFGpl#cp|B&M>T7&@jwjf;NNSl07g*O^X%@ERrSCP%xn z$LrnyQ>hc(u{`2D^FJ0NN4t2Tn9r88?BSmbwmke_*xd`QCAx=j`9Q|W!Jwk>SF$*@ zqFaE(d{X`7R7GuVb#3Hmvpr11Hs9u@L0c|!08T0DD;)A|q)g>KzR~mFD~LPpn0W}) zBUqN_0cCE&X! zbuxE4ehv5Ek&;cGU@?rJ_(H9GmcCAgef}Em6j{S6o5Bm^VplndkJW1~zu(VrFvCp0 z2VN}SF=644SC1kKe-b_SF_z4!?w<|!zZN3JDYgg(Y~+M+L+eb%F+DY~;!IGKl%x4- zWZY=4!C~w}$9wD^Q7-i~wtpBqRbI#EDLAQBRbf@`zkT&WwvYAIHGjG%)h(u49J1T# z_RHhvh>_-yoDRRS!nw}^JE`#gW<~y5i!9E|3d#{Ix$vDgS}pdj(w}@wx4Vb?)mJ8+o`yA6ef^L@&Hu%(VEIcF=}EJ`p;wpwYT_Z; zA?T>JGtC4OZI85z-a4soA zG$rzl)Z~|*Wtfu?C%=97-+E?9;=ex~K6b}Vam%0yzLH;a3P$tPb9q=j3F|+f`>sI3 z8q#5MzG2qOivpqSKiYWuqmx6o3fTmtRZkeHl4Y?2>(INP>7|4qd-Z_2zAP%~A%np{ zZ8%0q2snM{MMhFb`=lD{qd6&3%%5VqLjL%MJ6IK@$T5WP4`yVB=6?VtT?GEy#}Y|z zrpi|w*uglY;d3A2bVY=mNbYB)oXJ%1kYW7M79MH(!fT+N3;nYkM_&qSN{SQSPi@$w z+B`09O_I^JN zLMO@Dt>{9M98x}{pBz$lEcsMiQ{%Rc67r|vnpV0T9lvcI3V>UM3yv1aE6%QKmu= zouCO794O_LE7|BK???*T&K1{H z^C#CT>u05A@K+^eyZmVX9$8FV>mPh08geQwc5&k{TUqgEedQokq|ChE^63AG0Doyw zR(TtKo37!^I`V-lt2{b~cIR^9htkxQxE9^!w8h~S%EHuOf2bhqlZ>cGrPAw@;-q2q zb)9pXmCoxhNfGx_MW}B~D7P8@x<*_Lpuh6}u10#h_Gm|Y{@N4Eqq1+n>U;6jn4#Zc(!;gz zu^or&@R(v9ZPaX+ASOZ$i+Z<;nS7_T&fm@{kPpE5?|bmFij}G(`5Fq%edcVHDXsJa z1kGPisIE(0SyM4>DhHY*kcMkR{;N$bqGrEvD73f z@-p)aj@Xl86d>E;sh-3qcanB^C?o&#gMym$he40NJo0)o$rQ7Mpr@K^EBFf<2`5C3 zPpazZN&f!w5w(~NRx zHLlG(npd~nDBZfj^r}pQSx)TyASUGWOBxM!$C6)L(|re40a8_!6XY!m{(dX(XjTU2 z+PkE`@cm!D;v9@f;s!y7T@=<6H9A)EPXz=ouT}f!z3NyJV0`7bTnzim?bQYS%DR0Z zPKUp&9vu2AFW)wnsY%B-Jt?8bgo*9XN z*`2bf+4XGGJvJkfM|D+oPkHKZtEzjZErbZ27$iVq0|Jnc9FPz}LO?)3f`kx(1A+}# z2%(7x2w1*z?m74G-S=D7GhTYu-hEx&b>F-1-gD3S&Ogffq2__hvT9)oP{{0ULs~|_ zzHzETy2yKU&&#fhNKnY*HYzo&FJrTm{4r&&d6faZ#hyff0#K<}JYc!(Uve2Mqsc@z z?0fX`4uq-BB37xp)U4Gdg}N++($J6^G4*V1vks8(cw#y!VP&L{n)7jkDvu?;0)^O_ z3JYpr!{UNW_yvqG8S>zuFGVYK5UxIqUGh?OJs~n# zS5@Y62g@@+)hI+Nfvqj`NId`^btq_AbCNlyF?oU-wgH=*{g658Mz*+e?r5j$$3swH zm1nC1g$LjtcWlbHOZ@QDw4^cbymh@~uwmbx#m!QY^pk5_sPW*lYb9+Cy1<3dX6>@&gI z8+-gr&!ifjKRG2iWFI)T^Zj9Cqy&lAcW|Y%7j$+q%O8vCA5qBDs1~WLXf6` zc!i74kwXU4hKx%oT3r8iqpuPPVHR22b1ES?|L+o3beYAg29{=7W@kk2(Nk~p)c9NwVXXH#rKaXQrEpnF&=2CNPGQCE{l85jhR zF@f5!DzUTC1)74w9y2V!dr>8whOSo>GCTqNvYyvBI4UUg;1q(Gy<&sV0Mk%<3(#w^ z0)TI-L+!?GW!zy_VYUf%ve|`8Lzr^Khw$4$>I zazWNVZ*fs>@g)k zh$*TW&e7x5VbQ9{Gscj4LtQS9h)w+*)4-ionUNXfa}ODHW`8vMg#YL$XY|1qWBPKa zK{v_ufk!(U%z!=N;JGixamF1Ekz4uLtsrOac%6oqwk$fv^uSe{(%x~24ZkIDmP}6^v zt&lQ?NH~*w*DcC05iP-!;mY|~XoD-iZyZYiU5G+Cn^X)i9x>M4H9%8uSeKPT;@zh@ z;MvnLijunn<5Z{i$Wda`#P&&?t6mB?0V~R4-N(_g9m15MuSQF%2vm>6NqH_>ZNJJG zBo-!{Yg3bsa!%9=CE@>WN_tes@te}MCG&LnxG)mA>81m=`T@$fxr73R5mJcqK^UT3 z0G*g%?+oTs)JGx!3c3x2{Q=RgW9zg+b$7$(?bQp&j+92yB(+g^ZBK^arJJs)`j5g@ zXrId!mE^E#VZMwhsK4$d(1WaL+3g@Pxf!1$oorO>OBm*^EJXylUb%4pC`BZPeNjKk zPOJ6MibUxf(>T_I)zZp&jj$58KN5dk4) zR&#H{%<3$(@aTHwS#GkH*nE=Q&>A)$13)ofB*;)Xyr-iH@=UlTdg%fOQ5$H7cPpca zZe%ssn$XZRVAUaQBY@6NP#xhRo{BOFl+Y{dkc^>fwfHd$?t-4nnt$Xbdj^@3bJx1$n~<1!b>;<#%kJ* zZ&51bYKnRv&^o>|qL{qV>gjwkWZwa9Z7LA93#!{saOWCg%7WPD`)B2qr=q8hnw&5( zy9(19P7W`oUUASJi96iAwS*65JVk;Cl{X``#>ZuHNJE*5&8U7Z2QRp8*9bM160AUs z`T}aKz*I?axg-WWAbe!>O>31S84G)(gsKxWb4S2%76x!cN2YL18$z;4?1*ZSGJ8Jk zZPu^*7Hp&88Vg`0^&w9blDeAkcKTDO*&6U*b$&vRp9Yda0rPxBpTMEIRqdm z4W)1Oh@hVGfq8&aA7ZR>AbFbrCPYBq7qKb%ss#y66PN-NW6U*lIIcZXpprk_n1<@r zcc)Z{UUs=DogefU$PyiPrv*On98IcMB}m+J<>1H*Qde{|ovU+USdqY~-lFNYV1t7T zP*ag7G3L!|oq0oj#)50?=Bz=Sk65xomVhl5wK-t&Y_UT&NFx9vDyTM-<;bXhNVdD~ z!}q2)yC^|OMF^o&YsCOlZ14#0#MK4~m|*+&vfgYsdSQA3_Z~i3Eue{GAlh}9Pwe7m zQF-;j=z;{Xus+&3M(3!(dUv%(ya*WQW~;;|7j$nz5nS9cBPTE6cD1&c=EZN0g=cVc zTd|-0*7=;`nv5G9o6$zz4k%y(W~~9s&*nxm0Ptgulrr^gfxjS%Au@b;Z%@?g2*Ne+ z3Mu1j92<}lqRyxNXDD1bqHeDhfFXew>Qr6Ps3;r{RYI^g)!K|J4E+cSEV_zVWvr<< zBP9Ip09Dr0SU5VO;58@W*$jV(CF0e_&M z`W~1-m6p9vI6`cjoWK!6?Axlh97m##%i^Y56$q)W4E16N3~6YVb2^9u(dFJ^k00VQ zxdPGR+*`e1x3>m|Vc2tUI9jeYhl;QR#d5H5RjY!VYT#ZDW-|V<#p1$bgD_Oe^-sY~ zcQ|k&N2jOIxQL6MQ=1zsVaI=IV16&NAV_&g5OFP5x+LeM)9MB)AR%W2D2Q<1uwN3{6F5Z{0phB=HY<%qieI zFI%8@d^)Diq=hz)y6@Z2W^mZ4tp+oL%vie^6Pb{&Dy0W5dVzRK zyq8R|k!Df0})WQ!NGs;d(rUea5O8$yjh zPT6?1m=hDqZyRh4j3$T0jQl~rj8VI82}EHE-Ryc_aSS!q9#SBxJR60gZLbXU?k>el z4Z+gaBREQnB_@-)iBRzZa}tP40^Ym^EY_!Fmv9&DbmmAdByr1~QxK&*n83Jgp5N%y zC3%QRfx4*VAW+EmA+|jZl2jmy&%SLTX*|bwsf6mRKOMEM`&j`q)idvmGG5BpbZU1n z$1&8ULX|3(PkCaRBjzo|mK&#lz zg_uJQrVA)R5D74v26>5UtzHhFd5I#Azmd~6&0qmYcJnnKl>KyPfQd# z0sk|D!rS4oA$+pc$4&1uTgx5Z65vjtPf$CMm01||z?8AV#9Ip#rjGSdgEg&BX;Ka- z{HH%04Gn|N_I7UVB{!sn1aKlHE@=mDEj(n49gxA1U9??O4IbSuVB|>&b_8R(nvYlo z#~rsX&~dttj!k8LK+mS{u+JIX2~q2pKoJc(s;*PP&gclIWXPhA8r05dK-vHftf`@G zm>dQo6-7%*Wc_TnH>Nb;T!iZ$z6OKt$$0&Ij6Pj5qJJ_W58H)?rc%6=unjsR{C_XW zqXm)P9zabhh&`%Um6lBK&uq zJ=6$ZpRclKGjwrCdN7XH%XE(yFS!=g)WO21I40zLhdNGe0(`t}p6vD%C(ZWvL_AUt zy*<&`lWSD_3U9iKB}eAYM)2dB8caZgVcgvAT|AH2q@S#%TUR%&jDoj0hYP8~U@7!s zvVJ+l1hRIowtbeYhk|U8Shxnw!AWT*IN;*7@FrEZcCKt6X%$=Wal$ADO0_}8o*@tG zNeww7^uon8N_akLKG@S-#2U8E69@Pp#zZ_HRbdnm1zYwiISfLd{nnk#VX_5cKZVI) zkAo_2RlCLVn$LeR#*un~sL#{)|rY z>3F%SPS+*&?=c@ekzyNhiV9>ZHjUJ+E?CmdObDbXml1FU|HlC}=TmRH+bsT$v5*P#asq=>Km=(Xt2J_Cmlk2~?c6S6X2?~uHXW5GlpR+0Kb#uDf8nz5=vW_p#X541-N^2 zF{eU}c>G+OMPQ>E(RneNQqIE+4ab2NMSoWtc02-OK7h?*+Ft{3AQ;$eMXh=W^TGOjIYJQOXz&cZCK}N&KoaqPAW9u33@1qS z!7&VyKkEA&`LMAc$ha777+Q*DH6{=Z?lfG!L7}Hs=L6JYjtAlI-28>E@?BJQVcYNk z#jJF^XrID@mX^Fjq=*MOI@~%3HI;+4Wuto#ezKYz{4MM@hBkL`IDkUOtcxTuVoAYs zpD$YmkP^PYHn3aV+!GjialU$5FDA9kwokw$J?t4({!`N`vd&;GJ$kHad^$AaigzXu z>qxXwHRya~X{ z7D*nUqT1Pfd5NMf1G07Q-nM^|3|=G+prjy2OVb3w1*SCe{QD$x2s)YPi}q#ilg|j#i8T|BhMDz_G`T+(ComQ?s?;Rk}O+;2a*+ z^_=4oF`7ys@XwrDmxxWk-R@^FTR#|`_RlA46Sy$s$OZjVqT~_(37UtiwIEE|#KuW? zYWP^71gOpX=w0|Pxp?Ms#7&L7A_DC;3==peFlVx(vWxNPc|jcGfB;$ESca9{+*J$@ zswo+ivpPf=41$j+7?8Y2;L^Fh>FwR%x(Xd`2U1gFPXPUZPU3Q;ev>mB2)>!sT!Uvw z?YQoQ@2jP%Sc%4}W=AYjQ+}YS@R8k@Oc(+BRUNMc#ll$aP^{td+YF^;SY(yxP;Q0m z;7z;@hb#-1K^jN!j!_7{Eu{y@3I1Sm%l5D*uDmBI?XAaL`*1P7m{&Ut5_T6p^Mz(e zD2eyz|LhFNP7p(^)=Vr${!F)8Atku2-OvxTg6Ew4j-)^be)IM@B?@+m953GM6n+I^ zEp3)6fVsxprApWw9-RM|4SlHQMjN9zuGXFG5LbRl!*WmrjTAV)~p#5^K>YXSaOu+{5-gvvCdZC^@~D z4PwtIc{p1!wz{euVmVb^AL2;ve+6ze_}b}cn0-X4yT zAjcJ8xiAUeR;`IDsf8$#r-gGCD`*7-Muru8Qk7SvJyfumdMS&UL?kjt?pc#cn-gOT z_(kQb-WKg4$6Lq?WL5N{Lb@fZ@7d$9jY^vC&0eWggZT*gG@9Sa%ju%PP;DHBdq>=a z=teUNM$X2ky(g4lQ5H2>>#RlG5IDYq zr`Xu(`N_Az*s=2ZaYt5zf9e3sWpn5T}@GL7||oL0^UiH~>A2TT2mV5>vcxZnaA3pR=)mmqSZXhdaw+34JcNPNqI zD;Ac39pW=3AW*J7DEPka`fh1$YHU>@x&SPqx^A-zw08k4svDpSDBDM*%ycv*<{W#0 zai0_xE1X2y4`F#MBp}Q%%$wR!odtW4xW<15W@wcD0=F5nmQ5Ng;_m4z5Poi@%ZyD3 zu=^cZh0Cr*vFQ)>Og1TRZp?n{8fO0-VmK+jV(>KZ&}C;YUS#M$v6|2Nlkxg8ySN$r zow(k$H$Ji7<2^wN+klS7%cpoz?-&Ecs7)F^!t_bKoY)hMeE}FJv3GUhXEhWzEt%-B zYpWv-q)rY8FSe$P$(g)`YU0UZH0Af>_)l@YhK`Zdls1bfxbEk zF{gR^4!X|6*Ahtsgr+5_biUEelSUrsYh=LbR@Yp>xuXCQh1cP_G$t?A9(`Xjy|Cod zAt!FRW2Towp55`M!G!CA1%bR7#J|F36>xBN5%7clpMwX#B z9xJNYG3wUcjVSWCz&-dqjQ`8`sI))55mmwq7o zSB(Vur!4jbG*`S^R0>Vxo-yPj90L7aC5X=vB{h{x>EzYT3Mm(YVQo6-%x6$K`*QvX z2RVxbrmoH6MX>3q=eJKV1#|F|ON}9higAEBkI}E_@K~^E9+kkZys4?Khoq=0}N+QLRH2EHCA$L>V9FFBX{^9Q5$jHDxoLD|Cl@*fC zsBVT*sU+#$oG5}AO6A!MH4;wF$$bTb1W0DQ?3I+AEaock%aIG7NXGQ z=6DZ$Uz6e^+(kf?NCxx3EoP(VPBTJb&CnY+j%uyxB8viH_*U;R`LdRyGr+&m66M<` z^V#SzxvS_ghHviPlxDk>d<)KbA~T3QDZ5?t*evGbhUp=ssK?HAsYfSX6iRFS=Il8V zXtJZx>U;`&+B@%Lw{~vIqdcgp2i9;>DZ#^EBfm_H)Xn&MD1?ajD(Yu2I`PGXgNVV) zfX1#Q4#dmnG}u4FsX7VbQcDhixP;4cy}U&7(F#t)v-1f`ozbK%@g5ht+b$?}L!O8F3RBEuX!axXSi!R;+;eJ#!2<#6$+31r98`-n^WLiv@Go{5M zHl7|}QE?{(3HOKJK3`p-RXs}T&KX|_HsLi*R<}v&&aX%rljn#x5f)~>ppV-?IuD^w z);(KuGkIofpjA!Ae?3X(0Z8Q2fk+6J)SfvLYt{N>1cAqe@7VbEP-X1NrUQtReSjDx z)#Gyvvdt^RkC59tZ6&3IR77YxD)I7`=`b0VqyWFobQK)A{D@uhMvMmtHIvGI3CSg; zrTFCb=Bw;|bgrDj_~?fwn3HY23bhJADC0}Ma2GBI3Xrj(AsY!st8cF1V>a=*T-a>W z-URXrFbQ*q0?tXvvD$v=bg` z(rLx)kOq8zKO3;mCztykSS?6}Pbs?9db^e{+Q`JA%ZOD>F#)?0SKx+FtW%&+l?zlN zV*ku(;kv@e&BiQ~vJ)WGm|GG>L$V#&wD7nSk0w<*msJwJk&@?!a2l|Q1=y!V-X01X z0c{>Ha469Roy=JM6^aIU5)`EV-W>k1#e6azTz2>1QABna*aQC0Y{#paT)&7SozJH0 zV;qX%7DySaYp-m1`gTHnb!Q4|9yiw^u0g?3#59<5R*TQ3I|q-E%1z%0Ys5l!HiaXS z^G9tTLNErK)=QVWW;q?*-XI5-sM7dZ8sLc3BxZ!WptQIZuoH(US`d zO2*{Ioo7>Z^bve+>=f;5pF@s3!nwtn&Q=#(Ckl~KD&`Ng z4~rq5b1TbP4?(6f`Qha7f}J|%At{G+V=5z%3Cu!9GqRHwSxK979&Hy6UYln>B)o0l zsv;6o`_71LC4G%Kh@;p@)>A zdFCEZ)ltHN4{FMe49Vz{)h^P3jmfSpR+0RQG$3?ZV^cW@#{yoKTB_&~ZY_4G6;iK@ z^VuaI%w#gBVog#yXMbSJx;}XVL-)Sf+QOTeqm1K*v$YqL=(cBTBM^nkNYca`@)(tU zsybFaSb%$Up*eC-Z_NSpLH+h!SrqzD6_<%@+PL|#y3v zkrX_~#hL;W@m-Vy-UWv;2gt$DSDAu@NTwkF&rBNKCNN*BYGhlCv+g79FW+o*m*aV< zMk4kX=W}EdC#TfMQXGYOhFGNlS~aB{(fj85riYk}Ya#n)9nry?q)jky40FkqWPoFc zEMg#M`)N8w>y#)DnT~K{Jv(h7BEczi23gJ-rRE`rYLE?!ro=MPy!mE`Wls?cC2@8i z;(sX8=&A@9gmMI-zz~H3J#h&4vfgYsdXcRu2ekL_$!Y<(N|5IvzDA$uO}d@V&gycC zdUd$2m*)CZf8sjii_Xpr{j7J+X6HMLhrdp> z=sG*Y%NZVFuIr`w3o?*a$(1xz}5tF+b?_3-Wut(0BcR zzJw1yj(>IhT^X;}8~&H^^G`&d5AfL^|3t>?^;e_se>VEui^l(+jMwXp==<^b-^Snn z`;$-RI{&|r@p}Dr8UH!C#`Evv_dkVyb^J#%Uav2I(hQ_`q_xxWZ<$|r#<ip%`o$uiXT2sB>p=_95Ka>gU^L4zw|DVbDx8;T(f7$$?*YC;z8vjf9Hy;0&_#Hh$ z@87wJ5A=^*f6;uh|Bd(m&+!+3{0$kW*MImiJCuL;ynNK__oMM2-8Ns)tIk)3+4<}5 z|0Wv$QpW4``~R#X%~hYPzx~^2{D+@03$9loKm9uImHmJp{$9rG{&hZY#_RPzgr0TG z4gEo`|A;G%(DDEI^JctWKO50+y#D_hjeq$SGhVNMbtDgxi>{mg_TQuNfBGFWUax-` zJuv#%`7ezB8T_lS`Sg2cyk6t=*5~W>e=zoEz40$(yk7Nt_zM4{pY{4VJdU2I&;J7% zuU9=MGQ4v`e~>FJH_^V1|4_#3RX2vtFa4v>)%W^q{LX*=hkrz$Ivu_K27hw@(eZly z0>18#|5(QB^`#Pq+(O6c^~=%tAN;X-zFy<^*KsOH3Of9Z#)EdT%j literal 0 HcmV?d00001 diff --git a/sb_parser/parser.cpp b/sb_parser/parser.cpp new file mode 100644 index 0000000..3a0de3f --- /dev/null +++ b/sb_parser/parser.cpp @@ -0,0 +1,220 @@ +#include +#include +#include +#include +#include +#include + +#include "block.hpp" +#include "hasher.hpp" + +namespace fs = std::filesystem; + +typedef enum { STATE_IDLE, STATE_READING_NAME, STATE_READING_ATTR } state_t; + +Block *parse_sb_file(std::ifstream &stream, StringHasher &hasher) +{ + Block *root = new Block(hasher); + root->set_name("root"); + + std::vector block_stack; + block_stack.push_back(root); + + state_t state = STATE_IDLE; + std::string curr_token = ""; + + while (!stream.eof()) { + char c = stream.get(); + + // brackets mean changing current block + if (c == '(' || c == ')') { + if (!curr_token.empty()) { + if (state == STATE_READING_NAME) { + block_stack.back()->set_name(curr_token); + state = STATE_READING_ATTR; + } + else if (state == STATE_READING_ATTR) { + block_stack.back()->add_attr(curr_token); + } + + curr_token.clear(); + } + + state = STATE_READING_NAME; + if (c == '(') { + Block *new_block = new Block(hasher); + block_stack.push_back(new_block); + } + else { + Block *current_block_ptr = block_stack.back(); + block_stack.pop_back(); + + if (!block_stack.empty()) { + Block *prev_block_ptr = block_stack.back(); + prev_block_ptr->add_child(current_block_ptr); + } + } + + continue; + } + + // space means token end + if (c == ' ' || c == '\n' || c == '\t') { + if (curr_token.empty()) { + continue; + } + + if (state == STATE_READING_NAME) { + block_stack.back()->set_name(curr_token); + state = STATE_READING_ATTR; + } + else if (state == STATE_READING_ATTR) { + block_stack.back()->add_attr(curr_token); + } + + curr_token.clear(); + continue; + } + + curr_token += c; + } + + return root; +} + +void collect_files(const std::string &dir, std::vector &sb_files, + std::vector &other_files) +{ + for (auto &path : fs::recursive_directory_iterator(dir)) { + if (!path.is_regular_file()) { + continue; + } + + if (path.path().extension() == ".sb") { + sb_files.push_back(fs::relative(path.path(), dir)); + } + else { + other_files.push_back(fs::relative(path.path(), dir)); + } + } + + std::sort(sb_files.begin(), sb_files.end()); + std::sort(other_files.begin(), other_files.end()); +} + +bool structure_check(std::vector sb_files[2], + std::vector other_files[2]) +{ + if (sb_files[0].size() != sb_files[1].size() || + other_files[0].size() != other_files[1].size()) { + return false; + } + + for (int i = 0; i < (int)(sb_files[0].size()); ++i) { + if (sb_files[0][i] != sb_files[1][i]) { + return false; + } + } + + for (int i = 0; i < (int)(other_files[0].size()); ++i) { + if (other_files[0][i] != other_files[1][i]) { + return false; + } + } + + return true; +} + +bool files_equal(const fs::path &file1, const fs::path &file2) +{ + std::ifstream s1(file1); + std::ifstream s2(file2); + + while (!s1.eof()) { + if (s2.eof()) { + return false; + } + + char c1, c2; + s1 >> c1; + s2 >> c2; + + if (c1 != c2) { + return false; + } + } + + return s2.eof(); +} + +bool sb_files_equal(const fs::path &file1, const fs::path &file2, + StringHasher &hasher) +{ + std::ifstream s1(file1); + std::ifstream s2(file2); + + Block *root1 = parse_sb_file(s1, hasher); + Block *root2 = parse_sb_file(s2, hasher); + + return root1->compare_to(root2) == 0; +} + +int main(int argc, char **argv) +{ + if (argc < 3) { + std::cerr << "Usage: " << argv[0] << " file1.sb file2.sb" << std::endl; + return 2; + } + + const std::string dir1 = std::string(argv[1]); + if (!fs::exists(dir1) || !fs::is_directory(dir1)) { + std::cerr << "Invalid first directory: '" << dir1 << "' :(\n"; + return 2; + } + + const std::string dir2 = std::string(argv[2]); + if (!fs::exists(dir2) || !fs::is_directory(dir2)) { + std::cerr << "Invalid first directory: '" << dir2 << "' :(\n"; + return 2; + } + + std::vector sb_files[2]; + std::vector other_files[2]; + + collect_files(dir1, sb_files[0], other_files[0]); + collect_files(dir1, sb_files[1], other_files[1]); + + //* check filenames and structure + if (!structure_check(sb_files, other_files)) { + std::cerr << "Structure or filename mismatch :(\n"; + return 1; + } + + //* check non-sb files first + for (int i = 0; i < (int)(other_files[0].size()); ++i) { + fs::path file1 = fs::path(dir1) / other_files[0][i]; + fs::path file2 = fs::path(dir2) / other_files[1][i]; + + if (!files_equal(file1, file2)) { + std::cerr << "Non-sb files differ: '" << other_files[0][i] + << "' :(\n"; + return 1; + } + } + + //* check sb files + StringHasher main_hasher; + + for (int i = 0; i < (int)(sb_files[0].size()); ++i) { + fs::path file1 = fs::path(dir1) / sb_files[0][i]; + fs::path file2 = fs::path(dir2) / sb_files[1][i]; + + if (!sb_files_equal(file1, file2, main_hasher)) { + std::cerr << "Sb files differ: " << sb_files[0][i] << " :(\n"; + return 1; + } + } + + //* return success if all checks pass + return 0; +} diff --git a/sb_parser/string_utils.cpp b/sb_parser/string_utils.cpp new file mode 100644 index 0000000..cf6e5cd --- /dev/null +++ b/sb_parser/string_utils.cpp @@ -0,0 +1,16 @@ +#include "string_utils.hpp" + +std::string quote_string(const std::string &a) +{ + std::string ans = "\""; + + for (char c : a) { + if (c == '"') { + ans += '\\'; + } + + ans += c; + } + + return ans + '"'; +} diff --git a/sb_parser/string_utils.hpp b/sb_parser/string_utils.hpp new file mode 100644 index 0000000..823a6b7 --- /dev/null +++ b/sb_parser/string_utils.hpp @@ -0,0 +1,5 @@ +#pragma once + +#include + +std::string quote_string(const std::string &a); diff --git a/tests/build_logs/.dummy b/tests/build_logs/.dummy new file mode 100644 index 0000000..e69de29 diff --git a/tests/iPhone5__1_9.3_13E237/inputs/sandbox.kext b/tests/iPhone5__1_9.3_13E237/inputs/sandbox.kext new file mode 100644 index 0000000000000000000000000000000000000000..fb07cbea3904ac843a6680a09de891eac5f6fc04 GIT binary patch literal 520192 zcmeFadw5jU6*s)knKLtIZpq|A2oPX0xj2Ck0|G{*Itjxei3m{(J$dI8UE%hh6oDX~BX!?_2)B`OXZk z!?L#1b=<8XmeE|Y{{w4_;qh4okB;&=<^A58yIjPAdxlG#fp+C!xMcqpELeW;f(KSD zyW_rl7p!>je%$|ec_S-?^8H~}3djHaH~a(ZFlKbQMBveQ@PE~@XyJnk&(}H_j?9r= zt{MQ4dE|f9ap!%@mfg2JQOn>u7LD$5<;P$4?+ceGfb)U{cRcXGfct@c*@QaE;sqF5 z694+w!LG}2ELbqJYSuN=9aRasE{%_cZ{S!Y>R|JuCUNus=ZyNFK?g^mj%*wYuR7-8 zZoh2Q^HVz;J@&i#=C9`G0@@uVH|zBSk`c`B`<%iWwC-?3^xh zSCTV!vpu|y4wJ~(ZvToIq@BL5+CT1FVtU;Bj5MiAEzLgXs?CwIq*V?L)%8rM%A#EA z`07;-zf4@K9og;2aVEAZ-{y`Qf^QcKl1<_pb0vQ7(HZNdH@iscF#lov9q%isvY-|d zy(e1MnuqHN%H7haw?cE=BHfI86J3P6oD;L@)%rKPa#FL~-|V_Nb(Ei2yk{D(*7)Bb z7HPbsq0@Va?L$B3Vc(f4pK9{)9`6sX`*dFrJR^Fc_K;Iks}9VjMm-;}pv2ss8cF3n z(m_o02x(vN6(QDFwZwws-G31B1`hY@+2kA682i+#d{Yq#WVAUckfJ7G|z-u;L2j?>UNVeg&9rt_6c*Q2)QBHpD$)_dRo zHg%sSPzro}6n;-8Uf{wCz!wdkiXLq%0A!rLR5DhVOYePa+{bF06K(-ag3my4y zEb4#_kUSM87E7(sk{Fwx0FM8z^FX{#eo&obl6BtHug(R7>WuvDLUnG6*C`CDlO*dL z*RRe=gX%nf!8&h`*Qp*<=O>{=-&OtUGz_Y98|qYOL0Z#lS*o^aPyVfgP?buhQK_1j zYUuYN3r5Rr*U<0U82%G@8X`R-71g;UQk3Dl=OS~vpsKltOTSL!&is~h3?~6G-_TX8 zuK{)FdktqcXy(eoY!b+KPHe4p7UAhHBE%N-X9cpW=SfC|8pebKi4+g@mEwJ7wWW5R z#71>Vs1`Jm<|CHo+KIKz&JSeB9qCHpGTiyMV!6Y3$t2Jn(9*0f(E2x#^yOr}Xd48)&jkkQ9&wUi5VH$3;0ll5dyPfj=C$v`B0hB(uzoPNUJ(Za*nD`yA8LF5ixcV`tS$E4DSRg#)_7EV)ceSm zT#2(rgWvROr0zDghuvMMdhcdB~Le67p z)p)oju~yTl3TQlHD_C)ZQhkqqx=Yg2)xK#rz)|GtiAAPOZRZJdr6geT|LMP>^Bu3M>;<^$*HAIV?V%JOv z;CJxkUgfQtKCL`mfv3N~(|P!AUG${9MtN(bxzUr~4$a$Mq5e!)=^sw4b#m}j)~T`v1>N!YFZj~25OfOTTc6POV%xHUSe)t zxTJicAy9@Aob$N~!8bX6#rYR5;c6#BtI#_ytK_ECIrOzAIwfRTqNb*3X=S0a&Y^bx z1saqcH1tvrCzaxSphqLwoF9Kn_L=BTJky^spy^-s@RA+c56LspJw14vXLF`W!}0w+ zJ@p+#X9M0h;%ia)dQ*=Jbrj;+Bk@|F>|vN_0e8s&JlA!QOVfv!_oDz%BGJ=-DcpIT zB4=WKSJOjp*MOd;0>2`T6ddPZzn#MI(XX_`iE{~_9bHZ+cPOsQfG$S*%)o+){zFbx zu)(yNAHaDRwF>>Ha3JSYDABxo6^+l=G${pagX%qxxbv_wjV`%Mjp~o{EGhQc1qbp62T}Jv?bYvA7 zH?ndS@T`%t+f$@T&g^zhy0&$bWLuJpUKRkyf^XRpG7fSve^{VpNrlAavzfgFGuo-p z!ye3Wl3VI*sSw(oOG<0a;0`(M8yA|L?|rN0hSX|68Ae(YwJ2PP9=RW|tjDnehb9ge z>?w7M3T)Ke!8ulu$RSzf&BU3q@nb&HQgj`}Z(RXD|%5BZ5tWZYq(J0rV-Zx&Vw5n-W zl=HN-8mX#psl@CN4mJJ&N*muswuAa%nY^TwO^KIX02yVX^|Cr3RvL3-_1zdP^t=fU z$hTj@XbF|KSs3?J$Mqz`&3%>yNzISr{G3G>&{gvL%F&}5xxnHCtzRk=PhQiT zXE=^;&rd?~Wv^ztmbhNOPg>`NWZuSR-k~Vxbsb^P40KVSxy?w=^paNB5uuV;g{nHo zD#$38-AL!X-MdRmp5F`Kre(#9#9UbK9R;czzc5q!V0kn+A)E#VEBo*=#a(Ju8MCYK6w^lGz%YQ#(OxU-a>>ffp&gZI5thWwUG~DQJcDI<5Yg z{GcluBxvoDICa^Q)V04Sh6lzYSwEz*6oz+ENcMyECDw!SQMGhq8?1LKM9t@1vpGL0 z-~&cF1kcYy@E9P7;X9S}6ZrmJ9~nn>GO9AtPosIBLvdT?{D|E__9NE@S< zD6^ddJm>K+HjW1YUtHUJIny3$!M}TpoEE2%PVK#n`C;(n(%uQz^3sILT<4?Ut7GtF zdGDo_W1P88#_ub8$0e^TddDWO=l2%HuL)|Kq|~Z|&d+Ms(MROGDna4%i$b~AGTZP` zM{#YYZ#2ANBrl_y6s~eagI_@^alR7xuNcqw_u5;D#a65E|4^19ZMu4gR5BkG$;$)} zAg~Xj!QY3nTho-cpZ79-nE9pFysRY?aLmQw!12vXTB66f6X(7rExFGRUWofqLpjpn zgYN;)L=8vI;5x>KhE&>fS%1qSPH<==oft{0oTofl8!=bwa>czbh%=}SiXVua~S zM);eE#R&T(yH&5;H$`;Hxgo;18EL-*?LQ0M@fEbg&cDX-F^*mwtljLQAtz_kak{^C zaMYAF!cs8i(ur4GHLdd6^z`)WZ%)7I*4mrzx|yUwqjTAL`tcEV*3)~AB%a*#wmJUp zmA7NhRCHlm;%a;H>fgz$$!{gzJ|3?{MOP=wKHeUCD^SlNfre#hCOShP)`mch@md7> zc-w3`OIInmjwIfB4<|}~eK_%~;;s0+H~rCDb@uItMzMLQ&XgW?JR^;Bj&oKw90j+& zHTg(U)2n(l9^$US+z9p% zcqOj%9gxJ=O5<}5_JxIOT5R1cTS%(qGAYX~w7?tVRa0wk-4bDUO{YlGeLrh^vx`p^ z+F>Ev1VE*-fqxWg0?;vA#C>-|mK%Ec-C~QHszMxmA+N~Q9@}uPy;Qm;uHiwRg-9Vi zoxsy~z*FNr3ZC?vz$?yc8oz#y;p)B6%vTwwh;fDqfHD`H@iJ~SIKwS&vE|lA%%dLB z!`TY`yX1UgrsmYU{4)W;ije3gHap$u8v82A?Q_}`-kOFQMq96NkCl$e9j?|TSHjb= zS?(cAJe9zen(ph-c(hHrEu#DFC7;R`7e>lUO0M=1+fV$go>(p4g=28+Ck&1&fU7Bh zV{?z-Q8#fmR=Uui21u;_v8Zz_AfavgWa&Sn^k{3g0>dKjNjcj*T!G@Jq|$SVn@0&} z5ARVaQ1H+Q^KgiVS)VkhDbRKvj=iWUJJB1ZrdWSMB+(})_)NK?1u&>`S}jsv@b6L4 zvn(z}mM6#MS(%Lq6Q5`@_b#T(}?oh7JQt>Mu|4QR;}xp|fwt<*5;JNUccG z7`2_3M%Cf8xIDc+E>C~1)Hqn4UZvE_bZrLTqH3laFnO8@iZLnDMFR_((MU|9GVLt~ zb;qR04T{c?4ryJh)IL}{OO*%6&$F5zh5Nfu0`BYLa9?%-xDE8HD8p$2AFq|g^oxt* zfJ2siOLd_|Ir|S!4_Jh17WZJ(Kg&6O&sUb&_)KZ@|Q3h#eq0C&_7o&%JLQJ=+P-x+RQcFU&f=;WHPmI}txIQ2ZnB#1m4uv$Z_DA^o>w8y))aZ99 zG!G-)6iUaHk)8@=?42et9~x`31m4M2Xpyk_F-YGw(84HZ6{zm;K-`qrehmLS+AXn~ z-9lF;f!^Z|EKPS??p=6q=9VHU1A16Ac=ZKw^<5up&;RDY_TJ9^vGzWcf2=+21>1Y0 zFU~)e`7rk)?XdN-^K%XMQheMeDl~gcp3@u+!WYqR>|>Ubfj*I}|0Op5`WSyU4j8-o z=A+B|fA?6c|aRoitU-0$BD6QR@#X1pvvws7il9wCkE<@s^WBVZ=APbJ+U8+#B3Y` zeNd^F;pUUY7v>KJdP|he)ms$)@VrvXdHygbS-$b2<)tY4Yy3^Wt{%Eg@KTB=ZAdSf(rv&`-K0k)8V&W%E!@&`cAn_(C4 zY|W3`Vg?%OGgYf0M~K@Zad}+9YKIoOK9izX^}?4~Fga0r2j%;MX9w7}2Kqv>{N#(4f4X1! z^bclh-U zbo8Kh3a?T4nZbzlM^|k9v4pKc!b0})zS270#vLaGnSm8`q+nAk4E+&zmAs66`Ob!S{+iK)i|`FFDUo1nR)oUw@GRFW!S-p zowGCCCg%NwvJ3OC^W(PxEgb!inJ|5$NV+yABmSLk=nKB5w36T}$@#DJFH!&TACavF zI_IMGH(aoO#{m4T7?aTXevCFOXovaip6bXIomf?wZOy2khH<(>X=N~Nq{V#(jQ&zC zqURWBcQ4~(OO$zbl~T`nK1RcddHzw>#rWVSO8MA49W|)DFIoO)7cKurzw&(%Hsh zzHCtWPGvnG{XhH8!x!tnuV4A>LFGS8mS2C-@?NEUnbJODkp{rOH(9>oqUGKF%AXum z{^?|S{-Whq^eca8Q2Be3<=Pk@*gJ4ufJ${Z@=jh|T{2<@K~PY4ffRHchsk_BlUV2d zT00fH>1M2nYGQU%p@F^+yFc@sYwcz^8=jkCB-1^lLE{rzG_Z}*U|H6Nh25Fdm73~% zxXlKA^&3P<<|rE0U4&P@8iuc~4fFWQo?7IS4zsUL^oWRgu?7rOgSFs#_v&1mEsU_~1*E zK6pJ{0)Ir``!U@&t{a?v<41J^3H?8>dx-sXk0&o+|LW=FB%VJ2p6A*|CUsM$&%|_^ zoOMT+M}jX#-*T>(0;|oiN;CW{O6huEVN$!-hsMXX`e!K6jFjBAH$_g+T()+>ift>bVFjR-(_bbrhPy_3?^|3O%uSSXlRedv(7Dr{= zBG%K_`i21K_q~@~<77JL*{enA0j&w`mH6Y-|Fdu3Hunn?#i>r^*a<=PZ>b#Hu!KO!G9=`dso53^MV*# z(KFC%Wv)O}u)JA*q2}_2vPJ`)CTm)lH`Y>PhE|`|!2Hhw{YuvCdc946e;F%Mz~bk! zuQ4h}Oh1q5=<^S-o;-%0Ou>2wsWVeCRm8fbp4K3mQspBBr1(bv zO@Vi@qC*M{bduuLy2dyA99dD&kiRFtVS;39xTK*F9(V)&67gNk?wk-JC(c37)Z5AKq;z{ky}j`sb~b_5$vW_L$dl5_T2 zu_DX2OBV4?OtttQj#IdvHbqkh*{>QpB7}&=0*04Uy}w9WE++IIJ_A?~dc;?fg6~cr zdR9vw{aydLJfpkQ`M>Q5J*`C_&d=raeslS`3-}Qj{?6NgGrBk3^M9u2>uE9C>96N! z#P$5;N-G2Pd_5f*N!pt5nWae9su|sudl+{f35r!BWtxd)b49|&6i!*IiX41V!HM)h zcGczz?Wtk-t2s3se@FO+SE&P;RjR-c+-3SQ@i(oX|58uCOs-e!n0?xqiFsrl3>RV) z^jHHV?W-0G_VfoU?HM@keo(YKab!GLY+sG%YjHf@)U!5$qkntXOEbC`*8p-d3ULRU zB;q8_d)=QS?k*B6iHv#m@%UyykWelP@4OSJM z7}f69DYH;dH}q|m^X;T$DAt;5T`fz7xo3Db%MaKK-5S5TMTZjEC@~_c-pzR89`L~e z9D8vTA}Ux<=OYGzlvMajXEDFqV-7BWcy;~WF6_gxsZYGwm6v*%@6E2%RIC_{>+;W) z$GB82H%q#G6_Se5J`UHrWV5|O8naJDJNg(c3zXv!dB$(4P@f=_-HY71iW8q*lbkPO z`i6kIi{PD^$M|>QYQ)*R62)9E)M4)bwr33fzTLwj>T}xXf!-JO-0PXqJ*FJk<5oFz zPMuR!R;QN5S3ðw;c}oL1L^+kkJ!(8`cJG{Ux@A_!Ga5TKlJqDgng@i$vdNa z>y(T6SR=t{z2|+bdg?_x2_I{^JEK0~TTR30%`8m*r*R2aD%B-t zd6t6L1dV5jKPJ<5ZT%NV80L0jObd$kN87*8)=E$%TH)=w~$O$J;}8 za~_qOZ)7XvkzkF?@0Q}Tqg0xa)U(5ieaPmfCH+0~vR-&$g7mG5?ve_H2(u43EaS9yfp$IvUTRA+nk1X|pw zanCqgKb_%`VR4+3?S$Y1nno^wy)1b5u<}mW9ec}r^z_wGsni=>gVe0yPYGfwn2-NDc#n&uS+Im6L5E`J zCuT}aOV-iv2dur%IQ!9$>IlaN*txU&&6SJ+EyR56I@kj--|~#J_fNjCKSfVl6o15O zaL`DQD%NtsH>{)2E9KXL4l^Ya-j9;C)f%ZNH%}rBs~tM}C&VN(Jf7^s>J}m*Nqg{; znBD_ATIi;_i z7LV491jmMV$pVQ*CUEVAoi!vOV|Db?xXqcsQDgRx$)7jihd3{P`t$JMfOX{rj$Tr1 z^F;lVf3*H5WNjQrwm6Rdc)@yC_pun@4c@n$*y&*WR0f}_f3`!zBi0bfAFR}O?QFfg7*KBefUEUi!ruYgnd|c9kEt8Fd zELb&t6T4V?gO4g!y*23%$&0VR>S$r#h<@#{@tp9ZGG35PaU3j<z z)O~8T;w{kk_wbpY)6uV?@sLIYmIfE0M>z-c;#!Z6`Vjd(Ub<76JK2bmThW$Qt$Ni) z*G{uZF6_qC(_hLd)fVuc)sEiao$yxc==+$Ty+L(^hj&g#+xr}fY~tIe$0d`Fz6$%c z=GTN=k0Wj?D)3Fc2z(7m_%a8<=jsRF2l9pBo81q-JglbZ=)($pulL5_yYB+<-3Iu) z2MIZVgTWW0O{sf(T)#Nal?TR%>1bKh7$27v@o{%H!R^^)XxvwAyknL7%UtN3(dUISf8!e^j8?mb{X`36HK2j!kvEUk#WH_V3B zwQ?5M5lz+6cw3jo+hXy!%a`GMlu6J8>qGu62_MVF*AY(-!_FYZnLZVE6O942J*kuw{XD#dV-Q{4 z8=Q=Nb)>HRSup`MOFbaPLDhY+`b}~v*8XMO~F@d;M?Z|q|lg83YZLssgBtaXzSTDZ=yDdiA?mo&WL+=(`p%z@>nGw8Ce<^0R%19F=f)>hzjAEqVXBB>ymd z~d|Ez1Xi>gw-(} z{dHW6H29?M0|oe=XpKJY zSK7_fE>)i8_NKX+TzRfXkkVTCdL7#jT&(v0m3eXDIU}~^zAVqsCT`jsc<{Dz=6$08 z`|WYqZ$f?qA~M*~{~-*19y+LMCxbsTpt7(%6;?NUPYR{(aYb-*V*kldU!Ddxo^H?dj3A zT|~u?K@EHvdp9<_y+R7NUDru?aK3fx;I|W}tvz?={vm;3SFo?}Ju$`WVe{LJ`Mvhs z4f{Du#aYt?tejL3y2ABllIGuu?-(TX=dR(N+=a`ARwX}4n%@Qgp?(^nYg{g>!IhoXyEK+5uuqQ3{{p>I@|(c0 zG6v(qF2b4OwE)K4H0*G))2Cf5PlI-oXZt4n+qoNme#Ib2-DBFDg2?)*&2~f)mNg%f zCpK%Kcf>5GwdYR1mI7Ogjjbm1gFP)q%6_ogtV$jIm%>>J zeU`l}QaTS5_K(PKhgvby^0rufF`79DUhr1$^BA4aeG>yNiajIKM88I{OQ*Qw7;Cl! zuE*@r(QQ4$0-&sBBPj2k)12jbX^Pw8xzcS8=&&EaArtH~=XZ~Ds&+D(9Oq2;PeE+I#(yQ|PENb2%S(7V8&SH& zd$8ZOYby_4mM72yz1Ts9F}1pweba)#q;754#;)j;EQS#Mp#h z)$CCtBZ3_}^~XgLPrrM0+IF>PeTB}iX{rFf`V*v<;KBIIIc=AnW>*~6*BF#{W8d1+ zWch?Va`ZjyuWVk#?$aS1dJz9l0$Byv z=MRg|`eKaVKZUk6O553J`x9k{=L}}4E8MxjucNP^KgNR$o}VhKSA2tx-VeV92dT9< zREaoB9lZr_c=Ua4Xk*1FKfkL3ocEtHlg&Bp-ep)P^N%Y?38)H&2Sm?ONxPl#L+tpR zpl%{ty~}j;0NO1Dgl<5{6>#WlRfzRig1)b#J0Rh7fH|(qV7+eIqmP4j=Gj3zB*lKnLBZKnswNR%p~b0{!u&C#j4NPw^;?2fWmcFj6jAESM6~2 zcf~3Phdeg1JvAmD$)&fr`yOJ$C&T;w+MUtRd4>cqBM# zj56Iqhdrqr)kI^wT}Q9%xg;(DCilMMk+tQv_oX-KsHi-LKA}L7zVq;Dt4Gt7&F3|x)iVu@S0n&- zoKc>DH;V6oTc%@n32Y^%P#Z|wLB?W7G8KqW$lkFPM1zk#7{`aj1TU5m2fS7m0}ee_X>`cZk_Bq+37*7` z!>krFsOTn{jMMn{BqcJTZ@5a7RVf|4B9zv|_Ad!V)MQ@$z zzQpqrx6N~v`#xv`tYsbYbr9P;A8~7>!acUVm+WH{KU48ezu;%9AEOkRK5S3+-l5>% z^Ia_8Ms*Lv?b>sr_7{4xcj@S;@WzT-fA;o5$UhzIS+z72BZ(X!D^tQF<&b>A}?j2iu?t%UHp)`jj<`o{j`ymg* z4#Sepz4ElNV9sfc#eqI?mY>vbmSv(2V+pIyTI)@iA-+FsR>;u(9F__J8x&UxDA?$ZRQrCdp%sI&&8p z_pLvr5nlV+YhX=qRE-QTtSl+9`$l-g-1K^>I&}wEmbMd~%x0{wZ8?S=QL1gTsi@+& z%s$t%@E9z7Qm=6@g^Wk$9D`OF<)4H|myOHV()t6rZ^-dGM)6~~6GHJc|D@^%vXB1I zvoKpq$NoYcEed5cagK~Fl{p!1FTNE&8>`5cWpY-56|2-KyRCtuS1-9@9yEQ9J{u~m zBG_d)X1?Z(T{XKiJ^ktV8rf_aGoLHXwDB~Re|r8cEB@op*q*VkRLXA>=~LKae^5%< z4T@LhUQh6j$VsW_8&dq9zi@|GV6Hap6t|gyH?E#TQM{nr-?W+HDDF zkz>du=Dl>f`3^0a3>|qi4jqoSz{fAe5ybI390}gknADx8cfaw7b}weSL5+w4QHj7v z!&)jSj71jA@uoJWG@2SkIzrLOZ$ZWfk-pcbQD(_>?61(YuzNWTEjpFQ(eMaJ|4wOT?7PdTh+x2zA4sLR02{;-Td!KmscVtYeJeZZgCSYhv zfrcy6Kf~`s3W>rK?3it>y`V(;bT6|rp6oSwdV=f2Lz3B#25Pe+*8gF_p!DBQtGkMb zkc;^pQn}S#6O`+S%;Wk>x{N+=LzRM}7wlX<#sjPyODhIxxL$ve+uT-*MJ;$UST7OqI?G$n? zi}YQyphF*#YjJfG5%K0X^1I)rb7PS0i4;D4n%`k+DMxSb4I!^m{MsGT1$fYz!Izc4 zD*45JrT(?&R_-?jVr9zWPn`Qr9u;))qu(0yM9deKQv>;1Qn^xO)8G?Xr+z!sX8i*C z<%jSnreY^jid)|$5|RF@FEIisYy^tep0n?-fo(bgQ2kA5f#s(%)lY=J@ey>5bvUNg zpQq6mywkgL<|zBLg*A?RXTCG9UZk5MDGKF@$gzd-#XXBY8VT#jBC;LZ*%oBc#*!TJVyp9XcrvTl4}6T-X69dpXaeCEA5H+c#+QOHF`|2x+ft< z##KuS*!qWvc$JtwMd&Wq^>Iy^qi-s_l+Xs32gb-I{%} z(98vxSBLfd5@bffnxm~7a_^v|ktVg4F8!d*yR-Pa2;mDr z8XJjWfl?>41dPb3B@&ili+wu*-!7h5%2t8#t+{!PgOy+-*Aqkrm_k-U@Y_!t3$Hqj z{aA(b03(T(Vf@eSJU{MVVce}(k^;t)QU*jhZD>ttFg1wuiC&{Z0~**2M$o_$u$c+{ zvrF7liWn@6zalT~;4O>-#A%!_tKeXOjbm&S--zd`VQXD?S7{Z^=_GW;6s&+T>8{;w z>dMiNmqgDEfbivbZLhdYdztrd8lE*kJ3x*R`aG;#4!LWHg;`sqImJzKIjh=j@`QuG z=u6oh`|9TyeeGT~c)l9@4r9+Yy40}1Sn26u^=`C`XrZZkv->)!LP~XKxYMEQxy@;) zNkl#sR%WR`H7=>E{VdN42kKbTtM78D;b~~#-2ztQ>`pEqU>(bS&?k${g8Mw3d=EM) zWpv{IT(;wU);G!Xx$H2ntN6G7FQAdnzfI3ecrX6xx5C3aUg2SHKxZc7CZcp1_|1Pp zAIfDlT90bihwwW2V9&EvvZE(BKzUg&vcV{kTRp*Oh``$f8$V=HyEe= zN~F()nSRQ2pl?EU;58Ka$7xoVsn=NWJ?LV_4nqF@v-7m^YtV)!lPJ_^Le3>dTbI=v z8x4?8kM!sjs^|&3Bt59&5ha>rj_;?*dHRhU)0#_t43}BvpVbEg2&s^ATUiqy;I;ZWpD! zX9&mr;JV{xNxfC1-d=Unri$UmYXIAUUKQ4%k-HR<>v}01d>h&xDOr2&j{OE?^E7x? zJHo+t*vdc&BuAm4@y63v7v6CCu_i)(ien;Q zwxLyajCnX{j~r?p62G1T?rQdNg^2jX`Z)(WygbZmeHL;?g*hR_y`P+iSs5>e%39s> z6mvP{ITy~*|G*~$rymFW&*RvSgRN<;^NJKXI~DqV2C|dYZU{SCV|kV$N}eS)i>Aq( zvYy5CyeGUQce$kAf=C-s^;FE`N84Dwop(|zI?MTrPX9_$r1tYos_o;i8D>wLCW1?< z;}kh5Vv{tmWz~Cxy&`>B;Q`byG~xYDk$$P@byxev$?(k~E?n=FRqGVnQvb@|;n#z2DqYc)+hOsg`ndejo>J%-mO=hfk&c$L z@+q6WSfzvylm0EPO<2}3>BYRyb}Fr7^cQQzz7Bncb|6wdq*W+lJ?6F+l*Ypk!RQyO zmhdbs<T27B5NehuH>KpW<9PmZ6^}eh?5j0l)F^7s zY$6V)Iz*5%QrQt8|W^Q03EX+*huRgFL4qtBg@agr;@(i%Q2bMApIyBsR`T^WM zfV)rRGIuqenZhrh=EsWu<;hwF)?fY3(@T?2dP3~Uw$re|y_tJ5_Oe#f_sxS&a7&L$ z8qs=36@$l!b%)laBFzjRSeo5>dsXHRtg-}dt9k(MSnDT4=^jGI_6@~+xua(ua(Wf? zonZacFFvi>jhw0Cp)MV~&(-_OVF|qZjUDy>D}q%ooWF_i&|=xQOv_C5r0g~~#eH0p zs}LzCLUUnxRgn1*vA2TsY#Z|p8JkEE$_RSj!Re~cuFls4RQaB7c+V}87I`uSNwu4d z8|S|it>G)t7O?iCr*$C)^YT#38s^b4`8%AS!+V?YSJK59Y>-T_ui!mo<$iOT{Wa!) zE@|P9O>ZP*JP!8En$PNRgqVfNgF~z7?TXINa@dMA5MP@J2j7cKKl`1A&Gc9{FXl+Ap97jEl)i^fd_yvx&IM};oIQ{{<<69hOaXg0m6dYr5*m3mXFaehA_%RCS zzu{mxw;%UH+G3?lOLsD@+Q;nytX3`E2)lk{E6E=fm{pJyNQ-M5gubYFxzl_c{ENAY zE}^AA#kV)MvDnCP@Utkm8uOwQAhsx;C-&c*&w-_-d)PX=g0~^@4DYKPgbr7*GAxO`Z=l2MYU_`qukqx@ zHl31jQ%k%1Y=A};5y}zl!Az&8#@U%%tvfP z{E7GlLL+g>Z}2UJY$=BqM@#od$}k$`l8U+!(O|T|KD2Ogsr^`d3|QT-U<_7Ya2?-b z1%GuNlV5RZsV!PuX~lXo=VTac>l*{_hL$cJm16-CHUh4G{~>oH`b)6$QlOg4f$2RN`Sc826xsn}z@iKS`waD+0{aP-@!w#Bs_5JQYb5n@rz5mQFDau|L zO09N8X?Z!$X znQ{#>?N<&7abst9a%ttAnRRuJG-*9r%#Svo(UYSG%x8qmO04B^lRN#OtX!5?o#lfh z?XN$ZoZpDuc68??^9^Jn#>=S8aK^{`M|o+f98p^e5ZA?W!f++AoG>@a_S7X#>phI;zL@i`U;7*piMoS;-dk+>M%fslDc-S~4)^Kn*Vk!PB zdkuEqXzB0cG5EjoW>h)4*Gx`u+*Qb-XoY6=n?CI8%TEn(@t7hleJP@g(=TRH9+$rw zaRauf75WeleJBrlCirJh!_UEcaU^Jk;UN3UcwD4m2s{Cs6z`-)s!?!|liV$)r4L24 zu%Fqk`tjgh<1yklfO8^l9T9p1^ABk0-91O8L>oK3r889ppCV`c*jZ~Fng;xOz&TIm zr*igDM2`hNm2;qLo<1y%+8eJw8j!C zOBULP&8+Oy+m@|rl=;BSPH|=i6&b$jBrTe@ zdUI!T1tVu^8rC?_D|dlYyA7UkcLL&9>dw^ZVo?5k*(yh;Di3hy1J0w}b-0@bcnVTx z8n(^s)D)Vo0S=m{cWNY-Wz6)dv2kOECZ#f$Y)isaucdXp>HT0@33wP>d_R~rd+o?< znD4BYiMvp$m${?$z{}Tlz|_x?^~YP)Y0RI6b^%2*gF-!Bd_~hx*=Z=K1{AD)ZQ}-D zr~GWjbz}?g*3zH#=2uO$Dp=W4oU5fJkRQ2~76)$|ae@?Q`PH7$GiTUFA-f?gOFwDi zJgr^Pt4Dm1GczA^LEOnQCzdfSu~=bdGs^y`#zO;f7mqo-~L0$imz?rYCB+m+>gG)1VN4pV*V2@KEeIR zIG@1rU_TzX(@VCwkdu98rK9^Q7M*Q~?c`$-AI#^jfk*IOuN&BM16LdC-es7&)V}Iq z-SkeOfMKhl`wbN=r}52@+FI(B ziB03vR1vGIBb}_THJ7@PvzAG$ZTL+H7VEk4&V|))J(G}U_;r)6`5G?3em`Nnlgq<8 z;IOAzeR&y&48Ut#TppjBofB&K-bDN$f&nqroU78Y#(w=Ei)LN`J5tIu00(26sda zh#}AgNE5sJD4N|$3fQj|Fntleow%lRREo82!7rTHqNJeU&gND4-2vvqr}IMv3twDW zurPop0jC!61;i4l4Xh*uU)R4G2@oNBJYuP%o>5m zZN&^Bz?Hfy@|CQ|!$PF=nTl?Ir6WOy8=x2GNjJ!IQi-j=|8<>e@5kS!a%3xSCF8_) zl{FMBgV+1ow%TPvSFMWQ!|fHQR`KuXeXK`k`bgnorAOcNy>wUMVgc()&3AF0z+G%@ zMSw()(I*?b6JE#J>&pb@gAqwV|Cs8^b@lRWV!^Hs=&SI$k&=;E{dTS38kS(BCrCmA z^J@o|YH0(YVVcUf;bm>RWECL=%y*R8KGs7lwRdxt4XB5W?e)oM>l@-@tfBYy+Xum5 zdEa(1SZc@$1s3M-B_)^mhF31ZY8BT&8qPyf6Nlu5@Oy25-b_5@ZD#6P3s{;+?!vpl zjqo%E9lT{&&uLcRtGOtAqX8d>MEETKEa$Ag=Z@B=@A1om`$Wz)({;yn&Ogpib39dt zmCxMtK(&(_qdy7zGQ>&RO0l}m!7_dohO!W0t8?n>svsG-T<%GNd(%^dT=Qg7pHd4_ zty67dr5B_0&6PLDOKU?}1@3^w$*r=lDu-MN)Djz^KgIf%i?IB@*F>6?Co5dU@-d`I zpq6D;z5TOX=hJn6P}-Z_`CI&ImMXRO1hdg^_EjUoZe7K-$6>weu9pg(E9bvHe>&j$ z1KCnB>$7sI;@4MPb-bK%sw_yj@8`q&seb6T12_wsnb1k5b*iUL>*Vj^tSg7LGG1&Y zV=DdYDx{MWD<@U|%E@}oIn$l0Gw5O-JZ3>|bPUA6_{^!GbPggYe zGf|1ez}lQkJfl`+%WBK57*Un=IN4iq%V!n%1*m5#rX2^)G}&0`&XzStD=3d^O>G4g z^x3j10DT1GrJ2SRPU}p$Q-4OqU(bGFppfmge!9Yb@>d7>Ga{EJb2+4_1giqv7Q{p5 zaV^YWmnVgSExjFW_$?mTMw{=zc_HTs1s{aoZh(jA@#z`IEzZ74_+=^Q(-r$LX1ad( z)zH1sEDN8|J}sfsEC=)xr!}-2HmG`)0nTsO0G|$Q+5g~h;(9rb z-{45t1Dm`fk+-whU`vk^zd=S2`M}d>W#>}Fv@AR- zZ!p`IXlP2GihkI$Wa)3^lcE!{ZJ`D+UIN8^ZL0{)9Uk{6aeFR^x#@FhuOwI~f|8GG2GV(gB=yC<_QwrRtL=WKp z547>jgDaCzk5HiQ0Mr`#+bDzjUt&?bRo$Rgzm*w`U-t3RooFpB{#AG1z@B`feDz0s zH7^d+4XFE9eFvnuxaXbN9pz&=QjWo{gB^$+k3ut{CuHnZY}V}51lWBHYwQaa@x)f9 zhhhIeNzL*@2e+`j|J)AJKwY_ z?pdvw@N_zSEs*|Nf5*}ltxQ*$j+Kuo{uan`4W3!>jH79IRtg=Flt3%C)N~riP=D7_ zQk3aiQuhVms%k5!`o{sRqHf2p=Ezp?GsHyowA3NDb$dSLg!NKJUax|Dk(nnNe6j~xQ1b_}U>6hfrafn-mK?eYc@S{E1#@8- zj_r@*_f>KJ9Oq3q&f)k7Hq86ew4@tH?6(#yOX}JJPCKZlpbx*u5Tmx-zpoU08v5&A z%RtH9cXhJGFa-r%=L%hgaLa#C3CclYCIo!)8P!zVq> z^agbfa+JG~qx^9tZhD+^NkgjdQ;aon+NbM%FLd2VfY}q1&+c5$pxKOX{<2=vh2Nyg7u`c!*e+WQ@S#&8K-9RNN(}hx zAV&PP6FvSqiN;<2ce96cZmu{=f3l9FzkX9gAH^?X)K@kr9FNeyv}=(6l#{krZdIOW z=#U6kh&XRAi_@9@ciwTxx$eFUa4p2a(Uf*Xkl5KT@R8yvK8vz*w++_%MDo?rKQ3eO zmihi|75_PL$obq-*D?*=54!CDb^}YFTBe^*#$>l&I)>1IOLRc}!0&S!oU0va&f%EH z$KeylymLKR)eQaxejU*UwpDxxt9iH-tLrJ$^^X6yfkRH$QjKlA-=OTl&51#Tb)i>X z7DbC@&o%V<$X82Ul6$%i-&LRn_RNVI2z}1=)l&C#<7W(Nw$h;W89cG~$f1V!TU@Mn zC(*JCdUNT2wX+KC2)5D6a}8a7fp#V;^(<4`F(lj3B-_cy``di1mCuw`w4l6!y^(-h z-j%c3}wPH&bry4)j{Fw&!EGKagA~N-#RkrFUc>-!|F>pH&@T?<3c1v+PLpInTv2dujNztA^cT*1wVnX|4aGb z@$d70;J@O(<~#U8)e4nM^>fu$RfEc-+K-UEUe)hKPG}WE!UXkX^-}c%>fehWtG`e) zir{SJ)a^RtJPO+9=rf2KBF@UzLryoW3R@dHLwm=Y$6RkYnQh8qg;-p|+}CRFQZV(7xc$qi;J`EMB>s6cPIElZTwV`8OYWw5I}Si5F^$$L7*WBMOzgFZAPp=B0{jWezo6PXVkV>)DCW- zba@Cell}KO_q~}UPulO&?;m&Oo%im(ob8@_?h6M3_W{ed<1CXVI-%oK;4rJWGBJyZ zPX#KOAl9Q4!s!KmK&L-$1 zm~{RmwZwq-O{4mQKN#c1zJABu58|$RtXcm9jNP@Bu{?xikeXoZF-q)gX~ZMTBm;7K zjps!DACC6FSw{W++P0_`k`IW(z<$||mVm%Sa3CiF8qnNq>FSOz^9o_}+~>auJOFwv z{dGH&w(mF#x>*PsKPS+RG5Le`St}D~Z`mdK)nWQ&Xu7{Tk4&^Nv;{M9 z*lWwAu!xA(S)T=Sb`8mS(~z9|w++pC_;qs5Ja&-h>_0iIm1W>ASS1Ilk4vi9aTIlV zb2Zg$FqYV}O~w)~DH~7!Gb~})PFO-Kw;FTyq$`LmvZY_Tw#SQ>fPV%w9fb3j1nR8M zb~C|hWS7pctb_<4e6llzb`WcF$GX!#Sky-x{Z#Hxxz3|^)UQr6yXvyP#@#HK2@AG4 zI7h~~T~D_3#luYc;?y!JJmSZnE|Vf6e)wr{#r^r=;EMah!?fbk6kJPd@OSuzJ3#uV zq~MzW8f%_&Wy<<^wE-A4CbTM&;bpFJd#(Z0lCaAEgS}0*^epnpuGo%~drzSrPn{ZE z^AitWzqdbW2=?})c>169_Ofl%+l%>37{JR6v(6yB2&py6nxs&^W$?=YTqbQhMK+&{ zgvSGmuqN4hy~KJC1Qy{A-E6658ybf1IZ~#y`dH zu!z6lcX-4{=c#{(<7)=*RnupzW91gcZjFY0!*IsvZrG+7VXR;yW2X@)wjQxZqNhCY zY(#R+cz9W%^NPlKI914V(M$dPvehJ$Y}@jI(bfi{4*n4`e9&4nTPoUyo<|OPk@8^D z*W242kFIY7p88@t&NUqd0aD{HyU$f6)Y8TFFfZ6vcb(0o+l2JNh`NaX^FYY zriXiBBR7#ri_uF>fhD|T%QoOIam=xEd9F#GwWAJ`t^X!7*#ez_R(tBS=#QeNjrs`Q z?!2Qg-c0(qftiX{-<&bRBh0AJ?R@`(Pcw0*_P%Kmo;A~qo_(JV!|C$4XC6;R^Hv->7NBxWNfH^qcC5u1+u8`u$DRlRJvwR zpJ!dC&jSG;@8=AqpT9;+pIsQek2yD+wG!DY!gpaH4>oCe*mu&y7P0}fQ4ih00lcLW z-rcqnmI_ljhR|YU-rg1oYDk>K8#K2Z`R%xavX3Z9ghjA;Xv9t4A9yjxm~?!b%$5Bz zuydj4jK*0*EyhhQ)5=C1p_1j zM8Qm6T1!M}2IIoB=mK6Lf`;r>tcke3DAOE;6_F}-w&%apSZ zP53OT#ehB}O4*Dxf2m!U~EzHdG5|Bh`6_?y9RzKr`{Nj8gxln9*>DEZ9|M7x)C-SFuN z=%V#J{>t7%SPN4cDD7={UW?O&0U($s zkH>dWZoBIFg}y~EP3`IPp9ar;;_~R|`U;%uDl~SOum>DmQxT4@5}UE6zOIjMb-gsg zv3zxgc^BVZpf%o6-*KK==Is%nB{*@}fR_ET{+H*8W(t-%YaMS@pMPgZR4VS}>A;=j zT{6ypy8daz`X$l<|JS#khc%;UEVLH>9*ZU~f)4jNx13P6|g_XEdT`#@T)5uHP z1x==2`j4LNxl>W524!xk--6uUgd}^P^**I1*Y*S@+1ZC$&KuB+nlw{~ZeMtUuGwIo z^!X}_2f6&P518D<(w2CNR!`5!Q}8%5&G((a&Iyy2)-OH3Js#BOt4QHcZj8r>G@k@c zJ5Z});+QRcSBsJ?S-@`^=~JwL8O6jW%&MPtex#(04)abwPuzHB{YX$MCZ*$F7p?Q0 zcHCG-6u|`82>7I9T$yG{wlub$tVFY=woj>8-4{@ zQ!hpLwu9CY7OMx{eXD{nCgJ=)x!N7pO>eoq6hCdAXJpH5zLN&V9!FS)b@+G%)+*Lw z8lJWIf1sSPALE@7|13Ff_vqb}a&!}|jnPMz2a?6#f{!Gsqmh=wMw@8PLeQLrLN;o# z0(#tqF(!8t=nPH|APv3E42*0MW(!k=v!oNjUcUD+ALU1sdNHTe+g&u5?VP?pc=f&) z!Bv*|{l%F1i9DBTALb9_?#HcYO7OG>1W}U_hwmE0Z&$|#!m}Q|kM;m( zxL*xuvL-|nUx`lr5qRF6$6*Zxn`8%Mw=<;^c&_Q76dDI|W=(R=LUZnE$oiD?IG*!_ zj4|HmR^+W6;fPtieD!;v9fF*O7x`1kaxVB^8Tu`=L_nSm{wr<rg6H-QdpP&OYwj0V>M-=tRP<4cn10|mM-uBgn z6VALeA#K!I&MkoFd#x)RaW8|eOtoh6xT%1@>LR@L_b!sP4@1@-&FSBP!2OW1VJj)1 z4lz^*aB(pQpbvR0U;wPgf0!7B^lu}-;NGBKS{JHU?l(2_Nlz_%S8>8Kil$?oqG8ud z(*l{0yVtJ+ox%T3{NIcJefWQ<40?5h|HQm*N)BUt)-(3Lld&)GpN=^4Uf}M4mHFDm z(i82&`EA|3{(9K3YL1yS#VeIWPpFBW3I1gB08pgkK=@8DkAwzgKwBF7&Sw^#oeg&gmo&y$XuzOd$p6uO`k5^OO?Dn^!eH?K?~wN35CdhX$r&(cVT&0qWU_y3e;-lzG#NdTNzXApAGMI}#o^ zv%DV!wlm%3Mx*Xpqe1gT20UCnelZ80fub5>xLZEO8@Fd}#Kcb|hL}%uRWp&d6rqZ8xMw$S3Isya@rlsKe}x#90%K zVLF|t!h7(*lkRU{;f~KX(k@c^qaGpi5pN50jnje0uwL+lGcOnJz_>I!82c9U%8X~4 zcfm1gZp;1Vl{kLZlHW~Dr(kBinL}vSHzLX=TSn6PC5d6r)*$ua0kHP zFSw#!BwUs?KKupTKsFw>nvp_NL`%A*s4hQ{!E{nRkKgPHSGf5{T_lkd)=fyWdskT! zO*-7K9Nu!bB{3-<+Gw40H;-TD(zTd2|LUb?a52T3+0}<~M?^f4Yx6#{SsUfHoO|g& z?!Df=bX|u=IwQE!wVv~v+3@<@<*@rRZJ|_)y|yis%6)0Xbc^@tEke}WFYV0D@t)s8 z@ot5ko9O|HH^*yxAQ*3^_vr`Zc$wbw4^X^xZ&-_IE5%Fp+O`JcP4GUwRgO2-dwwg$ z8|}^TkzOBXPthI++CwL<%NDE7mRmvzQGaKjH>-Si9G zDcBeOLSzg1BX5}B4<9cq1*|Ft`+Wur@KcIyb8x;r(zerLctXg)Nw#mcKpP!#Nuw9`JaZ{R2ToycvMC8(Ko9iF z(m{a-r&%J8&L4SpKXToY7VUlJQlw^;Wvi*z{}|^|A9vw|s|asgq6S_a3_h}y1=R!$ zZHajJQiPtLO}IgS@WtE(9~z!?!4^CNZPmditET18mJQ>I#$q?M#n^%KC=ptma}jx& z`dx=EMd}#lWfC+B4=K`0mgj6BN}O$ZI@biMVT{pZbY}G99W(4pPDnEg=2VNJnfVO6 zgagmd-~E0B&a@rMjr`DXU^()ERg{#_p8^|W19700xA_7XA)UvxFdtqOb<)-T+r`Bn`IpBa7!t$Y@2P-U(x}42rNHs!r8dI`_YyxoUPJHfA6at zOJ(S!uW$yyfR!{{$=#^r{u@|I=zU=dbQ*UJhK2Tj?^?syUW9uPeuMBFLU7ERV7o4) zPdFEGNiZ;Ykcss<65Db$XN9^g=^9U4ZutALzL^O$BENzzAE(@A3t3k#%uGnen|5w5 z_9a=lhh_q4k;6Rtg&1)yc2arEH}=EF&g{Qk=(7V~nX&`AaW1T*H(n#!H`=0c+>scT zp)C|XOd=|FNi)i5u@&m1C;JZ-rdhtg(@*+E+n{+m=iJjztZR_x;(LN}dF{pEgJrF38rvimk5b7U;FU*$cQSFo%&X zST=a(ck>dCy=&csJKcrLx(NBUkR0GUCe^#{3FsnO+EuSkI@22uTf6Z+Z(`hm4|{(D zk0Kuj3eS8TDDiDFd%-`FZP-0uhZ|Bn?Mo+N4#ZuGFyvhxrdu-~xYf|uA*9yOlMYYG z#*W$8uSm3DWU`Di!qPtZ@MWIw4ZS(neigFZztM5K@0hjzBFm>TC->^4$9v+BVpL`f z$BiWq_2gXJeIrAQf*2^x8{d+3TqkWF6sxo+ejn_#fSF<~WNjViiE19ROOV7)A#E~j zDx%mbq{snZu9N=QN2ew)b&tU+CGR`NrdhsWSZz}*!&@27r3pNx$w3Z!$KMog(r61e3qlG0)@749zE;O43PhSj+R^rE5%69KOe6+;?}!?bcZ$VfpVWT!Z~Bjr35bjF+Z+ z5{^+`_x5S|X$P{G9+irjeF(kAM})JAt$|Cf(k73a9>lWzpbNbV1i+ z-)LZaJMzgNx+%>~NQ1M|Jk6}`gk$4@$0*gWa2sgCvDLm&t@pS`*5zAtCJoMTCL9}v z^Ks8&tvrX2aO~u_u7`B*k8TD2#P{dG*}6&(yMJbhc@kc>jMTn@o}ZVRc}W^xl7W}h z*G1oKJ*)W{$=DX`gz51+oSj!Yk z#J+(s*6fCUA~2>UCsC80h8PXqQAqJnH_0i9INhg_oSl7NvQ-NLuO#9=k<>8O4BTW) z4`ZzeyVJthW5wW+@gKxjjo35L9d0E{Vd>$3{>kq-yBu^5V!M0h5;hIGt3_MQ2?VLieogw+T)Al#0SkFXFS7GX2O zXawq?CETvNaXoQh*hePIzo^^^xKk-ZL*B;1Pmx?2{+EjyDSX7M<0fa_YFYOER}0p@ zTCuU7S>YXx@D#;>E-h+3dkWqO)BkY-((qc> zfYn!WVWNi;IG+Fyt8_E)Oh`CA*q@CDFDhhFtS}xc0q*Ga$W#Qg$_ z#q{O-8PgSncz|J#Voi;1+g0Mb zA>?i2W996;2n&84&WjKR6-*ge>8}KIhnIufdcN-zP8-29rAfwGaWxe9M4LLZ?$q6PKWNJ3{*d$vV;;E%v_ zH^T3rt^dz~{Fo`0-;R0wB2GKPBJ3XY(mlQL?g(D>X^wbBh!1mb?;uqu5<`oDDqh!3>&_*X9h25R*5eto$BX(GSq2@dK zUMz#R3+XMKw-*kx-RYQx*ZhBgKHJymkMy>Qs z5%jbabjEQ=Crt>zFOc+MZ#32#S#f>G*TESq{*{&9m|BC+jU}H+qXL_ zhQFT%=^)bUa1a#cJ?ywW?a7X>9PV#j6=&cr_GMl}_z^WyEyI0o)KTESViVOJ!H5v4 zlPWup3}xEC+yn;oP6OjenSS1!o*X}WXcAw9)+;I5m#i7h?;bG@-m%Kl8}LbU4Rd`S_kTlvCL3##F~-F8X*y)z!qO?N zw6ibG3=8s_i;gt23v2hHBjDb=(0!?C`eyUUU9d6GjM_B<7EG%fYV(AwP4G|uH|(Mi zMY*G4M63RCzMzADNBDtE8nG{TCEc`=%?_iVCv@m9$G{ulsHOvW0|`ru`#;)z?H>mo zXd}zuF`go8abBGn8t?HLj@I0;_f}bcWobcw*gEGyyDz$(4&x0hUGm~yM4qeeiB;B7 z=w}`FTOWod^-k-^eWS2`by7^A@%SCex0~@T%$pzjrU}47muCWO9Y(dK9bdFi#5q?Q zP4Xpok-UPKw9?;uv`skcjyr|4==Tv`wBZnWwv6xS@r%8N%TatL8c+|)a%qf;GC`Hx{Km z2OkY9vCc&$yb2?!j}e|)4O@L1V+`R^A$&35|0O6gC*qqcA&eE`-R}|SG(tPV5rkXt z&J!I5W{9!B-V2)tgm)26BXn3N?gP&zHTTc7&=|9{$=GigZ4ujFMJ+})MTn!Ch940j zD`+G)B-y#=s88V$2fzA{ATy+CK8iaJABVR=~3JmA5HnXdWo>m{pJ;uq;Ws-4e&t@LU? zt&JjO{%fU%K8L$d`F0H7BE9#8zSZ=J?f0U!@>t!SM;K0bU?T9@iA#H?8~4U{WPj6t zgCnuWf2B(YyqbZ!7WL@@deY(WEBQTOEZC1$Wa1z=fqP z@Fuma#ynkRF`t8XWPBG=jCHiOro*OgI-d;=fo8n+@1xB8QpXLS{DXoOLZfvp_p#)LC5f!#;e*nu}93&v4wNl@j`X zw$ONRvpEhLpr`XjkB4uKlanka$cq(N0~;)i9moF+tPc_Y-^aflAs3+#Ap;=+Vej3H z?LhdgnXv^}Z<8$3)4u1;a6FM4{$Z9S5&imQ-y}RWZdbWg$n<+teYr1HTWgfIz1*ARE4R+Hlq>MD-UMGIFYzak^Bofo56L^}Fx#^nT+p}v6^ceN+?%@)dOOYu-KBV2*L#w{3wQrE&>78=@hIvd#o!ymb4X$R` z`ktiuGoq{ELb^2x_tw;z3p=AD;9Uc{E}>FH{;BY;G6Od`YhjOKLZ6aGE6Y96nsg+? zGIBqS>bE_y`=_`Q`5S`&248=%d;0yICs_yU>F=*w1^+piGk*NPga11*k8VdeI~qD> z%(ZreI}i>b6eF1NZ5qOdczzw>0MaDlKY;YQF!&t_4`ci9!C5&3+OuM?)6z;`!&{nO zt{-Sr40fjkXcn6wBTYqoIzLI2>`&mX$Rf;jO7`J?%+~1R$S8AzCqS#t#Vo&P$NsE~XAA8aw=yC6K&v4LrtcSr> zGwBfjJsHsX?h5DG%smS2tb#xv}!%kFTq{oQ%{kU@k^ijq_dVaJs zhCff>=Uz1(6BQXwi#r>B7>9E@2s;q2jSOS&qmTasp=1Q!pO&NHfb&ax)=4(y^+xKvXR+`)m9!xY9`A~xto6V+$|MNpOs!eXE z&qmzEA)J8=_ZqF?%3A$nH}%)OoeZPZc4`;OEb2f0DcX4+D>V$=}zk57rNU{6(ikp1o?as$!xe&wJY4prh*rCn2L0Ti5)ud zLt5$00C@m7b+IX1E1h`t4ahC;Av}v9r(KCN-xTlp061AM?OHTtgEqG}ouYc_al(`G zexfT1|2hXw%B*8k!#tw%aBe3~b5P1XbcQ~e=B8G91ae~==A;Ap*CAvhP(FqwI-Fuk z!zn?%M{X5-{lRZ5#r=6~7>sXeGbPuC{L!oL9R5={)yw}98^ zll%U&F0JxqL;zkfc-;l`g@pF)MA@wfUwt2Ts958(@l0}^4)?xkrQuykPOJqJOBEzb z;LOR1Rue{tdV#}y%>QNbz30ZI$VK=0lpC{nLH+Fr4MoLWpfOC7GaIN zgzzkaJQjtR)A1eM{__4qPMnx=Dk5xPve7K0_54VuJfph( z`5jY{Ur?Ui-u47`SF}&8LLcC+2Y&u14_7FSuC7Er9m6g%CK*r$TzT$YVo_|0&5&c`!r!b)n<>=X72*iV8b zr8ig>r7l&_XYn#`qD&<4fIPmy*LX!cDfUH zc0eOK1AAID>t4b6_5>evOUnWs>CGj7fOHo*&Q)k5wLHg3Esqn) zHURpqklvyM^d$>4=U4cry1(x1_y4Seb;zw?Cum%TTSh^{M&2@r?!FqxLjQXLjbax1 znBKe&eG(*5E8QNamDZtN(y4mnC+GIbkh~xR;ASG0Io3n7;7R0_j=WlUUQv8>!yOu_ z4c@XMJc1*w?c`RESMmPk>wJ3#-wxt^3&KCoJEFsd z?;Ea@z5wZq@P5^GzHP)e3*OH~puS>~+}{TDH(`Kb7+31)7BLMy9Tw^x6L>pX@xuZ% znndlTQzgQ8+w~#x|8#g5`v^hZ=KsXE-{Solgy7n1X^XO)MJeC%_ zdXn~8%1wc3iE-^@-}hR5H0+7D)ssDO44cjtvI6!vtA|4E75sYGC-`N;XrW%Xg>pK= zBqMx1lB|U@1oh;-afb8m`8e@ZzY3J0Me#i=M!!LfZ~uHYHwOLGtx)tGDac!&p!-D;*@eFswX zWe@3MG_bSi_gBDsf4?7hWkGlT1#D=d>5hv-&t1;dkRNWk?}#13=^?5Sd>v%N%jr#l z+(bRfn^`}6e{`$c`6Hx?L8@$C_jh`Nb^p-icDCSKB)&~Wjw>_~$T3aH@rB-z&?n&p zp6jN-ibNyw8(tr=KeF|*a}Cl&Ax##~@0n13Zr5dJCBB8>TO#r+(io6myprF;p&I@k zITj@zutuiWnX{#@UCgl~H(Tm)?YA2Che3061M)B;50U3z8_K`l^%x%?iv5A>Q9RE< zOf6zYp|mQE2BjI5(w2rw`w2>`N_^BhoR@Y|Debqe9ahbLElMMAh5i0fy*D8*9rB9d zrQWQRYVmFimHCXT7SD40`+Fz)3PPh9=^5j@F&AE)R)W{OgR#FyfY(GA7~wkyjqpdX zG`{S)5BmYMDzJ+V_@S$tUySk5S~}hxm73*a(*(~3(4l@m{LA28D4J;+=|?;Uz3uPH#+<(q{AstpzI)`s zEK9sXFEV)kn|RE>Ubum`@dj%+PhZ~mn+tRgNSZH==lI5jNj!EDkA0uzl?%z%X!N4S zH^~}_|5>m|UDlM8psGX&vcS>g{p(ZtmNMRCVSVc)qRgrxzwD1aJWF+wot7|N9XlFmA2*Uyc7C;lCCC?_xaPMj%{DvXveb zpLRX4r`-qcr|^bC+BaaLyni(ygLxonu~b7L(f>Hlsz7S~68B-pRM5b6xH+lY|9V#n z_5!~33O9yL`v%BYpnbHEJtpAZRT7g3veDS}i-d;Jf0#kVuqxDi(fPde~K$~ru#-xT!IjR^N4 zThkVz07_l#wzRKQzN`v;vGH`%d+4l9y-Vwp*X(5YYQ5^;4!&oe z_h;BE!>w7nje9iG@!s#}SrWrVeN)(OcnjEzbG?`wtNK=8G)%a=Z%=OY`@foJG*^$s zDOhH{%naLdK`+@HvWCPChG;q4ZnZ`p)#3It_C)w3VVB`~jCQl}2Weu_i*e@y-!I7W+OdPXB9IZ2j<}}6+(1UQ2K$%9oz4K4(H zI_33rhWkp>TSi-1dL1}+!ICI;`)@^`Bx0ZSZ=D~wjhS;gmR)t#!shs*3HydvcPa3} z8K67eyZ!G$CN%ntqGKy8pUdLg8;4wqBY$TB8&WH%aJw0Fu7sJsU7yU^M+3(tcWZ5B+7Y&^kH zi-kgq2DaP4<6A2%gv~u)=^uT4{;lt0E}wbBe186%_u65Z@Wc7Z-lr~WqF%!(m@)6M zDTy7MF*ewL6w*E6myN>M!Vd$wm{|VH(qlZaQkdpfmt!=>4r5Y;Pry9`Np3lY(WLdo znTGp}NwH>>HEFE5IoI(1Hb(;fHSg8iFl&5CCL_oG!1`M%7Z4ub2Dy^zuQ@Wxg8CoT z@Eg5<-md|#s`Ch~!uM9d6AA8l5p}-tZt{?m4t+?lh2$AJ=y!T(K3blSt6xr|*@sk0 zugGa=3>(@=T135?(SPVUZ9v1vF^Ip>YnkLJm83n|e+ly>NMXkKj_1$Z!JPF;|K7%XA<({BPAN}5$fbP%= z%d^gQ2i@MIfqgs8#3)b1B?D|Fjae)pjKeuEV;Ai_P8)u9UZKyCJu1DiJzna0Gle}rQow_d(y*mlJzVjh3_R|}A z&dTxGZmmgpf=wd3SeiKle*WShIcH&4GzwVb9qjs(mS`s0^>%-ZTc+Q1@=+so@Naa# z6}=@2-|zo_%9^AZ*Z@0rExvXd8B^gj_hF~d$kJhv(U|3;IONyp zZ#+&uPOVb^pzi}X)kvok;F}fJ!HQNiwC;yJj54qyM3yN6OE|zKnmp5-eQxrY20rBw z*)eORgl_!D7;pvv_iJ{ie$9;ZUUwuHmJ=H3Gth@M?whSQD;z;_C-do2vn+argVf=E z9ac!b)-}?%U79AIb|2<2&Yx`Kmed-YM`0#dUtmpY_nF|^L1@i2-(yY!wWCyBC?U>G zyycC)KYXQ|q-z7cergYzhOjzP_s2IoX$+Nh=-{9WWFqb4q%;Q!Z!?;6;2 zOw!=&*jqf$Xyh5?%W%R1WFO@QKf};(;+*-kFi$wXh3Cx#KE!+r?7hHJcVGDC8v}b~ zF=M|&*okl#!fFH@T@Ugx`eBwCz@>CoUkm)FkO1Dc|mK+#ak198*9zM+X&w&%soBNdvu@G9mVBx%C!-gwcme3FN1DD z#@;uhUC{`4Ah-}(5q^*GEds3@* zck`7h-R(S`fv3Agl`dycx=vNPNjzN`Pd8DO4*I-Mc`-O*9>h(LwBaUDi)OFhl3FN8 zPxr}oV`Fho&u*-kAU9+PEKIHRLC?AyzQPXm`#-?Afft^m-#hH`s7T#j?OyVc-tRBu znvqpr{XQ)}v7T?y9TlXtm^TMuJ21=g=9R~0R$Te%Ecb9ogwnbGxNln@%JEKK3X2Nd zN+Cp_J9o2ha-J6VZNY~QcyKm#EGQ}bs=0Ir;s3R#!D6x+j?Bb(=^bg{*jC`wUAcQa zpCy8Hyq`v@uqPg#hbjM~{UdyagXG;EKGLM0_og|>?>B6|I<@;KW;Oia6Ghh*!oCjt zp*5B6z5|8F{ps)}8qy1ruja|al=bxA4eVn)QMwARna~+ zHO51`1ynZ0u7}$h)(Y^17i?|gjV6TpN;YiPd9o02!G29cjfKcWVY^Fu*a7dLFkwP3!h4UlPuRScl7yZo!;RamOjo4 zYxksgcNHL?tNuOMD`VL6u5^jV$V+lOX6=XkOu-s&pWo4)ZR|?R{-(^uQtrns8>@X$ zJXStpy~$(cc@tX}9?=0l&EXvH@RoOvzN9Mv+Kzy0YE3xB&GZ%?($x3e2OKRz;_ziq->dwYD#Sj1&g zo$H|^X8wLV-m}aK*qP4bv#{Ua-4zGCh&$5y{?YR4C1~tni52V@>69Ri>=BPf|7XIy zEKmJH@YU6uafkA|&v*H2;enR=$IahJbDiP2i$=l`Iq z&;KMWA{fq%H`E^pG_iu#clXI>61Kq~LZ5$JPyP9ILrO67^vBW5zeMV-NWIccDTC?m zq zUr-|(S1%sMoVE4%Pxj4g8TReNKj`=0)kS*HH(k%6jhd!Yn9;=*_5!|4)Z3y2iWNb~wD4yrA%M&!L zIpRq8(SCmccEuu}U{h}Qo(fFJifCOsZ`r0LM5)`CEnq#j z1pkGUyn>@C@OikI*EOPdcAlX{*Q&*xO(PQYE!%Ra1^qpAMhv&Yozq>;7I0spLzk4( zlyg{+8c^nM+84Iu?5oe!ei)T9!k3g1<0HP6tjr)a=)*nPmN~NtUzr>Wk1lK#q)Mc* zSYCyk|7*;HpTZ_?Ip#zcf(7{dZ*ZqF7a6uQw3pw2Efz%V335Yqunx^6({4m{e5JOrJ+Evq9ijUtLFiuUg+za~$+!EiM z1AX2C=oNIw!(f4U(XDMU!j=tjen@sJxYvc-t>{|>_{?p9>=X;U{mbq+aCGzFiGc0a z!S3>7)DQEc`&>ZBA}>ebY}K!oea*%NOTT%mWKgZS%_;8hRQLfw`hF+tI1PTc?t+2s z``o~?pd$&=!iV7>c(`R7*6M0cC2T0id4ye%{aiR>a>&eEsRPY7VbtFU98%~sywt+F z<_^mniex}EuW-Q}>kJ3sDr>hNKLR+LWfnr)mO=f5UVRTUhUUw??&%Ae2wR+@&CuS`%4g7D_WLvYr>Nq3+>;5X zIKmxF>gg9lt%HpRO8OXfLSY`9m*keHF@@lGv(mvA6&8(C<)gKXbdOoM8Q3iDJ74aF z)%#}i2%OS8R5Z9YU-kugJd!_2hTb-hv6)v4tPkt*4-mN`@SO35fxU^jmXCGUhX3#5 zAIEjLE-VUrXNB-Ru@?2jJvr-yEU}0*S)|X20Z$5VC;ZDHd^yCw49K^S^0Nq0mdSyH zsIVr}X0pu|*H3a3tv|mm^&z6n$%@686+7L1uy3Q@UgvrGJMF7>A4J;@F2vk)0e8da zHTCtzKE>A5yHAy((M@zq?(^J1eXjSK)@LK-X4E;|^SCON)^dyc(Y&1;lg2_{5*6{4 z?~(7sVN;?#+w!*YSX3V-3e8lTEYwEFQ^~$Hf;~^tVzzY36?TM5uI-fToGrcV3Tt`p za)N-q?Zb+SAPWDyOZy_;!GM?E+!RPiEKUcV$L{M!7v0jWxqaF9F;|Wln!;N8{CD=@ z6fbuFwz}Z;)%$?2Bpq}<9rrBZ?6=|hKL0bMk4P_u$Jajpl)z$N@clmMRp)!}@vTW; zgt+=6&t0CW(H&)b`~0qcjm3byN{jcVz|5)o{cAID%kRE;jLr8T_Xg8%;&Pugv|b7w zz5ZMJ6GPvf$bYo=7Qln^UZLb2&-2!0Eb;1E_4_F8mi{olJPw+Pdu*DL%r| z@W&b;kAD;Rxs*5`;qwtb+VhI`Wm?BVLL25w0rd5S6uzhOCH|2L=Tz#A@3f@nJ!swv-13-(@JA!)(da&NKo=!qk0UA( z`#h38fTyVCXlFL&^B8`&3bp!sfJSi$xKNr2XoM#o_ozfg5l@%V>1vNd4@LM^BDbu< zaQ;tz8gxFgRl?gup-`^X8?gNoLNaRNUk$7WZF?T=I0M=2HuMSo--CaW*=FItazJL& zH{eW;3-bIfi`B6lXX?LzRqo%QWf3F>EdtC3cISZ4yy71Q-rn3k1Gnqad7LZ$kz6Vt zj`KKI{C@1pb^5Qtl9m$ffTG)h|E$fm&3inTwssLYu;Xed=EVd$*X<6{t-PRr>=Tm2TkC}q=lGKxbqtn zdYPAHj`CRZ($;5g4(>g`eic4aH}ufC9Gw603-I;YuLsq}$;h5tFi*5ix|X(Y zyC0hNz8+)y0(Qz5dgy5;#;W6Oc^7vd_WEMYrsO%fMqmnO!e`uZ#o;DME)CetD-!_D!2zxND;PKhp%J^pT`!60t z?c#7F9Q?RHfj)sQiAg*A;WNQ9Dj-Bo2mYB&+DFONKROSmh%RezHkx|oBWSNafgDb) zLI3tg=Vjpuldq@7W zIrkp#wcwm9;Jqf#xp|#K=iGPat8vJD%^8$7MU__8pGR3ltV)&|gIlbrC4cX0JSpOI zZjz_huj`ei-6TjBOzMPPI_6aqofM_f)WgrRrG2DwKJSV@lKZ_H!&lxv0@)bZzjsA) zdrt=ce{rdLU%1t@p2qI;UQH^ryg^NS>ctDIFjip*2N7;Zp!FozFV5n!Kn%gnI=#Rn zI?G427Y%<395d~qoq=!sXJ8L$X&)ZK0dI1T)zEWco;?qpZKwZ87d%>U-5~B&Rh9mC z%%576ITnHTaN@yB_2GO}l!+)2c1|p=Qv>f84|%VwdwmmR9rGd~`Q{}%EQZ}%%wf%A z9mZYZdm=5(*w1Um%{4!)`+eQWfbJKwtXR}v81TnlimgIm26Ej^V{n(>GrxwOXwE1Bz_Cq!0mMt zm+;%`4$uu*xV_GfTi9yp7Pg1^?R89w#BB=D@=Jc;#?edCEHMghG~nj7m?hY;<+s-j zUlP1|?Qh<&eJtgKgZ4^>VV~p+^ci?*VdQA$`apFD+nlU{yX;>2vmr!BVe4jn411@t zv=Wa|wBj`56c4@8fYPy6pLPa zlCK6G@}e6{XX5QN;ProaiJR4U58ubqzVgD~E$!NfatW-X^{gQ@CJk-E6FSs>l6BXh zk{;l9xX<=Xq?4mY8ZU!myfxiHPw=BBl7!W?;Dj3#68A&3xN&B()8!WS-%T<#dJZ;s ziiI%jY|vtjCx-894h!XRLdk<939pxr6>w~@7tqJ3V=}@7girnysxS87U6vTyUzMtW zZN%Zs6qCeo-!oPP{6osnt>E2Lj}uj-UYH0g=?u%*ykA$4|C^QtS&kK!F#`};jgC;KdxiEd;x8;sCVkpX8H-_e;L%nF@VLRFC6%b_yHAMse(&X@G2F&SOsUR;MpoTO$8^a;20IG zQ^9bZGGxB~RR#N0@CPdREfxHl3T{)uKUcvmD)@&g*rkGNRIoz@uU5hND%h-o=cwSR zDp*v(qg1eQ2)y`O&jW+|bMZAv1%IxB&#K_xso*mz_+=G*SOq_+f}2$Eb`@Nwf=g9! zp$cB9f~_iet_sdl!O1E(UIj;~V5WkvmJaRTiz@gd73@*LZ>ZoCD)^WRKBR(otKdcz z{D2CsRKX=Gc$ErXtb(&u@N5;Frh*eyaEuDpso=osq5b(+73@>NAE@BBRPbvmxJ?EB zTm`qN;2)}BmkO>?!44I?S_S8;V6zIIqk^ZZU{M8+Qo%+Q+_QLSe@ZI&a}|761^-S3 zpHaattKh>b_(>Jqq=L7r;5rpts)7qu@JbbIRl##raFz;AR>AQqI7$UG6?}E>(Eh!s zfey0v z0Fj@n?d3Jja(gMu3BD5Tbv5?#YG*~c82VUZFREQzP*zc5XL+G`{H3_2)V8*o*=kFi z6$Q598s`Q(%OOBifVK9TN?VPCg>o%e<1DoosNR*?iX8>zwle#mc+QIT&YFVaQYWfd zP+M)U3O*N?+N!GuMXao-cGjs=S612A*sJX2#rA@diZYwCd{6>)1{{_%sI01>`h^-< zYPYSomxw8)rL|(wrW$*71WPKmm6uo4h*kEr&gvR_l~`2kEJY`ZN?LKFv&JEoSHQNp z%$~%QuX6TEw~K3RD5ONJsX#6pD%RV@%8II*YB4RPBwbunQ6*M7QD#X*s2bmiUsO?1 zQ(aSKtK=#F2MHY&)iwVl&GdmT!hzB9imEbOsdF=`$p6z+R)d}? z3+9-_2C4yt*PJ@06kbqbtFhr@c?|~LUd528$XQZiFV9r!l38V^l3B6CUc9~loyd}E z%k6cQXc8KS(Wf!3*;I+KE3vP!)t1&UTV-Xb-M#@6F%xT|1k=67QBmdGY@<%dta7e( z)MQo^QGrOZ!C7q2Q2sNEF$bz_L8#1GTvbu&s3^Cy63m?{XHhN6%*1SRu5lL2xnVZf zFq(rI{5P}MQH8OVpPd!OHKod9b#<*hGqkGYm!;0~_3~4htr8#Y#kDoIB1~t>FSBfY zc}0oxSW#Q9S{KW7#r>tOlvn}H%^SVlCw4EY5|M}y#sjeNMNrE-L7drj?H zr_y5iRgJUEUOlJ|nYHBueI`ed+p^Y<%$&uUPE|Mmpr$;Na1o=25)@flVJqQ)GP{_= zS&~V!ud1SyaTJyz|9vMb{xP$n(q67aKz%bYi7V|@HBQu0{to;(*DFL$ zql^uusoqq*LC%<-GRvyh^6GLR*gP3F80Bi`+H$P4Vj^Ls)x6V* z=43GX%?x2v8N?#3uEyvR*~l!ds90ZHDSsg3sU)FCtgvExCC34TztPb(1MxDefl+|o zFj9j*sV5XKe{dNXem=v76kJ*5MEiMMdd%ddQ^ted)!3@n^TOnJLGmO+{39o@<@TD5 z6;+ z^$R|+zVng~IAQQ&dv$e2@PT8np%7{d^o;!R8;S-Lzdi&w%hyy4q#-D?6u1@?wR%XL zOuV75-+8&_pS%WQp&tKk8Zd95-rKQl{hp!>lW|HxvgUnz`siG+c>a zWv7J~gsMT1L*)@JBxD`>SW&zlvr9=>U5mw4UV{Fqt{oI-qpdO+L&hKj>l!51&iL8` z7fI}+{45ih5Qm^zoSDSQWy*v{j$Z@XR?coo$;v1#tyBM12idio#U(kb3RW&#G=FKq z9eMZ62WwOzR)d==jX>IJmNjGMtl2l*c+;Hk*@}w6V-UAO4JnYb4-xeOh2>In%QCSZ z#7Ng{1cwvks)GQrFl;35yTvVB@9CNs8P+p-ZNCWO-Adk=oOkFG?Th*ok%sGvV4wzcb8jjTlCHqd% zw3awihnXf9UTG^{UsSth4Hg`sTktW}HN;1xRNtFYa-RsiFUvXhl4)@MAio^^sv7*Q zcq?b`BT%xEJ-q>=Kerr=+HK%jF%D~riA|ypwGo6di0@FM-F|!Ug*sknAUS7$v&d)O z&B!}l+!DdUDG!3gwAymaP{7o((qngDb`tXLyfZz?b54H{CT>oxC!I<0x+jNQ(SoYXl>{xD@oFV50-(;ds#)*CJ{)gLY72$`L$JcNMzM(s_b?V8Ugw*863w} zBc@a)4T|9`-vE*BdU0y1YRi!``n1YkP>jg{G&)Dv7(am z;S^6nGc->8lMG*HU4c5$HoXL_ zOxDW`R2j^#y>4LCHrT41BteT%5ZGj`n4+GbW=~F;mQg*K5E9qG3_?kyRs(V>!@pAK znrhB|SEK6u0qucmA=m*##4r;oHrT7ylvZqH3Z@6ifN~4#U~A}2s78E(L+zBjWh(>! zZeIg+2atnO;hV)!iclVWiX|m)NfNPac|%e4nv!WyPn2(BwDLEy5Jjyns^a`^urD|g zvLl(IwBg!{AdX4{fhkZXMo9soPRs*k>i_G6N}>WnarOery+B6Ostg8*k$Bz02GyHq zHKg>xiH8(8sF0u*PnN|(4a4%Tt}TW>59s8-j(xpuD6YUz+pG9wB_s@JQ&|z|!*~~# zKow+LTMlv3SzJAqYF6Jr{&dbTn?I31RZtJvAQ<<%7jkBP* zqH#H}fGt9NNvM<25U3*2l;8v&f|r9@ zQ}FpTULa|pUiRuBCkcXH0hMY{TRXUAXa=}--dU(M=!j?=RArKkhzF#1U`&U0C!~Z> zZvsKpRu-et#K(l19Gt%Ls0_~7Nh)Qzqq*8uStY@j)dP8;!8O5UioAjTO2DGn+4U;E zwyL7Ga=J_(2IcU7)e52oHZi24MrSj0PBkVMG0CA;i>axi2~*itUf{4*7jU^;7NLTI z2TffO-$Z*^ksV6w60y9tR4jJbfE_`^u+dUVQraeLM@ z-wk%G&-Kny@Vsk@cyjikwB%leQMvDCG0k38bt|z~gwG&~)s}OH`+u36oXK>h8>WLs zPA{t{g7`IkUaLE#MoG|7Z;S-Ff{h+f+AiJ zO9BHa@^_`cOlc{bYtzNsIBybySC=O-ibd1n-eA=GAa_nqDV{u)coKQjV)FFKB;MXU zXd-~hkU)u{p;mFqPaR1DKlq#J`M@@LDN z)gfrestn8;uId15#5Ei@i%U5+R-^{gAaeUJ(twLml^>D`u3G34X%Y=oJw&Sp zB@Rt$%-u>1#6YQvj$g@;gd$Rb4ve*u8|^FuD-Oz1EkDVdqcrTb&Js)~@Fc-nLM z$^(olWrXTOB;yMBP!|quGbjJRUNZHk*dmk$WqhMgE+UjrAs|GskYI2{sY;NN?Lc}q zGy?b#6}&}+W(=}<4P`S`EVpk|%S0xD*Z4b<>oh^)v9cp_AXfy&pG6OS!|L6LX3Wl;?R z2N;UM!s{&}aCb$Os!l;EkW)BPO>%B^$f(#vQpXM=mpm@@IrIr6S`IGd=0SD*Z{^Kd zfPW)%Wx?<|42%Y`k}`)KS{JGg{BKoGod?JGa#8=irVp-NXqI26Vq)fPL&rB*y}=n= zuX(EO`!^b?%IW{Isj950lHY0Yz@oYtT$HS=B22*NqtXk5C)eP`WCKARNY9sn%mk}3 z80M^!6)`OQsW&tafhmF0pw8J1XMgw>!NH(z4I15BPV+j;NNet3l z&Js(WI)Ng=(>s4pN4cmc60K}x*7inba+1qXev zE&s1#ki-lzLFvd)9>Kx~B=F#F3bxa*od@d^OUOD&nLxob_9{&0fAN)1v3W}h7R_I= zv|z>j<#*1%V`ag-W#;+V23xQ+XXTwM<`;0qD3)a=Z_)oev!yF@@|Hp^`tRkFlb^ph zZ(h#Iyk$%O&79Nm)*XZl!22NO}zwLI@QQS~0LqAqF_OJ_>*`uyTRpYHVvE;=)X!7F$jwB4J0q z^cB2AYZH`XP!zc+zTSY4cx|zLSfD6Y2w#5Z8$`MPPu+QdM^&_cdp8IOqRFO*-fQT+ zcaYv|KnR9j0)!fbO#+A%u^=jnVgY*rO%%Z{*ik_cv0+EVhS;#>yMJ@e*|UKSki5MA z>w7uZ|vNQ9DPRcw%rFZgY+*8Xs5OP~Y6P|SvWL6bT@Il+aR(ix@tt6(56wgc@tbKXr zFdk%Ehk8=?^uR#ztOLh$E04343M!7wo|zOezhYgghe4B>$g3{Wlbgkf6+1iqQhx3T z=-+YhrHeg*VpY@wOdU|t6U<(Kg@m_GOM0vcyj8`dYI9}!2X{AXOU{A$LaWzVTkYqwFS_^u7bP8 z#d@+W26sVFR)Yq!4h+g;BVdiqB_CzrD4XBis?srCdJOE^d2qjhBgUu>xsRg|*W@q_ z5I8(H+skt+S(lE3I|faAq0;Vhx`AS)owwS~ssNlRs?=52eeX zQ_O>)jLxag^3Ec2;NUIrbT!G0Evw9EY)e;UUztg*=>2(;HJIJsfp&N{$(8 zb#+tu=FyzaN`w3~E6-an#tO1uX0V?LsHZv4>q?HFmdsmNyot@bM)>PBZ=SpE)nc1YQcPr^()ajj!IsX{qCQ8PGiX3z2l_oAfCDobPd7_$y#m zf!oeCGrb3qRxf!R=Zn0(TvsFCdUYsu#nKp=r`{_=i}i)a8hq2B z5P9c!|2Y)EdLLH{W?kz`2|#a>ov}63IJ)PFwfpwUxmHy^H|ASTYwO}Jh@pyQ$H~9z z21js{3VN@Nl{jb+R5U47beFIRdXdyDFIEUg+?Df;B>RjxC=F{Mc}#rssEiF8kFtXv z!82Idl*~1c!SnRG;0JLgQy#(48CiBxc$A*!IM_ONZp~~$Yw=J%#ZE6zcgT~T4uyHr z5^TO(uK)&K>N0k$Qy{ac(30yK-`dFrZCmUEZRbEUuz@W^sw(v<@0*;Gx@~x?Iv6ch zrzu#D`MwV1)=2Hzwarv|TI*QN5E#0_^{OWxX8UBtp>0{|tEG`>o|^P<8Xfo&j@fCs zPZ+J8qN>eo6ld@l#QDOK&I+wQ>~>0L=WC@BYR#kXINg@5Wqy73v;h{VPX>jZ>8azv zbVoP!GY^X3!I!7dr|i+K{V%7^*4L11`zCKCYa?cD_^Mz~s#<~`?P~d>&CFI%Tg|{@ zBy0UF$6q`VAUnUI8&JV^v|rQFOdfl`DHX4eC;{Px6%1+14js{G83tkv!=M z`bTT?XgA^x@bxn}v-vEwJ2_^~zW zdK%*YoVOnT7n~Izmfz)VAb)c|OpLA3$kWWkYwT%a{F{lyYig(0%%m4nqq(Og{;zvm zh~|En7*nH_r;YJ%ZO3n8;z!qL>uHbwJKlDpi4PN_Yjp7NqkH&wwBvU&@wYbX?BNHP z${+A{5lwuUxV2d~4?lv5e|J0nr6&F#wR?E@0nG9rczcQ_K1__L(VK6BdiZa(`-sLL zCi-gh^9;cMh_}CJ{9$5Lje#EilcnW}E zpY)CpjXz90S|rKCe}G*+*E>oy{xI>oBA0o_;$JjujA;B};`ab_If5W+t;Y?5f=!^CfjOrdXi$|rlB!t&o0JEE3Lvv2ZR-fb(EEI3HGq3t$bn5Y~n1umM~I zo4_kz3%D4zhf82L=!d;v2J8nj;UJg=hry*V2`+=la5Y1@Z7-<9ADsBFP4AJbED^W zem&`Jq?=$7?;W0-VKKM?mVmdwFA2XD9)TO-x9~Rj1LXel7kf7;ecI;^F?OHlPSb9$ zdG7K&OuYR_cf*5lGyDKbZ?k3;qnv{!cT*Gdi3ivo;Mebe6jwz@siWDWbrRje_VgQdo*>-qzP#re#$S{ z-@KKpfK&WAP35}{_{ZgquMLp`#!piv@-HH9IA2kl%{N_7%b#~*ctM+U$ug(JxBWRT z;3X?g7ZUObx4$LpDVsOkvM$D?j+@4V#M#N@p>Y0{*B@7Z>tWX*!a2+6qc4s0s&YMnWY^u&|6m4xztM_h$y6U^rX&NTM8R)TJ=hW2M zeBsW#*uW2!A-j+ zslNv)G|24!IgXt$dE#8!iGy~fiDY%_Q~P^z3Ma|>cZ$Br6DM+NLMHZYr}if-9Q#Gh zdY8|fmO3$op&wihP7U-OUtStA-@>xrCNrj?G)O^(-Sx4P?KOt(a!~1(m}peu~vKoQ`6@R-009=3K_P zwC6t_&>y!v);v&8uka>MOsO}7JgnY3+pe#W^F|=PRi{ewl=;a@cOqjudDYHN5bx=8HYFyDT>&=`-Vtn8wR8zuJ<`aIKVzR0=i{mO7qO=5HsS$yni4^~bG8J3P1xjIsKi;_)w5f86-g+m2bWC$s6YUtDPslQ(kA1NS>cEE$Hhu#I2Z5 ze9B>d*h4>8pnsabPcJWDP^_mfG}IlpkUfUtY22J1&&i)fjJndPslMQ@e;WMx$5;7T zNhWd!4K{&a(y&iv&!VTkio-KReVJX8IeCQMA35dH1kE$L$(LKo5fg zqf{+idE3dUce~xKUSC&V0h-MdSCY=BJa+uKyf8==F&AN2SpUx04=2q>Res0E`oRTr zL+E~Br*A*8&`M){n=rqAV8@>_eok7lb`jS4KX1BDy*Z_uJ-+TV^+?;_ZO7!4DdsEQ z1Y|tnpWi_>eFJTpwJpBMhT@Kc;(<@ldm_}Icb7e2Xg6HeD{xV-n@gq-bn{BBryow;sU zc*DYLxg7r-JBCW{_{9c7BLkmGEOhkCNI$XQ=LJq&$Jga?!rZj1c>ITDLE0(w2Yim% zzBy>`)VIqc3*K9BV1d*2YZhF&V9J6u3#{;N3)(M8T+nSnZJe%}IQLF{s)X#^o8ymN z5M{2|1+fbvx$?$UOgHYW^PNzu=PPW(d`G_=|NQx>ff$aj%hTIF#~-@qJ8hrN(Snns z%WeL#CQr+!=lo0Ox0>J6&bRseCiAP#Z$7^=PFF>od#65?MRqkR$hd!Jo|BS0?t`^I zU*q1x?cY4tx@X$l33G?eoi=yS+=2X^Hn%^{NzI~F7RRq3J>SVO$KTVW z*?n&JxxqcZ>D+>@c%kR~26lG7!zd7H@rF=fx z2haJ3W*?gUI?lT1mD#&yXU~3R_G36*TX9Zm77IV?jSZyaYCmGOqhF4{@9f@z7>=*Y zbJyOP^V{U3eKV7%rA_$k@Y#RN3b*q;GVAcHw`U!hwFjr`4cz(CenB9m(ArO#H6akg z)!O+~aP9xhNBbFmcem4VR>xV5ah8tNXH}gQJ*)bxNSv++Twd)j|9u9|t(%o#XK8pD6})OF^VnVoUEI^vwv zEEc}!|B&jW^FL4hG!Vnp+WBp zYA2ko4mhXG7F!}aHCHej@5>oZO0M?7ZU6F&U4a;m&MwbgdncFbJQQ<2yL@g&$_!Wg zo2K71J==fNbSu2_^uMPao%YSNuclR=uIqE?-lR7aUqM#9<5QixzM85Ol+K5I zvaTHe4O15pBYkQ*e;r?!r)!_>Ul2%9DJxA`xK7)j;L)FxqszSZ{luvgr;fl`;X|hm zp4w&V(5anpx;o(8JN2pXE8hRLegAhp+8>|d+V`cVl$w(5zi5i3Ca!v+Z`O@R--VKlGw^|;mJvi+;Z zS>d(Dl^FM1a;>`ey;YR*L&-1r(1G2ay&KN zZ2##!|7=#yqdBosXV>dp_D%80+qIdyVNe zCfnb0jHO$`n4)7&T$V8AI8N7(Ft7HXUY57*&;4vCmOHJ>o%MouJNrhzF*?Wp`smmB zdoJ3aZMXC0U1y*5c8uOJ`XQWEuKP#dJNl;4_m5tW)3pxgl-Z(HF2}DRJ>MNKp?m(C z(W}U7<>-~?sQuYyy$|xye$Hs=U}-RP^w7~AahB9#bd%9lN4FSV8K z(sVQ^I16&`+2T6dHd>oCXc_439!RXR1N8$)Wp&0m#TbmEpwDw%Y0WJ$YDe;Rpg zmV*~E`{IgtqP=Mjr)}&uNs*#($#O_$n!JnIX(YqKH3NO{K+FHk4(Z@ zIu0K>bY!=Y!$)?(>FR_#U)uj)pY5F39OlVec1d|pwi=CWMEy6ib^LEW#XNu7JN-7l zac}ATdp_D%GX2epbMeTFkuDBsf6>S@Kf^6fOegn(o#{R`!f6S2#VeeZ(~aH|dd2&2nENazb6DoE6r7cBr(w;9)fm=kST&rkDmbS^7Rw_$ zbziWye_*JSlH2yd>;1B!3j;A+t({N7+B@llZhPl!rzu}Habk*AsX5sisx+;TVnd4| z6|?jGWXPT&&kXrw$WENDr*Oe35=xZFA?->1}_uSugy7&~5+P z0HtZ=w0Xeh0qbyDQ z;jDOj`n}O_N54J&w&Qd?fyP@i)5LzEwRg(9 zG9T^x^>f?4cE4Kv!u!>>OXltOTi>tydi#Be)Abp2QnOh2o_~E`CnZb!l_OV<3~u`s zeU}Ad1h={M`SfvrwmHArL*5W=zmz;&?VWtAk}dALxNkZx_;Si@aiO`}@mtV$zPT3k zwJyisp_@;Re@Z|%g--6PYkc3l`3K+Ugji{uoA%EA;>d?W_x#`$Z&2SseLLZ-``Yzw z)wg!vc71E&bXCU%r}*D|eqX+C*+5>wnp>YkX@BOPzvLXWFV(kH-+%j*vh)3KuJ^8u zce0ODqrv0;d_Bu?(!MGm?T_`bdXwV4+UM0icjK&k*7aG|C#}!AKB;}C^LJgJsW>M! zi-jNe4Ff5Kp7pBqIn%7Cnbw_ct+JfC?dv~$_MRWzC%R8DoR!|w^NREden;EW=hSz! zKP>cK&u#nA+Mn;XZ78yog~aLF((TS}x0vhBZX3GY&~2UV@803o za*qG1E{^{q^Jz|(IbB9~aWu^F&*|K?vlF9B=PsSwb#BeoimP?!Y=2|I5(D9iw>-U8 z9$Di;HeMy$_ef6Yo*zzX&KNq@=~$-^a8|y%Iz8WMYo}eE9>M8)2D z)UZ>wzoD&ToldnnC3LFODGsMA2KT?J{p0y)|93~%!X4jne8;{xOUH5@V>({Yv0TS6 zoUYss@KnIp2^I5dFFEvj?`WTP4%*+- z;hqjR<1Fp3?{IC0j1Jd#Sc21a1thM#|^qp?E4xzPo z%DXLJ?cJUq-66U|QJi(piT20af7bp)`@=Y0ALE?VEC$c{1+#GP2&5ER`&I3i2V$Iy z_W8BFQ{LL!L-+h??X8}qcnR$j+W*-u!Or*7cKh4yYWHco7je3t#W|^2dMyE!>2-PpWD`L`|P&aZP(*0-TZCS+Fst) z-!>ViYYZ;0_JwbIPaq{%``~lEuiAXp#>vao+WAy)?Z@p1t$pzOdipNryKVk2zKgj$ zpqr(=^jgx!(axFmEd3o{m!Y%|J?@=ZZ&E(mk89($ePo+RN)Tz6>}2Z`t-ok}vh`;; zU59Z_dsr-d+m8>VWNELnozblw{c`+mTQ?_0v)0Y{>-f41rTv-D^N)qpURo&Cyjm4R zD#*QOi|go@H-E?1VPW20_#veByuDy*+{*7ns}rrV{U=&k()+FUwtBAB`>meA>Dr0Q zTdvce<(%u&j7fo%+;Kmaysaz8-@jGwKn%y%WvI44bI%{NGxWG`X7aSOD$%M$tDjny zu=D-ADTJ~w#24_i4S~h4|v1OB%<#D>o;+)hhMj|`+S|i9UpX=}3+JO;z1PCI+nMzav^YRK$2XY4`C2KRS^G<#4&C;_-$q>AVsVRsI4iyCEuva@ zTU2lHPxHT;SBEG0YlS#}3qR{^Ywn~Gy6vxPzB&*iSZnL^x%Yf0m-Wwt)_!_(cg`=- zyhQVCe+fI^ubO?(?Db|}HG37O>t&pinnkNDj$c7`J8sW-&ZN0=l*&j%qVM z{)?L}=C9-HGC%F-1)tEv@D?p4E74<9UrOscYlrjjJ~9+PE@KR~#;{_7@^M_ZDoaJt^bIhtB5e9zwyNGWvNuWGP75W}exmj!S8 z`Y)XQ3HIy;V;W@pXWRJ>Z!o;UU|jH(SNnd%blcu7ozsGOW6Rg^X%Nt@zDYx2!O!oV zc;e~lhSL7@wzuxJQu^nG(Br;T1NU1=Z`Xgj{-ZeSjxF^!)?ZV9OZ}BNT`O=_i1XKv z>}phyp5HW(Qs}m?RKI*6#;MvDX3p>VVrcD))OXt?v!1_Rwm-9;rCpDD&FfXG*P~t) zoUTeZM{kRN)OGL8@qbtMsJXtY`(52{xbnue+R*VE7zpicKJ~2Ivu=Bnnw4USx+fEJ z{J$ptn)plNxoLlT+gp1*t935h6JTsnwm6t#-RZw|ztOb;fQ)orpUB){e0AJyH9| z+J|eOsQocc*N3>g+86$G*jp4UtZhQzHRNcwWD#? zJ-^rbs@DEmzt?)F)?57jz1EvJCpC+OZ~Ga6lw9qD+kRxN;ei z`DkCihO2!b(^<*cl}vifYCrQ@XPW2^V8KB;;ioUUHDyxMm`c4o|iS-3HQlw9q7)tx@h z8#~p*0x=w4m!bB0r_cGC^}Kc}gI)s_rbPFD?_ z(_$72KknbC>ZIhheXy1DY}Ka&F;1_Ob8mZR#jE#f=$`*@Ri$o~WlhyJNNenTS5#eI zb#B!aRnu^~X5pMN|EJow3Z&#}-^7%}DovfLwE{8DhxSAB(LVSYZg|!3s$QI>+rL%* zs&cH#zg3RnbREIv)&2`)r{)Sa>)jYg$<_XvDvqAK&sU|OXFK^>IaZ02Pto2g^)~;I zD(-py*OkAnobCU*vUSG`m2)a@sr*9ayK%bi#O2lgmdYE5@AwtO!aY{Wxhu5xFIIXw z5W}exm#6pqvwbfo{Dt({CxCKIdOs>D<1P^?&`I zZkdqUZ}X>DQk`1*CRIv8O0u=@SE*;ER+aiyYJt<$4Cl0%#rnw3z4`b2Wo=9A<9 zprVtK)%J%f9;&#vqSLy(Ene~EKn%y%<>_so-+MdGtT!be?StF?p^6Vx+<>!6c3s6a z6|bmxUBz^qt_3)!%oeTkIDQ4``EH%LJ%3J+_LC}(59H-)?R*NQeduxTl@dd;Tncr2PK!f0o~e)AbI{NzLL5$gUm*`IWKX$~h^y-$MSOoTFWi ze{;Ewff$aj%hR<#+qfV9dZ=-~o;;MQRhBvB=9HU>v!tozrk0z43%;B(TTC%`yME)! z>2l?~pWJ+M{Dbqv>R(P*uORJ%?{u}cKIz>J=aU=n^tM-+quG*>+HdnWGkIF6lqpxH z+{HLcI{VX%5_z;QNY8(ztW$2c=Lhd}ca|;aiWhpH@8oi2KH3M5`z>X+l)VXeuG*hI z=b!7FE7Q)R{kZe2{Vn-uKd`LZBlU)Qm$J?q>g~(6EnBy2`?7U#x@zH^y0lpMo$lXd zoRmVheXxalYR?aKqWycB)7#$Z^~z~SKH48HrXEgL zBF-tZ#loL%>?rM|A;#L$YXg2xn0WfEm*0x#)IjPRp=P~p{sks| zt1LZB_bgopXGt-oiXO-;Q z*cGw!W3P>!i_?{cbINS7@ZZ*^-!rF_UAK#7xBL8jo|z>}a17Q@FMdW#a{FKPu+@tay(0f9IopAIk4& z&@!fZO!b(SwvJEFs}vI(<61f4e9o(V;a9v5qn(u8wh#V&y_x6vcQuQ?6}s(rMZ4Nx zAANoFQk+$?#nI`}lcN_$PsHgOk8{dwvG8;L&rwcFuJ*xge>m#nKn$n9yDWImZ=H|! z!EY<(MCC-?i?d30Yt)9Ql~K1wt-$G8j&sUvvGC)*Paq{%`{2D^tEgsy7_QdNr*qfd zDQ{{%+Lwz`npUi>ky|5g!CBIkkxL?HL|z#=4X0}g&PmOpRT{^yAUjyESU^9$eh&gn+*d%D4GU(mf?esjLl zGH;xN_6;H%L{`R~tM-MT^&IVk+y1|){ho8sKJPxibYy(wg^{Hri{W$?!8vtl@qb7A z-$H7i>pSLi$Nhfae&0(tOShfACw=$$cKSBsblrvfU)8?h+o4yywL#i1^eyyF!dW_w z^^NlN_Ko%R#Ob;ecfPbQA4n1u$>t9@N$w-pPr+bI%ADYW+ItL>fgdOV(Dzh!3oF9`P(`wJEg_r&F9 z77H&P?pYDRvuzkxBJ0BN65*aJ!;xXJ18-;hOTy?Zer*#bz*4Xryckx2m%!RE9M*#o zunF|R7BCXFgHf<6jE22n4D1JE;ZPU{N5FVE3MRlYury48W#B|u7EXobU}{$R@QUG{ z@=2K$#0p-@4U5gosuW%Y|MaZNqVb2t{M=U+E``;?J;hhR>d32M4Y(H8gxAAb@J3i0 zZpf-bYkA7A%S;qadNA%y>akw9$G4Yyst@-g<6q9}X-H4;#Jz|NGmCo~8+n2y6W%nu z8R4%WL&BSfw?I}n^hRf7`&)*4%H`&^3U5t#G4z7oSp3_-S((R|w1sJ~9gN4nJ)Fn= z9pD1k5pK%tq!o^1bMt zr_i42|Kmv~H*-SxM7#e(`v0Wx$#(yT#g?wl_D_M^*JS&r!W86bP~%}b)OeTyH6Bu- z#=}gg@h}T&Jj{j~4{1>2VGh)Im+6lIevM4{4dLqvSHFXV-xz)qvcjS1_cxn< zzajhBD0~?IXYqf;==Es$R?^XUhv>O2{4r$Z z19gA+<5qgCteUTKL{l!vID0aDyFJdJ8D~$~<=bJGZzt3^dm3t-Jp(n)o+ZA<*>h0i z?0I{fy@0Io^&-^xdI@TL?Sl8A=We(Sz6_=JEAY{qvi+}`a=aG)2J*1Gv;D8bBq%v` zbGH9Yn0{@xe-HfqE^A!gmi2b{JN7t&aa*$XhVQe-kvQ3F=Eb;G5AP3ukMe!$IUssF zFXg+a#9#IB!SF-)ANIU28h?oY2jL&#|F-8t5&vvIq<%kU7iQHrq#qqNvigzyS3Ue$ z_!r#wf#-A4qzAe0%kZyASM371@9Xd*$hr@j{`U>>a&wP{e@nRLU1<8>F{u9c9aR7O z9;*NS0M-9~gzA4k!A+URRUZ1^&!TB(=$*gn_>x~pKg{z-_^(F4-@^YOpHDr%i>92A z@V~=Pn(#lv|2BI3C7N(ZxF_Nt6aH_w2mKFwazzsk(bLOL)zVYc{9XjApI-nkp&pkd zdc5lA#kf!Xyf{=pzmWUY&r3k{^OD40_3%Xz7n9G2o>C(Du>M2!|4U4M;SmwUQ~!tL z?~8~;Ry{+~jgE+d+hG~%B`GsTH1z^WKQ1DH^gr;#i$)Jf|1Pa~nTI?%e#kf}8&NL8 zT92R^C*_GJ{VG7|R}pHQRDv2Om7&H-72<20RD~KR)ks(CQFUakM>U|vOHHWpQVVLl z)P}dBZyk6SOoR`>x}>XmtOqw-$@-7~o(CF4G(^6V@g%N#xKTtC^4a5QESh?Q_&1Gc zj{p0fW}@+j__v5?h5wtLmZI^8__vN|i~k#*Hlp!|aRW2jMRcS-hh?-Esm~5#W>M-3 z65c7Is|oKc65d73yug#~hlF>F=wZUUi-cb)W)>kF#;wfg8PSLEwHdu5dchYUa;AQr z9}?a-Vt@(nAJNZ*_m`ZheHbKsV8jp;J~(2K2_GyuQ~L?%4X1w$h2`Kd{7ZO-M~p!3 ziY#6VN5TP_NfD#DKPhvRX!;GL{Vt0bYy8KE#vd}SlOx8Fzs5E6YCm;3{W3Qj`ic@g~AFI09&t4Ql`Q7}Wmnaj5-YHq`zv2WtQK1l0cTNvQqbcBuW| zQ&9WA9Z>tfolyI~r=j+L&p_?}o`u@~JqJ^>o{xCZjE5IQQy-B1-%Am@@lVg%B^rNd z_J1!!?f+hhu4#A3??+JU@5fN%^b@FY zdKhY)ehN2bex`gGU!RLcU+Dc}CI3$n%wT^0%9Q78Q$Cf4a5E0Rfm%n767NF%zlB#2 z{}_y?Uwj9jTbAwr9`0WDW5f?|#?l`nu$SWA!e4fi*45+qYhC>rYF#}+ep*+5fm&C8 z#lOWh+5X?4%Jn9f|!i;y+WOF^xZ7elR+ zmq4wP;ZXGz0aaf z`%m=?y%R~l9R4$*Gu|ustnpqEJ#sTE`6~OY@eUd9ReV)_)_8}-#&KUYsBv5!Y8=;q z8pk!E#&IpEaaqCv>22kU;A=Ef-1T~HuLyhAmP~*5M z)HrSiHIAD@jpG(DHLInswQ1K@qG?yiIBw%>hktrjThaJKGmhIsjpGhJYaDk();R72 zHI6$&jpHs*GO7sD3`qgs1o}H}|FZCQzP<-tnT@M@gRGo#@lJ)xOpl zzmo~q_?-eZey5uIvHzjQ?{p*2@TJ=2a5xiL<9HU~Ue9b_8s*S9hRAb#bCFd}NV@ZV z^Wb*4(6sjg(dY>o$LYRB_Be)S9A9DUx7gNi3Dh|DLyhAMsBxT0e2wEQsByd$J+DLE*@7ettntpxI*6)2=ze7;{rc>A z{rWJn`pu_M{rWSge*HOAzy1PVMESlXzS{dMQ|=?auZ_M(d`C_FeIuIslbquH_LP49 zz3)5I&%XElNO{!He}HNaWcuq*zMqj*?&DD9M#ley?-yj1AJWf%_5DUZDla7bci$hj z4C&`5eSew!{}fGmApQIw-`^(wKc=6jc>fLV=SDA2q}5NoQ0K*AQ2mg3-FxCK?Egr$ zS5cl`TkQww=f#bzevV9diO7{(7`Q1jR{1gx;zZLwto##9d6Yl0spm3K^<0+x#(B#{mgj!W*JAYz z*#GcL^s5Mu!AkH)_{KtOKUM`<{k|$xzpqC5!zg!ksD57qfA#O0M*muowaHKY8&V&2 zA`_8S9?1RmBI}y;>hX4j_FwfyQ+`PQZW!4p(%OGP)4v^Ro7z9g(GPCn$Y8+xm8~_3etk z^zCN!>mGS2`Ac7jzC9v)B1>P${kl<6|IH zyA6WUcQBN`L!k5>N_^=%3`*bOw!R~frSC{6eUqT{9R;QDXj9J1BF98}F3@=cbo4iN zW-{r^&KwtM*_oHaQrBerQ{dOPVE@B!;RHBz9ri!mmo$EL5-LBP~&9*)OcA4 zHD1!8#>*neIe_wIyet+?`Jg#h^pk#=CnGWoxdHlQ!WIx2|D}=3khQKr%Ddc@U*+X~ z(@ra(+UY9F_pxVXUxp2H%JUjt49-f3658H{aaqtxN zp>e+hS>s?Q)Hrw=Y8*TRH4dJII-h(F>U{EfsPoAexc_6%i;*uOs~yGFobT_#f1qb~ zz=l`%fd<&}m--c@ccc9vTFZm>U z_eH*otbD}s*Ju0poBDh&@_=cF_afgX-dOKJ(Uep281JFT4{TXfKlqUP8JO`=@NKceC-#|0pc%wAm zghdsJvgR9T=9>$k&O3`jop%<4ns16j%{Lc9%{L{uU+0}Aq0T!m!ap7VQc&le7ek$Q zUIKOA84g##2&nT;A6%0e6%`2|gfUT?x1vQ;Zpe9OY*f7Qj}whQWS%P>l>qO7WleY) z(S$?q?zfzC%nDKEqqKjj5LF5Nwcb>On#YjwuN+ksS>vn<)Hp-NzgkpvWQ{k-eym1R zP14mkgM`1Yw|0j*Z@m=ioV5p3{ypKotX{l# ztp3)fRu<;%_NA2lG#I(LDby9|sP6lI;ez+x9~XZ?pa^BjE$YygMC zYLs&rocI>&Km0Nq`ybXOd?ftlan^rW`fApHsPo#R z4(goea;S5j6sU8a@lfYH6QIs{CPJO_OoBS+nGAK#GX?6LXDZY=&oroWp6O8MJTsuq zc~YUyd1gYL^UQ)e=a~(4&XWdp&NBz4c%rk4vJabLdwe~y%%{+4*)V}6=sC~^ksCniF zsCi~R)I4(|+?08f@@0OwSv2}u`QKv7qx_N0_}&OLzHj5c!St8g;b^!C_J?=C8H}Gh zq1KJNpw4aYhB{Z=40kWPCu$3vvGkrO_7{21ZSTWh`;7ac_8AYLUzi8`A8McR5dPXH zJZ$Rck*G&0kM;?W`q~<`4O!)d-2ZsgVG5B_^Io``xf%CZxn*(Yqb z^?b_Ka|hJ?wG(RodKzlpdWQJgH$MxtUwDrC*M8x7WX)qQK1hrq-1Uj@TJ--E2&u_y=c@Fvx z{55M|)LuAt>At9UDep=8AvEW~`=QQ*4?vvd~} z0Dc1x!K3ga_$@pPk3r3^-@#e%dpHOF0O!LW;l8Y&?0NEd@HjK`V@`z8#&$NX6YK0^Ep;5GOcg?hiK7}R@B#o-iqAxwoO;5=9oR^YyiU{zQO zmM8s-6;AzL0xKhj!x}IG)`mV<4@Sa9FbXz<(Xb7SfgNEi>;~gtFBlK|!vr`OmWCr> z8F(2i3%_7ImxEu!@=)`C1^5H32#>=`@Hbc){spT*5BgMv7p$%xT@4mnTRpm7w5R;+ zr8S~!MqA?&mcMXyt?1ge49k~VT_-xxmSK6{>bknmjAK|Vc6I&ehWM9R-9R+{uvkU% zYXqyn#;^u#0=2F+g>_*wsCBS8Yyw-rmarvk4_m>mur=%r+rUAvEgS*c!LhJCoJad~ zfa$O!^utb2>tAQ6^{)%m`qvd|{p$v`{&k01|1O1E|9U{Je?6hrzg|%5UvH@OuMgDv z*B5I2>j$;|^@m#j20*QU1EJQxK~U@8V5s$P2u#fy8a)$A-^>1{vwf(QA=a4oEuJMqdNB!|P3ZUMHIJL)N)<(Kkd}>l`%e+wHdbGIRDox2@so!bPp&fNjE&fN+7vVPnJ4=rc?hsCLn&F~=g zvju((?}4hXd!gFp$}Ecd`D%?W}i?z^>%;D0~5VD|{Vp zgYUw};79OrC_6nH%1+OLveTb{vdf<&{ehnC(N7`E9u)VJ?hg1d+zGWFKMlWv&k(JR(QlKV+5r;&PV`<|hVfG~_C@a}zS4geDt%<`I}m*c zS?RxLhaZH>=Y2b#!n@H~5(T^C6{0C4VSh0u z05zZf2sNMn1T~)?hni1+hMG@LK+UJWK+UJWLd~bYLCvSXL(QjuK+UHoq2|*+q2|-S zpyt!Rq2|+npytzmq2|+En40B@35(Hu>J`oSgUqKzVv6FQo^^p}{Gpjoi$Tq&#bd1b z^g?9KrzN1~(~?m0=|xcUX(_lN>tenMt$FGa(WIyOw5TT{#uvl>l70x8C!%5^VHk|I z{UQD_d}G?0Patx9Oq_`qACq9mgZP(@DHCJOGmv?=Y)m<1&AZUdyXA?On_D5KBH@~M zp_zBLnRKhfR5s~WiK%L*3rV+{$zSsq`J40d8iZ?JtO+$Q)-v~T{tq=T)-m_hjY%~A zbz|z;>4};r>znWfF%2o7=1E9Cjba+x<%gu(G^PpM4qKXbY9^ZcgVa+C$)^6qy&0`y zTE|%PCN%SA8`9HwY6~@<+Chz@_E6)e1JwBJNPNwkouKB;&eV_Q%`V6quU(<$&2CWh zW_PH0^HQkye0#v9ce4IN&3C<^hxxEK)I4TA_w5(cH%8;WU(5jVRk`{@l?xgFfiZ)T zRlY$`GhTZZv1?oNu)d5QX!b6zr<`?b%%EXLaB zkAc7MVf~l9mh~U*%Nl3;X;S9p!TmJy1o71D)R>ue|AVIg&4OC@XG5*~X;AC_9H@1FF4Vd|4{pkwuY4I#3q;c& zpjr3RO}|(aa|QAd$_**kVpC3)i+HBq{ZRFuLA-s$%Y@&-EO-zug~9uP<;d#qS3>po z6(%3nf2jVx(#We~Ruis#9j-xEf4|z4V{Obe=T@lxvk|J_+(vx$@7tmJ_a?i4-+`=tbSG5* zz6+{<-woBjH$&CW7N~xF57c^mFVuQ`A5?wa4^>|eK-skq!jJKP2>zP&NX)}uY;{I1)TR6g!B$c$9VSBls=+jec+pYTxl4<;~6fKIVrQ zYu^Fccl;RhQ;fCmfM(xu9BSY3Gt|E01k}Fc7btuBS9t7d)_*Ab^>?^}@IT-#!cRik z+kZmY+ke4%wDaFk_Vzze_V&L}_I56mz3qv$>}@ZUy&VQ+Zx?~Gw=aOQw~IpA+r^;l z?cz}O_JvUPb_pnZyCnPxUIeeDe5K&LtV?1qhUKrmBsM(OYIlgF1Y!&ul0#=&kd9(IHYunjB?o53=$5iASq!E&%REDvkIigtdm*zc6L z64W_CWvFw4Dp2PGRiVxYszIF(REIhrr~!38P!nFTx^`?WSZrL#M`hvs~s8PxeebExxy7Et@m zmQd#dt)R{aT0@-=w1GMwXbW{d&<^T+pgq+2KnJMvfsRn;1D&AG2Rg$r`h6Ezl=|rk zOTcbW=LX%O&J8YwIydM6m%*NJ1?&ZN?%o^f+`SLfd3#@|^Y(sF=k5KW_QwOD_QwOE z_Q!*u_Q!*v_Qyk@_Qyk^_Q%7Z_Q%7a_QxZj_QxZk_Qy$3`{Pki`{U72`{T=?_QzwO z_QzwP_Q%Ok`{Qv?`{T=DYF0|@1ll1fbG&HU0n(o*#!kjRJ!_I^{Gr(&Pl4JWPmQ(q z$J3CtKb{V?Kb`@#KTd_(AJ2pvvS#sHP+HGtizYp5zcGhjiL%y9$bMp;k+q*dX8l|c zyO40LpOEnM*hR<+hi1QV1@Uro7soCkT>D*U_8Wev{YD1Vej^iVzmWyC-&hK@-&h7W zWiD5~llu!AGd9I3GO?WcTgIAJ%WzQ-j%dW(q@HMel6RzjQqRu7OnsQ%b^ia7; z$LvS0gW8W=PrMo2zYhNSCg=Z9>*{*Aa1ZDIFbm!USHqj(4R8az4c-Fpg}1`3aHGlZ z_SoA@d2WxrgL01cZW4|CD|wXn&e*$bS=2f5-LNd*H`@%GEYI<8fqHIt57hI4d!gdp z2X`-fAohMZW9b92LC*)!|Do7N@mKvkZ0hF`BddNK|EQ(D3^gg)qx!7mn*YJ7UADZ{c zUw}Htc@b*A_7drPJ-cFe6Hog!i2QQwE68d$NcmoieHCtpZ{7qB?}=Svs?zk&(y zYgic`fr;=N*c2W$^>ZxtThlJbV!ubf(cbSw)2@<7d4Gug(UwKM5AhRxit-$X&%>YL z%kTs&O1u67b#C-4)Va}bQ0GR!L!BG_0d;P466)OOPq_WczheKUe$?)edj2Q&Ut5Nx zlZ#}9L(=och1oJB-6C-p*fJ#jqH)D+8In)&xC?C=GEPdwU4&d=X-Pxni|qYvMO0iV z*nDMF+{LgByaaZJ;qX!z0sBH991J625{$Ofhu**GmoZTL?^vk)cO2CIJ02e8eUk+E zGb{}?F3Z5bk;}qMsK;_~9v*R)kE?*JaVB0veN}`FR`UOx!6vXW)VQw#b)Hrg>O8F) z)OlKU(ow&yfvj`2n#ej=s|Cw=YRA>VU+IfFS4+fS=W2Cff~Q_weLGy#ywU(F{f2}q z-A1s2r*T{pJDxazbeh89uo=|*HO*la@@WC}y@{4k&&gUrJtu1o^_;8?RJq$iJuhnq z^}MV-R6TWoyO(u}>j-Bo?Gz`w#Qxqye3^`{ab4nMUw4h`PJ3uPc7qy^$oO9x*ArRe zvIo?-M8>~YTyJEJPl&zVC$2B)Yg|IY`^ELQWypIF1L6ju_bBf`(bOL#{~>XMP5dEo z!%X;4(S$?J3x~&zBp;P)1XQ_@$uB8x46@2K$_^h5RldvYc!YER*tpA0__(-a<3G;G z>c9AtPDiW_g@O^TZU+agai@h6#Z#U~#9W=h<2{3|S-DsulcBP(3~-7;px zrQ)ymLc}r|v*KpLhLCd#)1J`SYiV(wvX8R=ngd^8KAH=I?Y;TPviBB1*?SA2?7ejI zk-fJF%HF#If7yGBp`L3lf$N|jro#-_h2KrcgtFtZpzOG%Pb=OTpzN@fa3%KSDyVX=hAQ_OC_C|LDEn+J>;|uakKlhTd<mhvO_e4;nk~5hy$FQ7AiaE0mqL4QikL7;MA)aF4@UYgqr`D(WW(%Km!- z%HDetb|c<)*o60Ao`U5l?+&QvzdNCx`#uf5$j`u%@L9N!c+bHbNcVX-fOKAfdd~YI ze1Lc_L7jK+f_ndEHDwJLM8kAl6I+R`c2Gn!hH=*pxJy3S#TTpi8 z+fa7pJ5YAzUMRbAACz7BE|gulAIh#g03U(x!N=i2_#}KE?tq8jv+x7>BK#1_e)$N> zZuuC>j{XG7PCg7}r+x}$r+x-y2YwD^Uwr{(UwsK>Uws8-UwsW_Umbz6ufBn@uZ}|5 zSKmU}SI402tM8!ftM8%gs~@23s~@54&7Yv`&ErsZ{m)Q#=Lsmg^A{+)^H(Ul^EW8F z^LKc`>XUJQz+!7p#(Cpqcm5goSDe+~A$I5AasSvd#P0kzF4vYJcBdzv`^@-&*qveV z7m!Yw)kQ?(4~^Yf6zctfVz3b`4x7UZVH;Qi-bQ~Z3D+TC1ix92{SRdaUJPXiUIJwY zhC|tb5m0uZ56TXVgt7yppzOeCC_69)$_|W$vIFCw?7(;^J1_yt4lE622bO`d1It3$ zf#sm=!17RbUWe3(pmK|6R$_}g#Wd}BZvI85!4Oxx&1!UP-jYX3lG`}0vG~VOe zN&7d0cfjUwBWwZP-w|rXFDqO7b?D7`ll4Ddc41rNFT2q3hwSG&#CIgV_VbWOKX%6{w(H)Zxw{^-?LG@KD(Qx4{YU=`m(GxE^oNvVcKl3JzS;4!U{T~b z+}C48ni$ugeXr!M+&@?Ta31Uf=fnPR0UQh$!r?F-YX7Jw&~Cy#(sL zYd_R`*BQhc?#+zPLe_I+NV%59FE!;_7Jnt-!@SEylaAz}-WBmz*|I2mcqP<+auwXY zY)$-XIAiIW_`LS;+W716S9@PWI+Z=w8d>FY{I56u>*8-9p8Q4G!|S2!;Txgs;hRkP zSpQAEvHlzRmiSuxYzS&{8rjmb~Qxa7XKKs`XiK{ z@sC6F=GW6T@8pQ4-#}wmKM7@5Z-=t0pMtWhcTj(_BX%P1&3HQgnRv^thQ_XbmVC5d zeh#X?KM%D}egSHK{36u8{UzeduHFS@SMP?}zrPG+SHA*fSHB8nSHA||!9IB%>ivl~ zU{ma?H{lrMJupe{|53gq@7wY3Agg^vjjz2>cJ4kXJNI2EJ9j^noqGVv&V3Kc&OHb< z9^Z!=kB6Yf;|EaV@k99gU9A7`)f-v=$+w5+lla5P>gOU`lJsPlz?q0Sd_q0SdP36_2AO^|&YmQVy)^&!eWz5r_e zDGD|J6oZ<7ibKsm7edWHC7|Y?k}wHg1ZB6Eg0inKhO)0OftsJfq3rnxD0|)qWzR=a zjuGCdglJ@yL)1A^3{-!Qh3fBdQ2jlg`0DQo$m%zxq2A*u121JiQWo}y<=~C9S9z#; zumaRPSP^O-tVBA)y_FNHAgh0f`u<7P1l4!-glaGh)+F9AZw=9uPx4T2t%TaPEXp3Q z17(jVLfPYWq3rQ`Q1*CzD0{pCls(=MYW{2lcQ0#_&=}5G+9V;!9;e=#CA3J;KCe0d zmxKCK3z2xv_ZwO#v`UaY**c+Zf;GjJA@$Z<>30dPFVz+iq z=tBM)?~w4W3EgZNVmEhB=s|qVBbP#@kIa2N6Z#@6{a$u>Z>W6w*zpKw-1bZ8Z{l zOu{HQ6^=IdjY+r+mO&oNefm8n82@HQa>6*$)B6Hq*QJvZE{8o}3hV>N!~Spr91JJI z;c$vcpY8UG%aC{ou1e* zV{XDcQRAnEMweEaH14L%mBxE8IS3 z$Vl*%{re5RsE`_=HYyYY9gyrO`^Mot$*LlJUc#`m|pzdD@b^j`;`&UEV zzXn#u4!auaykafXdBrtQ=M~pN+56YQeOcG5KeOJgv-`J||7}_86K+hf>}tsG#od%} zbAn}8!(zW#Abw+G6Odke~rdmGA*dk4yn+Y4pK?Sr!8-i5N`_Cwim2cYb@ z_n_>!gHU$d`%re=At*cU11LN0Lnu4$BPcuWW0;!tNy4YpZ&K!A(bO-*j{7X(3;ffw zJ{OHYGrAHL~ouBT#nSH&AxmQ7Aj^Teuwbo=J@*U$Ly)ykgxF`l8CmujGV9VG2`A~-+BZVN|4jG`S>e#w zZ-29H<>vmA@Gs%A-=MMIa-r-uc8A7(^FrBgVNmv45h(lZ0=Ox&DF0iL?6+c~sUK+U zt_vwgn5RVPlE`tiKSaK$bSdQGce4H)`Qp--AV17L3=$q*Is#eyV~Ff49fhoYbtKfj z8X5hfm7md1)Or&Owcf-LZ`m8H|4{qB1o$O#X;_8&ECcJpvhWA|%Ta%AyyZ(*K-RuO zydVFHCZEcs{~uX*9&gnYH-7w_q!JlI!##JNhjYcX8-{-T=xv$6b{Qi2szH85Wuf5iHuf5N`d0{{DGYXmS z)M$Z*`HWAA7G)HtV>N#$LGy=FG=C^#zW&kj48NN;f2jR_I?i;TUnO68 zct?b|MMg`ed;V%|70O#@w4vPdSnH9Y{HTn!lzTpFZ5PUq&S+1$=e5=jq5PPPPLz9o zJEG^eHtw8`k42wPx-fq<(lz6_biG63ZW-Ov*8w?>o*6xGB_2<`7?|j#p z)6wUTGthkUOf;Vyh~|@Lq4nf!w4R)UJ{O#eQz##V)A2mK3(v=Ws5ckj!FVCgq5LBD zqeJxKj7x~EKWhEC6wOZuqxtC&G(R1R=BJm1^EWKx@^Br7Wn95}PK^%NupZ-6qE}{& zNXKgZx(cmdSEKdo8s_UC9hq@0vGq&MPstDI=SOFZ$}mqDoiUd4=zTHd zGc{vMSbl1TdB-WyX&R>MWt_L#yyBLONakSTTQU89Bjg)1*q-^u?Ub8u+=1p1ccOX3 zU1%P0H=0MxMBh)`gTA-87tJeXp?S%D=yvW$-#^T@93Q~9a1Q#uVJ`Z=E=m#}f2C$5Qk?$D_D0`56EI&HHDW zhWiJ@dy3_pSKm`SkrCNv9?Px3OWFS?InTbgcq$|H-eM*C-r{M>Yu{7&UgFt|R37vk z=dmWSD&zT#RQ`nIK`&&yn32k#F!bLqq5b}9w4Z+&SJJ<)!7%=hz881}dolf0^gY9C zIFS8%9ev-h4*h-E8@SgB`hPr^>2IO=%G>DshxO=thj*|szw_OIbr#Y8^R$oAJZ%fso$_hMCs=R#rx{<tDNS^jh#&?v*rhKcR97CS=J({QefaYmGqWRfR zXnyuHnxFlG=4Zd6`Pp_fKl=^M&wfYqvp>-MYzLa3?L_maUFdlHpXhk}ZafPALdWC( zM)S0P&^&Dq`g`bq(ed~ibUZ#1OO3}z(ed~?=y?2I=yzUq(eJ$WM!)l_hmP~tN5}aa z-~`+UCt^c1|JxVM|Mo-kzeZ@@w?CTq9f0P22cmi3L1^CB7|r_*M)STy(7f+ZH1BJI z=6y}kyssIW_ccfJz6><)i=la6CJs+##d2caXW1IA7n1ko#_}m2oy^lvjv?n3NlBXRWV)HcO=r8Md z{*O6d%UCPsGoM4|YaMGt?0gvVxg(jcrsk+vTc(@OVaVs&q50g==y-g4G@t8$=5xoO z`CLbwo#^ED+0V`z_7lm&y2QFM-SOG3tUo_;T!`)OC}(>2SP!O~cc|m;Jwth~*zv^X z9msL?4#($lu-?!gorv~FeVFfSj`t+|7yGiEeo^{=;wEp<|6?Yeg7(+_u^;iN=s5Ff z=s3v$Tsz^6*y%W|`i$6_tl#ezFnm`rFzm(5ML>(4!C{ka$4=XdC{(7#iEUs(VBu?L6;%%lHD|4zNJzh9Yy zMJzWL{d@KEa0mDGgXsA4Luh@RkLHgLV;S==K=Z_fXg;OY$exYH~WWSyzyyt zyzv=yyzyCdyzx17ym1ve-uOH^-uMD~AH9fcC#;UWgu|*=$6jW=-bWa|Gg^ZM?C)Ci zd#G2?@0DIfzkhm-{rCH)*D)4Z7kh(p?*sMwr#C70`=__CdF1Wb`t)>leD)o5e0Bpm zKD!b9F6v!$JMXca^=lL6MBa~mK)LHzzl-`1{VwXGa36de+Z^tnk7J)O|H;uU8s<0d z8~rp!z8vCI-uy-E^O$+=7qKrnZu91?X#FRq{Hxg4#NG$n(EEUx@^50_5_>-&dGmL% z@7a!dGcx^$*pKNLneV6A&y<@tYm2I1V!txo^NQrr+hf0n{rgSB{vmnvj@Tbz{v9#% z=)TdN8m8j`jV`6#ibW1+hPyEv|H2&n8*`EVCya~jp?`8*>|ge$CQ%cMWTx^#Bp-}s z*2zregBbFLz0mI{>SEW0^#9o7Vfufxf3J`B?+wuYeIGP0X^8go`=b5)erP}62<_+h zNBj8$(0=|vw4Xl+?dKb#{rtgbKYs|?&mW5R^G(oxzA4(zH$(gR<~Tf=k(rrkKOfW3 z-XZ;bR%Q<6qm$Vh$}#lwxoAJ1mznD4^NH=}3($VP5bfuS(0;xcXC_PdpWXJKr5e_k z>gUV(Z{DeP8R@^{A-4Y}rky@4^KhoyP9xKg$ZSFEbPWA_OXjPoX_eWU>Gtm!`u8?y z|9&LezaNG6?`_fky&c-WAC0pU?cFZ>*FnSnrMBNO?2p?g4)wh=THlXldnZMC{%3jH zxvuyG?Q3nn*p1kJu{+u?_FzBjuzx+#ez6zj_D{!$?cz1`)8h#>3z~a^R)DSo|@iIV#)_(otL==0IZa zOXR*hEAwo&<9&%tKPU6tbd1ertvfGs5I%<9Umib(=g$jRkI$bMW~QD$FH)YfE=HdN zFTvY6KbN9^e`zpoOb!Y4VqjwEf9plK|1PKAc>fJ!y)}v9nOCImKji+qGIK=w{=<-` zUxiz_|E@;ww`k04c`IW9qJMNKUy#EN!QDJ)Ae!| z<<`slLOr}cb2jJOdWqD_2QudnTQ8C2=Vi_f>zkMPP&lp!HS9lQM9LaHffPR1YA^P`dK0?1k z+>CyQ_%Zq&;uiEf#81%g5I;q~L;MW=4)JqzoZ$=fJH)N%cZgr2-ywd5euuaX{SNVK z^nUyXy&u0t@5k@Z`|*49e*6KwAAdye$Dh#q@n`gY`~|%qe?{-d?dbjZ8+t$fj^2-d zp!eer^nTol-jBP``|(foe%y`2lYeFY6YA~X8tN@_zV>9+g!}Pd4doc_$4FM{evD?N z`oB8F-j92s_hVi3e%u?qAM4@FWc{pE|JOjn`Y?Q_)-Wq_&>NHK|M4~457X~6!u`5` zR;nL40KH!i%u4km2ci8)W6Hf>4<=^(KkLw})cuOYO|qI2d%q&fH_vJo*4I2MmSsPZ zp<#cJ`!zEwD=T%sVz^(kS>F3K2fbf&(fc(IyT z_iHJ7zm}o*YdQM7Q4zKq&pM3Q=Z#AAdBgZTJREy0V*DTd?xh9#{X$FhyO&nzb4P3R zyO%cTb44m|ZJTvemi<}VtfSdqkEb1aJj9f@&pL+KvpNxbd`SP;IqO)~ z>+vAdyJU4u$H;s0AleH9G{+#>0uo61kRh|m?vgM z8s5Y4_F?^A-;?kM{?1_EtVn~2l%I?@VZW@@ch{#deG)PCDvTSRO1<+wIt{B70- zr{mub(*L95YiFYMbs&z%v(WzL>~#G;huHDNbJ6>F5PH9!hi8%Jvb`G`MR@+titPP8 z`$-(???u#O-_H?;eC!hT?~--&|7adI7|p|mpn2F(bpJ2Ickyz(hWUqaJ{CuYd*9TJ zIKIpJ8nN9gnSKC{z_HAC6&^%Ju{hojMYI0pT@onz6z z+j)Ifq;B2FxU3|x&$r{z`dfv4*uMn2ywlz9YIMIRp!9G?Ht-&ak?4_NQbID+|Z3Hx=c=OgUbZIruTGtm9H9Y?X< z+Vg%VvFG6~^gP^+u6HK7-g|H`)9*#s&vKz3ye}(~If(dvbliS6K8_Dy1D-$UpyT*+ z@kz?(;Z|h%@ZRAeV&6N=N8dXuEsC$72JycPUTB9-~S4&2ix!) z{2G72Z}1oV7JtX@@Ia39du)O~;Kt;Sp`RR>`02m>WM~(ENw=zE<%D8FtJ{Xg1nQXj+nnq9P4zOVTccT&C^&BOlU`qU);&iW@S^?Z-yVSBRv z%}PDrW5}0ka0u;XB%8beqv-EY>R=V_h1FOW&C~Wq-viY{+u8cqgnq68nwRZ^=4B1h zylh`IAKMSj#~Pve*#2lfb^w}>9f;;*2ch{`V>BN-7|q8HLG!Ug(R{24nvXR_^RZ_5 z75md1eXo&$zSoGM?};+e-y3A1?>Dm1_ZvCck^1LhE^+RZ?c?&$_g4A%9v0wcEW}T- z2z?$a#;>si7h);;9;OU^4^xi5hp9l{!^F|^Q;D9R!_f0{IGVQ}fu5%p=y__1o~Ksm zd1{TGr#9$$IubokN1^AbEqb2Xq37vn^gOjk&r=8VJRO7P-5t^2y>!A`*nVdmne38% zEM`yZlHD~s)h;0W*Dd=v%%9dRyL-AES>GwyJ@5?diT$w`_Qm6|H}=Nvcmf`aCt?Te zgGb^?*b@8VVR$l@V?Qjx{^{*u_+8Ga==-SC(DzXT(DzZN<5WBYZ^kpx_iqEy_ityR z?;X!Z-@~1Q*57l{_i%&IJmNg`J>2=|d$&-@{#uzK6R6egAbS-id>8 zCJw>-rVh=%JUfy-Z|Y?l@=*-;+c5Ng8;;&@SD^1zuf(M|0+-`e=zVuJzJS-@8XSr1 z@LJq}*P+i%qwo_PjazXHevM=CN4y?=jv9x%a6JBvRT!Z@B+%cVCDGqYRip0>C!l{H z^aeZ#Z^R}z5q+O{Q+8xxQH1`V*yp&(cqLB3kvJ7c<20sdKPQzRAHoOh* z#2I)m-j4U<9XJo~M1Kc%7y3J}yV2i)&BSN$9(*3}#nm_~J91+o`*$Dl9^(7ayl*!8 z{PqC){5A)Dew&NtgY(emw+GR@^C2|voR2=gJ&ZoTEkK{&7NXB@i_qt{#pv_fBk1$n z67>0PDf;~ODEj>N82bFS42LHl&whe>Gcd7SL%l)n&lTBEQ9e5Pq=s?~`Rz(HzkQna zY$85G?DN~R==0liXg<6OeSUi$XC`0BrXOK^@I?*l!|?pJIy?1!+RNy3+!}lk*W$zY z3NFG|aVfrr%kXu40@vYF_y#_UZ{myi7Oug!(dWYT_&?vdZOHzM``vLFWL)&!5IZhP z9DRcKW1Daq%e{}c;|JM34}O^a5zF~Jh%C1``(t94!!Vw@h52e~KFR)+>5ivj$frL; z$5TH?$5X#R^U1AfUi~GSSAT`G6WiP$&ezu(&KENN`EB+OO!qzDcdS1@@_mSXKS4Ru zf6V@g>0_C$<9J{CGv0{5gz3L#Zzq0&>B#)QW&go?`b2-%FwT#Z@5tUsyovdccvtqH z#J(Ry&cp6-zB~`?S9o6g8+~5;hxv|P$NPVr$$9)2=VDD*566-di9ScHp65F0crRQ` zTo--sx;Og1s2;AJ&>*Ki4y$gEvrkUyeGx_v=C~W8-}mo}b#9{n$9mWZ8{+id!=n8*2RibHPLKCT&-F}*puo(%TK@492e z^LSp)#D$oJ9hjbtdy+Xh`ON3**P2{XG+{&jZolVVs4&7d;z&FM1C8Ui4gaoOBTSUi3Wlz3BO9J--0gPPi!N zLL63oQO?EekMBh>y!X6>^P3r=|HoKlaLy3Qz3%FJ&!LoOF#R%Y9=SYcSbDntIB~`J z;kX^IK+ngO==lWxnIiXCtocE#z~6K}>ocnkK&TX7)HNUtBm?}u(je?N2w`um|f(e~vo zw0*f7ZC_@h?aMv5Ki-Q?aTa==??cb?{g_Mn?DTnlfY`sMF$Y`WTFHWby>_Vy_R< z@9mS@Fdgf3mfM%|-qHPX8>P#U{%`->1JbeD{~eg?em2fM2)LsTiBZs+#3C&2_xGS#Ac$VL#R!?Z=2IkL6|&+n;5k{TVUk*||By_G`#Ec5ZGS z+p#}GrswAtq+?|KyD+zy`CWezx_)AoE6J@OcKxO4>1F74%G2{XJ!f$|w=&Gn^FQl7 zxcac%!_%=2tvVvNRam}dZi}#7%Mja+QqFc-=eDD~O;y|6HetTDxkutL#7Bks+lJ}R z&wR9tN9P_xc}{hEW%&*vcDiw_s#9)9Y=NDb-*yO_ZKGZv8_K)pc0qpsm)o7`-zU4} z9)}lJcQX$6k>xv*J#%~Dpz5Bv$5XyL*-KfD{-5$a$=C+GIX7IGc0$I{iNmW&bQMsXjONyil(OX{cw&dM?O4A6wv<@z%QwHB84a&U3%U^xX*4w@3R@q=kGCZN85=zu+?my|M4=~p}TP11N8rR zC9!$2e;42$;+1$W`hIa%*gpL~`hM~L5YNt?!*uuO0d#+AJ$W2$ zN0y`Q)Dz5a{=EY2&!6P_m>)hxY`e7*&BLEY^YCZTJp5Vo{5^-Bzg6h@dmcT1FQEP2 zi)g?9658*tM)UTU@h;|HgZ_?tEt;=vxh8cVyh?q&g!R;F2+t^aSN>-C#x zy?-k`|J%4RxjtRb-}(RQ`9_Yt77}6UM_o&P|PnZ(+Y`5})LLnwuIAN5;cH%l$kzH6D&(9QF%zJbWuUKKCU$KKB(q zvz+mN^!Ey1qvNOFpx@Vji;k;)hmJdbkB&S3fQ~!#`2HWm z_x~8a|HttCKRWKX1HLdV-0qvLG{qvLIdpyO?aqT_8%(DAmW z=y+Q*biA!OI^LFnjt=Jch5uH-Sg3Q_X6g( z-MtWPcQ0c7w!0S-+wNY1w!4?2?e1W--5r8H?+iuT%gfN`xXaP!xMApX+;H@GuRxFY zO7wU~pzZQi*pB$>aNHyFt_jCIGVi)@+}CP2ZsYFJQF;G6KOUPmCeJ)(Y~DDI$Ncqr z^gI(&K0Yr&>~UA2$4yLmGOwE0<45wX33)fL9gi28eq-Lmbd1b*Q{E)X{jOO{swd}7 z4f``i!~S8jSk?5rX<_;4dE`;-@6B49SB38^Hqn1K=Xh@m$2%kMcGhn_LF(@vd3O?9 ze=*eGyO^)0=I*?iOt=1GsK3ibrt*M$iOmCMp?Sc4;r!A6qj|t=%I!BE2-};JH<$I> zza#Z@UfzT0?IX+2&wD7WZ+_l_&|W;OIsPAMq<>$SwId(DS_% zJ>QR_=lL<_x1KFS>)GQRkM(RhvFH5>w4SX%>)DfNJ$nj0UtV{8n)ndPpFzJDc^18I zYy0O_dA#R;mHr>?pI^YnEcYTFiZ7wx3)Ig4GW%zLz9v2YTFhtqE9iF+ucF^UyoP=U z@jC9qde))u*WW%FukU9DQ$Ffqf~DqyMkA5~r}= zhoSFb4@dux)Dc+2dRyRL)bEz)`^{G9cLS|)B==z(^t*v0(fvIN{cfNw`rSY~^t*wh z(eDP@qu&j5K))L}2K{cJBl_JyC-l34&ggdo$D-d2bV0ux=!$+fa2)!cwHx}LwLAKr zwFmm1wI}+XwHNw+{&@8Ld~fvq{0Zpa1vwFYpWFwn*C(O%x-VLh&4_Q%41W`*HDh3USEjT>xN!`Sc_lo}8RN zmGd|-F-609MC$Lf{F^Bsot&gnxD$2ZzDFJo`L4mx1;&=9cVs%C(caX zl}|rK-g&o%^5xsU9>%&YIsPvyEI}U5PzsG$h%=c{mDq{cM z$8+f4`ygid=ks46HXlch=f!Y*9uMme`O0cEUwN7N{2ksJ^zW#wMf25Hu!{5iDo()H zaDUF@>$sVC9e#;#;GX20`RiGqJPoSfHV(&wY=2|^J7K>z=5N5giQi+nUK8Kd zFph2P-^191{ymKM(Z7fB0mt7h`eFV@#QttlkL2(3Z4T?*lK*j7@0R>eneVvhCmQli zig|4(D!~@aqWb!^1sAk)nDarV?TWFhf&8%eZJUG^-cb_`Kjj$4Ef%7 z%xAv$J$n9rK=ZvH(R}YGG~fG~`OWu!LG!&|*&p-0?ZoDLzoGfw?`XdF2b%BgK;QT7 zMBnf1LdWI*MBn%BMxQhOLZ37KMxQhO!I4~#J?Q(Df6?n&gTB{_6r{Ev#hgf;g1rh- z=Sls2WnJ|5m3yPlGxgBlyVghRLj&}AXCJg)G(_vgzPM%q{XhENwGsN>b$?^_>j0d@ zdX(Cz)N4$MV+4oC51(u5qZ3$orQ3g2DppWr2qGEvdMqposE1k&=R9+#Ac7zt_Z4 z4fPaRE?!U`=8G3pg!$qHhcRFOiIp1Ow;20g@o@CLT2tplzJM{iI8ofW-Gher8hk|2>y+737CwD~aNhh?PbVlpR zvFLlyE@(aPij~|?$D#LCw{Uzt3c82m>rv2)^&c1QsbN2jyGD;M=$($$_wOg5@83^E z-!Jt+-?N{D-fw+z?Sy^>C*!c{eg&s+p1j{M{JqWo=>N$`z4sYVa9V-Sp#uueU_S4+ z)6x5lnDR3V&LZ}{8;IU_#FU?1a1OEeAM#v#Zowed>-~mIKd<2Ybd1b*LBWNT`&_F- zt1c?IgmSlcF}gis)^lmWWyEf8aC-U>bh|^-^D&)zcX`2;#C58#C>R#%-Ed>--4)7u z=>IWRbydL#Y=PH?<*wFHU#|(vjWiDR6kG!Q zKCdhCoIbuF5w2I2hURdak;g?bak_7Ti;idagpAtL`nBRgikF!jNy?hvu92qxt4+G~avx z%{S+u`Q}_S-<*f$n-5~$Df0^+!g|x^7cAvEjHrINU_tsiAo=FPf<@^V$u}1lJd%!) zd~=D*h2uu@%|{ECQ68J}n1*r;`R3zjzPTLDH=jWB%@t_A`6QZeK85C+E75%OX*Az_ z2F*90Mf1()(0p?hnr}Xj=9@2|-*3K%=94d>`Q&OepL`k3C)c3)KCnoqus=9BBueDWPMpWJ}vlN-@|@?9LBe6Qer&eOoe zCJpBa$tOQ3_=xh+$qzM@W5_2rqxs~=1*v>;3$gj+CulzTDVk4yhUSx>~swI;;+nCQ?tF`H>R5}V#pVNNAtx$(0p+RnlJ7|^Tl0gzW683PV9EO-Pt{;UqM<7RuI<7RaW?f2;a(Q&hSlzSi6CyquM z6z)@)I({T>Shz2-+d-CZRJdPQU!%eU3cZf|YuG;|k2%<{Ig2c!FU z2-?0Lingmw(005j^P5LCL-U2^g{eFygV=UGhUQV3Xdab?=26*b|CfXIf4OM?mxrE* zd>sBD&;RJ}iVAVpT;Bhqzr!uY9m&$d5*$=rT1dYXz6;S+)Ti>oNM=9Q<8z2{oc*<3 ztfbs=x5LuY4>zV=I|3blYJnS*EeliaWGfBlskWVL!|~Zp9?5oXACD?bwU2Gl_OTu1 z|7{=J7pB_B4s5?BaZF*y!c_Z+w2z$%I~S(fM-1)Fv1ohK1#NG-qV3IbXnWHQZEw1x z?M)A~z3GXzH@(pI=6JNd>5aBGC!p=kiD-M%2W@XoLff0ZXnS)q+TQd-+nZC+_NG7D z-kgfIH>aWP%>cB$IUQ|p&OqCnGtu^DAllxXg|;_mqwUQ(XnS)m+TIL8+ne)nc=G(h z3qw7*h?zdJ@LHyOe<9PaD;!1abPVmuXy&V_8B;ix z>9!{r+LP-7f9P1P#ZV+Ww7Uf80KCQ}5H8(ED@} z%k`w*Pez{$rcmA`-L7n?npQYHeV=2v&u>mIe@lA#ThaUcHuOH9f!^o0Gr#xw9q4_2 zC&%UU(p|*f=Xay``AqaazX!d~@5L5ue-^qw_o4Um{W$Ca`hV=Pi2fgK@8)28=AVn5 za30!DJczav525YEe6$^S7-9eq{R7h0mm8B!0H= z|K?|_XkW_NkJ@(W1=eS~^rGz$zJ&gcZZ-Dc`R-+OTzw5XuD%u>SAPXv&#P#=^%`zW zzMgKk*8R6Whdk{~>bv9LZ?V0a#M_1I)9nz_4!u*jA>9sP7(d;Jj-S4Z{vE>i&~eR8 z=(y(lSj6@}K*uXTM8`otLdR7%qvNU{qrd0cg2yrr`w99x;ZMrMZm@OSQ?5!F8y{*=Cd zkUa6{!e7!ck|+LJxIG;sdE##_7w$JCPyC~BC*`pzJ2aGI$P;&=dE%dFyS*E2um3{Z z>%YggSOWV(e`>@w7uRBZLb@l?e+d>dwl@fULT0I*9W2Pbz`)>J{WDU4?)}OL(%rS z3EEya#o@_jMHxlr70orAAEdpG6=hLAI+>}V97B7Zjkec0MXB~Wm)Q0?4{fjW(e}Ck zZLbS)X0oWretAZsSi|~|_PDgDqA1dIKKDymQ6$kNT5cSkmyqf4q7#^Idycf%hlSYo znwaTF6t!Tw?I|+7Wl<|)r(Lm^e0iX3@ZOtXsG)XW>>n8|??q!5Hnw zxnV!gD;gB`|Gc6LSiW=gd=1BMd`$GhqW^wR;P+)0Gu{5;5;Q-)G%Qd5kLJfiLOitS zGNyapYP~#^4=Wl@x#zFeD?<5|MI$Kp{MC9DvH9H9OpivcDH_T7vmPPwwMEwvdw!Aq z7+o|9SK`=kKaA0Eosm5I`l4|~sXQA)|2sZ?U8>U8C4u%kNwnXoM*Euy%y0jD1KR)I z$a%50 zx|8jDU)|1pU7~jwhwGx&hr1~66urA>X1W}y5BC(^n~stCFstakbgb5g`_cL^8?6ry z;1qtxJcs%FMdlXGBX+z@cg>~$$M2Z`A#_}EK02=WFgmWd0DofoLNs4kgysv2(R|^N za6C(kmSCO8(xS)MPUq;O8ji>KnCP;i$J4Po4!0c5AD+NNUfVt{l|MXH^kk9!`%^_v zbAHSpR-*S6G3Cz`JxAsKcoHGFKB=EE83rJ$KlD}iv9@q@9!G!U!*_V zQM4=cXFD~NW9ZNRMEkSd>Hh35V*9hd(f;fov_IQ}_Gka%%w$cvKZ_Lqr$5^_m-9;; zo?G`SPJORY7yW-8d*jJiJH38!Dt~N1x%uNh=yw(k(fn~=^m~u}(B&JU%kPgHlLxq6 z`t1Y%yZvyz8yBap_rb-HhFzKekmCRST-&5Lb-kOi{hCCx;^xJv>y2FRjN({v>Uv|y zA2ZQ>C=1Q^veA4m2Yp|ki{^uQXuZfs>qP-tFAC9mQH0iuVzgeAp!K2@trulzy(mZP zMFm zKSSm_rMN$_^I^z?PG!EDn$wC0Fx@-|LmqTGng^YM=0RtodC)*K4>}9YgU-g;iF4dO zdC<8U&KJ@ypI3Z7)9tU3_=4gKiS4J6_@d&AiT%61$o^guj>G+B`OppzM%&>b>|clI z(BjLO-}X`e;5aWw`h>^Nef4e$fA;dB(LN zzOHx_)7|e{M~Ct;#bYUV|7*QIl#eSOPr1iYYZbA1MuO?lNV2$^kIFCr4F}Zk3aVpQikY`LypPy;z^D`aopKeC`r(4i|=~m`9&$tcE zGiGoe%`oNzuE_1OC*I^#|e;^)2-*?jghUMoI`<>mx=y!Gt(E3Ju7W$(_+(-6Di#e{E z#3RK^((Mz{J}oVNG~GU7`1>l4q0hU^@CAGvZHJbl?a&iwJG26Ahn_^+p{LMxXeHVX zJ&m?Q&!FwlvuL~X9NO-zLff6^(RSwrwB30TZFgQm+nv>DyYn&*Pp&C`C0ysV8m=?a z?z~$3dT4iE(@>6~-C2jWJ8z`hoi~YXZ{9-No43*SW)#w{q~Umx`~3jt zOMJxsBJIXOC5=l`?FNQ+<6!3V{2hXxzeCY>qY2t>G)3EuX3TH9(Hw0zGFY$eMvT~Y zBNJ^mve0%T8*Mjo(BF^dvYysU^GXU>Ze1i_!+s*=g(bz5zZNOdaDI^EDk&+W{KH78 zhH|95yd+Nfn~@3)7O3Zs(l(b?#kGCayyu_5ZE;*9e z<8Ffp|RUCGgG&*Md=w=e0Cj*;UyrleCizK+WFSByuN>s-<`Og~mR z&Mq4E4_VJ~B|XCQZp!rT8m1%vH?LPo&#<0eCC8`t2U)In$=|I!?h{J-g!6HthUJj* zlbp`^=&PaJ`B%{{^kcf?lBblU^2+|`cgLrq-yNTZes??o{qFd5^gG@&@Pqpq|3~xC zf#~`6a3L`vUf(CUIfOMJ1{H5^29LF1e&6 zm0w~#|L@tQ==ZvV(eE6Gp!wubG{3yea=!b#9R2;!Fm#-8I6BUF1v<`nB|6SH0v%_( z3LR&>8Xaf61|4S{iFK!3S8^@Zn|@tM75CkU>QN=5)At=R&N!xIY&u598LuxHmyVHf z#_=u}jvEx}oaRNHdcmq1lcq5uePejKXZ$k6yN$7avWOTf73Oe36 z6&-J!hK@H*N8bC)z*Wh4znkqy6Jd zw12z@?H}(&`^Q;m|9BtTKi-e_kF(J{{Q)#jpM&<7bJ6~C9@<|%i1wEcq5b82w7+~9 z?JpOg{pCU&o?KM&2X|H_ezq5jTDto(2NrG0*;rN1h9@{U0&YpD%fV>9*g<^cPEB zB6d24{&6+))zrLPvWDsQj~M#LwP^qN3fe!uiuRAMq5b3QX#cnlXD8lpyY!E5YB*lE zUnlZ*$p)tT{o;DopC5TA#O7&~Gks&pdrbGc#dp!~7L6Te+!Ut2U-AL5<7CM3d>D?; z<6-@w{oIVUpC2=y-$iXfzl-_={VwWLw%b1XS;^*uj^^Jo=Cslpmd+oRKJa(-)_kA_G9~^ z*I_@j|7wKxU;Cr|)&b0KzkMLuZy!{e>bDyc+m9WL_S=V`{q~_~zug4=4zelw9b_}~ zd&1`EcaRzAb&sLfJrlj|S**W(G`lp1*z2x-50{Hx|2*{i=i{XNc>YJn^9s@Nydrcw zuNeJ)uLS*mvJ`#(C_}&FD`z{I5uX1s7KxWuQtowCzvDZM@(iXQj?E)Sl(tAuSJ&5) za`Tr~m=kGT+9o|+{T}m3^n1*s!u4ub+7|0X+Lg9v{?^f>HEhqgRkTB?&n;p5;qNAN zD(zTm|Jib3r(rsVe4u}6B=ZsONBZXw zpT_#l4+c=~xYOxqesBhwADoHi2LsXk;4Jk0<=N=_%X84b?|Ck|-a+X9XFCu5|7_=@ ze}D7>G=I1dE0*y6KW-?|q4`-9h^{o^RKe;keW zk7LmOaV*+DUXS*Vh-kq3-JeM`l2OXsCy zqB*@-9IKKMVdVH9UKfE}#8I{KN0 z>BjA%UzGmee*8GIuSxxY&PVS8&L ze``3tRJ^D3-*k*@zos-&mb$LBMv2V}>XdoD_A0Aemby=nc<-`$#9nvgd^9Mlk1MfZ znR&rJ8tNyK7wlWMUs)pU-VtM=AwUJDi1^dkJnIM zfY#qawEh;cA8n(>WhKO3UmZtzDf)k`%FzE~RgV50t_rkX$I*VhGJPC}VNT@mvLh&W zJ!-$+0`1pZqW3{7^gd{f-Un^a``}2lo*#wQ|F&p7X~%loM2{|OPwaY;deEWlm~^aB z>QBdTJv*0m!a9-8WnGx>=;*N;mNRY_?OOJ~^M>wa-OB9eyO;IkI(Z#?px2Su{=cj@ zvDfo>^m-CgenQ!a#9mh5Te|%~#xG`+-JXt-@rygk z?o7wX_{Ci=7tSX#elfG`Udm%r?$J<=Vfk%~XT7u?XOVPaRQ8e#* z49&Zip?TNiXx_CP&AXmJ^R5+W-t{D!cRhvXT`SSN>uEIadIrtAo<;Mn=Wuv(RoM%i zpMioYX(`W(%>zCiP?tvEaJrQ0X( z`bxujLE6i&%f4f}{rxwrKR@zqh;45vXZrVLKQP^X9f^M|`-Rx{`6sj={~7JaDQEhx zWxuhWHIeNa&IeNdd)Xhv=3VOe#}3M)k)7eZc>L^7Xovqq+u_~Jw{$Jv|DpZZ->kQ7 z^q;al#O@y^j*9+UR+Em^agIoNs-KFMM-oRy>y+j^&-b{VEF-I`2))vGre{6APv)vTSX5p|G)Xz zp-eX)Yl7xuO~dl^|7bqeJj5C0Sxoo(#8^*0O}w$&tu42l;a^2+mxy>7J@ z5Ic@ih~{NQVZP$>GGdRn1ihZ6==H2EFHe_Oq|4)Bxytgx+3uRiVH)-)6(3RFA{`_9 z(XzZ1vDdxU*2LyzZI~X799e!;dFnnw;X^ zQ+X;c!;qJCW_kPbW6^rl1;g_{hUb5@|L(^8=4IW{ysQVu<2Xf6V*B%6XkK*2veRd^!pN&B8 zv#Zei>}vErx(215(evK=yV!qbV z@fwyhZWT?GC)2Sy?p2MBdrd&cy;9$wO)S5$+`MgK`6TLv_2wqD-VjqhxqK?I^=ArN ze~2lcRz98BdW7VGH<#bSdaXCe^jphsOUFnaIHUZIuwS=p*iR%6ysP}qF#lcUGsE<| zHB3j=e@{92U>J9*%?oFh^M4xG{?GW){mf@xIGb|w!Uxd5M>7X+Wxl!S|8tp#=7|rY z%RhwXd-KtJ?_o55T!7|%3(>!Gvj{gP7ni54$V7Op?Syi zXx{Mxns>a2<{dAgdBTnUPbec*U-Gg3oHSa+3g-=6lzCg_M&&$7Hy6q=2eQWub#7@VMPkhCEH8tDH zzh=7m1crR#8#JHz7R@KVL-UF6(R|_uG@tkpXD5DgyW|r;YdBuFPyb)Oo$0ps$o~8m z_Rsxcdbq#-K<}>|%r}vGxDzkIU1)pxXISp9^4(#5f0h5kezuJMt>L~fZV}z{|MjOe zOt(LcRHXXTXodU3^FP|3?nSx%Ufoc>cSSv7_p{de#P&-Km>!MnQ_-*@b)J!U--`W+ zJr1N_+P|U^uEYZ??3WJEa30Y2{}qiZ((nI?H*vfNv%KxgA?WcRinc3F&~~LM+MYCH z{_y@E?UyntQtfe!*!Cq8!~1^>@Bh($DF^L`a?!ufoQM56uleZTAt=DJi3`#5U4)+R zVzgfW%Mu&*TuL+^oWZ8{hZyZqGg5c zVXKNZ9G}PE8a;ku%8#sQOYC_#3Ox_Rl((xmn%MJ!w6EG(9YunTA6||eQbF^n+JiaH}wLR@+IUbKkbG~}x z2Ie~36?IY4Yo>noSBGo=( zc)xx+-p=#a8R&D}nb>h5{XhDgdKUVedN%r;dJg)WdM^5$ItYDEJr8|OJs*8ey#VV@ zxv1hotT+9lip#0DBdRa1xFlU~k>}J)D+Z@yM*E3daCq|8iW!`jfr;BRoEM~@xV_>|%10;f&`^${pSTO{ zC+@CD^%FCR?I-R*`-yweeqt8dPuzzyllO;uHzP6ozx9sxYEH$o)Gzx9q#u|UV*3GN zrax3MpXs(|$n=LR77#lfLqD;Q`D$twRV-$@{RD=7;t{l;Sc3KwOVNJfQM8|U4DBbD z;q1iYZkK*yxrXC)`+VnB@g&o)Uqt_pJ`X+>%2!rAP27h24cX6U!hXA-EEn33=g{_J z75jBW^!bVxnZIlG3mX1D1SSrT(*NUOxH_z7O~uP${c9@LQeH{9R^TfvKY0!PKi-V5 z;T`xo4x;^AhqjY%;Qlii|HlH#-wNwpU-5QW@A`@jtS=sYN5lJAx1-heTcS)AEE8xX0#prnECA&wxIpOC#>H*{ZnGw#m~@w;d8WK z_yX-0wld!l(Jw2u5qGWrO2c_FewpL^n(3aeZ;1Up>9@q5x9`I7{ZR3JIKCe$ex%&< zrk=N-n71Xu({eqsqU(xfo9X)@)q37>+oPvMguDSI8cp%H~#Ls;HkB1QdiRSCO z(R}?cG++N4{XYl)pubn$gZ{4MU-Wv^g#C@iBXR3jG`?5d>rqF;`8O_)){Wagc|B73 zfBks9xcy1}_&)Je{c3>LFJj6Y#`h!kdhCl{4`Rw2#rG%nx*+}20r3Obj@JR1eo(w| zI!5}ZgX4#=ea{=xFExoD8s=*fZ<;R0W^Ly+i)XT&=d(F_J~Pns8AHz})0@p&lNHZP z&zGH^FDE@;ZhAhZvw!*V0_OL={2kZoAz}Lwkj^+r8r_Qa(C)f`)Po?RFou-99OvYPb6m+istXw%h&C zcKZ~x-R_Swlc&bb7iJ_*)383|JHpfBXL21rkDQ_0uPeqQEq&6O#du0Uc+?c_!8lGJwCP<`i*Mz zzMc@4yCFW2(>oc55?!lQ_m+D`k{xJ-~4<5dY%@d z?cO4^-CK;dcaJc?{m>G$A6m-#?S~#Ew*7ky?T413{m|oRKeQaT&)q)m3EVT6d>id= zo<#eDr|>-5xs_Od9{qoMz0a`S$xEJ%uOfac@|=d_K+2zwzexFqkry1J*Nn$%paH?DzV} zN6LP$7>~5iAICop)3<2i?Z_t@jtklD*7#>Q6h9B^+Zz7@UnSlamitmUe_v@>4r$-N ziGPhP@cS^|x5|9qX_yb$zaQg2U~l}1`8-}^xu5M1*zaHB+ga|-$gdifL&|>({l*)S z-$TFQ`DXqM|IRe+U9|t2UGbgFKM?<3h(>=kPE39aIf&#Ykl&vm?`^*ahq0+bq8qI^I8vy?tc?> z|C^%w-wge~(aq80$Uu)Hh8{;IdK_8kab%;%k%JybE_xh!=yBwuKyr z!cL4g7o-1Ix&&upDf)M&%g}Mda&&yK0)76CEpP{-5f@F`IGRBd`zq(E@W> zt|d05ycIgG*cyEg-3EOReI)uG`Y7~0bX#=Xu^sw+eKd9_ZjXK!-vKu!kE!JP&`)>N z+Ws^A-m-IL>i3q%R;K>nMi=z&3w5nb{e7Y1(7!L#tuhk+-$r+QmgDHba+gPXR`z0k z^Fy^AX8jHPKODU)BMr7bn5vieB~PsEQ<=(hu<1j|lPddGrt%yujne;DM(WL39_Fv- zclD=j(F4)v=(EsqfwR%)>2uKM z>2uNN=|Sl8^m*v>^!e!X^abei^o8j2^hN0N^u_4&^d;!{!lmf=!eDfKVF)_DFcckM zxC|X%xEvi{7>15749B`tuB^NQ>rKD1a#W?`3nMD8s!UxUWPIW3%4^awGQKdf^4fHa zj4xd0a^ZR+;|rrJ$5I}fGDbr=hVg~#F}(jr|9k=^m~c<==T#3qu)&|z>*d8|5(BN zi||DDdolX=vme2)_zq(U9>(;gIEwv$6#r)bAHzw+%h2D4JdQULFGv4g))Q!+zXBca ze-d}GzNhda;*~fApT;Zj8T@}--Fe)M)&KbM8DtGf$rhrJa_{?or<714MYNX|p_Gai z_Y5hC7HulYl8Vq~DJ7Ijp^!=o(Oyc6UAlj-*O~G7`2PNSKHlfL=Gw1w-sfD`%(TSC zcs#y|{!jT^=>KFdLH{TFZS;T3m!kh$z6|}}^5y9NmcN6(|M4#R{>KXR`z`OG{gL<4 z{>TSte`F=v5BU)7hkS(gLsp^vkkx2EWDVL6`55hoe1i5v)}sB8b!b0iJ=zcX6zzv> zz$@@Gv>)<0+7I~xhr~B_{EF+oU+hZ_*FDk?`MTpK%16Y%(NK<|AF>(khkV;H(GS@| zY(Hcx+7I~-?T37i_CtQaN%0>;JvuS=)1md~UG->(w{?sJf9)6v|7Y?SOxvP?5a48xEjvH!*CW>$9Y%- zU&WfZ5NqLLtc`DD9efuL$CX$YS7SX~hxKv#%e4Qv{{h;6{EYG=aU(WFf3N!}^!K`t zM*lau5q`t;V{kEXWAuCHO>hP_MgOO|8Tvof&2cUsi!Wmf^na>bqW@Ff3jgLFs-uNKX&%?*@e4LDZaP%9D|6_Od`vUZLWcuMWruWCClwXL? z5nqHa;>Gw1UV;npQtZckm*L2{wEy@X@fG+c)2~Fwq3*W-1R-+(vcP;4`b@qhF^gPYLrvkXJO&vG;R zeU@81-_cuBh7+5AA?M?^lo8=P-Ij6((~pbZuAzTn+$wr!$|3!3uIGxBSn~7gdm3@{ zIo2rj`PgXmJ&n8gy#3ZO#A_?=PPr!~(I3XpA0C@L|Mw=(|2VY&cOTmS8;|ybCNRJK z;rr44@B?W7??JR5{1Dm?o{08?AI9rB&X1tuoR6a8oR6X7oR6c|*(BW0@Ay1{j(0wZ zJL8j6p2AB;O-^~5_3w?-{uBGZvs3U^mir9$;Ch^jUXRnz>v1}IJ{4 zUCu|Z%LV9lxe&cB7opeX>+GM`uE0)+)eq%xRLTt(ElY~i<|iTIy`MO?LRtx{VDpqbp!gG_A~T%-akkGzxWIEe~LHa z737IuqW?ep71m)rU!%`+zrkZUPMf%nYehDvd`s+oqdvdgg1$$z6@9PgJM=xG@9_ux zfzLIMF#eCtB0r`4Ou6-}`X13Qls9Giuh=B=TgtZNboF`g@96mZAL#wP9sR%WKhgXA zFLb?s^Lg*Hf3Rg_N6JphU61-c(Ju6TqTOh{um`Od_M-K|K0envxpdaTF$9GPA}^@wDQ%-10GNXi{|*Y3+3rXI!go}52q z+@(?K(cyEAQjekB(p;Z76qq;&}A`TTej$ueB|9X1m& zF*0tEmf8_FVhVnZskj-_lk;Kd$7kTWcxGy%zn-O`y~ofG&Ph%5gLC;@Wh^f>KQ+;> zM*6`8sfDSDel>>vS`qsDnZ@YuXO^J<3sj0fyh8hrjkxd1(f)4_-?7)ljTT%=z`RScJVX2hYO{JReiA4|c%5*be(8*N4@2v%US%{>p`Df8`>yzj86! zuet>7w_J+$TP{QUEtjMHmMhSH%av%qWdPc5xeD#KT#fcyu0i`P*P{KFfoQ+wI<((1 z2<^8FM*A&8a7g_6)S;>NTW-*Bo{{5vW9l%!MBax>a*xg|BxZ@HD&e#>yQ z-!cO2x7>#ITW-fm@jJrxG%;{1}=iKaS?flWBaF@-yCn53{1M+ymSglgma{Z0e_85sVvoZ?-wEaKrmmpe z<8jdUh#lv9pXt%a2dOJrp64HlKTQ3I*yDxl&+61wxClQE*ZCR^=LN|lKS^Din#dzD zXOyp87{JM)I5OsedM8B%k>!_3vbiZJ+;Y^upz9@$?z+2b+P|1Pwrbh|EW-b=6IS9G7)c`!!6=@KRj?mcOG|7&hW~#) z4AaKWA6Xr!khPJfdD&-89?%dTB?nT+eTP^!yT2-XN_Z zvFG_n^gI(&epK4g#GY?#+_j=n+A*xp^NUPxoYo{6YnM^Y)0$#GY=+(O*zh^}|6%?X zX~%{6=>LcL=>LcL82@Mbz>3ysC$PR&700Kw!S-nE@kG|&Hti(h?1~O)?ZSK=(%NG& z@rl?To$ma|@i{roe52*4j>_j#LhN+n>id?3yd#Xurl-*!6K7zj7wG?Ecg(_HD9=XQ zmmKtWtaH(EzC0Ys_+>tJVg3SiJi8Db$1Xz0v5V31>k_nGD@EJ6GW5N(a@@{(PC>^f zJK+xEQ?V7(PeaGiJEP;2r{iv>pMkb#UGT0KdH)Yb5_d)0scvbBcB(tE?d)0DpY0@{ zX|R#c_ef(r2hYJR*b^Pk>4nL5Ci)rWy*ZxN`{$wc{`qLV--qk1S(N@iHpL6D3HHOr z*q`})o^c`Z?8rrFthZW(-<@LQD|*K=+JC0U@lqUvm*H5vocUWs|GM)E;$e(WU5SrS zJ^&}-Rruy}wEy@F@iokUY?St&cp>pX{GER3b(A-!d=T+U$_L|hEN=*oh|&MY^_1U$ z?&nbEcYkg~_va>be}BXaRj=*x1q=DcJz4NfgZ0r@dg}; zH)2Ivq*^szdE&T4N3dOS%B?p?q4nly9KP&-`SF;vNb`9t|8Dd-(>-_`)5l`FL*^UD zePAAaALZuJXixxbHti@B5FE_x&nj z^V8L6e!2$DPd`TU(@$_xd~GE@Lf^2*IZmk<8!w#9SeexV-6qtWBo2tAI+pvSQ> zZXs@h+p#G+uF?#*k(V?_$CHjl$B|l~<5exuai3P`cqjQv7#C>GeuVyidb0nI{txvD z==1irxGvrOVQ9w-(C6NTX#G@#KKCw0 zpL>^}&%I00JfRGI?p==N3#Xv@LMQaO_o-;!a2opDyE8t;^T*TC@qjbX=dfLHGTVJ7 z{!H8zrxABUpNDowpL3pt<_~AH-N!^}|A}Wa-#K_6pX-S)F)q;y=Td$yzKp$b0iK7C zbN)9*OdUgO>&t8Srvsa__>@{dTdo5be4n*tO>(F|35L(X;M(f!jXgzy94vF88eq*=~ zhibTO3tG?Knx4q7h7()QjzH_#+t7OUcC? z>BrG}dJ@wAcfI!iH5{+R`X`6&as9-ho}Pl%W6$t8@4Kn!eK!p=aXQ=4C`$WJ+>Q8I z?7wto`g37_X#a^XrTlrk0&&->zbCK84=OS;Q&qWra`}HQeUvHuNwIsP; zZxh$ycq~QtZyEN&<=B7eJL&Hx_Y=c@u0Z$mJ-iy<$3gf3?w&^fA8#Q35F3tKpZ*aJ zerA38Djc?Sefny=4cA}=evEhFCwK*}#lZ{Lr?12D#GkVMDiQks#Qu-$2K?9Yf409o z@_G6f#Ew&|0c+OtK;+EP~Md3o3Ke_bNV6u(@^hk;XGLHZ%x+w z-(eod@B2{S|B$Tje?0WQ3H9^O+*jtCzwr6W*stloCF^ITe%_Y;d$NAU>g_o`f1vs0 zb~KOt6Rns2LhGf!(R%40v|ieQ)=N9ldTAG0FYQL_r9Ei9v=^!m7ay;K#4#H(dg&oDnYOvC+z)JruoYEeESUQ1%>Qww76r);)D4?+l)x_AE^i1VRNQiZ@$HToXC2;emYQYf9Is+d?zR8>xk>(DPceR#ZnL5 z&u|^3a~!;mGFVP!EHfi3Bhk(y*HLyxPDY}g$MBw6E_xm1p})(LkG8u7*o%H?A^Kic z5qf^5Zf*hGyRH;E17P) zflMEeaTT%CF|=D(Ghb!pH5u13-F6E@yEPDPx2{9mtwCtJH5hHThM?`%^*AMVgX`t` zAF5%0U4NCxO&P{<+nCS%_;%d>4DCN2 z;CS4Lsnnw*u`TU-1^&i!=@{F8bTpnZir9Kp8!kQAuHBU}CV3xXxDW46uJ4}Y`o^O7 z;l1d6I1arJ?_+-N!|~{SIDz%puH8@UefR)+A3liQhYz9m;Y4)%AI1{iOL+v{{zuX6 ze+=FJ$IAoZ)!k(;3gOU9DLD6b$WuD4&`!o!IT4 zhHgJG^Uuh5me~D3#_wikJjZg~Ze;rN880MbO}%?o#%#*Zno0kk_(1%{49ES_nST!D zeJLkyv1b0fjF*z<8S5qA?+*3IE3D6Ys5mc$;{2WQm63qsjgU)0g>qrZ3kp-Fj_u{N0Qd$$AKRZ}+{7 z_mlMy*0_}VhxtPNwUYbH`s+jHtBie=u`2mFr2bl+u_pOB4DX+QjJ|*R3Htu&TJ-(X zb?AGi>(Td3KgIFXV;gWfeui@?{~WFVzChnA-H31Fm-r!mg}zt%HTquZH|RLdCiHpe zX7oAdx9I-|Zb94Qt+)-pL*M)S9$&>D@JIX+eUI`d^gYU-(failw0`{+tzUmb>(^~) z{rWpvzy5*NuiMf3^-r{Z{R^#6|3>T6f6)4L2U?%*MC;RCXnndHtxxx$_32(565p5c zZ>UfAYp6$%`t(3XWvEa8(@>6~K8<81>eFauqP?y{Y&}{Ptw*b&_2^+ZDPBF3^G!Wf zL&I{sPF8W=Yh@;$Bi2TrBi2EmBOZ=EN34s!pH~lkKd(Oee%=x2`*{t}_w$ZK-_L7^ zzMpp#+7CGzeg4=8ll>2_+s2tq`5pOhBTba+cK%4DyjkY4ly8nS*HDg>x5#Wo`Nxr# z8m@Dson{o$_xY-87UVj~QFhFY_X%PpG&svp+6F z;_!bN82&HgVm$Q!GA?ELj20JQ8h>D_E}Wag5k@EsnOw zqtNzvG}<2Dg+A{bgT7C7H}1rH(ErgGi#`Xum-S@L9hW(t<$f5sPs4s7IVXSk(yqf2NPEcsBESrcbDNE^{U>L*j5f zA=6*Td@)R)ojEH^pKTnA@Og~Z=lst>-#?p6d9BF2%$JBA-_$ekWjrVLO6F^PzF+KB z4c7&7e&%N`4CMzx54<`sNL;yUNPNnQt=P`UXRN^A`HtX9@b;=WVpU zS&G&-%h39!U-+HycQfDN|4Gs--pzcE<$GPNK(8xe%HPjiN$mCY0eXEAQ~qJ*N5o!d zNWQcxb2ZELxH3Ej!fT@`BhlXmdvm5hxnGvZ*UdmoA}(lb2evg;d38HzSXc^ z-=7-hL$>dq%)hZK?qEKTBl5YOnft@%c4hA2bE_h|HGB@)pS@1!y5Fav-1&P}{F_2z#`eoyZ>^!swHab3Jk zSZ}}B@fz+o40&$btVEvMj`dW=+Gm}ZmFTAKGwVGPUhd#0a)jw5tJ|3CXwbo~4@+)6*IGak=&o{o;=pMic4 zt_%7-xHHl3zjZ~w|JDut{#$qS`)_BV-+wzBtBpG+s|Qw}a86cV&hOAsJ+pd+>x%Jz z;+o^m&FY$9`v*6o{ezp({=qPG{N-kJ{N)z3zi=zsUl@+| z7e=7{h1<~n!tH2(;SRLFa3|Vd7>PsT6~; z_{-f{iT=Vp#E!p=Mf(l+qWy+(Xush;oD?4)?x%^d35VWKq2KU8R^qwBgJ_=r5Sr&t z#Q!~KcqHp3?l1Eyq}_Wg#I}3Hbj-g$g%zTxVPiIYGy6qx{ zcJUcB51)$W;nUD|aXQ*A&OqD6XK_kwrt2jSe@?@3!SFqs7g&Ck$gHdviT&QpZ1j6G z#FWp;noI2WW{~Zj7q;K+<@2F^eHm?EUtzvp+-I+%Oax*{g>sO@4wOW{SSJ+ccABcCwjhjq33%ydcOCd=X)=D zzW1@-qoVt>{w4N&>pb4?J`ncnzpO|$zZWo_@qfzuq4AIzeE$!3PhBLw#1%iB#&vA-JbP$ zUXkf1W_L)&$nO%Jlzp->=LN|tJ7%X4d!CW)NXt$QpG(V5PnILg&&bZC-0wkXyHQ!$ zIblDtHS8Di`Mm7h@cF##+sKC+MDsOF*T}{_a5; z`nw0^n9uf|g2mVgegEoI>_mJTo`DCKcRJf^o^=N0=2=~E0Qty2*TdFb|?k8WQdbo=_E+jjxB zW;y-P_s068zdvyy`u^BOXr6a5`aZ`cxGsKaHv2_8c$tR!0K+)y6&`=aQLp59`X0xC z?8JK_bRsN^^f8(QrvJ-jZV2)d5Y)JO?*@?Un$s2FT z9-5uV8?k!%bF}|x{&f?Y4-T`O`{8CZFT4fK3vWg9z~R^vN1)%AzYWdzZpZc(C??;&G!Bpq5n_pdvas359jq> zG>;vJ=85;AdDnO}@0x(-UH7AT*8^zY^&pyeJ%r|66VbfuVKnc01kJl1Mf0x5(7fw$ zH1C>(=ATcXdGeEJ9{LoThfYTG(5KNnbPAe>K7-Z9P0OB&)hA5Lo|SDLIz4+vcH%lf z^3Z3qXC`AL4}C8C`DBdbp)dHkaNQtz=MRp!worG+%rZ%@^N7^Tj1-zW6qp zFD^y%#bs!|xE#$F-$C=mchP)t1rCY7m;C|z)i3tGhW$eF#g*9~Q9dI6p@wn{`Qj=x zUtFD?$QRcTn=gKh=8K=8`QlnMUtEWi;_JixI5GC=q4y*8{b$*KalhEUBYEBzAvVt= zw*Alkis`oZ$n>wXzae%yhCFZ+^YQ<`+21nVJP<=3xCPAvx1xFAcW55?J(>spfaZZe zBLDyEddUNS*08^>pWpw_{*CG3_y5uFUvCTLzh`eJHoy4;&2Na=-ao_kyS;oqv`2rV z?a@EXcPI7t4jhg7=6ANk2j5Su$#nC(T4;V(JICWd z`;X>#hljXsPCcf3Tn<{F*!LEX2-6$nG$i);9El#EgYi+x_-OR^_#2`1>oI&T8fl!< zBqwn_AaT>2X2c#(WP6UyX^xAqWscWv3k~NBqiZW#3A1$ z2AY3mvb-*ltek9OkGFdMbI|w4b8$HNRUX^p^^i~O^-zF|d0(aw%>#iL$Ay8(d)8L zxGwwVTtMt`QuD)pl$S^P=Uhl^9<076bP?svBeeh6EOJTCrOD~)dqS5{-jwN=W0S}g zIsZ3*yeelvj``kIIoEL9y-u!1uM=X*ug$rR*z08=dc6=+J}74}vDXcfKMu*cp7nX1 zAk%Ni8Jdi-@l8u^%(;o!>jU}RupIKbkQd@{-6+2$Cvx05cq{h7;n*KX;H7vQ4#3-S zAezq<;GHbDQz8!IXB9b#=gTpCkNhQ$nM@yrIXD^}AG-^EZ+{H>p8nl<80YmK97N3W z!}9KBd(8{SQEpy%ADWMiNAti5XkKI znpZxCj^{m&&B%8q;V`a;C-4T!pG2RVKZWksWOTotM)zw9x?j(r`!yBauW9IhO~(zy zGtl1+dlvoOv6;9TpF_tLpGU_NUqJK8S$G!CM)TPhu{X}aemED+kLTe4d)oT>Zw;X)Ki|fIq~@;=W{)phc3uT{QlNLJc`dP;(VHyzMhlFOW#2A(#4dA_x~`N zkMesDOLE3ukho8f=le@@mgOY!P~`dk@|<^a5_u?w-%)xO{hg#0=;6I~_wi{4w)YR(_JRmg%;`7~0`=Xgj&Q1DwjQwDc6oD{@7tU$ z#IxSw`G1JF=6px&_yV#Y--rEjKUi+K-+x5!_n(;0`t)a(KPd7`&acGQKf0Fp__UT>PMp*>Ph2z(W<%ClCd^s zxrd?KQyo`~u9;f{2al?mOCE5{8p_QF)>hQct&^K*PcgKohvz1aTV3?H)kEvY`e^-l z1X?dPV1C=vBhmJ>A=_bldK9tspy%-< z^gN!79=DF@c}zincOw<&Os4%u+wpYtcR4a}9G}Z%dwNE)a6klYE>#h4vr)9gITsd2JDPVtO&=V+meD{!ofuPi5%uPLwB)_bJ#i(kb^;%DrFI z-<>!O{oRSqSnnR%fAo75XQ1D==z{)U$Cj!F;o zcSO!Xe@~?+ICP`>=iWqvvbbKI3}PzPT49W3`>{N4f2Me{2@H zF!!S5bhVwom~z|sOR!1g(%j3E({&i1zZ}h1uE2ZnN_+$dp!v{MI18`F1$Yg5p0C9f zqp!;yh=WI6m+O0@-XGYwS;dgt!MV2gLvnB6x;KBg9=$J!DIc196S4Qljp+SBO!=_f zn~A+oko@76+*?_`_XRS2c2Y+uqmuJ6opGqUa_{Ci)r*eNaNLpo8Jl|#rXzU?)9=+V9Ya2FUv8xN7_NiyI2I@1 zeRw}UfDhoI`NKo3*Zg53<>n6$qxr)lX#Vghnm;^-<`0jfzsETV9XEOc<1F_{TuJ#; z==vw4>wg+u{}gon&){n2n~Ju})6o23I{G`CGthSZS#-Qk z3vKUbqwW2RXgfa#-OstWETD-s2i{yyIhZ z+~^ZLg?KHVj_c6zoAub0_)~OTYXkPd&(QIa&(ZObFVOLkjp+Eum+1J&SLpc2*Xa1j zH|Y4tCUkscGde!nl^gpQB=jE;}|fdAe%ZSxX&8S;N%{~Cw;F%kclTbaCnk-RLD=lten&UfjX^#9TS z8LOISy<08sFs7UTAoEwxtC5@^LmpR?`6?@G<<(}oc^rm3t`3^V9ggO4bqw&z+b&Vg^u~EjnC|=0NZd598F7uN zwErP)p4XDt|4TbIIbRF(|N1Cr{#JRd!*M!J!*N2&+vFWj?05xo98L(w$>YFwg?h9d zT93Bp^L3*q=59wPIdHKod+K>9I00&?pUXMjM9E+L1RBw|Dih-{U5s1!ghDgJDu3$sa_{%B;zjlI`Nq-w??#UUN>Ubqvns@(f08y zTrs*w-q|>KRFAxKIF7cD812n=9voNdMeMlJx#+l3@34OQ|LC~V`62F;*N^F5AAMPG z>&OKmcD)D7`-k!i^DbgO%hhqDi_!6?OTuz4&AW`)>*%1Dhw>}(uB6=S>7WBb`Biz> zQtolMI{CS4(Cg}8`M_j+U6_AR-VnCq-N;}K+mVQ`&$}TRBiG%~yc>zV?hbkrvHiDU zOpiux&bx)~)D8r`z&I;3B+(`>9{-b`AFvlAqt1H!?4gpJT|+EBL&5 zK@7c~<7hrG3e5vXqj|?&%x``^2F=g!W`E4j?;$o18H?uU_oDgvI5a=M56#cVqxty+ zG(W!|&CefTId!8C<~>C0`9bcViFpqvWA*-d1igPAMemQt(EH|b^gf!z=jueC$a|95 z<*4_|Q}_r@#!2`zdjCwp$;8i~<5N@7-;tZfa%xAX=glB?IeI^N>9e?=`DfxLd=7uc z=kYIm0e#Ln3wOp}%$tpujCwI|4##gV^)`mzmz#^`+w;&o@+CB1eVO%|ufBrKBCqDX zM!D-(^VRv3o3AdwCXt1Ci;~mTak$sfak4j=Y!)RpR<0)L%v{oRmwN! zMQUD0f9*@kJ8+!7qC7e75%Q{U@)CK~CYDJoe)2o|y@5Z_?+t86^O!%; zJmxPnkNF$TWBx(&m>p;yvlGo@cA;EAyY8kUFQy`YBqiSG{_g??|~X!LsnjnMB69D{yu zpfUQrfhOqp2AZPZ8)%0Adw=NI{H**$y@}*8EkkVHLrgt-Tz+e&TaO~s+vFcl>~suy z&I!y{S=lzf9n;NoFyuMy(LCowG|%aP<~b*!dCtjbp3@Ph#8O-@`ns;{V_ulQAU{7Wry#%3?Tga><6(HPJuPN_ z+tU)XJuMCMGyadZr{y6&CBGBX-HwBvO6+}f8q=eZ&iSXa9kxG6d`5m3Vz(1nZrA)X zaS?V8*H1SM`-!waXXT%rpJ;zDv_CzP`*%)q|9YbBPcO9nITvkzdNaT6&v|J3b3XfL z`_qTm_NOn}{#<~zKmE}5r$0LGb79!ti}NoE`+0HxCCTHY9;Xw+_rxyGzbxPW?B)4a zvR>Q8E70RkO!@xYl+=Xq+dNS|2o#|b|KRTKG=G=#?0xYT_sz|$$Nupxl-obP7407nNBhSk(Ejml zX#e&vCS$I|}XRj>dKIyTX0iFE-}T`!v+6_i!Kk zy|1xsS7q$p{Bik-dKIZx@5>*bpQu+c^j9aK{nh)?_g)`B`>hY6_2@(Bd#n?2KHK#$ zzJZV6+xRG2uReyp$ND(>9_u7rGM)ZE`u^&Z=zlzq+uc7_S`Dp#T0EfgE=D!~9uSFW}FQk5cBmd1%KQGo$j-h^j z3$34*BTW*3a+Yr1-nZ`gz5n=biih{rs(*U+V#+zFZk%>q}y$ zf0Vz9>DCL#^ws%mh@Fm!@qgxH{6Bv!)5G{b<^JBoIt=6g7{>q6`g8+^@qe^F{Tvzp zcfF4PYuI1c&-j1-CZ>n+f0obqe~8UnC};ZS{BN1=I6tzzTf+9cy?j30_urxS{rAjQ z%ysnx%c&OqG5;rGm!l)O9)Cvj$zSkA;$Oq^w&nj8*0U}D4?b5l`n!hD8CQvJ&$nK7 zIS1?KznE_Q{5M)Z{}Vn>`;XSoJ43uHe=pPBuiat4_Jr8w94y}#%J=90n_QpT&p8l2 z|6hJ3vHN|{NI{~0j}~|wsuWZ$NSs$Bu2yguvBw43t{Mf^aS_%kFh8iN;kcvY{{?jl zlH>ox8#sQ4^Lgvhy6Ew&ht{9<(facUwBBsM{9*hbt=}6KBq?iKMqp3gSudy~h9{W+na z9r5{mt}XiBr17QLp5@#VIkBJvvCC2W3n!uD?CI(jZ`#WPYcI6qaYot zL^2ApSYFj=riSGiSBYj9{NLx$c?G!zwkvrB1sp$*Z$5f_i778EC?@te7oo?QnDUZ> zQeuxc(oU5Xl(Qa>FEagi^VKU063G4vD&y11;erWgb@XC?#rR0 zZY#Jwd0!&$uia5_XEH|KUmICak&Kb|*J6Gy91rCEwNV9kQQmCaXbt5U-d`JozR!0z z`aa)1XuCQVeV^}M^nJc@==*&4q2tQq(f9c#pzrhDkG{|M0Qx@PgXsHw525e#O+?3~ zAI25LkD%@HqiB2n7}_s;9Brp3q3!e&XgmER+D<=(w$qc*cKT_wot}cW)6byo^i;H+ zo`$y5)6sT%2HH+Pi?-7<(RTVdw4Ht)ZKq#A+v!=%o1@`4BJK3N zf|n^D5r0WTIfi!n6||jxwII=tdX3n2dOq4tFF@Prg=jmy2q(o~57+g?*c*pl*VNx{ z7JR|=XFH9w!%ISJJ4_sHOue)ei*Z?~hn5$-!~E9w$o%gXtRQxN4DI%N%vV|Ye!&M! zx826jZm&e!?GMp*`y;g7UWK;XtI>9Q4Ni%D>~_#@f1+Xkk@|04!3L(=zO85Zts|d? z*m~7+pWA;Hw)69_A8sd~3-#YdwEp{&`K-Uc!asSh?Q7hD-{4-{gg(dIj8mx}zQwNW z{}!yreYF)M#NS~}{61{g4+TFGwuA>-l|X{l1_1 zZBPG2+tUNA$NtiP#MbwfXnPtdOthy_v^}kYwx?Cm_Ou$>o*ss_r`6H^R1NewdQJ2> zdM)&MZEf`U*Flf};pp+Niyr@a=<%M5*lzWI z8rq=eA@SU{ZQ%)pwvTNK+ZQITw|40DMojsMg(nev9y*}sftd1>3p)~fK9Ke{r7)G{ zdi;^;X@%*@7@04lFq87|{y#RW$S%wZ^JN#>p1M6cj^lW+KbTjT=(pu#|M|54_!H9$ z(e|J6lS*{l_v~%k*+Q6Hmbn*a_`7o{IJxPeb2(>WsF>r{gg%GX9VL zZ($d-|9B?49bM7w=!R}bceFow7WzE(Y_whOf&QM-IruB~M4zYjLZ7Fei#|{7jXqC3 z4{h(yN1v0lkGp#4{hfM6eimFt2mC8v8xNODNMBUNIQRR;lRQ~JCC8Aybf(A2chlcV6>ea zg0_>_qwVAkXgfI+Z6|L;+sT{Ic5)cnPTq{RleeJlH*bm`Bj@fk$x@ z*VSX_IKbn09oNky^!pA^U^%}Z`6S-V_5Bpu-=B<*3p|axa0>eWd(U7U#%HHu3+9`K zt#LZ~yD&4*@6$euexG(G`u`cvVG%x$<@f@2##z`EXJZe15&iz{9PEp8(fbGUkZO^y7>@>eCRhcAKHfIL%*Z>&>v_%v>nZd{=_M< zzg#c*(BB&N7el_YgXLF=>@3_(?ECS%(D&ns*}gqtd)+?f4|&i&v|ZZIeEu)izi4}W z00(oO{f9SUB@V|(5zlEbivC|!6}%R!;u}~E-@(Ih6;?;TFHi$*k7}aNcWa@~acbj= z(T5k+!NH>rFRELVc#ebN{q1__``h)=_qUHIio~MP21VvOw!ewIr(w}iMUkfdeg=lT z=V+E=KerLOf5)KhZDX{(ZGyJ5O_|@krx}{}G-vtdJ;xH;?zTYlo|fo1LMt@yIS$Qh zTBCVQ8#J#u9zBjHpzpV}Mc;dChrY+w9vxpe5glLXfWF6e5_;TEMvr?(^th*>$2}E2 z?rG?8Pe+e?20HGL8TLP`D2Lc_hir7*!Fb3F#{aPc>&e62)9C-Bc|n2l`9k))XQZg8 znAqd0{{L19E}2dHkLGn{Xr5P&6Zrfo_!xFV$0<%l$0<%jpHp^bxy>WA|JW>YMo|~a z&8O7olxI@jl<8fuNu*m*_vCanuR068Zq7!3*R2Phj_07y4SS-`4SS)_4bMfN8}>%? z#PiVShv%cu5Bs3kU0+-=x?j-+ICxaQqW)YDK0m~8-Cc-YcNd}8-NkHQGiNWOPn(IA%V zb%#tJTr?yZBlBHfbOYt)dpfXUXwglSyS^LI^%1k2VMW79?Tky)`)>)46^| z6x|l)r~Suf6?YWfj_G)4{^uCGsB(`Okf5{xcrUeh?uV_|L`2JtfjG{z6jDG*GXl61-zyDYCd@@GA|L5mIy^VhVuV@bCeE&~FIVQgU zhecd}^YBXUvzO5J`DL_yeg$oxUq##J*U6c62>|qU-q!?brN`j$i(RzJIy{?Jw;_`&YZr=X1N!{?s0{zqA+aFYQD7Mf=h1 z{uk{R9l&+*|H5(Z7ppw3N8+}DQ{S1(T7*BHhxYoOzo zHPQR87JC2HM(@8m=>2y%djHi$@4tHJ{Z}8o|Bk?F$c~QN@Y# zg4};c7dJ}A$o+RrapPo++<#5{TsV)&{nxDcSjwA?Yp$Uj!~NF+9lvae)=RC>dg(Z{ zUTTfjOKs44>3FnWIsvVh+M@MRJG5SEkJd{kqV-Y-v|c(1eXe;j+HdKIy*bY*==-s$ z==-s0==-th=<~-6G~ds}(U^t)|8_Q-|L36je=eH;=b`z3KAQg*p!t6xn*SG}^-D2Y zzm%Z$ODS5vl%e%YIapK{c;9czjQ(Cmow4&r7K#$ zbVKWx?r8mT7FxfYjr{&^aZk=uzt}k%&J$9<^eXO6`H1+r8p<)$FXy54%lXBL`lS!C z^-Ev0ez^dxU;3f-OMm3|e~T0K%S9TNhtv<36p!Tkw!T2}`^!RXeoxHwD~hjVy7dP# zeL(S5#7@VM|6k2~{Qht8wM;kv$B_RIMDzda(ENW8n*R?*^Zy}e{(n94`@gQ2`fsR) z?Q{M7{%`RuOm{qV7|U-RxjDqdTW?(c=2t-_76s&{R3h?e|zyA#6Iss_UF#9 zf9?;<4|zrfnrFnA&wMqGzbA4Rn&*!}^R2sa#ptoc_u$}BV~g))Ip$j! z@~v@bzI7j(Z;faB$uNuWCpO@|aZ4Vv~pQrst+k+=U{ABUdO!v4w6^`5F5WAd%r>wgorXRyogS7m zqj)B<$MsqCxE_q3OUBQK`CcfVMeK1t=xk#1rWctWjm#;Y%kl9#L*jYGFA;klko|b2 z_+?y#uZ8>JRSnkxG7dbyctLTZKZKz_w2;r6CoV$I-|J|8_y(F6E=KdvH<{o5&|7GK zXbJmmf9P#u^U|ege`p!nA6ky~hu%TQf!{^@2P@G2!h7gA@cU?g=>xRCv=Z$veTZI1 zAK?hTU%U!;Pow?EzxaOn8Z@u}7|rWHLBGee7I!dx9aiFc^#6E2MaP3Tp!xr2Xg}n0 z_QQV27uYPavG_~MJ-=!{IQGwIzvUOS-|{QEf4`yow+-Fy-_d@{A85a2J9;1ei7Q6` zUHlgg9`$$eKb$x3BMkS^4)i|SiQY%M*dC5(@gCyPUq<^ad&70Lzj$A`9`_d?V7|)8 zzZ$mN_`k@1#sBv?akH|h z)GDc6lDM9b>2*pDPsYf6bxZ0|Za+ucjjCVLpv3JtLc{hU{gs9#M~2TgETO-`^rJLP z$B>^jDoOl)%rR)b(->dldTD}hVpCj>&F}+kj=ec<$13x;K=Uu^|FFDPY@hkuag>|S zwMO%~HfTO~Jetp)faY^;(ciCWhkie~J^DK~Cpvv5?LYc{)k)~~os4c@M|AsA(Cte_ zw=WIdzI0{&40QW4@nfcE;d0_^+<-agczmug)AP{Z-N{Gu!2&doEJX9jA~cUIM)SxL zblklZ%?rzLUA(-+_OV~=6g}8JhVk-KIZyTzPb-Op?;CgKd>zelPA^IH7tcWZi(M#p zJpD{Ow7=M`B#~Ek=Qvl!&MG;(B#~Dld1a51b4n6G*wyGb_BH4@_O<9Z_CRzT`#SVF_8>GL8;s`5 zL(qKrdNfbI0nL+#qIvR-Xr6o%nkNs#YU6Gxxf!cZxTR!diFxv^CBsV+=L^Y`N0i)_ zjFCL~_L4i2F_I_W>E{yp1@Hx=CMzpdF+#D9{UuU$4*A`*r(Avb_$xuK7;15Q_(zj8k)yWNAuVj zXde44n#ayW^VsLmJob4U5`Up&Hpj7FY?g-Oh~%*^mdvGmM0}2hatwLwJT#AesU(rd zzD#T$`wE)JzKZ6tuc3MDe4G?t5bo27v4w};r-wbq^=WkUaOD5S!-`GkrzLdrUW9L8iZ7@&U2aG33E3 znXj_)!;+7fZXS#w4_<}l!K=|ccnz8de~jkApP+g0TAUJF=X%M5*K0UluD?oTL&+CR zH=p~A<+qM}9%9>L%guu~hWWlM`I^{#?JG22Bj)qplx!k4KSTCsbJ#!khvkPnY75%# zZDqcrsZYN{^O)~h-~PxCB|j2}_8(8;`2K`>_%oi0zu;N;EB3?R@G9JfH{$Q;@9X@5 zZP@PZ=5q3!$MtZ!fBpOPKKw(rRH?kd?C_G4Gc9;WY&?AEY7#(N@rOZMEE zjL|%KKhw>V|3&lU1L5_2N&5vuK z`Et!tk8iEgI>a9L+URjV7$2UD>xTL2mDVTrJRI~0V%v)bOpiv6ENxhtxDJu{sM4c} zJx|Df98=l|7h#i9@3+Ppt`j6rZd%%`G?6D`$djA%dGq9B(ev8^&1YJo`AjP`k2#L{ z&68WBd2$=}+x+i%V)Nt^&^);9%h(y;!qagj zo`L4QUC`ehIuk#qyes-#q#OD?q&xaM1!v)ROg|g#KlDKR59gr$hn{FY-V4qD&qed` z-WbOJ(ft2>_QU+Y4>pVRExmwp_eahD`%!NG-yfSqE-bw$IbD4YaWS@G{!7sN@KW?X zybQe$FXwanB3G1NN$h!0^XviPy1csds&GADU3x9^?TuWcVg1H?A_Gf1j!eYZxLL*E z(m|!>#e++)=X&#c9D-ht#FXDqdLyydqzfa--dU@rm9goiGfESADw3x@TRO8ek*8wyx@_Nb_&E8?^JpIQ0?x!)SY;N^ z|M5uXdl64yf9K#a#B*^Y^UXv5C-^1w`}8lP`Qs~SKJ+U3efrnXaliTKxZeUae_e>- z`9Fr|{}`VCqj}O|G*5aH&6D0j^Q0wcp7b`FCoM(uq-AKHv>eTo-a+%EchNj)1)3+l zhvrG|qj}N?Xr8nZ&67Sv^Q4c^JZTl0C#}XI@inENgnIj94aXnJlh&55r+h?worZD@ zdD5q7p0uGfktcmdY@YNvnkRjM=1CjTJn2iE6#pum=ZUee4?WMcC!0$D;e49sAbHHU zAvTX8X8P9B@0f0TgG~Rv^ao<6W5{!UWWLJEpGtpbx_J(UJm(iQ&-oS2bAChfoNZ{H z^E;a7{DD(q+g&et&Yv3gH?jV|!}hp-;!scQKH%7Uh_TXUd>%Hjj z)$GI1a6f*D|KesmfZyYP_zPB|?Lnk0F|HRy$0MrXiqX}|s^Z{L)yl{#!gz%Fg?UAF z%FQckpm{~jGTVQ~|IxgnHs$6Abz5rt?0zE4IkKz)F2bYA zY}XrVI4(%Leso!*vP8R%pEjr%Q4$s2&_$Kq6h%2xIdOl7<&&SE= z`RItAj}-KLq@w2|4Lu*}cslh)28Q4NV>|i%zp`v%+aL9O<)H0jE}C!Tq2D{s$DQ%Q zvI4whRAE^W`@fg_0Ym#-jJEG3X!~A@wx?z2xKuehE_Die9dyDKqfaY46$g(xt&Dao zTnAXc@zwtuKRKf;(tHlvPdysihcj8P^?p~%t@pbnr+3G7@w3X9kMn!BhVzS|{ynEG zQUCVj^Odn)W#^V9>R+V(?Ok?WS)%^c-4WV<+=YE`C-&v@)_WJA^sf!2FhqV?VYwBEZ4t@o}*>%D8xdhc4a-W!P4 zd)MKR_@J^O;kq8IVZV`j@A|T#l#httprIT?y>}y8@7+|EsP~2uTkqYB)_b?0_1>*$ zy*C^u#YcqWJ27_Kp~si|?T)gCIF8nPNWC^P#MW!XOpletneP3FOdnM?n%Lb<*| zud;GX+1*UH-osGu-GkP9W6^r=UbNmDht_-dq4nN)oD!Shda3vB*Ra2d^*tVO(dA;s|^U@4&UYbm~_0iK|f2Wi^ z!}2{I$o@|)n?~&Vka6Y4}OOK{|noh(Zh1z`&h#I9M5|j{hs_%=5su6Sy^H{Z#g=i_YURB zalG)o`W0o7T7y`R%ds7JpXna&576ViGI_i|Odju#lAm7{j_>NSHSE8~8#&$|mwiI) z@kTzsu54{s-nz0+!|`6P;dmp*dqdf0$>WXTcz@34t^dD3uak}F@%|D$-d~}|`)lU+ zcz=T)?@h_$y_wkK{VjUDx1h&+D|)=YL;EM+qy3W~(EiDf==)heh3)yd>{nvn&-w*@ zKg)Q?4Awg=Q6Fxj-a9le{)6qZe%zj{AOA$hW&c9QW&cLshyDkBA9@EmPP-G$pLd~o z?`|~j-Gk=6d(pgiADZ{>N7wr=u8SWC^+Lbce}~o!(Yl<^NV(@DT7GPK;`|`@f7K9s z{}V@lS-|*zn6G+y4d(N_A@kKNuSM*980v}I%vV`ir~GiHTTfu9C+ed0L_M^gsE^hY zN1*jY1GJtv5~su(x_;`3qqL>}kLh+e&eMqHSBV@`-k8{N1SD=!-i+AshopAVmj<_}$Q#pv$k-Ei=z?&be~ z9(gw9)*n64`s19iJ@o(4`nnh8jxU`X%6pfeN9_4N==q_%Px%Fud*1t^=lx*ZFB$(o zs_r{Hit7FQ_=FOgpcE;FCe?xp3Wy47vPrh32SJJoiim)qh^SE@n*fmxq7>;x1Tmo{ z(t8yFrAd*ZNE1-O0wN{9_vhZ>dcIHod0qD@Q_hrgW_D)M5p^DWf$|Z~i_tH!{dFEf z;!e?>iM4+q%kfI|%eWk0W&i6C>LP1t|3l70U87%%4xeYy&O_bY{pxjhzv_-U5A{Hu zhkByULvK)C=bv7*o6h&WiFN*Y6LtQ13w8eKgF64bjXMAIMV)`%L7jj4q4wK%vC3rn zf7Jf@K59SCK<&pLp!VYrQTu6s)c!jFwZ9HT?XQ`r{gsa;v%h9VXA^6Gl{!BRLhZMM zQTy!>)ON^0?Y|!>9fwjs+8Gu-oLKdx?$eAQUH555Vw5u~dbFF5c7J9JR&&Nif9$49 z9S7q`Pjfzr{*+kzm(+1E9(5c{Kph7YQOCg~)N$|`>NuE;Iu53wj)SSF<6s)zKau%C*dBj=|sryI^QP&ZRQ1{OkqsHe;P~-EZsPTC|YJ6UR8lQiSI=+_SmO(3` zmt(K&711l%&-A;oOv_vqy_WsAZRTpp{<}un|9wO9*F|r%{PmLj4Kh@W?S$lSir#AZ znMr2U^aW+=B?Y z(j#JulCJYs5!88$nDk;X#ff$PLhe6C#*~N&pSO_wk};*+7%5jerVQ!2|0ts}%f{Sc z<;upCqnwU2)bIZ>i<$*-rOKYwz&Cb2*N>fvH6D2xH6D4zrpxs|YCQ6)#a&}w zBVY5mZ8u_#FJ8C#c8}@7eAG_Ja`cROgILRfOt*JTFXaFK#=OOP@c)0Mtp_r`=o9m{ zyZzC&e_wa`-*K0}A8Px*i`xG0p|=0~l-KspKyCjI-0lA%v9^DI)b<~M+WrGk+rNH> zWA|S|G2#0!Sxm1mlpQlDCVc+|x&JaaW=Kr<{tMdwC(1$nf1;02_g#jf?z;>_-FF#| zy6-Xqb>C$q>b}b;)P0xHsQWHsQ1@NNqVBtVjJoeK4t3w<6V!c|Pf_<>#-r}LOhDat znTWdYG6{9xWYf8*CYv-xb+8Md;GCgJ{=^0rwq@|iAiSI(}B6j-S=2<7W*{ z53SXFSiF48xn484{>K}<=ewQdx#V#D zkAL6}{2jj~zZvVl6ImMd%x~`TjCMT#?zZP2ZhKxr9nY6h z$Mc`4v;Yfbv*yW`ssXrg;>Y)Rn+nPFY0){hB}`ALv5eyN@x4rpq{qRP1N?e zh1x!ap619C4mm$A2YCDyo z9QXY_cUbwdo^qb>c9Pmo^egoD$0msptvsXBANU88PXVJe7&nK6j(qhnVy# zo~p!ZCuCew&2ta)Rl6YhQJ(5{(mTBnJ_vrXOSpau_k#0~=Ml>9E_hhl{(%in6kHzA*rWU=9?I3+U+}1=XZcu847(~;>!dptJ%7-`eT+vUqe zI+q8qJa&IS-sAATzt`iZe14u!T6yF<0s&6~=^0r;Y3W$K@ytX|GU=CdlVt5ZEGP2& zZ;Gd_rKft*NH0e^QZC)|9P!m$`hWZniEG}>ZKLuwU1WaGdtS2g?L6(>`bhl_o)_Hu z9o_oG)PGUstv*)&?~_iRm#utfY4b;x_chNeSZm5_o-Vkd;5E;yxD~si2Vb{(-DK?s zEI0DKpiL|@j zAAE;+4{<-#@8<8~0elbjord>O&xK~-3H$)-;D^`%`=fqGAAk?xK#rd^^k12%`;j5i z^?Oa0mCyDJW;y$050chiSpBZiLp&c@dXBVoWPcdy8BThB-Y{wDNcsrR7}8hdjr5Fi z(~<2nTItqqNV&0|iKOq$``9ziEr*o*#5109+7CWO?FYnc#|bKL^TFy*6ny5HggbBw z`59T0rR5{-Hq|rT(x*vF$LcK$W_Uig`ONgpcIPw8oewednWKCwkL(w7J@c&m7t;1) z7-13mACrHarBMnTPwdq+WI5+vv+#-So$t$>AO+qsqe5FevdVfe3oOc zXTO!-CvE>g*6)Dlpr!vHEgjkafAk!}!+02v;t@Q7$E^HOY2}gachYklYfU-nIe{Ar zPI`XAt@tx~@RZg2MOr=NdG6DmvzC5FS~_yPU-X>AH3b(vzv6eq=dtqWi=GR(kN9`1 z_nWli9jpI1?GMjoOTQ#79huLcp1&>qFIjv2Li&HwbwB?f9F1471ztsc@9baHbKcib z-#hyc*AQRFb>!c`OyZmP4C8@Y=)pqN?*mS3_`DN=`W|Qz^pal`^?O7y3=$W|rsPNB zEi8fhouVWrkzWe+JbY=~NPZbiCH)Sp!F0;vZpxR#)}-HwftlR@$F{`fQQwWJfG=T1 zd>JcY)A98GsQ({Z8M|_yw+eP6u8J#}Up4GWd=K`tZ#QyB>}tu8$vM100VHaT4B#Gw^<#jSrxHuXzxEV7`rT9_bI^ z43_g@+(Y^!m`i$NT!Kxo%@^GNNB#e?$FP9(rdX1=87?Poj;ru-)bBklurEG=`hDn0 z)bB%2p?)7~iTZu073zC=Pvanb2K7AEvp52yaXiN0B=q1^jK$9}4)uRl;&CB*QT>z; zx1t~Q-a`O)VGz}SCE!_1#0!{&e_%4|z1S3t$5h-iDlIlW)~Qm3`$Wib-#Yd=H%5;4 zcCl^nFt){`_&lD#_HH@k_pT1H^qX8?ca(OX!tnQhV%_imP<~i$r`VT?cR8J<-Di?_ zj(R2b)mZg^U8L2=QcVjA26n|}_!>6HZumI9PCfmO+C4V>J8BQq@2EY=*Z&88gZVYh z>lOPZ^ZUl>Ep2}CJ?^K!Mfw{~pV+sFb)QqZzrV7a@5H`q%h^v_J+$}p-?Qnyuk~cQ z8Pf8R|L^u;Z2#Esbv*L_-3G)Cj16DM%kzxuGGm>{SC(YOhOi9|V!bctX3N@T^0@zR z)93y_)2YvRbV#gIqBGB-oY zQk;y-a0;%(skj!W;YOT}`airg@F>p2E42G8)c1^Mv)+ZFIkBI+?T6e4nH&3s+kR;8 zN6bULA2A>Ge#Dok_ahddo(ud6^?pPy>ivj3)cX+&QSV1ALcJfc81;U{64d(D4v)|d4E%IEyI7xjM4KGb)d_A4C^U;_Stsdy0e9fd>KhWIeP zfJg8Z{1GoPoujDtZ;qk9H+>wtlYatx;ZN8Xf5!LmBo4q|Q11_&!ffKxn1g3i@z$L^*oQ`i7zOh_##dw{tfjW%kOxG`hVaU@-N{G@-O4(_$Pjef8iqh8|PF0 zA6!a&1y|rzT#NsrzNd8!pQK;;4>ys19b<`a;CAAhsOMF0;cntWESN?AAII@TyGP(& z(u?2$EQ&|47%re*aXdjBiKnpyCNcezc!9VSUc%CtMtT|4_pR>0mx;^b3s?@XQ0`9D zbFp_}4bsb_{%=AByg`0N)c;GUgv*%!-MAVnW5iPWe=LqwQQz;XhIisUSOKH3GFHcG zSOaTfO{{~pus+ttMtCna!8+I!>tZXchp|{6z1RQ)*btNOK1{{?@p*gzJK%$;|C`we zU&n_~&;34(ZxBC%eXudUi%swYd=v-bV>k$#;xKH6W3f4&VmgoGKm7jN0w<9E1Wv^# zaV9>6`rcVf>`S}0LOoCXG+xDL@N>#Ni@6w$OECuZeKZfQW&eo9m88dEakfW1MxYl< zqYpQd@5dudH-KA+gSZ_NQ2$Rp5%vGVl2HFoJ{gPhJ8lYoOSx3sgK0R5<1`)he=}O6 zzSH&`9wlyrC$TM_!{_lLw!^=%JzmES7{&5+#3J-lFJK|*FJf_?w|)srV<#+&ov}Q= zjC#-S6+F)RbitGODpn%DD^|^aEv{Rf^N{0oi{l82jLLsKu1B0xvsQk0Y3D2dk}q@^SM z@OyC?qzCffmzIu^N%Pz{vOVC&f)B z?w|jev~n03%AXQ9jr1Y;Q>CS2$eu1=l82L^9vbYtb@6KN?Egkv42`l5)kiIv6RorSf9cvz< zok-_*igj^o(V4O?ZUgDZ^4CkNkBr+k#(hKj<=jnio8!XQ>qxvMZX2=g!)!&}hau)Z zz;>0l`pEciN8BDO|83k(w?0yTSKN1Q{oQVTV(Ndd@>U-?ukDRHY~}aG?RV=V^$)}y zbnE}%)+eU^A(glK7`bBBk+`E){zqB+XVx1dPvswvJBCL_9*_IU@=r*+AA!7o@pIfS zmVQ#&^*z!ar{hjx&5@_$&RYH%8NU7}z02@lAAV@{#fAzi}6_9sY)` z@pnwYKQM@wFdi>sH2#S#@h@zSf8(S04?c`n@BzGv4e>vl?=@-j#mL|CugBfA^c&LB zG4kEfx8j_5wP&HUbd0<>JR-iRr5BNwj=bMoJiZtf#}bwwDJ>uQUQMa^l6Y4^srWLM zUs_r|(yn*K-+_f#7K;|#6<-cZ;GI|oD_Fhq((Z#G$A886yDhzvtUYld{XglYMplWh zjK#5<v%T*@y+<5{dXKm|>OJBbsP|}UqTZXSg?ewMHtM~Zd*dCh&*=Y& z^&QT-sPAyrLw$#{KI(fs4N%|XX^8qiPWPeS*SR0Z;{!MeAH=C68pS`%a?T#{khJ|2 z?LD7IQ16L1M!hHA1ofW#qnL+};ZkghdOy7xuEXZI86U?T*aG+96L=7x#AEmrp2U`T z23z4pd>ZwB{4;nJpT+AKjSl@>4C=jh59)pOSk(VfiNo?3kCo9IAHE*+5%(na<69WO zei+0IOu$S`#6g&Z!!Q{~VhVnYsW=|fa5ARjG;EEt@ws?sNIm+eHpKU{Ty0VBPd$&1 zVmo{s+ha@Yfc>&wi0_CsN4^mMBHLH@6_De$Q~XOBU9bL@_fVh?;6d*TE51~$ar?)=dHpZc4q-_PGd{eIpD_51nT zsNc`~qJBSr2le}TKh*E%@1lM`e-HKh`TMBf&ofZJpMQY*{rp4J@8|tdzn>34{eC_W z_4|1ycEJ$p_wy{&@8{XrJ8Mw<5cb~=p~2GjU!+}g;)jx+k@bi6@}sNc`W;H0dv@!Ut?cj=F%O%Df`V|&kx5Bn*eb;id}WWJ4; zOpsO%2iJAWo%^5ildb%e_-R&tsMO+4FV`-e@o)=i2 z`uaU??*EG`%w5dy|M505|82n{0YCplbDOAF)!Zv_>8kUeqp>*@e=VO z(*It(G=4F0y(O#Tm*9Q4lyavjmrwpJ$`znP`qx+#mthH9j-_!0-ZTwERy^;F6;&)s9-Il*{@pu2bo$b2?d*bgBJ7ITJZ7 zw}`hG=|`NR(w0*m%_;6J;nndTDQ$ijk)Ko2dnf6ab4z(kd&A=?BrfAEORVj62Woo} zv%KY0-s&UMy~|t0%9r<6aO)%WD|+vC>sNB?6H~vk%3FPmcxPc%?>$z&nylT0aRPE5 zHOgC^eBDPy*1LwcChMo?HjwqM<*n_mH`?>`%ur<+>g^k52!skk3A@DIg#fj8hanI_I=pfnCbuIJR+@qk^H9KCYJxG zw<-BYoX4c)Bl#`7%`CsUw*~npoX4f*Bl%BwTN3O07*CR4$9c+PJ%_Dyy*JUy%Efx0 zCT_j>8E>q$+q2#nYv+Q2(bmod1Bq#8kMddmf`Q2NRzF#Cf4N{FQZCio+NPf-nSQ#o`_D-JbKV!ppEk6u zw++rgV#+=5ZAUr%-ipNSy&Z|Q-*rIkcf_pE3o38Rg-q`y?<-7a(a=tkdYz>mCokhs zrbkS3x#FT$cT6yK4%IWTX9itX?_x7~>9@6rW>Ac~6ll+Sddr9i| zmbSkl`F*`_v3;B7_3`#)`yF@QmbQJ7{CB+lh(Bce$^mT8cX0^5M}CC!z8%NfzuDg+ zZf1Sp9l-R8u>C(|ekHT}E4KAV%7?rIZMq?ECKe~ork+11OIAtYy$d-kcaV1o%X7>b zENyv^^c?R{(vLbHNlQo4hj~Yk{+%;iS~`+G(mR^;UCt;;I{iQCwK`OZvZy zKK6dX^5*A_lPqs$268@};QbWW<9J+wlPI?~Z=$sI!iY`NKl4r@o!|eZrDH_Ou&LhZ zmOf3|bdh$Q;hjl-^q|@1j-1)vS;QOgb1Oeb+H{cf)fe8mR{jg`e9NCFEgvKH<$US= z%F-7|OUH<_xw+mYq+ia>^Dbh$YyVt`+CPceKNlaCV`9AU(<8Ed`kEq$Hj`Gw33q#ZVRH{_m?^ep|I78NBoA(=Ht;crMdJwZbJ5=752k9Snd3V}$cX{_)z1`mL-02|G z`QE$Noz5P2I>bz8pUT^GFk(T@0q;>O|AY6STOX-^$a}=Cf7q>0O#L5K-s)q7ci1uS zDJy^6d&25xW+3%{@}9K%nHfJ@{mcwv>i?qh)X&U7_Mg+r=*)(hDmuX+Eq>0a|XJ}u9G-s|pkkobo8mOGuB?sSM*zCx9^=^*=Ugs-I4FXAie z3vXwnelcGpv9@z@)OIGOehHPg`WO-UQ7PXYR=%{f{iF<5V1FTw$or(M?@r4vC&|yu zz=*opclqwN^zzc`RX{x-QW5ohNF~(sA>>Ca8&}y^!^&5YR=%oRzM5P99=CiH>bb1y zsPj4Hd0(iuuO`-8RNGez8)03W-o4Vw*Kx}ehYmXRd<`iV7pgC5j|S4pVdw|vKHvT1 zd$Jpuw-z??JwRM!Q6t}j*lS87-@{h#A!+q6qE6l;z9yF5SXw$pL@a*P*VNJrDH_R#c96QmYyyx9r-_9&-vO~dK+o!7_lR}o$q;;ucy<_*TM4JOY-Ue z$$x!eN8gK<{(`jr7DM}-mwYdi@5$~YS)b0*?lUR9>afg=S5WU+b-^uzy82$lUfErJ zuld67S;?k(-F)4d-VWz=$@B^aBI!MRZ;<|t(^Hbp@Ber&{dF(YcSd_-_raG3yovWS zzqjx)>_h!>lz*FeHs5vVi}UdvY)O7UyqWc`FN1RG-``{TOJ={X*p5e}fA8=60E^&< zSR4mZ&!00uTK}$C>o@kp@Ozda;vB{oSvU-{QO{2gLOnk{n0mu`4fE;EPtZ!GxGEECP~Xj@~8MFTmBT^4DwgxP4!K4^O5a6UFo)eBjsoLW?K1K zzWLyzJTV>0! z+PA^#t?{jM>#cR`5mRry@~s}Sd>egRZ22}xmT$AP@k2O$t8crdZV^aSjqQ{qKEyD5r4+67TixCssS}L$xz8%XvWMZ8^i! zIpjNN(>dfjVf7CCj=0l7rt_okm^+=L?sSNm&T*Bu=^)Gfv+pNdj_0i2N#8H-bdc$s z@||&~bK0E_G1ED#@-`i0I_G`A+H}tQE?T_{($)*f|K0bS<^S&c%kuw_mVXJ=-(5!a zcYmV#JMw9_zkUBwZ_&_yB+GL}+J1W#)vtx~ula6R{(sW)ueS0}rp^DB&+%(I zh0@9)^NH{m_v<>RsJ{rdKw`=jlU6RAU&0@0`6c|NEWf0*d}Kal{H1X@mbLslq@9nE z`IPgQC;#HYJ0;V1b+_>)OjKb1(mlG#a$ZTc9|DksICX6=?LtHe=196#qzx9#_w zzcm(jp7Xb*yg#RnwEhce@Am%Ztz3J5J1f`T-;r{yb2`W>?U|k&mivPLC6;TK^P;qV z3rX+ff0^_{PG@Q9Nct=OS4rRLbdi>hq<8gqBmGSei zLAU~kQf@`w5Pyza4mo~5Qo8Lw$n=K!M_IYy{t<3Dq})iQTRCLj^O-Jg_^MC2qpYPTurv3tz zxBAF^iCq6e(lfI1q@^R%UF2V4>5HYMW5kY}eE(A1fL~jFfwX+&dTp71g{3c-mX2Hx zuJW(M=s~OeYb<}Yw0z_~#9IF*(l6((^KWpMd%e5d#4Ptl!Tsk8Ia({X1}A-nahmt=>-mZnxepw;nO|zEi%{L+*F%_3y##yuJQ|R&SsG zfLm|BTaTD}KPcboA@@5D`wwA1{L$(ikv1+tmj9^#xTPPHHXcFJPx#MR`cM9!N!R!T zX_u4!Q^eXIenIUI#LV}!%G-P~Vph&M|5==be^|X={pa23Ak(?v|IMAwMRz*HOy_r% zx9K4FH7@zDTKUWVKi&FB{lEPGxb^>b>l0J|ippDk|>7(J+B;2x`2DR8$t9b`I{16AGW zRB@+6%yg=$yiEr~)19b5b*2*+s$q_pS0hlz>erMu9;tMOY;33OzBrP8!N`Lflps}StA}t*$-z3o7 z(jS$U{upXp*c3G`Y=#;alFxmU#{(^`d<$vipK!}R>6U-WEl)o8OGyAw8O|n9Ruz0 zF6@AJ8sIxhILg&CMR_`IC&Xe8EytS}fpeu2a zMco3gVXrCO0^P0N>(c5W_jh^(-mvtZ($bOpEWHA6+4Oo#*7Hqi`N(~iK7n^E|7}Tr zUupX*(tiB{?^*i0($bOpAQ^%8$?xf81U|I<52WQ|M7xCp0{!tX%(VQ0(#F@weUeZh z+tRb7r6a$u4Gs*#i>9}Rk%)kunl|3^sD-gb~Bb(;U4t!3%9nKud`V|aB(&q-| zk^YVIg|zV>l0HAMfb{Lom(tSZn&~|MkDD+Tb>AnCavC2m#9Gdxz+$(&)c=)Pg8IKQ zOR+oVx;weMghQo+bY1;s)(>0~-%57AOfs3`f!cb@JD-bwzb%yPl9xB-bnMVLO4e^;=gN`=@NH68w6O1C(@BUKXiKVV;GgdD;_$)>d z$52oAossGJgB}cGES}Et2jg%jaXjUQ<$8mD+UGmRC)vLX1|r{C2m})?KPW@Hodjw7 zKQg`4U=sGgWSd@UFa@^}x3+p|lI!$zY4wohYZH79n_xRD*H%*Qd1>X4-e*fS=xBdXPJ~8z(m2dS` zerxuiU=|L{8x+jOY#eI!2M2T9`a|6M#MJ*t`BooU?qR`E)QiX)5gd;FkeK<8ly+T) zEa#ZuXj{%P!B4FG$HB2y{$s_IA1AFm(q5kiCy}3+JzkPOLE1QWB5K@D%ycIQKeO_a zgEJ{#H+zbt{8VY>r=iBx(^2E<8K`kJ`RqTlf}c~bPTp)uy*bjxXUKj#H~1ynt9ItR z;1_rw5>sxzv~tMyUJzVNezVMl!LO|R!eB18BF?jV3zbj3Mbhda^IZ}wu=-0S`T5fF zl^&J3Eci7x!If5ixuo0*Y2}dhSQT7L{sVcdCHZS)?T1-UWW2I2xPkqBhqGR?zZVQd z)^BrgBW}Y@Hl5AEZB~AZWZbh=+VO!b&o{yC*aUZ4xgC;n-%2Zow8yUC_m;m~GEVwV zT0T;LPjJ8G@0H~5la`O1f9U_M+`-@vHob$vBjlgYIvhNNU9t}=ws8fr9zO<;5$kw8 ziaK72S&rkulf*h+Pq_I%p^n?1-E!nJE;$wa1v_P*3Z5bTTGnYveV+d#{bttL;04l) zWSv88O?*At^_J8W4i1j{p^@Q;I*fmh^W7j0zeXrWy_pP14^Y8TA_p-c& zp*jh56TfeD2T}iTt`X`z ziyowQ1ACPMZMqK4E26*bJY92kE7o2ZGpvx zKbi0ZMvi(iAtpihf1gTdnGkL#RG!Y@ArBV;z*Ag z9xE*!?fu?()c=L^qTYM&%dLF(b>UsDV zP|w4^hUI{*8q2^YFch^*nrU)bsFfqMnC;3-vsFADoo+w(alZLVf>t zf9HCnU%~|TOa0!2j9=fgSmRe>@-q@XAYZ>fA^9IB^e0w6+W2+=kVZ279@OW%e^2Wm;6c2SJI}Vc)XLBu+WWV zB+Io3>u^5dyLGJZl7ywiYA3lTGe4mq!Tqj3@d4KJYj?eux$C_g)t{|E^rlThtw;U7v;p<|(neG}ZbIE>*o?Z*umyFWVJqsp$=guv zydCx3lP2PcO_is_{z7y5%yHM@E8`bXLq1yd>RJ-qC`L;QG6ZR3S-KD;dyC3yj z$^ksVe(?ipdmKbKahUpBog)c95^H-%eP{WoZI|N-$85VCPxy&)lbjRM=A(GL z^K-&UHdq#dNl<@&HsM#=S>uaysQr(a^z#W9iM2g0ptc9G z`u~LAiM3sj{`HT9OH5bW0m;9d@TVIi<^D?en{-_d$f(RK3IABRD+yOAr*@Z*>XCWY+|{@@N|*++?jY6v8IRA zuaH>YrdJ`cQlieU6{Ve5kmKO)#L9``;{feAs6u_Ue^pfbS3|Y?J*ak%LbZ2w%Ii3& zfjSOqCWeoLTEuGq+Nk5;Ues|=2X!2ipCs5ykcoL^F-=|RTCAP$9&M&P{-)nsu^<9f+usX~0 zEb9HjXskmVgALJxdQUJG*HS(X^&Vh6>U%C;)c-5aU+e_1A4s{dHSZfBihFzix->uiK;g>kimE zt7GDewm-cft(}qn`lZCqq-SJxl9rCvU%!m%uU|aV+^`s>$F{dG5- zl=Zr8&vBvd|GPce&wD10W4o!p#?WS`mts5a!ttAlZ@DqjU-z-{>aSI9!&m(NZ^z3! ziT#+4ju)idyNT}+s~lRt{yyaj3o{ZwAYc7DTEG4ws$cJq>emOL`t^aRemxV_uZM7Y zC`(OE+N+QNlU}?NnA#(^(a8K zO<&=rue5rr64zM!u9h~xaJ)8gof}J?pVw2K@Bb%mq@A^&BJrlg&BWRc z$a-&0+=9z-yB$y4r0pNb`T3i~9q#!V?fm?$yZv^$+iw@@{Ja}=e*O-1e*T{FIzR70 zouBuz+#09sBi8wOKkEE^0Cj%;0d;;pi2A>)hfx0q?J(;9t{y@C-_;*c`^!=EaXvhT zDR><9|I<#O_M@Lr`_a#+{pciWKl%l=pPWMNKc`XK;S9^S#W|aJj#%3f*^hrsJnzOb zg6&g3!><1mFD6?5pZEvstN!YD)c#CNzkez5Phz#pWmLNmlm1uY-^6Mk)O~@(D@<4I zf#hFJ{MU_f;wHzg)A`=le~H)K{sQ^l*Nw!RZhwK1gIRuEH>>|Hq`vlRCn>yNMxfkB9p@V2NIV^DoL#U1KB@HCzZnGct?`@?=sT%4`lx+n^Z0- z+<&9(A9qq;?Qs{XJ<6lnp#rKMDx%iE66Ljj+>P2lDkp{ak1E7!kE*EsqZ(@exCga= zL}7^az1@%3NOG#b7hZqs*K09-_3O1s*ZqlmF@7ffzgw;@?#-%~6z-?%OIsgg{Tn7d zO?@3N$ocqwi*-IGCjY^tM&zq~ko<>|9wt^k+WGns$`uwiPHIBF&ev$?>qk-N>&H;% z>!zslbu-lYx;g56{Wwk!wa|PyUq2yj`859`&QnP($uBXJ{@<3Tl`Wr^hkR@IXHf0_ zEag0()Bj^n+UNFp&qJ*JBNlbui?iv{|D*N~uf@J3Klz%^Z3D#GZ-O@8grr2~qjo~t zB`GPHSj&M-H#I2*mt(r^H)+z=1KDp{Cq3uxH)#7!8+ZBJy37AOYQJfR+HcyU_L~lr z*M8Fxwcotp?l&(IYrlC3wcm6??KhoK`_0R!_IL#s@Vjjn>=fRQ?0!>MrlbF#_8M+< z=>N&T@Co<-i8m0lf7m#rM^bpa)e|-TdIL31>V*TbH)@>mW>R>Z@fNYhEqzem!Fn4t zZt9C2=kxp@YTVQhHEv=)gZ19}dr9H<*okkyhiv=H2P~KNmk&|E;3&%|{Y!Uay2_VZ#6>&KbFrbBGU%V3U&nzX|Ztn)v|(ML>I$I(#IbsP=DD&!Bx zC>(*RHxgBE6zV?UXxy7M#y!5q{_pW+Q_V)*r<#Mh zPxU$KKHXf@eY!7D_vz-L?$gaj-KYB!b)Rkl>OS39sQYxeSZw&hq&$oqwJ>QJ`+J}4 zMM;a@{T;baw+4bD^$n=;`bN}#w+S^~-;CPtwxIUAt*G((Hq>~1J8HcC4Qjl; z12ta%7Bybqi5jo(LXFpVqsHssp~maqqxSnf*gI=)(tg&bLujA0^+Cq#2a*nwo{{x~ zv~;xN=n(2SI_w@tM~F3E{}DA_KZ+W!A484TkK?4Q6Sm)t3;p!J`(2gk3+VstJoQUb zL~{7Ng`B@nTdeapG3T+fN$1!Pbsj_Ve@!}1tbDZd`vs;`Sa>n%H}Z9UM?1g&jyk{p zfjYlmLY?0)qmI`5vChv(d@HGtSohPA^>C7zo~?&ee_RCBFBD}y^O#OCT!_VS8AhVcA0@CT`&CIS zgQcup$|RS@B2Jm)vb5V;=MHJ(B*kl-a>?pnG;X@x&)h}6`kC^mex`!er~gOwGnFj9 zJGnCXTF={7vGl6R)kxR+-u50#k4mmiy4L%)H7vbmaxK!e{Pqn>$~lPEMLRq2Dls_V7qh(-6w6kpe={ollfqBqvY^-2d&?F$Zg+;-S&M1)o(RM z^;=C){nn$DSHJZbs^4l#yJ?bfIh6teEim4!Q_Co zb1*s4wts@O?X7r?la$PO%;NCjyz3>3` zMt!&cO+1Qkp}yPS2lbuiw{dS)-(>n<_Oo}S?PqBH{_#ELTNrvjIU_mTKO+6( z2gx5MhxeKhoZjEI}G)G-r?99N1(pXI}%^SQK;|ljz;xEV^ICjSX4jsF{&RLhw6tu zLG?qQqWYonsD5Yysvnw&>W3zw`k~KI{m^7oKQsl^4^2h&L(@?G&~#KkGy~NS%|!J> zv#@v8?Bvhw_?{!J-H~>in>>&7jI1xDrK9yj^HKfKm&xJr+yY|tLtml#p*9hw4kzca&mX<70vwzJ07NdL3KV)Z}75iuN} ztL%7OoxFx}>Zg!$Ym?Uzs~lQCwVrZ?g&UGLlCORWt)JS2>ZdlN`l&6berhYKpW24% zr?%tt&^MYt{nQR=?Sd@lPFpU`pV*G?-KgXHJL>5?^F7vMdH3MMxYy1f`;zw)2Z^QD z=YSjkfGvm*+VqbkAF}dCk`H5X=ZN(${+u7BJ;!&upE*W7^)ts&{mcog$MwI}Xg)Nd6s{<7L~wE=g-Iq~G{6`7gKMKe3)OEFqWTRdh4VT0Ln2VyqX=qy6h&>1VyN~mj@k~9sO?e$ zmk*);$2gvUEQK40OXChKgZuCfJc?ygoGP`bS1v{EQa5gzpI`(J%N>j?KUul*S?pK;) zS;{|-d$U^T|9aCuJRxmAy4^oKl@jhBT2j9-)GFoalyLum^bgOZJev~kA28Cx^<^~H z;(8$lBbdGi^*cc<>i2;-)b9cD$cIh`dQsOyKCC^Q{vWT;;r>7B`YVXtF#$_aJ`wf% zK@#fvDH(PBl!Cf`N=02irJ=5$(oxq>tx?xc&tb9QZByD{G_m)DdF`- zuAkbcbZ}$j`l(~e3vP^DKfS1W)=tRvQ>T=dNsk)dSz0>U_2et4>&Y&t>&RD8*O6UO z*O9NGt|Pmlt|MPZT}O6DT}SpnT}SprT}Qrwov;_G-|LO)_ufSHdvBroy*{XZ?`>4S z*B90Ay@Tra`l0&0cTxS`d#HZzeN?}ff$H}@K=pecqWZo5sD5t%s^1%k>i05H{ay%r zXJw@fqCGlYlyUTw0`d+RKGVgCEV`~BUZmR9M$iQK=pegQT^U1 zoRl@%_SYa=d?>@+JGH&Ywts^@+vmuZYPXpE7}bollYci7Atam5O>e>MZvpUp(|XR~m6Xtw4{e>O+j`l4NT&9(E<7b)|I z^?&1#<(hBHspX=aofj6M&I?~r?k44OQRmk@mTM);wGaz%5$5A!@()sOiA^s*WvR_4 zKc#^D739n1c)LGaMtSvT%TfK=ig5XXD^b@?t1MofvW9#u=WW*#tG`-DeuT3=WdqBp z_D153DVvD39>{dJq-@6JxXt#9t94k@e3KHs&Oz(1cDU>Rt-Jm^QRl;5sPo`% z)Oq$h%B#Qn9@Ss%Vg1x!?IqTEcOR<1+K=k54xsw0A5iUhkn(EBL&Q5+zr(l-kD#uD zenedd9YtLS9i#kG${#1z|EW7ctoHv2)&4(|?xp@oOu}DqAD%*Om(%zop0Rd1mvYwH z_gu=a)YtZr+CJfa=wiwR>o+c@{LcESpZE>6KM>QO{E>2*SnYBN)h@)O|C#a^vDyde zAO24Hhxw{Kko+qtSKSyX_ixHI(sf-U`TalTy1N`$H7fIF$_=Y`Q~ixCAI@Fo(Eq16 zbH7IV3+rbhQp5dBk<@TMQxxt0|KQ%N;;G?&CQ{n=N4pXghOz8gQn%A^lP zE%(%{s;Sjd!~Giad&fPgQK{j64XuBooLw)~AlCiFnv^RH)k>}H)Zcw`eKbF{= z`mI)|e(Pyezx52N-+C6+Z$+c}tr%3lhF?K{ap&Gze`2+cWJ2pE*;h1wMO-K&!PIeHmLrtEvmnJ z9@XEqL-lvhE4e^>;5}@2pO#FVn6aLY<|xE7IS+lKLv?8ChMV zrK9zCT~YnrYpLP>t{buXyVp_uU3XM}*8|nx^~6b8Z`koOF4XIPj~~vrZ>E04{-^UV z(x3IQSp69>`F&I0Az$ZXB)?zkyTr;z>+jy9Tw&q+sTt&}zeDTqK0x(%AENrZ{;2+L z0II(mi0bb$ae64E`O@EINn2mE{%#P{=lB2AA;juOkmbs;<j>2ObtLNiJBs`YOlP!BXKd;ioBr6;kI7#`zFdsA`?*gjuYT@RR6jS~%G3X& z`nib~PfGoad@bK?Cll-ZF@^jHXKLy+mQU@B#M4t}5Nr97>CQ@>iOX@0?GLl1wFA=6 zeV#fuHQdi(#DPri|GVow&t32NsPp-ksPp*()Oq|X%B!EtMfG!ete^V1g~U3qFGBTm zi&6dD5>!986xEOAqx!J|R6q7Ls(qI+9kuUrRQs+VeZ)MT|0AC6tV&%?tmojQ-k)59 z>fhF40N0`Vx%Jq2HvK>Kw0$-btAE^ty1%y>wY|1jyKPI|YVEx(bvxy?y`;8RxZnFW zbw{fDsc%zvvHt4!cB1wRV$ye~eow4+`VQ4j#H8;@-Ak-~oM zKYhPrU;G2##Y?E?#V(_s7yA?SJlS8U=f?g<{XeyTQ2*cU3hMv6UB&0{U)2A1yN3Ed zf&Zb_<2q_RZlIp8zlnRZZn^z<;s2h8tbdG13-^yj($qf|O)Hib?pKliv3Oc!TDV_D z`#rM+>Upw~sD7Xn>N)PxsQ#b~>i4EQQ2$@3EEZvT%3%q-6ZL;c?n3n&<#7P(UjdH} zqyI|HpDSjwY^*`hR0pQ1>&dVn4P^HPrpgdrN)=ha3wy7 zYq1gPe&<7|>+6S6zso&>x_)kq8fP>?jWZrajWZrYjWe2}#u?2})jgv{=%khI^!? zqm47-P~(hv)HuV78fW;>p8rRUGXkh_Mi4d5NI;D<5>exfB-A(~88yyGL5(v~QR9p> z>__{gqyB$GYaEErp`L4OgLLBm*@L`2aNz`4BY@>5r4L2BdLbqn{rrZF)$57)qPPajyOm8E0f$tZ@c0 z`GeDjkgxs{$>7digTS!X&Qh1@9(r*$k#Y*D{36J&Fa(t+j{W(zr{P!z9nDV z>9#v9eOKCU(zU&A`yH{K>;E40y~#azIfwq=%I{0tPps{D+XKXUF7gM4e=efNJHMgEJHMmGIe$=IMwHsOS?|2?Ivfkf84-Fa&D&GV!rxr z0@{81LezbGCp~=MJ_2>$z6k2ReNohX`(k)At9W|J^zeQinXdi1gkoz4jA)fpD!oj) z+OM>q!#J-IQ0Km&AB(d zj+-xa{MAK0H(C$%+-QB&bE6GV&zm;Hg|yFo_)pdY>Gxx&><7{xWO=V~zQu@lSdKCaLw&v`~#dnnFzqSG0_TO1z8$EJJIHSUg0 zk7xecpW{&bGcoDjbU(57YaeRACMG?Q9wgTOjf~?H(i54F_GctNDLvVZk>62L($grf z>8GNmPfWe^^tQyBerq@XIn;dGxaG)azkEKuBXN=J4(aV|zih9V{j!5(I`sb-mHA@& z3)lo-wt6o~J5P7AdYu*9{*2V?n*Iv*z%Ev=Yx=7gMf@7|^d7E^&+L}|I_bI&kqxuE zr}wn>>>;f^k$Sz--@qow^#<+TTUtKab;esvPuCfJ(!iXe5+?(}&y887Fp$uv3fi|xHFg-l3@6YrLLj%$WriaJ%$hbZ;J(M0E*Q1T! zvQYn*GaEHt8iX1z4MvTZhM>kvIjHf{N2u}AP}F#77;3yU95r4Vff_H3M2(k5p~g$2 zQRAgCsPWQR)OhJ*)OcweYP|FbYP|F*YP>WaduL5ZpTu_S5Sl1$eUb6fXX#T&=llQC z($U6CQ&HokY3bqd(sW{tmu8^GOEXd9rCF%)(rlcRHOJa@TUtIs&`HTLaboFOnq57L#I}Y>G7t-$PZ;Ti(gEKOg6%dx=LFJFeY zC+T}KzfND49`0|@`kUp{*YUFgb^NSE9XG2`$IEKe@wkTa>TlMf`kQs^r|NIk6YKcg zfa-5HqWYUnsQzX%PUpP01>a`>+lnRGKenOzm+h$g3*Xps?MUBA+;%qoKXyRHz2|WK zk2){!X1>)OuKzL0`96IQ={he%H)U_zKH&2-|%@ z|BtT|A3ymriUjF~~uiUJH zfq$|7dd~Ro^zeQ2e`ue(sdptkd|&-4>c0BFq-+1WhI$V9_Hlom{a5$9Z?OJ_p_}Qq z+~XcO?hDhM*5TtG?Rq`}bv<7Md(sX?QP=0i@M+e&IO@J{B$KK&@c(gj-|=40|KtCkrIIb7anh6$Elm_ErBEto&)1nD z6(JOLUgxBP7D|LPWn>fCLiVa`C9<x5w-0_xAhzb-mo5dp;ib$K&~YzFukR zEz(o>4bl!iEWKqMBkkZ;>8;}!X$QA)zHpx*?cjFl?HQgn^KcErF|>n^K-<9`&~|V~ zv>kjT+79l7wu6sC+rdYp?cmO6JGcwl4(^J!gS(;a;O=NU_!zVu+yk>Yjy=(Sm0oDS zL2tCZ+Xrp$_C?#f$D-}sdql5uAC;%4{+Fx*pWyl%gYo-V zRkt(W+38W$O1vW7a(!$%hH@ThFOLhc?d8mCFSH*?Ef8X=hegw>4%<)qo@~V z;l9MPu`$lU<~W!Ax-GgU{aRwne@w1m{_BYS?t32ba^m^K!v=1EJ+ar@+vxT7Z@eLnH=_00 zJ4|0EdN=(&j)!>@62G7R0kPL5vi%>We~4>v6Z@Z+{8+>OW1amt|C{ju`~(}}7F=KX zY5HgBseB4UKDCwQnooU>Uguw+`P7$aKJ^uvPkqhw=2PFG`P8@UxB1jIV)Lo*(0uB9 zG@tqb&8L3EC%IpK!WZyod<}oWxA9keAAiHm_&a+1wxjpi4zwM-6Kx0ofwqHp#rNNz zXnFKkTps<+c<;yE=>7N)dOy~p_hXcix*zLgct6(7*n`;n5ySmhkJ$UMKC$;>17h#T zJ<)V)+i@K-j?741Cmqr2gqY!-GL9zpdN~Tc zUWggqIim})*A3FX?3&Sy<$IkVXXqo zjxl*tbZo})ET;qK?Kn(hxx}omUk2^V&_2bszmV76JT>)uPA6uhe$VM7^gZ?g*c$)M zn+Ij2euwE~^!J(uqrcBI1dH+C>4vf%^Xp*@H@`j={r#rX(D_bB^XTDdemw$R&Kc-( zMxyVTj6(D2(dh3&orxQ&(lb~O_j87Z`x!&KHY+2Q-)6J^+GI{fZbqtIi{!U?8TlEh z{1!ugTY%=bg*c!5stEo4rUd$XPQ_?mT7o{mDn;|sGCY;>bN0!@YIZHag5}_l^Mx6M)Ke) z=L^Rf$%Ch7%wTxh%quhu$B+ltpn33>XdZkOng?Hv=D{=3Ja`tG2hT?H;5ld>JQvM_ zuR-(RYtcOTIy4WShvvca(fs#%H2+fabL~qIvB?G_So0&1-K)^V(amCoV$s z+FQ}Qb}^dQE zcVfsp*P(gmi)h~Y5}J3ujOLxMpn2!3xH$Qm>m?6)UBmvm{<_hd8E-M(-vvVAw=*^n z@41xvAAN2>%%KWL~|jTb~eW&9k+>hC}Og8oj@ulUmv>VNFS@ZYf~ZV$`- zBV$Kc?jIRDv3~SN#-EHIR$?ie`ov^ru#eNAJ%tcv|GdajjxYtGos8?tk$n} z(E7D5TEFg*86|Is>Sfj^wtm%i<{La0T3@+mX2Z->-h?4<+AA}4T=zzg>po~bxG!1{ z?uXWY`!l_H(*bDSbRg?7Z)!wreRvR>H#J7{ri0PE=@9fh9g3c(Cg^!;ik_!t=y__6 zo~JbQJhed2(_!d&YUyzDpjNDRbksVt4YB*Dp1-!49>2pg+hJWig6S4U?KK=f;{{QN z%#Lxa{yx-^==tk}{vOs*= z(?i4gM7F0-X0I?^pUmE2x;~l5GF^I2Uk%SkjLi#=L-WGp(Y&x99(g70fAsvF5SDjR z=80i>CuI&~e{PHhXxKmF>!U%LC&#gReGEpgk0I#waSGGj5Dm>7M(puZ^RH9U-vLWK zM;M-YdZzi!@XRyVPV?#!==DL&@R6CLiM>unq1Op9!_Ul2C-!cn0Y~%{=&>jVf;lJ#v|h|$-Fp>za(=C&kRrv9(wEywH{is*4KjwKe7;c_d zgKb&PmFVwaU4_24bTxLyndo-RLbqc!x*c=S?U;*h$2I77T#IhUb?A1?L$_l-`d-!b z*qz}E(D$ouK;N&r5$(@ih(m~PLf^-_8GV217WBQVMQFe6t>|-;#c03n613lTDcWzl z4DGjFj`rKGK>KZPLyyNwG+(_PH&oq`naWS^)KJg;o1d=AOy#F{bKGi^_hjCinaWR* z{Pe!e`!iGdDTd$idH{Xz=|S}UrHAkwd>AL-YMg|RU=xnRqv-F8t}({P(0uiAtYNw* z@LclBC(-w!p28N)_cWT1K7+mw^(^|n(^~wH`JO}b+UL>tZ(cy($61HIhw~!(KGjPO z$CuIfvtD8U+DFv?#OANBq513UX#V;Jn!mn@=C5y|`Rm(g{<-#^j*-@nj2 z`EN8&-i_wT|DbttEt)4sS*bj^4w@&|Mf2o6&^);wnkUys^W+9-p1dcTCpSd%_Jh?fVC#T`Usuo$^pYxK3X;>bH{@hksss7y7xPgA4EM>5{L5*gnq>nLK!W5}nEX1dzi&RJa;Z$6D7pYDq0 z)7{W~x;vUrAA{!8Jq5`s+r0vyNxHzdLp;%WoSU7ve$G2M#w+ z?iZ%(pLGJU@6#ajotSkJvH3Kz9|OXExgRVy)YF5|dirFh^Y?HDEx{_p!w<&3w#v;yrf9TVoK{g3vSo*m+Ivc@sq^D&m?w2jUUvFGF8;p4;b z30ddG>qE}R`B@W*JwN|?0kQ8pU5GwMz9>vLDeGcl&)dIVLTo?jrHtqIf3v1=Tx|a# z@nu<;6MJ5f?Vgr371v-g+<%oCt|ug~uga>vADhl3(0}BZ+Uu9J~d~a1o}@p#DdH*J-iCsRx(f9P;C(IG*X2 zVSSG8a`b(u6}S;^!%G;y5`8b~cB~@4183l!cop7-Ue~M8>-ui=y1oZ}-|Ai*f%l>B z6Wxzq?+>8wFFhC^w}-G*^l;W{hI{>}{}1#C`u{+WqWz<5m~KGySk~k5bn0{VCm7x$ zqW;IU=&7uy$K_Sg8j z=$)*0;~2S~-_Lq4O#gn?hm4;WeV}1_<7=ajvi|??F>TJ;lx5z%Icp2s;dT58dL0up z{L`$h#9q&zq1Q7p!#~gZg4pXCX@7i~^%d*!I!4BSo%Kx|Bh!7GwTzTdNUg#FsCVK_41A6YxYe1Bw- z_p{%-G>pg44)`l8YO$4k^>2I-cjF^S{TK4~T4M9|C_9z6*Fp34y4k7u_dxUgdJH$; zua7RT0Zzv~@fq^YhG;n*nPjppI|;CkE_&ENM!^Y;DGy!`<5yNCnPJi8H^ryqoV zAJG`i(+@`T_Cv4|4@L9(CO8Y5qQA4!41J%YIWE97T!<}j5gvw1uqFEbR4ZJCt?@o= zgC3{0=y7U?kK^I^6t>6b@CbYnJK!tW5#PWg@oVga-{DdC6CRDfVQ1V>)g{|}Brn-j z|IJ52{@*=2mH!`uJ18%Dpzm+=pPZfAJ|yoRoINCtk-Ynq z?4fat}iRRr|Xx^QT=G{4H-kpo)-Fax@0<_(AA=(bR2yK5&!dZAR&c#d6cEY8&04L)@oPvvHU6wtS^RRr@ zZdhIZvNv|U+=wkwn9`#Dv3FIMA2I30Z+as@tvGw=nh!B_E0T#r}b`*<~O#+kSk zXW>^k8^6anX!~+5?!;^GFT55b_WL^Yxy(G=3+JQlrR&l6g%)5Vya5lz8`1AT7IJ^s z{=A9UcJIx2KHh@1Qy1Z6ycH{PF;2%Ncr`A?*|-d^!{xXDSK!Tf8{Ud5aXH?Ocj6uB z^PfA>?||+?zXMu@kK^6w^PPLp=R)^#-yY6(-bZZv?0&R;_5j*Gdk}4(J%qN;9!8&I ztVY{skD%?dN744#8nk`(7}`F29BrRHfws?{MB8Uiq3yG$(e~LhX#4D0w0*V~ZJ#}d z6RMuiUdMHlmwZ9Pb%WdwFJ`~Y@X1v#X&8>7efA34K6^Dg)joTT*!J1$X#4C9w0-s_ z+CF;=7goI;%ENid_5UpotFPgGhV9wb_wQt5$Y+uE)q5efeU%#jLH37?H@`*3f0X?( zvEwnczc#U)+S<+8pD^C`7l!uN7PS5KDcb(}3~hgHMcZGWqwTLRaB=cW*Gv2BD-HYY z`s+sDWPita^ZjpGe%okUh|Sj=Zu{%|Fx?N?KN6eYBkhIN(|!uWf6o4e;r>6pPG$OE zaR&az_&U+=VSn8}))(@Z9ccctlj-W-M*AQ8QJ(K&xbG$ZN!*6{|H5;w_+{$fcqHR@ zV-Nf%p01YI|7nbJQvcIf2VG8G++DRtPJ^7(`_c7sDF3VL8;AWywrj7PJ+Uq}#QJD^ zX;{tP8v3mnjh+X`GX4e_&{T9L#o@w;h7+ z_n~OM)&$Mhnxc7HGp4uw(HuX;G&EmpfwnsiL)#rK(RN2Gv|Z5}ZCA8G+ZAomtVdMD+hbPr@o3fVM{l;$j?xtMFu8jf3$i9D*<5Dfl)HMSnkP7=DhY z;`ewO`hTORqyINL9R0u15$OMoo`L?~=t%VcMn_>M9F6|p=$UvdrsE*Yz|%1kZO3I{ zA!g%Qn8W_JjB<1Gh&?_!m*M&7|B@D<*LxxQzobRDt*SUDfo0XjIVGG||CbcQcO9j; zy{bH?3=`GmITeiG#dr+=PdWzuf6}usqJ4fg?v3Z*!8jIM;<@PmmyW}(HRE$8upGa` zLGH8jaxNgQ%l4ih?z4%;;XcDU{cA4FnH27~i!^*!lZr3Rxj5W^m*!j&?!QZOrZD}m zn#mgOKjc20nsZs0ZfefuVY;a~wvWX|aN9}9{d7&vwZy)+ zqG^@a<;)AissF?L^K-6`V`O;?a&92@{zJacxH0D@Vz+l8y1m3~$IUs5iQV2?;_-{n z?Y=dhj`86+&XTa)WjRa3e9LlfV|%w%t;ku9Wz{Q;!*${C?Nztuti(k1?KyWcd{@;S z%KE7P8P4~AIrlQWZuLDmtHSxb+nDotkA~?qt@8ey`>;Dc9OipK!*%drnC~Iua2+7? zt;t!9WATwN-Zg@K9nVeL+0mJ*+ z&!YMFTD0Bp9NK^XJldXk0c}UDL)#HAqV0&6(00VjXglH+tT*$uoL8~IoY!(TvL6$x zU(b0X-VdZ5@n+6jag4Mh-p*Mc$4EP3gY$*`M%oeY=PG@jlv)_yBE3 ze2BImK0@0MAEWJuO=$aJGunRm1Z_WTLE8_XqV0#z(DuVtwEgfo+HUv)&C|X_^R%zf zJnd^VPx}VV)4oOXv~6gf_8pq1eUIj8KcIQqk7%Cu6Pl;}jOJ;-pn2M_XrA^Pny3Aa z=4so}JZ%S>r|rZERe$9C$??fc?$U64kUZ_LoZSqcT=lnx;TZC?f6zRwHYb&*MY*Xw ztqz)})kX8PJT`o+hof4u$^(BpI>dYn!|kJA9= zkB#*O6+(HdG~2dS6h2}?r_GNcVo!A zN1%E48ED=;63x3up?UXcH19qW7bnwQFV|g$hU+f1{;aS)uAev@mmKuC*&;`#3K-?Z5YN_#Lk# z>+^e~s@y32PFFR4&V18ZzTX{Pk(>JNXa@S-Q4PaAZj=KJw=&&TxhaW5Jv5VY!~UyT zY)@@+cJ7?qR6T^$LvwSl$xYQm80wpA(fZ~(v>uv=);sgjdgpqy-dTXwJ2#;9&W%`a z=1sW^vB8|1a+h&lCRX2^drN#?ka}lP?yYf*)H{oFm&7qr?<{q`a2}C*XL;^z3{RW6 zLc?$j_0CGP-nkvEckV#z&pXlj=PtDVS%ua=ccb;sJ!t)NFIxZHht@y$qxH`NX#Mjb zTK_zRpKx3sM(dx|X#MjDTK_zX)<0{|`sXpU{&^g&f1W_=pC{4!=P9)Qc^a*Moz|i!LeS4^&pWuV>fN~hdGEj1E%)aKxj%C~dB39V z{}5Xa5i@>M?qHdD5pM0%c(EWa_UR8ocana zr@ltZsc&#`@>|zSIkip0{$i^A&+_X=Kji*M>~lM0yM7AW>2@()D8GI|%dcOV&gVtH zh3U5E{vPJvp1YInn;Y%W(7rLA6aA6&C&ab6QC@0$ z{hiip2Hv8W6j^$Z{Lz?TKq}?>x`{UK;irDF^q-+cz(29a@LmV-^vaF%4>;rqgHusSnk}YwT9zqJSS?K*Dj8ABllk_FE}EveO{>l z^E$Gf?nei7KZvdW^Nu2Re>$Q2L(K4_^Ewl|Ur1iiC9f;Xbw7~t-SWD}F*4mTc|90z zUZ5SSd*<~H+to|Mc4E`C%D#Dh!u);n$QRh|V>OJ&Bd%tS;Kk#w_G2Rmnzp!VgB0W(7a)Jsd61D*H6tm zEiYBBW9Uyl9qsQOj^@)N(Ei*r&~j}gTCR;k%eB#HxppR6uBD^pS_WFKWuoO;7Fw=l zqvcu-TCU}yArMP_CVgmTTwarOLIj#FlI4qUG8+v|JmHmTMDmVbyuzIL}L-|KH;r^6Crn zQu*|S_-{VV|NrLA96 zx4gqp-X+oUt_m&hs?qXpI$GXcftGhOkpKU6y_9!XYB&z5^c0I`aH{~r1 z%eyJ>mT=x~*05bjd9*0+*0?;vP#!Igw{Jn1* zUc>Fg-p6;K<$ucOz{>*#g# zI(h@Wj^0GCqqlHz@@?14b+lf?`Evcd|DX2`!g@Z<+sgLOj6Ty)ei~mLeV+H9)4l`?C96L z--vymTHT-D(f!$u?#~W%e|F-b_y=Bg4gLSvg7{BtgMXp>`!{yN-RSq1|6q5l#hw`D zN6A@iSDpN*&Jg0d!~>!|^6L@XkE-@V*JpSOrfYy{(VqDYpXztT(9eD-wqv_e z^>VZPruo*R&GOTj&U(2ydOZ*`yhVOXV$aKA=y@S#c&q%@#GW6dUT%}$mgRb0kn!#E z507J{9&VrCA#Cpv8nz#)hmXwf7^Xim|EMs&lZNrga*odLOdPg1tglNx^>e7-G1SZ5 z818-DJwH_sAA@bVpL?M1XY@qhtL}xqpV1qA@1PI*yODj--;F#LeJ|oT+)#CVeyaZN zr{TW(xBfmMKUII9$a-s&C*=>wPu1T@{XH;$P=2cZ#_(Rk$>@8@gVFERhM?ccor3de zrwqj>xPFJB_57(giTybZ{a)^L^n1DC_%zdvz;BrE47A-e5`Eq~3Vq%?8vUKWGtuYT z>1dvif#wOBXr7RT<_Xzoo{)p)3At#VkcZ|8`DmU{faVE>Xr54n<_QTjPbfz7gc3AQ zC`I#xGBi&pNArXVG*1|V6ROV2KPTTj>1++h8QK4_`QsQqx$0aE!!hIuH7od5Mj#n~WZEZ5Yit*+H7|QW#v>cy~mg85T<@gM=9Irvk@hfq0@+#L$ zIexW<{dN6yqgnZL8SnGa*(|?pG$+KCD-37*t_j=g_A!09f3HLD-+9b8jO%4S4#(?p zG%mpYcmrBK-pF#ViWcVox4bsLxS8?h7q_7K#iFo1^#7yz#o`bz$zRTRw{L0KzGWeH z`~DriA`HJReFLT!Z(A>*YQT z#|g<#9>{+%Kh<8sP`^ABACHIQq)-z8KTb@0M z<|j{~`N`90z4HwET=rS?x$Ii>x$JZ3bJ^$d_S*Ye*WHs5(2&3BCbo#8jb`Fbn=ZDNn7`kZb(!>^1s&rYZe~012qIdJ( zBeq^tf0ylj^mo}lK%ZNt>VuE-KMLjU$N8H%KGp}D(Cdkq^7xbdPl-K_ThQZ3%<#|h zw-S3ik^12C{4ZFp#}66*W&T%jj7|G4|Jrgq?Ek;z__xe&IlhhZ*Y?zR*n|E3K9t8l z#O3ji|Gj@hzuV93pZ#vXV5f-oKkJG6)j~ho@7(|PqitvTwaFd%JLB>iDX;&?-xZhF z7|PQ>@kWlzU)YWH|BaTfyU}v=AG92;Ma$8sAXSdmLCev)XgRtET8`F3%hCF1Iobd% zNB2a_(S~R_x))lG?v0kC`=I6MzGykRA6ky?kCvkcpylX+IH9UhLE{3;(StPH7f3mJ zaKWJrpImi_hT#~>(I#j)+O!~5jy5B<9Bq!4qiJY4+5#;{55t93Eeos{=OtTdSRQh} zwkhaakh*`7apKT8?(d#mQq_FWc8c!}huUx>2u!-i$XNMz*I<*gm(1@!>i@7QN1o z!%fR*|A*=N7xWAB_b)h+?W&1R&~V=w&xlSc_`l`mK*n2c4noV#lf(Sf|7f{6gyH6! zr(h?puc3G}?@whUrf$IGxz-{nz2dUe_ZSUne@FU?kgVd5OfM3PuyVKgfF1 z3(mwfm>I5%3=PKvDKE1MvI|n>C5G}chxxtVbJ63Fhu-J;=zU&*-rt2xZ+TgSmX`^R zgXLv0vG;okT3(i-MLyANKdWf(hX`omVh1oR{-8oEPI6(FFyRXCY3NYm*8tDzF@yRB#E)bw4jg_mi06 zmljMRc7G?M`%BF5%L*gM9t`{SP{G42$Nfh3b9KQZ#I6UKe@(%oVR>r` z9uN1&V;Z&#xj&vLcrv~}Fx($c#oPCEynWB0*UPi$^|BVdPM%|W?~muv`{My5B#d@0I_AzE}P;`d;}j=zHbAqV2oi(0-lY(f8=Lqwm-6K;Ng| ziM~(&2l_t!F7$o+Khfj*7y3T>-{|}3yV3X2|3TkJuf+K5)%7&U1^ zIftyTUSa(>M%KGmVFUaS_ry)u5Vzpo@pRbYAC|ih*5!Qei}i6o^gQp6p63JbKs*rr zKDZG!!-McJY>XSK4ld++ATKyX!}X1!UD~8D)h=y{JGd{Jp?Okswxc$gR@kC2)viVI zq{9kZ7N**@7~bPmDL-3EORx-C{>JFLdTaW&Ufd-S>95$Jo~9q>8gj_Cj0 z9Esm!C;S z^gZzc^gZ!H^!@%KoK!{qkG|hujK0@jg1*;ZioVxhhP|;IeV@MqeV=~}`ab_z===O< zqwn*dgTBu{7JZ-pT=aeZaa@n>Bl`b|eLsBy`hNO(==66j-)2E>Cr(cG?pME*|e)?4O{q$+*`{|YF`{_ya z{q!pClf&80YGU65n~px0zXE+OKLdR(UxPlEzY={ee--*%{%Z8O{7kGjb9Uh@Y%phb z;q_cc6RYPG&W*1lk?Y~#h_TQ^$`|mZh{r5WB{(A#$|GkN} z|K38|e{bW2s`Z5%Ij?!i4I0iXa-82Oe2?LitKQWx97Fr>eYE}eL1C)>_aU+EzmL%N z-^XbCZxh=7+l&jVJ_+^7yyTYu)+gb4+h>JQqZM4gTk&@M9Ph#}@Lv29AHc8hVf-2& z#c%Ky{1%_UZTKvHhcDpw_%i;0ui=mQzvp>B7d9(O<#|Z{`fG^IUy19?X8PX?qdN0( zd!c#Yj>4UsXY)X0`acSH5j#DGeD_bLtF8U3@NdSO?_$Vzccc04KWM&Ni{`r#>oMQ0 zgXX(+adC2wBGym7TTjDrN7|tciuPi>{bhTyy=|k0A+{ff;f&wAXdlM=J%jo^!@lVE z4Ev$aarO_>9Z+;2@xx4q%-5)>G0VFmI!Hr%0vUdA(ILd|G93~hTGWKtb|rE=n!0`A zc&P27=4k$%#&p;4`%f)cZdLTl)WdK(wq*FcWxW4~ekaiy{Z66{`kh2u^gD@mEXViZ z4kz}#@%HF@<42(1Np!&7RUM0tVmja7K9b|ru)33RI9|y1btyVJY8jy9ZR0O^AG|x(R)sMvF8bsQ==1$PKskpULFl78W_iFf8HRLTPGS^baGh!;G$EQ?y_iz zhUFMfiG~&pi(~cs-)k>RouAW)?O!|{?Oz;@_Aib=`xnn(e%loziPu+-DjHpsYR_Y6 zubj#8@qDJE=Q9IsuVkX_l`OQqlFjtCS8~wyN-o+?$wS*I`Di<(0BxrfqSr+c>#yc| zNTAn8F($Eu@jEzfrSbNa5&L~cIr@D@1^Ru)81%W=Sxna=qW;IU=$xXl4EH#z-)Ef5 z@aBvkhs~n#MHAxj>h~Gvq2FhmkA9yq5&b^n0<^#3LiBx>i_rI3CZXSLT#SCVaS8f; z%B5&O=w$SGPeG5zW$5=Dm!scvOhv!vn1+7OQHg%fkwm}es6xNzs7Al%n2vtWaRvH4 z#|-p)jvDlPjw{jcIj%y#=eQdEo?|BZJ;yBcdyd)Y_Z)N3?>Xk8?Zs=*?>VkTzvs9P z{hnhU$E#&Dzvy~mkEhyCynyrWeR%`={_c$o_xp~8=zV$3iLaj+mQGFi&i4<{}Mr zuBqv5-dRQzPo+@yw`g{ewK3_$T=WFP9 zP_J_yz0cnu_ISUE9_P2v}JQv9ahKw!?NPGXJ|p@5M2){P&AKh+|}V z9~ONS$H;O&F4`2w$nrNAeGqWT>1komv*7$(VrYI%cH+AE&97?x6`vfYI*bz!!3_$u~`%) z>LgO*)$6e?wqyD|us`dohl8;`T7EY`>ynAnThklGzr+a)-&NIL znVz|(3bEsj(<)06#n>H7 zncnMP8z##VW5RIi|1cf(KaOQP9p0h(ti(Ctx;$IM^@S|&+{9Syj#H+2-Hy{R9z*}- zgarMF+()b9_+ICw?FfOc>IO9q3WUp)6qVfq~UlY_sb=T+017@G14BG9Aeu8 z#EiczaXI5{FCgQmCZ-WP9z%PflIeKd4uL)pJ-4A1{DJpV`A3p3F6LJitp zxDt8(?|Nx3T&-dIQtO`;w#W4ohwFI`dOgo&KJWW$h^H>4{wJP;e@soiA2^TL{_^=~ zfBE&HT%i6(`^#@&xc%ifhW%WaxQXR>9FYCKIdKcI>qX|jHL)lx@7BZ;wlgoeSi^QA z`RCHavP3HX#E^e3XMXR$73lWfhTeB8(fjRo^!~qt>CHdyMDwk?IF8nLtB5TR?nd*_ zd(b@eUNjHA4}I_Ne)Kpz!16o}4-!{n=lHsKnBiU*tK;k95w!pM(QsX?iLZ;t{(D`7 z{?I29ss7L>nZGvqRO0DGsy`Iz4}B)_Y$DYkilIMmE!yAq9NJItJlaq20@_co4(%s+ z5$z{<3GF9%8SN){1??wz740W@4ecj*9qlK01MMex6YVE>3+*R(8|^1pkMGTY z`rVcIGroQ?T)%%Yzt`{I==HlBy?*~euiskq`i+WH*KZy4`mI}>x_$d@V{qBjjU${=$-o1)j6{ofzDQETxvE>Xg#|)(pyf{ohEL`>ct`X+9vPP3srV?C=Xpf- z`{?4%#I6rnPS@ftxCXnkoq5S_8nzQTkH-}EC{C3_7|vtQcsqN=+u0jK{g0l?Z9u33`i3g$i{mE#4KN!vLIp1}P z7@w+th87pFe)ktSucwCC^GeMApI$ti@$Nq|enjyZ#E!>s-bXTBZSAPy(eZi5aNf^E z&wDz0-ZRkio{66KEcCo**c)XYB-*$_2-A}as9;Md>5kUyNLNLcN3Vs^nd5Q zgxK?5ik|l}w$Jlkj-K}lhI_upg#A0K_-vNv{v-Q)PVrb`*N4nMuK3)rym7@7!ucMr zVf&EteO~eT@%hGZz9+`pc|p9L7oz9;BJ_MuLeKZbOz-)=1U=uE#^-x7vFCdVdcH41 z&-dl%`JRgI_cV0B+fPpABgx{_@7q@4(G0If|G!~6`aJFm?8fjJ*b{5e=XFo5(Td@Qeqt8E=;5b~0K4)EqK4)EyK4)El zK4-lRea^ZPea?D2dYtY+kI$Xx@wp2^wy*LQ(!mWw9^MnUgW*r&pZF9G z!KcyphMz&-8-5mj?!6YbvfStJeB$TPJmUrQIr%#DIr)p|^YNF^=i@J<&&OXupO3$a zJ|BM#eLns=`h5Hi^!fOk==1Tn(C6cCqu0rL^g7vqJ|EwRJ|BMvpTl?YMSKr^KK?%X zeEb9Sy7~}(-u)5!y!&JHdG{vtdG}@v&;N1#oGrzlay^;V{4>I51 z#k+}}4?}tT57X7w))q%B*LoI1d0Pi9Z|kDv?H*`(TMsR7>!amu16-WkvxM!Syltpq z`;l^T?~?r(@AH9uSbp1R-w@mGW;o;bFFAnme=OnoKl*z}2ZrH|N)96ao8icGjY|$8 z-g7D6|Dpd2VeIpRL&NwcB~6Ka&Y(VLXofy#XdX|O7N%=aau~7C8Ia|+ENRVlO^#Y= zXpbSo+my5=_BjI*w<|fE*yjvL+`gm(@yEnR;1(o4jNkut|HJWC^Q}&3{c;r3?c#ns zy2Sdtb4gd$dvVl7!+P~#euuOhHplMR29Lpx*aLfDPv*Nc>Q&O4*yE_jGrSKD#J>0$ z<>9eR*E%|`mKYW$>`r}ZhKLO9c6EPD{Lfg9o(BIn~i1wol!gbRJmz<2_ zs|S}1VZYvFI3_QlpZpYt-_7|Niu*I)FkDT1Dn5&+;j4H$zJtSYGmgNo@C@{SE=J-) zuIEv>3`d9KeP&5I@sq^r^_~&OnYfBL3w!fF1KH?voE-FbRCCeiIeF;woP6|oP669* z|3e|M{lrCRKXC$mo>Ppwt4d1Bna+OKQm*fY)n&%v`bN(8StS)=`_3vEgY}8eVZLEC zXKUzRHMZY$EZX09F52HW4(;z7k3P?tfIiPTFD&o;l8MAV&q1!Y3ra2|_IZwaelEh7 zIbV}F{uf0Tms~>Z^?=C>qf1LB$1x@^h^CZW7RPFRe>uyo6HP0b8kRq;B*}CWqe>0S zF`f`rl~l*EdL2y1!K~*B9ELM+IM(1uyb{y#D$K@zpa0Ax_W92&^m)W=wEu7p`ut}u z>$9DF4e|QQYfG*R_X+hs@w=7O{~S;6r}^mpbUm5}EkN_28_+!HMy59pT8QRBH=+5@ z&1n8}3!48dLi3+n(fe{S?#3lyy-Q1$vpp9_%QPGh_5NIe-k-Oj_vcEq+`1jTPwznQ z(>u}o@-FngT!r43ceC8q(LE*i5_`VX`|>{YzPum3FCRef%Lmc>@*%X}_hIz>uSWk@ zPU2{*Lp{Xgm5B^f}IpDtNbHM%3 z=Yad8&jAlWpJN<|J_l@sJ_kGqeGb?deGYhVsm}oqDLs_fx`Cx9GhKSkAPvs}jjhiHqvgmD^f}WhoR=06^*^RX z!%9zOxaUWG&U6~Xn=}4&Y!(eK9TAULpCg`uK1UphUf-k8>w7eMeV>V*k972Y&0sm! z7n#JKuPpRDWuxaQ2R%=@=y}S+H8b){3)m0yd}RK@(xNyqbC8ectj4ZdT zv^^YEg0`52xfPD1mFi_yH|5;U*46n&038GVj81ug$CL!TpFj@Bnr(dUTM z(EG0vEnkypxmAUp-)fGR=XW}$MOT#0aC-JfJ-;;!_xxUo&7!MHua3v7*Yiwl$Mmz% z=ZLe>=ZJIAJYX)G&s@X&lcH-&uOoK(NPaV~bbcJG&k?U@_=VAe(i`I8NSB2Zx z^PHQ)b$v_e&EdMfrSw*&n;0$9uzceQ(c;o2aje!yOVRpj8CpLsN1r3Ez{l9G+wfUj zi7(>q=>G)Vfj(!vljSy!?kZhH?0%@_)ZJ+QbPt+8-HYZ=_o4aI{b>I50GdBNhqV&mlyn4Q#Vz}q)X>1lf zQ~GQ?9-EA=TwD4A6fhE_A`d|^H*F~wY6WDe#3a%&luXz-{Sd9w+%1A@6h)1_h|e12ekeC zBlG*e%|D_4+x#=bCo}vPyc~bUO8gD0@pr7j?Kl&6;H=~yr8{vI{>gUFOYYLJ-N^qy z|5ds>4F6lhaHQQ{Tlx>K#5!fp7nNZckID1dp1Nh^gG*LV+k^N#VlsrLX_XDi>X-RE zvq4$IvQ%EaCz_WNGkmYIeTdD^_eS$`VutTqwjZ&1I`Z6g|FQ#EzWF&a{=l+Eag01y zJ*ccPv3WDH-b2a`4$~b{b|}LwPq69hl}*Z;5_`WR^EE4L9>++WR(2Tcwf)cn-A-cG z-?FSNvD?`y9^V?>-Zt@cjOTfDyRyT>^wj?hA5z)A>u9kzx2z zWu1`U|10al_-$34%Z|pf>dwX??{N6`s%~XnF;U&E>==gcs_L%HNBf`QyQ_MX^fU8NIZq9%dl_?{dTW?Y(<+ZG>x~!K@m8X>r4bz=gHVpd{pNbvP@lKDF zTf@sn61S=zq0E0qh#gPNc^p-i&hYN+|7i68i_b)#vpc*)bw*hh*W-jJQ$x9jOqWxZ zjomRXjL+3D9=T5P%L>B!ssC|sb!k~44#OfGjtLxz#h8vIn2qJk@A}Ko^J1Jfvs^z5E!WRR%k^{6a(ygXuAhsR>rS6nJ-%#0ygcn*d0yERo~Kye<31fC+W%$I zK8^4KY#m)#M*rY`K7YW_4?d}k{!iMi7o+{Xm*87?Dca9C8U3HVDY%j0m!bXJm!tix zQ_+6bX=uM`CEDMeMEk#4Px$_-n%MsM>1coa6=;9_49=td@il0F{FMy1KmICoyRJsJ zYbLr~voQSsABO+`L$_-#zK_?S{n6K={n6K<{nzs_{Qn=?k9$4Z-@gFu@4o@<@4pf4 z?_Y?c@Fujs|7Ntm{}!~re-YZ>e=B-C7Nh?+y#(#=UW)d!FGKr@m!tjPE71P$+tB{+ zm1uwY?Px#v9cVxJooGM!U1&e}DzqQ`ZnPi#9<(3)UbG+lKC~bFezYI_0rdPlh@PK^ z(0=fT(SGpNXg~NPXg~O)Xg~NGv>*I2^!z=Jp3f)H=NC_+&o7=rpI2fl!R;yScH`$hD*#!KjPkC$=%oL9>Ubyj}JN zeu!`4CVUIG;QDwvq+fi4*E{v|Mh)c_(oT7|Y_IZEe>hSvzaL`jW#e(thh-mee_7wF z{e>UnCfro!{F}=@VLkSXBlB-5`;^%EG1TjyF5I6{aaj|+~#&suYRXt`;m6o4`n|y-hS~PS$^B-rx2UJIoy8jUs!+L=-0B} ziT(fL-_ZXrCT95dvK_?scdPx~JJJ5`Kf?H3Wq%RRW&EGG0EwCJ@3Mc0ZzbN1E0CDs zwPjIxs$U$5>y+=oaU37j)lhyS!|RpTC$?W4i5ryfNo>D3a$Fmhvwz{Zs`c&OXnng6 z(@p07-WUD5#zyok89*B2hBfO4s>mamWtT8SiKA7z~m-BH5aj5^%e(EM@ zp57GKO>bV_498bDFHd9r_G4lA-`W=F|JELc{%>tdmNzzPRoqYH9ZiDvUv_<=m z+oAo(hok++?OCq%;}OL6FLXfr7doQ-$4BDss!rvdna=k5QCtTNtB*Dg*8y_8x|Mec z$FW;^SFBHb4D$`E>8_z&j>&VP9_2k5?)9OUa~=0W`^kHw{p5YZa{87ZOKd;6dfguv z$H$}nF0_|5GgZ3+*h4w3-jY+PrbI|^bv1otBxoCgJ zILzm`jYt1?ZUWk_Jr64wem>eCIuS3y3($U}3(^0zy9n*ioP_pUUX1ozUV>LK{!;Y* znT*~)Q_%b8GLDD$&*j8-5>Lf@a2nblP>J4GoP^N7T!r>8SEK#Q)6xFrE71Ps8EF4< z4cfnOCE71^723aiHF}-Q#C6kWm(RlS)w9dza9q7FG2EAP(fjfm^uD~7?Hn6jS3Zx} z^Q``#^nA2`;(D}yVgcITy@Ba%@7{=M(ZceZ81D6=ws&u4xb59ruvxUI{MLB9dY>;w zm$!uRUN1|rRkW;pc|4ukPrCx`r@amBr(KEm)83Bu)82vh)82`m_q)*Zz6w3>cccBZ z_n`f>_oDr@_o4l?_oLVG1L$@3Algs+5ZX`sFxpSM8vS155wxH7QM8|S4cbrp7}`(! zINDG91lmvgB-&5=6xvVwG}=%54BAioEZR@I7VW2f4(+FX9_^=n0qrMRhxXIHi1yRI zg!a?EjP}#M!trYvy;}YnvFAbU|9GAAZn^me+E4o?!|kVi3oS?AM$6IlxUFhq`35Yj z-dO$))7wvrp`Z3$wBPSNv|sRjwEyn|wEyozwEyoTwEyp8++MZ0d=n{j^`8{j^`A{aRmP*P5@(zhQay(<0^mx8>gxTkdZQ z<^FfZq1;FMX@4mHDU^FZYUrm;#lM#S9Lm98%YVW8(XZvdGySld-!#+*NO`%le0!K~ zXZemW-Oln|OqX8shlYMyq~7?m{4a)k{MCBnZ}j=cZuI%bKWIHti`FAiMXH{tgVrB) z(fVW$w4SJk))V#7dY}PXKkSLt7Y)(-eJ`}1Z*R1pZy&T=-WRPe_N$1JXGi;296;>$ zA@#?B6^-IpEe{W3_?W11#li7#q#ik>;?Ou&>yaiE9+zenO|dSfF&#y{hUFWRQdS%m z$7(-cOSGS_723bo8tuPp!}N`#wiWG&-9BA2#$?Rk#US% zkDV%xieu!uJi4ND93$6fmx``&j9jPPD!Rup(oR06q9<{y>K;Mc$Hep>_p9iIeXi

(Bk(v($Kx>%`^U@2(0_aa+OK#b+OK#L+OIf({TmPstQbV>{;TEe z$qcug9gJzwkcv~{@oG6cl;M`M!?0O&YK89yIzQ509$s;Jh3(wo6=$#=*1IFndY72t zBP&J|TmOzi>tAAqpIMPkY(0#$zcVT_S)cVUGCr#!JC2d*aw>8eZvTv?RpwXZh3WDu z3Ye}P+k>H>rZ5aoR21Q9m5GW{#&4@CsVK&>>JsBn?jY^|vWf~~x4RtOZer#eQ!$p< z?LI3We>S@P=fu-7p7Lj0#krWM9#=7e;k&BFYv@lv%8m0XE@XJ!>I*8)uP|SnXiT|r zfrjZct#VSuMab{}R7?)@U96$Jxg^YYsc|T8kol%oOu?~uS(tBX#pRerJdOD*kCFSR zvZ6YSr~VJ)>HkOjJsjSldV0kS&TCn8g@*HrEa%FK8sz_fDy|OWuhK9cnSW-*9M;pi za(2Zm?1;u*&&c-8t(Z^Tt8!k&HDS7W71v^a;_I*@I^OA#>+|}GDfEA|s$QVXe?y2J z?{NDg7FI+pdQr~Ygg?!v{>S5pZ$aDpi_rG3xpt=X_D|WqchX z=lQFOuj3fmp6@EY!4L6U+=Sb33w|F@hxBXwP?74__))`sn(Ej1xuVIKRKEt&FY#-L z?Ux{?e*3**JIk@(0vW%fVkfcVG4xyfLH$=-yQ|_)#@la!q2J;!wBO=ywBKSk+Hdg> z+HX;d_FF__?6;^hhV{{JQCGwExqjOJWAi!}$Hi>`&}_c*t@O7}JR5l|~0@SROL`pfQb!?QcNhgU1{~Y<~lCJPvjH z!tqec<)&!4+>GhW>zm_0+&5|1ko&3yHp0WueuI{1zS0WUO>Z-%HIA=tGo~%ev3-J} zzG&xgmUB2x#P)bG9)b23bU^zFI->mqN22`%omh_L>ruq!w@0J-ZD+KfpbPG<>N@5a zrZZpc#&K_0-Q74GcVs_%jp-5gzt@g9-B*UT>&nq~T?N{%8-q=FU+FA7h2wuV{z!k_IXH@VEVf|$xoA7+|50`4 z@iLbG!zYRLWUr&c0F3nIn=lS}04Um7-0w5K2-~v?`Ib zYLN<2I=|QJn(_F4e&?U(<9*-v+;h*pTtkp;Ko(lh&PMCmIcPmQ z7p-UKq4n&1w4Pmn*0T%I>rjO2#+QsP#%OuT=rNo(?_&)0`>|;G=XUh{u{+TE{W$dg zE=BKe3f@2W!g}w6 zsn|3!ZS?fycItVafu84k(E9aEw0=DctzX}Z*01kFufzT5b$9^14ztnv^>*{UBPu zeh95!&qeRgdFcH!AFW?6K(@`B_3Nk5 z`t{Rj{dy5vzg~>iub)Bd*UzH$>m_LYdMR4Jeh#f)KabY0UqI{EFQWD9m(cq4GR|L< z$jhUb6MG%h`)UQ(+w|rYw0`|6%dKC(hNeHSqv_8|+#P>o^eP-x{>JFlY;XM@re*HFDzg~~~;u}W4gCol~jDDB>S--|mzkUy`UvEU~*YBhC z>rH6=`UA9n{UKVv-i+3-w_w|eAC3N){aL?8(#uaqe@<+A`DsWmKQj*LB~riMI{M3y zj(wq_ew~Q7kKPv2we6$7!fKK2qrYbRJ`;CnNJo+McGu{gVY^+UzX{vz8vPyH4Vw6^ zhWfR!>FxLEbNB;V-~AD-@BW0Qf4kB2_-C%y&5>V5|4QujLel5oM(;_+YJK;2mXD0= z9sNggIg(EQIr^_;tftfZ!f_rLy+0i1fzb!qZbam74f{8~A#!N+Kgn3F@BWL{cMqfK z#eZnMw*q~yC6W>e@3mAy-)pIizSmL(tru5Kv0hv)r8=>{Lsv|wky0}yQ9ehW@1s(V zPR7XnQ!C||WQ^QLwNvUOW8{9Sn{sS2M((TQQjSl?$o*9><%DF6l>bjmsZZRr{G_1e zeq!pyO;Z|R$4O078e$hb8GB$O?2V1_Dm(=TVG|sV&64}aP%lo*2hbv=d5ZO#7AdE* z-u&q_G=Cyy`57s#h|Q;3qWKgt%Uh?MNo;1oXc|S ztJt*scY?4?}&mLs))6%K6Cn|C9?^zdPP3r6Z0i?_?aFW2D}7QA!tL zkGnH^+{ApYYf5)wkGorP{l)0LTf7?N^rSWo^R)|3CE^;MU*EWa-0dhW*?BEvP@ugHEzq}+h*aAa72 zqlWd!=Wj|G#rHHTy(Q&lY=y?&XUOs0nvzC*eramTZDG6Al+oCgI0ajw>)jr?U(-{@ zg!*cR^7+gVC+n-sm%MCTjO{v2Up6ia+Yo2t8FTmE!4nzko4F~G#!X2_^3Zx+K3ab& zKxt!P zeRMoJ&g@RKJ~{zCu8C+p_Aa!3Iti_x-i_8zC!_V#DQNw4D*8L7p~pELt)I?7>!!XjM_0h-CdifJ*z4S@6UiuV<`afDfU4+(87o+vlXVCiT zv*`6&g4R!$qV?0~(E91~X#MmB?1e8P`%hVxyswb&c{ycyGDg1dwUiaO6<@(^_$uze z*OS{}7^k)p9jCSm9jEpNdf%+ZY`$*|+AgpbtslRM){oyp>&NTR`tjRn{dhfYiNBMQ zsMl`L@H}If*Zw`8Gv~G6$bEex`+Ywp@&6+?VN>D{SYAZ_@*&nG-kg&7zmr>t9be0S z!aT1Zr$nl6qu%rh?q~U@=sd5V@%t*uK2O=2l9<;3nb+WplrK{f^BQ27*K->>FXvad zkMj6-JcK)N6!STLjm`tR6P*Y48+0DnUFbZp-=g!teuvKg_&qug><@T4&&Q7#;d%H8 zoj-IpZe{(?==`t0U=`N?iZ$>z96&qK9**<+2>CzprOdmq7ca*@@F#xnpV*i9FC2*b za2W1SiPX3W4-otR)c!{2Jw1rd8+!C^Tswt=Z!rDoj0}#I&W-Kbl%uz=zOuKqVvTzN9T)efzB6u8aBbxv4HgP z40L|jmgxMjt^Tch*Do{7#AdlouR?Aho%vFD)k#I`}_hi!|_4|^_-z;>yL`C;1= zJ3s7s==`u9(D`A{N9TvV0G%JUBRW59Cv<+;3(@&uFGA;s?TpS3+XbB;wkyuZZs`25 z7o+pTUV_dK+Z~-B_EL0y*dFNou$SQ~?1|0~+bcCOKkVhi&JWugogcOjIxp-M=)ACf z(RpF7MCXO=ht3Oo6;_?xKlN&?KCOT1Fz%C_@&Ty>llKWSFYGm`gOV{aFYMsdA;}n- z7j~$h3-=W=FYL9c!&%;F@^u=PW0)8AdURgc8_;=SN1*e<-iX_ABswqbP3XL^H>2~y z-h$2xI|`i__EvOW*xS%~VMn9$!lqzBJS{a9n@mkhO;1gf1CaD3Gc^O7Pt8n?CYK}E zdrWE!uf;4JgxT01bFeSwVlT|Y?wF5VumCT>LTryk*anO7Of12cI5zox80Le$9i4Cb z4s^chap-*0rRY4dWmuVXIF2W9pO<4p9FM2qo#^~86VUlzCZhAd+=U%*5<36O-RS%; zld&gGLFa#&iq8Ks4W0jGI$n!2(D`5PLFa#&iKB29I{(YP==?ADVJv=s>TIs_@UjOq zTxaC`&q;lVrLmq&3Gazk0lP{u@|A^u@|Sh{WGc0vc2uM$o5N8mlC@@ zhW6X%*sh}D`P3I!Z~HBV_S+ZH_S=`x_S`|ZnU`|WbH{dNT|D0{`@;CNrvaJ)$S z>FcR)u-^9DmF&NHWL1c*$FZFCt5eso-u6`_UYq(RvF*5OJMLR(JMKEPz4z^~-TKsb zh;7eBKDQzDJ@!95@~(z*HL`qT>ifjD=OXc@)DMXLKIHs-7|x&PhvN~~x0m*M-irEcfAhD5&7a9qZN zBRf*RPR43`?oPBl_Zzf5cNf~8`z`yo{_!2L?J3`*?I}N??YTc9{r{=Iu$}D_ySWZE z%YQZw*8%yRds2T5$FnE(H>^gym(TT?_`8O72xHq9{y@j~{E3e5`3oK2vkx6NydNDm zd?4)a@6?0DjvGeK@1fLxh#fbq)+7JLVVuXq{O)Tb|D{$Cd;PI&SR|5GDJ>CW+0aPk zv?|G1ZFi`e=J8igtA@P)msXSQhD2&;*pKnx$WduWCu2R*KJ0ZqhS+xE+Gsmm9kiXK zF4|6fET6Z1@HpblrN^h$OG~s9V`wKnAuVxVoQU2RC!zJ&`e^;N0b1{F$o94qpNzKi zHA3s(jnQ`EQ_yzeCTKfxQ*6xlH$&TTPsIWJ-sZTM>(GMZvi??F^QC-qiNb zmMpjZvlTXsv`#xSxn6DeJqsPrdN$hbdk(fCZiBY>wnf`}&qdpN+oA2f?a}t$^U!vt z4rqJt`M7R;$FvJDTHZ0O6TjR09z#3th3NIZ2yN%>jJET33D>V%TGw#>x}{yh@eYYx ztl{?<4~}$CyEGZA?XW%2cG%0%cG#Y1J8Uns9rkjx9kw^x4%-K9hrI%AhwY2D!(NHD z!}delU9UphU9U#lUHhZ$t^?3^*MVre>osV*>man9Ovp?Hik#uc*+C*a0wL8;H*CrT;bPZ{Dy({hRaDPqG(C(Uur>0E~ z_uJI8DOfEsHElZE_nA0NLwbj#D>Kt(gzaXg-4nK(nRYMR4VpMhL%XZ7>EeAD+W*n} z?g0$#|LA#}gZB44$n`Qkd5GBaIu|{k^U(7-A3dK7(DV5)u9)yh+M|4*?K8;d7p6Uy zjFJ66p7umCM)vn)+Ed9G+3(Y7i;^+2|HWy~BxB@zo=sbljFEI_Y1;F|P0ODP`n|-o zXTFm50(PAAO4^Iq1z*A*xD0#a%Xk$o$3eIPhvTcs{bOj)d=1S^ht9I?OeSoHT1^SR^GPa^jB)l05F0sWmP zCbwff>0g8N`Z%(@LHfxoKNxSQe4hND<%i>q(wnlpa(R>V#_6V8rx=rNHPNu0GXHOS zGi3hX^wY!Vnrle!T7=J?W*pKxSzc1-UOw(FRFK6WL(09&E! z-5yC#E==!2+_d~6<@23G?0RDE_pa$;D1t;h63>oHfM^_Z*C zdQ5+`9y0(JlnwNIsmENS;k+lle{eV+zn?hVH$&0;W*DE_Py6wad1J35Ucq+5(fRwX z=eR0!JU5{8_l;n=?Ta^t-!(G*Cidg+Mt9-L3J;>*8O&=BZcWe4+j%#??Z5oaX zDX*rar=};$s~F0wY02YDPaa!~1_|f5w9> z_xC-79^YJaKl9M``T1!3`~vj%JdC!_KZ4Gy_b7Uv7UCPkkKume$I zhj2OCf3gDYKY0ajX8EgVd;V)^d;aTaf6hv@e`OWgzw!p!ud*8LS6PG8aV^@f@+R7^ z@)p{!vJUN6c^mClS&#Osyo2_uY`~@XE_yxRL$BvXv|r_Yv|nWtuEh`VZTt}JSJ{kS z_bq7u$VX`Z$j4~E$S3G{%}>$(iOwt{SsfNC;BCJqWu!zq(_c=jqP^f3B=#BU9vx-{=E42=|7|=`WvwR-=op?-&$zww+>dFd~8NttUm47j0PFD{~nidd`9BBA??5QGEPXwNc-=J87C!Ur2V(Pp9|L+ zY5#4Q(TL@ZCZDWfIfnM%#@K}OehS)t-vpZzH%0q@nxXwRr=sop&Cz!K7HGTvX=uCt z>1ezD8ECtHOSE0T722-f8trE~6K&r=3vJ&&8%N+dSfBf#4W5i`@f184d(j`%4(*3( zkM={IhxS8tz}xYBEX51Z{-}<48lUfk_5)prwqss|tyta}&%rL3$8*vZ&m-=J7vaU& z4KKmVusim}OYth~fdla}9Ev^h2JD45?Ow4Hw>+RlFy+RlG7+RlFqe#>^F@K)kmF%56SEF6utr>CIp z>8WUYdK%gfmyY(sWuX0JnP@**6zwOA;k+qX89Cgy3#VjjxNkA^ljWlQWO-;mSw7lN zR)F@C6{7uQMQA@+G1^a7g7%Y*LHo(ZqWxsIqy1!ep#5ay(0;N~w4baD?I(+){bc26 zKiPP+pX^SwpK$`(Up5i#FS`p*!bxa<+1(k5^ldV+{a91beygcyztuFf-)cJAZ#4t$ zx4H-Ix0;FeTg^iIt?tG7cputtbwAo~^#Iy$H5=`>nuGRRJ&5*OJ%p=pF4}K3FC)=! zHJ|uL=8;=~_Io^x_TxN)_U}H5{{Os%Xg|nfXg|o~Xg|mkXg|o4Xg|nPXg|o)Xg|mz zv>#+K+7I#!+7I$9+7Ge>?FU(k_Jcf!_Jcf+_Jh2D_Jh2L_Jh2H_Jb@#`$1mDSbTZL zE8I83%T{Q(Z;#**+W)Z@=fvO4 zFh8AD_LheIV3_~@?Tp0#yIYUj=aB#7PTYXs;k&pS-^1T$$INg z80t@dq4lSIX#HtFT7No#)}Q`H>rV%9LD?aXi|h7}hUr@KcRnDxE{GG_>s%BOrcD_qp#dWKWYq3UHUo-P4V*88K{-UGN{-Ro8{V|z! zh@H=%HaedHG5f8Xc^t9x6&#DsS3u12<1xBx3uUkhp$k!^}w8 zHIW7y+98nTCucSyw!aC98)u$EY(E4NH_2>9>^#0r(RqA{xz49%a-KrHPi>cIfz~fi zW4lYZA5O>Kcm}q@me>zl;Q(xn)j2O`;t1lia1@@6by$85rVzKm7`DZHJQs_w9oi1o z9>)=%hvTsW*5~u*<7DCs_}v2|9Wy%-J5E{~vHn6l6)(awurr>8U9dfNMf;7qVJG5? z@lw15uf*;+7%#;eu?ME&WtfXS(fI><;aK9!aRTDUKn;}!TQ_Ql0`CBB6Huo|Dg z3Y{}|K`xJ{jkhyi5;)1_TycLVg6sV zAMbh$^Z#-^ZJ!xIZ2SC;X#4y~v>)##Wd7gGTiMR`?pt_{nE%%}JV(fVl9G8__}-Mv z(a8M2nQ45E`F}OEYa8#PoRN->Z_hx-w`X$Q21KHnF=DS9mi3QhWo8rm9IE4WbI|d* zx#;-ZyzqVbnFYlDPBncgOvXj%JP*a_JP#%4bsB??-yMsN-@QHT=Z?&A#E#ol)2Gs8 zT!xPCjic?F1@|GGEKvNjIW5y$h;>RtMe(%MCVhQh0dpRFFK#nedv5j_v4XyhV56JO>Dp7 z9JIaoL9}1-A@*;3%3R{jrSmf9XC~TdFtpPw;ClI-Ka4)-kD%=|kD~1~3( zn#a+0nkUfqnJ3ZqnWxb9nWxeAnMG(n#bUId;u*A`;#o8uS%T&-OVRY?IkcbRd6#qE zUqJgSUPSvVUPAjTmZAL>FQe(tay0!}fu=vNp!4Rwil#rWq3O@-xRlSWMAM&DX!`R8 zn*OXt)1NhH`m+{If8IpXpSRF-XC3ErVC3!0^~B!4>U?zX;8NCaKK5d zvk@JC{yr{e`6jeq;RCc^>O)+^^3C`jZo!Z7BixQ3qy31V;1K46_!NI+`DeHnKS%p5 zwqlt77prpLeu<4ZpWD!M<|{Ov*^Z_oJJ9syYc##tsqE()be`W`Xgc#P+OPB-I)46p zw14#nw14$Sv|r>Wv|nU5+Mn_>+CTCO=gt0+U$If-x6C~(_c>DgM}B9y{Udv^VdRg@ zKa=a#e%Qaze%O6zKkRpy5e>%V9}>tVE?^*^+qwF2#D zjYJdutd-Dy*2-uP6JwIx{$O+Lzx_u(r&w3Ke?PslzrsECJbi5(% zjyH;)jHAjMMH{od{j5lTL6hhyII_G+v?e4};rY-00`Go$7kXBmfl1L-F{C)ze@de}xoKWQRvA3c}l zl_Tw=?XVhlVEaB3&(n~fAfM|PJwI&MF?vDRu4D8PWBX<-~4}?uVK5sk%1caZ+t~$P;_uI zR`Z7;X#Ox1%^!xL`NOqn{%{?dKMcp=cs>5h@1lP#%zH2bo%i5Ibl!uJoWFskH$~e~ z-x*qZvvS>T(Xwi^8zTKBw?%K||3$XL6t*|t7>(u|#4JyZrW2cgq@no-G0QWenZ)KJ zNWV-p8smG-KallV(d=Z5Y?l+wWx4%E+Nd-yn$LREd!*l}AX>zBet#kQ{lx6IIC?v= z-(QkkKL$OHvB~XN&wlQRjtkq9|6{w-(r6jWTX3F`?< z=#22Z++)mnpQ&LxZB%++^j>U-bHeBD*YKP@5I#5CI6P;_=jKHp#B_Wpd~RNJE;b^b z&*v=vA@|>c=%Zmh`F~hX{*R6$ae2$~h0({u{r8xL`w`jClhG%z9X=h_Kc!(kHrQCY zD7u)~_lmS<`Sa0dun#_q{cs8P$E7$3pTlAJBA@sBUqH{3aih{@(U-6tzQ%Um|1YEW z|8n&HUxD8Lub}t;tLXjj_QT6xkFHGaPurEQijJXO+~-1_uXZ)tIbZD>Jb~|Bi~j$| zH_>{g^?v(T)mpZoAgyq@!Ef6F^8x4&fr+TZdn+TZdX+TXGf?QeM>?QhwH_P2b1 z_BVWp?QkomD*n#$ke2w;x?8GhcZ=(D@+EsRGxUVp@!+#g0eT?(;J^QOD`yu*cG|>-$ zw8Q@t-5pKz17K*s`x$L-{{>Itcl?UBFaL(NNAE$~qkl)+qxYii(SM-r(SM@t(0`%r z(EHGK=>2Fr^Z~RT`fs!y`XJg4eF$xb{s(P`{ugbBK8&_Q|A)4BRiN!%k(kF(IaUdq zOsyQN5=)$CZ9#)4bXPEhG@Io$!NP=BeY$vG1@M7 z3feB$1Z|gVinhx&L)+y}Mcd_?qwR7n&~~}g&~~}g(RR5r&~~|&XuDi1v|X+>#^Ptj z&W?HioTcIZLC)_vv9>HPiMP?P97DU@xoEpwyI7)Ku065sa_6D#avjii{qxcGxeIVk zykpG!bXHj>J#wFh_PL8Lx;`~TUF{{L8C)`$LomYa@TiJ|`=L;pX9{(lVp z{}}rJk^XP!Qps9|3BYr{x=lO|Az57%M;h)(L86)OYj2maAMyBxE_5E z;0E^NdjKQQ_W*7T%WsN}4BOolyP5r&zF?)rlSajE!SC_bibcX(fJCe-~rC-RP=q$Y4{(@ zr{jtVGh+8}{GNB@cxT3DC1d1x?v34-jFIEIKlVT}MviZGY)&#pj`P9TL&+F9-np@P z$r#C(=f@r2N_6Eo4eY6U_kBC{mI<}VB`)Lh&KM}M1 z&DdMS-dEV5Z|S<&+kBt*5wd=L?44wc4bn?D#NK0j_x~=se_}qjG4>&``+q;VeiQmV zA0)S9J@?b**p{$8`G45oN3l=C_MgN)4%>YaVy_p=+3#nuZ7e^(^vl@iVY@G5Td^zg z7h(G^!+N)8JI?=CG0Hn!_wCB(cZAsWF1LKMGZtyQiu;oEG{n2ukL82xSh>>(YuJn=iR`u+By{ha&J{`UiD|NGx)|NB9-|NRi!|Nal!|Nbx9|9%+lfBz4w zPL5<%VD)K{teRQ&zgNntoRvt2kpA~7SyhuU(*Is9t9mj<`rm8#xsYxl{qIL*)na+0 z$wzBgj-mhk7<3$BZS=i_I_P@|b)o_5RKy77$zhC=Bb1vPy{k-NoqdJ`#^f#$&^F zw`bi!?0GoiIAY5!rL3>Szxs%C9xS&Yae3BwV$TzDd=s+n#1(i~xIZUqxGqS!Wm4AN zS&4EBhH}f~{yQJde;1(F`C;@rKZ0K8N5geqnDrR3 z*I8{ZdmP8I-zUQPc`ED4a9*FvS`@DL(;BX?aj(eYtp7hBUXt}}migwAtmpXM=95d& z`;M69&u6_z?D=^CJwL=Oe<^DjvF8cNw_eU#&i8m;ko7CFUP;EtcCTi=#&X+_v}O70 zS*ybFtkiIP*q~AA>Z~`y=T~Qu|8cx)G^{_8AHJEz|1swGzJ;0OZ%6XQxA`9P#q}&V zUwj9B?{EW}Kfa6RkME)R<3@BIiTBa{Z9?ab_y7mshd3BFqw_{=!Q1d7^m{+XE%8r6 zdNsW4)BjDcLO%LA>6!WHR*tKp?2D`~vl96zl8th<|}*AeB}=`U-=WwSN=ltm3?TwvLDS?4xstU-)O#a5Y1N(q4~-`Xuk3< z#^Q&wD#CO7pN8ia$yXxTm9x!PDrs1bAz!J2<||dR6ZuLtV)K>iXueVd%~xuo`N~l^ zCw_ExB44ScVSnB?8@WEUvlH)g)IsZ^b@Bh|pT}jNk)23?kbI?Hh|O1sNsmsEU?%e&X=_wnU%bR(#I-P-{F)Ipa)xm-OW3CnRgX#E{#HLsM&~*GNG#$ShO~?DA=WhUd{syAw?;7;{ z4MOv~!RUD$f{v#gil*bk&~*M7IAe<@n8C`0QNakO4hj;43x(R#(5XuVlKr*>g37UcVqQwle1@Wf8~@<$)1|LzmR&xwCw507^zpx$i62TBlU`zelFaP zNWJ3T?E6{XX!3m;mSd<_Jb>0KW~23rIcUA&L9|}+5L&O8i`FaVq4kRSXuVlF*pdc|XCed2L6-*^J8Pdtg{4^N@#{?ll>zX(nD7o+L^GibX1ESl~w zLDT)EXuAI#n(jZ3ru#3T>Hdpoy8jZI?k_{r{g=^ne>s}&uRzoNSI~6-RW#jy4P)`w zvsZEchL^3>aQ={V|BdW5EH8<#*03Byy1y1p_uovW`)?7O?yp1B{kPF{e?6M+zk_q) z8^uE&tBf6R6j6`y2( znoQR*r0bud>H6nry1o@n*S|p1^)JzMeH$()`^xVnUEi+Z_hP6|e9itVM|NiKBDNg; z4O)&SX8E_--w|7GMvnLUaQq%GpAY%Kk7z#d6WgujzSxcL;m>Hg_6vSY{3}}C{0%K{ z?m^3&zw^6#M)qd^L2P*w`JTVB{|w*%SN49^Ul!S?p?qfCBXYoeBE(1XiG!>+pE!i( z6aR$IlmDan#9@}3j{X;xS7cYpN&Maj`g@PWm6LIm9Dje+oNC1W{v%c=HovLCdj9`U z&QUpu>x;xk=hPzh{2<3sJLec&fpv4d59??+|44pwY|e2xiTnmDeZqM>p3hr8u7{r2 z6VUwTL^QuS3C(Znv%UFE12n&Bn3KqFP9`?LX@urCjnVw(6g0nSg8m=rrg$qhL$A}R z*oo)7Ia;r1fz~TdL+cf%qxsAkXg<>ttxvQ<^P$!lWq)U)*ZC~;I-iYR=W{r|o{=^= zZHc|kYQ5szaNgSIvkJKmnG0tZM zI?m@tmU|!bxsZR}l#|FmZ|1lv%5KRSm6OOnk^J-4oZE5|`6q__b2OT7rl9#|Dw=Pm zq4{Pynr~*H`DP}XZ${C4Glu4ySy**)PEIyfpO%wT!gG>So|}`Gd`^&jGe4&w86){- zVNOvpM)J*KKNrpel5dX5xt-;WCXdyy97Dc&2byn=L-Wm2G~X;k^UXM#ZJ>norI~^T|1AKKUS;PdE`n}>$%U&Cy{*c#Sohh60?3;&daPfT}9R}&sjn2dJOsGD{NO$ z@oLU%thfGymF$0e9nB|KqWR=1G@pC}%_mo*`Q#d0P`1|ZC7*m#!|%nAPp%8c@pd>a zkAvkQ-FXL1cQ&xy**xDz@}u{N&5t&s`O*6!eWU)5=0_i}-2CW6^f}xd_P-_PBlhQc zKz{efIiC>weaL=3%lQ;n;MQ=xKG$%ZNPhA~&X>vj1VetZEqR<@C69AEnlA1@)5WjR z^l&HJo1c7x<|n&2kJewlB{qHh4$V)#NAr^((EQ{_JeA-56Pj=AM)QrI(R||=F+nf@T@&%T`f$@B-qIKl(ybNe^?TpdK8 zt3&8>^$+@7{fjx4X4b#sqnc}e_O4a+e+SI48zRlVHAb9Dl- z&((?Ob9EB>T-8UPs|GkH-Z0nvU{=}58uo|WKaF$G%T3%*$aB*q#6CB~tZ$ZkD(k(! zkoC=TTM)Y*!*g{S+f`JYo_hxCeXcM(S1r-!sulWNwML(-GtuYjEcCfL8yA$F;rZ%-K40gvU7i1VzB&^7e04&fuM5Ne$p6vj zt8<9E9_%BpyTcDLC^n8bo}=$bo}?dxCie;$ARCE zwhupm$MQR8qvOEmpzn=6h|W{{5IRroT-*|$7t)8}W%K_xeF){nhq>=8FFwM3^fTx0 z(cDD2aUrqg#>a9K<;KU+a^n*$uZvHj^VdFw$#P_9=UkMVXy06nj#qmI9k2E*I$muF zF2SYfc(v!y@oLYb-Un*y{93aK+?JQb3bIg8VIc&Ej_akD*ld0p$ zK1RoreG=Axn)?~C!+(5hsH{tJSd*fcL$Nv66=lS~+mvBG+g^t_Whs%lg<7zyBj(7SS9q)7y zTeICEbiC6)9JlYg{!8q8@`us)K>v3F1=S9jcj?~IKhS=+iW!)mR^XepHEbAJnn|Ew7 zR_ou#h3~7EcYOH1dU+?ZU6;rS8unw{IdW27{ba13w+85Yu?^ApVoyfji*1Cy7uy(p zFZLAlz1Sw``#4SU-FrEIw4-=moJ#C?qULD1tOYur=rnXZ(dm4@`O_K1n@d~fwaQE6 zdl>S))|?OP;b)@v%UNi?cQ%^uorC6kZP?y?uPvJIor~so?a=(LJ(}O0hvs)3_}=c3 z^Ybns_I#@E1$AV3;|TdbHi}%BcTsY^`d(0HmY>Y}F4!>AHLqK8y;@Ga7%it>f|gUe zqxbiv=>6RTy}vI*@9&=I{oM<_zb{Ac@80PB-3PtDuR!nbzUcjZC3>Cu;U~mb;TL!{ zdcFGN4&nj$6Anb*N4o|c4>bsVA8j!DKH3oUeYBzI`)I?^dCaaw+x@RY=QkUU{y(1U z(eXPspyPx_pyPaQ!~?7!iH=9Q2_xLUH{(%w3;JHxD0KYIt?2lh+tBehqtWpE}D-;c{d$Km9n<8boOaX9(tIGh4> z98MuR4yOnmhf|D>!zn?>;fz7Y;fzJc;oOdn!?^<;hcgZxhf|7>o67c%!@)2PZ5r;2 z&&ZpOBg<#x-NX8Wtj91OXC^uxXBIjh=U#N2*nQ}@ocqynIS-)Ya%Q9Ba^_&$i4W#I z#Qq$YgQRbB^A-?S=D6pD^liRzNZ*igIS=PO8q%FdG>pqh#E<7K4C&D0d5>YW$m4lW zvVEV4PiRQ@ko0j;-cw<_MR`w$?H1)d!*+uvF4izE$Jq4oS+t*N2|CZ+QgnRHb7;Ex zJm>wA$P0Nd5_{f}bo8aXWyx3_U-L4{yG54gtw=6M($iP+UQNbodiq*8zLj~ehvQqB z_XgW_iLBDFf8)-P)p=`@u{yuqTJ-(RH_>_R-a_ZKTZhhT_cl7O-FkFhyLZre?KZH# zdXabY-Xr$-)pU6ynjXK8rpKGm^!NibJ^m1f<7RZ6&KC6j$&b+YCqG8h>rZe#>Gh}h z1X})YT>g0;HCWoqw&wj$y^r?DZFyhj*`B#AZ#&n)bonbZT_$Gvj=Y`3rq5ra=`%6Q zzscK0Y&wm!kA9o?9p4w~|6%?2c|Rm$WV;{peqy=pqncj2JMR~k`+Yy7-$%@Te$CrU z?DzeaT)zkX-rtkkvA$BltiSU9z!~@_)+_%jZ(sO4`9FTgbFv@XmHwS~AT0ko?;p0? z9Y2(J5J#0CG7it1%lE|(=lzQ#%Ma&Ou>4^BKjnDH|5;A{pIdRWp3&gGadfNZdaWF1#S$;zPN%`KVCu+E_ko`2suaE8UhV{reoJRSLi5-Wd zJ5-(JA^v)F9v`47RiWf|XL}7dhe}u5XRV;IQ8M3d`AkX#Oy^ zx15fwzc&9mV%KA+&kSd~ii+#=Z(zOk84UHA5omqpMzlUN60OhNgw|(nM(Z=T;DWMI zelPWzTQ&S{kIVYXX!c(@l9HcBd@jEy741hO=J?XX@p^o0AJT(NG(Cv2-5P#h4A)~8 zzK_`)=Y(J5}%6Yv9Pw|v0Y_|Zb;=>%* z17(loFJ!w}WshpO&RBMSgn9RQPB)i6p8rICqP&lxy#FNMV>y+2l< z_s1*f{qZXM?+|${|8-*T54E3hCCj}(RuQ)&egiw>YV3|{@Jd{ZjDe!qIZz0dM?kxls@B$uoA+lT1=wi&(O zw%{B15!-veeT?33pRnBf?NjuA`wYF`K1c7jt?2#s1$w`IiQaG9xDEqLzsmob>pQe` zyK;SZXt>{y^*i&w4eP&A*6-4Azai_t%l|Q~|6W=DgO*j{xRCqpr~F@7KdtoV{N1<) ziNpPftp7Ft_pp9X{%>LZ9^-I7BJ20&{}tB%ng2&v|EF3y_%aL?5Qc$TNk#1s0H!ByIZdNI% zT98OLF{GQ-(D9~oEj4_Xzp=KFk( zk@aU5oRy4`?anSZhvk+JvC@Wn+7`6IEl9pk`6lH5A$@Jf@p-?uNALIZ*v|XC1A4!o zkKXSWp!a)6^nUMz-tQNp_xnZY`;eW{{=Y8hbut~B%ldA_Gmtp+J6%$c=y&SQ@m7>w zTF|2)k#8gYPL~z*EJ)~5bbxm2JLqmg!VfPM*E$Hp#4rm(SE04Xus37Xus2S7>f@t zxPj|GyzF`n*B|M38c{HksyRIhb8E9I0hG#jrDsuzS}h%U*h}6h2!!2iNpP0hTi{i zw0wS~A9pG@AG*ddVKez&*cN?b2%G*9_O&V`Rs#e zKKl^o&3tw)vCro`G@qT1=CcdXeD+~J@9%wt*ynVxo&AY|*V*3R zhg`R(LhN-T=JzftSj>8VFS7obf@g_ckKwv5VY`Zor3KF=uPcV@`aF7FUqG+xi|BQI z3B9h%(Chj#E+|{>_i|lVXgGfu%B8P{<9IC`m&d{KaQ;@J=g;f9x%7>K)yeaW;XJQN zZnrkM-J9rnehWR%>(KN3Hrsoi*Q4k8o#c7mK-)1ZNzReft`!-*q z@7ruc-?#Y+ecxs~R-OEH!49lG?dyUcIgdHzI}5%^o=4<;n_UIpCS&A%o9_y~PsYgm zHb3~eaNd#kZGI~FndOZp@7Ay!!}~VBpzquKioS328=8LZLEpFe9ev+sFZ#aCAL#ow zf1>Z({Dr=6vk!gWWnd%o4?WbZ4RR8@gX!l{s&Eu|3%Z|!)SW^ADSLlpy_d> zFp(ZtLet~QXnI@)O^>Uh>2WnQJ+6+X$2HLOxF(t&ABCpJN2BR+Ei^qo24nHsg>?%} zkLzeSKS+9fY~k@NFNq(gVL68MxE`7wpHP@ck542vJw6FdkL#o9aRW3xZisW@Cl@Bt z<3<|xhv9iXr7-b4H^BpxTbttlJ=doeb}URh*T{3*BE&wo#5~uh7oNd-pC@E}%feQ~ zuE+3Pw`RMFiZct(V!i1#hUfZh^tnCzL4)dhwnX-Zg=K$rrTZ6bh|5`H{I@rrrQ^@+;sbru;1>5 zm$DzzHRSj9D7=i=??FD_tFUL-U$4R|!gah{!|`FIyGS?tU>fJucynpr!Yd0C={Sb; zrC;)RuSy>8)oA+CA5C8dpy|s%wl{sb22EcE@w-gN2NRpV3_;VEp=kOt3{79IMbnq- z(DY?En!a40JTEs8J3rY79FI3*KF3S?LwWG#!kY>$zujCoisLZ9xdlD1#4NwHa5S;U zdmDPZ#4JxKOeOZXk@8?#VLJQuIFa=kg_+41*)CdWxzF+-hW7}v3L}lL<9M=h1m@sP zn2Wbz9;RbHW?=#T?|7^t_G^1kG0S}qp#+=Lt}_OGe_<^8{=)6(`wMrV?;(ss-$N)x z`{m2fcA_}?{$)81=KIE@$9E@sd=t>)n}{CYUFh*mLXYom^u5i==z9iJFrVd9(RQh6 zXn+57bR5_W9Dw)WV4R7L1Dl06yP3#@{5IdJnt<&hNj<-qv`h( zX!`vmntnfprr%Ga>GvWu{a%cw-_M}w_p@mFy#!6am!j$Sb7=bgJo+B#3uwOfBATzg zgyw6@(0uJ>G+$ee=4&g^eC-viI{CH2SF!rE*9za{In615y>MmnIYsidRfTUPV;cQ6e%p!1f$i_TmA9-hW^--s>o zeLNdC;koz$cEAs@6K=*XxCQU#{`m-*o*ixbUy6Qu@CW9bUy1Z z(D`z{#H}31HgrDnuh99(x1;m$?7)6}?rU_uot@~s)q%$!k^J`gTJ8T1%E}y3;u?V7uzy24^uMea7^?zu7U4iD;k)lL?T?x&v zD`PBPrKnnw`E^wd*B!~Ps~6Q|c}cv6hUFOY>!Z;8`skuWeqD>${Q4L)zpjnu*LBeR zx-QO%A6t~juaDEPKfJR}gnYgz;R!{NYP)%UPb99LTz(AJC$5DJ@Mvs^XXD9iUyJM4 z2#>|aSPxIZlduUk#HQF7n_)9NQch@Ilqe^(K+6fI;XimfM%eBQbYAL~_wPb$JNs`Q zxirM~-?`j&?#se)_6)zrzblL#E%fG=WTE@9)e4WhvIj9ei;6S*M`qsS2Ucs zChOJne0?&$0S~a<2wcJP8}UsXiJR~y+=@5jw|EQwileZ@oy*4EijLd74SkAUH{*>&2*Mq{>nhhUzy?fX#YpcU$GEp73H$t^Pe5ge@=)!|3{YRh2{B0 z1#IVX9m{bQqT^MHu#~tM$72avt{H=cI2L`+`gXLucL(2FDKf68lf znTx*9GY@^AXFmEq&jPf(_%K>td;~2oK8oJY3;F&!<&PCT5$@;5HJpF7-R(*AetrtQ zpP$Ara1nZ6FGlarXVCleS@ix}g5H-)(fjl{^u3nn(f3+jz&b2{5q)3$CA6J=8T!7) z%XljBay%PXU`KofFU41}AHIe|@OAY4^Ofj(DXVZK%ilon>(ywx{hH)?U5ia4Zx+49 za_=`Cz~|QCFnk-GPk249^?NxMdBmvx1Se%R%H45^P(^KUhku==zT=Y z@-K_NBKCgThTc!aEZ<(VgV_5DDX)KBw3F}gK0?-iQ?x4?Binsj^c~ABuj{MRzb~TP zPC6aR@8Lf9k?n17{RwSv-HoQhaa*Eyq_w-zTn)TjDi}IX=nlL3+oG7Ow{l_QzJrn9C z&QB=U*Dp?#>l?7XqO4)@$;s`Ja($!X#>I*4G5r6VQ?NSU(*$Qw&TEQ=9A7i^|Aw53 z_p-b>E~0$a0{wqBr=kA`<#e=sc?MdZYl)UGTcPF4)@b?iOf18*(El@YHr`2m4m$5* z8?=1e7A@bNi_?hPq2=iIcrWpJXnmjqS|2zctq)v))(1MG^?^=kec(d0K5!9QALxu# zCwDFGg4L&WE$&%teV|+M#l?y1h13TwDej((k@~=;#XXWSQXja?&xPxY)CYPM_hxyc z$(L(bj-fu#2dyVvf!34yqV=RJ(Rxxpw4QVoT2Hzftta(I>q!I9deT6&o^%abPa1^Q zlLn*pq#@}1nM1LF=VBN-f9ADledIc{JU<*Q=U{bFBpN&qj@7bkLE~p9?hH3 zc{FcE=h3_cokw#NI*;b9=scRYq4Q{t#?Lt4DQJB$6~E>C({MJ|FCDEfWT5qhOtico zMa%m!w7j2%miM#K@_r6l-p@tL`*~=2KOZgc7og?+LbSYJgqHV<(ei!?THYUnmiNb^ z<^9{y^8OuY``kFRykCm3cv*2d*L8SVT*Gxm&hPl*2`n#(->G3ahVuSIw7h>;aiY9G ziP-Y~-Dr7#GFslBf|mEE;+*)jkZ#N>oBqG)Mkw#!TbwBG&n!-q_h%7X-go&icpqBc zzaK5{n@%{d$n4@scu#%~&gD8hh`t~H5Wa?U(Q-Q5Q|_5xyqxsGau1S@KOADq+r;7j zDm+^3b_`=3$aaqxKSAtv7}EPE*{-7Esp6+uZ@C;p`o9P*moG-k<SpA z&A)cDzEb4p;$JvE?=vL+wfHw;uN$)e-;4L)3jBlP9$vOr!|@>HIAB~oyYoYIPAA`QXT^lXu)}rep zUN2<*`6U-5V`RIIC7oDqxm43jFD&WIa=-5)^!td}PnVKQi2c5<$@SgP@4Yy=9qV}y zp?gV>@Ov-S@cWV9)3f9#-kh z#DU>+S1X_EuY7KRhUXsn-a#eTU^^TZwjZo)KSbGnsD|y4-+67x4Pm?MlzBjk6*N}|{fbHnyo%Jw-W*bVY{)$VLJ@@)*Wa)WgMC>m6lYBRE>ncP+y6cSYIhGAzcjb zp<<|?VBMxEwEvex>NZ2-P*1t5BvCJ!g#LfryRkD)#*1+Z_Q0uV`~5U@oZxhHoZt-n z2Jb=ZH8atA%`9|Wh(kE8t*PoVu2Pon)4Poe!3PvdR42>qRl zF&m#j-?M!d?O$1f)}xl9<1(K^$7Mc`*0Wwf$7Q~V)A1#AT;?)#T;|K@xXk6~xXcyk zxXf43ahb28<1$~vrT98}zE`5>dlfn^^9^)d=4xDvYw&Gci;l~D6W_}5t&)+HOM7R$_J@*HmEBl##D}vfS~azoF#>pPza0-%IxXKkB{%POhrn|7KT|i~>>>qY#Qnapw{c1VPMZHwg;~ zS+WUT*V&o7yW>t{$|jp^Nul@Ndk;Mz9Ymye5ub|fDR#y3?D~B2|9*ex+;;Bl?9OE2 z|K9M~e7X0Yd+w>f^K0jKRwy|a2s!tUEB>VAT%ep2{O1*xoD=*PU<~=-J&`;9wnE7r ze+T{*`TYY(JJ&yv&)cj2d&R$WzCg&s|Fh!XI$xm3m2U$nS6VBTTsaL$xv~jJxw08Z zx$-?g%9R@dDObK1_@2`@Uim)Yd(YZ<> z4TM~|8Q+uk1VXOdeC3w7KjZW*h;kn&a^+S)%9UFKDOYX-q+IzSAmz#r11VQ-3#456 z5g_Ht89>UF9|cmb{1}jO<#s^ImD>X;SIz`duG|4g`Ef@eMqrguAzXsd~_%v`|AoUWTUTK}Q3&!Jqxc(-t_XoZK{0xxi?H&N6JbECIdWg>g z-vS;4`~&cFz`p`#18Mha1x|yUItREBuniakwgWc>&IQsQIuAGlI3Gy+*ug;B$2x$! z0S^K4T-`%~djS^!d9Ln4AkWo33`qOfA|UN!oj~eS4hPacwirnJSl3E5?w8=2=kG2B z^8DQ+fINTqNFdMOJqpP4caH{+0gnOFE_W=DcDdt#JdgMDK%U3@1t8_|ZXnO&{UVU( z@g{&*p3$>1g>iWO8A+myL!jt`93ao*?FHTo>;uyN*bjUhm8$n$uQ2U5RO1oAxI5|HQdmVrEvw*sUdY7oftc$Wcr4)1ax z&*2>cZUbBaq#bf4kb06~AoV08Km2;6*^53w$x~D&QqRo(p^_kmmwl2IRTGmjih& z@D)Jn_pSs!47>{X72wrCo(p^p=F!fWN7v%|Ra{>O{3h^v;CF#H0DlO)5%?zXCg9J3 zHv_4^y9G$S-a6pmn%h?13f%6@+g9GbQmtn|(3Lw^-T~b4%sW@!rSAjLPLHm<8+bHu zJ#Y!|9$+W%Uf`j?F9YWR?*q01?*|?Td;qvF@Il~Sz=wcw;KRV(fsX(`0enn<4=CrT zdnfYeKU4M@GzlR)aFo&r)Y^)!%rsb_%HOFavuUg|j@^-|9R zsh4^INWIjHKgz!2rCtM4FZB%|^-`|`^J~7j@>`gX z$FBYlqRdAi+WFfn-@yG9YraF2`#{l4eHTc*)b~I?P6mD-*VIe>07$*m4}sK6{U?xm zsUHC^UGw9WT<6bU{U%ZJ1Bzbirz@=!cf$Di&ZxTnxxW6zN~NdzC9bKb!gJ9_{d%R+ zL;VIwJMmjU#)0@PkZ~Y>2V@+G-vjRi{sFii_+LQAf%qekaUlK#r2gv9K*oXi3y^Uj z{t9Fqh`#};=lVO)w?qGPr9G_l4nXLw{w3GcTj6@zXCTM_d!>?--v)jka6YKEM}%`vPAEej4~Xa6jO8 zf%^l01pEx}m%syn)Xy9U{58J+S>T_52Lb;D{2Y+y@y-Tr3Ty@LjPWrCxCgLJ>d`(t z7uT)0CUX4D)7SHXd*S+E;EyqnI?zrttwV+n#WnkhIDqF1fV7)01k%2D81U&6I)@hl zb896(!4IE=52*M6SYGQNQ5hs1EV)GsmoMc_ubPU5|elY5A=zZBz9w>?>={7rlRXp2eX?f(xli_NAot0h1LQv0bAjCFeID8$`~Qaj zC3?0Ci0HQqiK15m$~^myl;e`&%kduR#HINDj@D&z&3d`_uaNs!4qt_IyicT__i7;Z zyw?DEUevXcAJ%^$^}W~QKF@c$0Z6&+MtOeI@Xfd;y>amtTvIQ+4tO%~R^VyC+a&$% z!*}AE^ydyB>5qGTm%hGR(ybr97uTdm_W((c-0Lsv>-&HYuYO?oe&B<^2hmQHmw`C1 z>fzysfIkO5qVEHxogS6^9~=G(u1VKid|d8-b@*#&pB=0xh|)gl`pMy^^feIU>FMET za7}vW;0U5y=m5K!{0!; zsV@iO`t{*&;+pFZ5cU4n@P7aw1ft);4}6;_^BE}m<2QiRAAc7}{qgsJ)E|Ez^`rj# z2e^K1)endNbJ+R__tgPKul^%^hjjSIK+@qifz+4&1V}yUPl43S{tW4_HIV)%zX4J&{uYpW@!tZe7yliQbpH21()m9CN$39yNIL&VAnE*{ zfTZ((29nPI1xPyoS0L&9-+-j^e+P1Y{sZ_sT>lfu{h0p^v_Mb(1)L82AK(_ie*<|g z^4mbtduv3|`)NSZ^Clqad^3=A={-Qv{{tCE<-I`C`}d8I-fuiI9oL*!MAG{humXHP zkp3SZ0Mh?s6CnLRHU-lEV>2NAKRyVg|HtM)(!VW$PoJ>W$d*D0A9D!WZ#(PIkp;MBKM)x|W+D2K>-J$l#*bNq z`-~sc3FJC{IFRf3V&JdWEE(wnrq(VQS&Hqa%Q{D;){sxI79-`_j=s+Lw+2 z(!O*okoKkHfPY!@g^|w#zqs}bBi+dFAIJ|V@n*gVWW1RKknv`EfQ&bj1Tx-C3dndf z4v_I?dV!2L(+9Lq?jK1bKgOE@g75g!NEX-RI|fF`cVu`ibP9-gGr5t%2Y+_%vw1z zjQebVBKejPAnj3P6yt@B4N z(9el)oqXTeg~0y;UIgU)x){j$bqSF3>rx=c!(~9ysmqZM=kpb~=6Jah$Z>KNkmKZP zAjioyK#r4Zfe)T^-N^N5N3N?tynn;Ujrtmh{BIh$SziN@-z_8S^feIq-a2xdz6K)y z+ehxu*Fb#d&XK$HH4yyH-6Qwldi%BO1^HcE<2=HLNA3lF`qYOZTU(`&$;kp3G$#z%S`$oNR#1adw94LBj456 zM8-+_9`0{reShQ!`aTeR?GH!(Q(qIgZvIH-)te(fmU;E&$WM`OE9)mj$)DF-SU(&2 zxxOYcPSP)cjFa?BAjkc$fQ*;)YarM4-vGI;zXjyF{#zj9CH)S_cuBuUzFS&<82K+; zvmQj!$v**T8qaT##n~iQN&o|?>*g1iCzWL}@@_ftDE#&!@ycWA9 zP~snK4P^X-ZE%0O^`X%Zyeh&BPH$XfT zI9t+T{Ra-Lnlsvl^yKe=5^t(qp3fVd3p{kyywMIk|Mi-KN9O}mYY*nNtj|Eaf5_+p zT(kU#0$F}s4-B{9XEO`a2D{3^4{l(vMzr?-s|SIv_BB1)F|A6qTzAQMe;I|<0 zd&I9A^Gy5$T)Z0XOh18ZMwOqywZLzzxsLCHeq0~SN9?^fqJ3!Zy$R*;?YFm#t{YYM zTOjPWxAHylQwEA%_V!WOaX=UD!1K3P-#L1hP7j1#_U_U3qbfa6^ziopsfWK8NIm?Q zfz-p_2c#bUejxSm4*;o$e-KDL{6j$M;U5N45B~^|diY0y)Wbgpq#ph&K)pja^bK6U--7%Pq<<*;nf{^Q9}Viqe>nPQv^(_-K+yjm$u;ReuEAfwIrjO~MhhG7y_x?4Idhg!=xjwuF`Ww-Tpi}4T6XKP>w%IxmXT77kc^^AnEB}@qQET{|!j~P^80V1t1sjFKWbrIAGzw^L_B|+DC;{A>+iI&_u%&| zSf0Oc?7i~*eY}?S8z}4DbRgHe80O=}tKZM|NBurPl==Zh&$cO$`nS!1)W3ZY?=_(v zHwRMhwgv8Uer<{CY1UR_TjTreFCebB8T$~f*)Bl5zwOwECBJRQX5f3ruKoy7z6XT9 z=c8jE8&moopy+$H!~0yHwg<93X9Bq{?EvI@v?Gw~=}t&beb3H7%HtnLeJM}uf@`j? zp8!(tvn!B#pWT4e`|J*6|Lg%||9leoejxX;EM65Kn}u>7xymM@oO=?bpMZG2*VsPt zd~YJ2e~Kvm1jO@w$M%=!pC;n@enjEJfas^sjC~f*&sufh*a5&NfVh@^1mgKYW3BRh z_Som-`D|WGKLYW5&e&Xe-aghQ&)az|d>Bypuz5i8Ve@f+x^?ha2d>G75y^)g0z7>6 zp<@g2{;{hU5T!qWXure8I_3T%qTB~!o*h267~khS1Ij$>LVv&g_L8xsc+PnSlzDap zkbKyYK=NTn0Xff(26CPq1LQnA7Vnb}I}XTk`FY%5f%{(oG7eQYka4KK2xJ_p1n^{F z50G)FlE5=oJ7X!}ZNNU1`~20tL@75A0!;@66Z$@Fw7W@;n=y2OplX zsxX!Z-!}_bM7=p4j|Xx*;u`l$V-;L;T$X_xm$=6L!Leny=J*6+U0pslgzs=X0`YtW z*Fm`kV!RBGjp6%8t{Nete4|7eZ$PZiYsOXqp9QW4z63l;-djt=dnXX_-ibsRhd`A7 zl(Cb6vw&wv`csKWe;N_#PbW%xAj)~>*twGKEF#jKO+>nLh%$bG$nU(dizMCoM5Mcb zh;$bcB^{q5{@>VTc#imgW0wFC|Bu%)&Vi`cm1CC!p9Nk4d{j-Yn^FAR_%uV>e3rn|LkhfvDFlW4BAXbws4QZR}P_cN?!|-T;x` z9qfOU`%W1TXRW$>>@G=nH?JifP{#c|K>BCi3*@-IZ%nTWSRFQ!<>8)HH>^5;)$ppq zs^eCDX?0@tuU5rZ|9JHeSHH3P_p5)pdh<2!U31TxmbIIo`obx9o^tUi^S^$<>J>m)?Atb@_gmufP1#%SSKo zx%@kqZ*s-nSG;+}b64DZ#T8eaaK(%(JFZ-C)!tWaf7SG>{&?lrue|@t%dYIZYW-C| zzN&c57q6Lp&5qYhzvg#Wf8*-+U48L2qt|@k+H0O)eXra8y7yi8qidhP_RH6< zzV3?a{`0!cuD|U1zU!a7{@@$-yW!W@Uw*^AH@yGGmK(Rd@yj<}d}H@b2i~;t&A+|r zrkmE?eBR9~Z|=YO#TL#t=nVW+I2r% z_td(p*L~>LzFRwQ-S^g=Z(Vomb+_Jg>(6d|;?~@4$J}=2ZExQ8ncH{0z2o-7Z$JI^ zw{Cy=_S7AR-qCaCqC5A$^BZ?OcE=5OoOQ=ZcYgP-r|-Jvu2pxn-?htK)9?D}o!8%a z=H2DHFSz@ayYIXE6YIaQe%bn0)^B^ymiKIO&)?Voa{V6n?0wJCU$*c2?tQ<$uYCUw z_iuK8)BX3|-}S)W5B&B18y>j)fpZ^ddGG@d{qDil4>}K?{?HE|+WFy)AHL?{rH`ER zNcxfIA9>@EeIMKWv41{#)1!q)cYgGPk6!%PA0K<;D@Q&4^yBLuKkxBBKEB^qZ~p4x zPt1Mdz$f;4;;|>zJ#p3(TYv4?uWkQi^OMt_`sb5>dh)F&fA-{FPxU@^%~QiqedOui zKlOvBUV7@Dr)EDr@bqO*fAX14p83VouRZd^FCPEm3oqXFV(g_$ zUmAU>@1^}-+U})iUpnaJtzId*}`6+9Se|HY2bNell5J~xK&RE+v*-eF}VpF03OG5DBlt9Ncpz5k~;s-zXSQ(N23Y0wswmhX<6IjJAQSI ze(NjdD+N^$wo4$L(QlHl#FVS}587o#1Lf{&>X&|Xno>sJ%}3AXn=0ri>BTQvD0;14 zw5%`ba-`mca&X)nufI3&j(^YY)4eBib`N}af`0L*A9`pe%jv(6D^-e_l2a;yWU2|S zDaMZBbfx}8F`es+C(<}$GhYx=ASp@zHraXQ!HX8o9kGu}=2Om`N;*^SEap>{WEsaV z;rTSX-5GQ;c@p^9%-1dy(}Rh!V-F^Z_QFIi(dVRQb{3spr|9I8PRY*ZdqBSJ`20-1 zCy@y}i5D{IQW;r%4u4ziymH>+MTafvUfMNxaknahCP{YSom$zDjpMI*WzBwDh;f<2 zUmwUss%d6ZC&r`G)Qdl24#dO}%9F(??Ex(!IZ@QfATiVJj1_Y%&>hm8G>Ox096r{@ z_?u=|N<}-9?!o`7cH=dh-myL`&x7rj>aok|tg|AY<3QL2e_PjRj|KU@lD(+l0~BfNnwr7rLsd{62LOVvuYd!7ZrSKY)Za|GWMqXDn%^g`COrx7v{kIlHC@3 zijk|Hc2;^a>10Q)H;*D%ck&;MlUr(y6Zb7v|?9SvE5a9tu266#>Is5r!A4}$3*nIY@tla`A(^v$dtWlXtg8%$<9MRvz|&O zV4D0=TOZeO( zc&dE%1Ku@88*lI$Kc64Yq3*%!6;2T&jQ!-(Mb5kadI(cyCb~*>jkVtY; zwZ&6CEz1%a@{fKyC-FiGFQAX*4a@p;Bl&(QUn%AiXf-KX-R0tY;#7l`@rzM*obg*D29f&Z(-_}Z3a&l6>eM0$Fkz3OFfpod0g3;5G%%q)M8Gt2% zW#LcwhgQmPig3)sdftKI(nm3EDc)+6mqac>^5zd=-jP#JU@aYJY5}dwgD#e2xH3P= z9r!g*N4iB#txYZZ$(H*5CNgj5f#Y8&&&U_y*ZgtZ@57p1ZfZGT&;47ENvyE9v0~G$ zrWSjq)s*CnF2x`mQ9iPi%!%HN=kn!rZ#pUKMRyXlb14p{27k@FA>V-LfU@_4^i!

ZJ_>ZuVyBQVmfMPnQh&TFovlE?bmU5^<#$kjBG)JKaZ!3j(JB9N zm43-$%(Z0l`GHCyp2;T@nU-84>jc`*-pKmP+tbNk@Hb&U2lML_c1&fcULQB#?f5)U zP!R;<;BC@aP~%yS8_B_tH@7fSLZhi!V2PYi?KwoO9OWj;5w)Ig8h&0*>Iq=93n*o&QXmbB zCkq(Wsjb5ACHne`P9KPxZg$Ja7cHrt82Yma!?16txZ}|~d~bNQA5rSxcu&- zT)P9pkXr1Nz=2XR(F(d-?o1?cP`LV$Ui#VRQ^gh%VleLdM}9n#ujHbVgyjyuv&EQV0brW3h%r6-L#mxp{M5EA0Y`ugeJcK6@&2qQ*T z9^uNu`aewn>S}rEkBDBuUPv{vh?Fx!-vxPz4=ibG>rzWdXFo(0)h-+_Uc1TbxPc%0 z(=T^oP+Ck4c^R@Chu(W`KenO6(@Mgjo+OZg(tm*rgFeD|Pcx|~K!af<>eu$?O=c%?f6hmNXQ(#`1!f7hot1QU;iKdi2td)H$c%vWh zLCqbj7$W~QR_tOe@>8yG>(8Q-F1y#N8|*+Ut9e`Pc{^lnzRz{oc;4RDu~7QixG%lb z3OQ}4lrDwFy*$C!v-zU#2C*9%@3%WWl|J%~#(gPoR~hD?Y{@NF6@8eR6f(7t$07I& zk3(-nmu%+Z+A#dV1ZGNRd&*M`NoH!clg@bMa>rFG$QV}fIT&7~0|jvLz4>Ccg>pog zJX)=IUca8C0DY^IDh=h5u9D=ShVmibN%gI-X=!gLA2d+D1>_B?o4!&YH_K{kD8IuJ zx%^^TyNg3AyIII5Ea&n5&Tqh^<-eFF8S-v>XRfcFs_TH_b-QrZ2I^D2*H$;I-O!RErt$Ocyjf^_rR-U(mkoh=5Iob+XI2AHyhuspAIP6 zhVJm@Tx0nZoh(%DkoLTM8k@Inf3yEoR*kifn-7{<&*K9dYM<5=hNhbZa(^?t?98P zmYuhn7APTVx}CLRy-<5M9V|?jg9~t20ei`rR_p}dUNRqro0#5}M8Hti3nhT1v)~|; zWE<@x6PZjQA>J(Y*(rTiglaA-+WjHj*m_MyXJNWe*}eSCP{%Leum1k5VzO|~*DkHT&~)c$P{)6vcQj;#OnTRe@&a73WB#Lz0L`4eI#|y3489sg78-<+YcuFRu zl~qS@e&N^LHFfREb_D$wHJNpq&i{m(?U$RP_VYg-ZmZQ+Y`JPH>Q^G|r1|FgPF^cK zN_M%gl1{~86;b84ZqoI*re-}(o2VY`DAyncCLL22CqhT7tSU(UtWNp7&&j8(F1%Mi zJrHAMykn8#qvsbBg?@;B^Ag!~M$4Tcy6VzNU3jdb&OFHViL%c(Q{JEE)v`S;1{bK@ zTsu1TR1vxpO(t^l_;PEPn9U#w`ra!6f?Z6c(s^B^c@4G8!bIWFbU7||d?;>QVvoE! z8p==jy+o4sC|LS3^vK;HzCN2MCi89cej3pSv9Ab6PbSR9O9>!%NMv-vNj16;h{GL6aU z(X0+=s9b57?p0Y1Zs>hQkQ2Fb+_f&dU4Cdo`E}$9mGVM3B}Xb)kN>bgPY0YK!)5U; zlncM+pV#EqzCNY=+F@YwbKuzMCmQuarp!VMv)$yTYZuLj+9N^pQyd&0{i}MAPo{b< z^ot5DbT~YZpTLGSjE*RSS9tTY*!wn}9 z)Hl#yC^Fw7^w#ail2w)OJ5+bGP2F+E8j-)iyo-D~%lKo!iHJo2p!AT5sfms)EDwtnmd~_<|=D~S8o;>c;pWytm;q!*A zf3knjXAG;_`=CyA?Y%R#UeR8v9WQJ+UWuO!XxSjn)zglxM=AyFKCCSM_c8kWQ3u3O1sU6NAE5wrH((}v?eZOFP@ z;e6dfr{ZoZ+SewRFYIzlJKDqh6aD<$|I?qfex?4W`6o5k+m|O=Z>#uYOvh@dw*pRw zwq%JY^Qg${g5D%AORbH~7hTxEu^6hrIY{0oy1j{fIlk)pay$lQi~SfhaQBO9#rNk} zZ!ESyvSQ!XDi-qflNh%F`?9uB)8U7UBV_v^N7~r>#qFiEbNI4NWAs_*sv7iKGw|79 z{T9+(qz&Gt{ac=C#Z0_(JfwKnWG5qH1M{H?Pkxjiz4orZJf2C9^s4cEl)w07-VfE= z(_1NjrvTd&By91$CThR>^Qqo`_2*N){p!xgvgjY+wV(TbKne)74cLW*(pkBjCEle! zuDQ?IZc`d<*KU9$k}g7@tEAfnX}$8OaV36Dw9sK2M@}}Hxr-Ij(r)3UcgwH&*tUKr zIZ()BX8SLM{H@&dP}@M?f}E7!Z={@fj%^qP@+ejO#JUo_nDO$qWpSL<&mRbn86-aq z=A$a&*S1l+pYN9J=G7PRfFzDZt2uGo@SH5knJWi^IXu1ub%5y?nbs-e{i?+G%@@XsfsBaf}TG#9Gn)O;YQN6-^N*4rsGAZ0_lm}Nb zIbYH%+*(~?+2^BTsD&Ln7u)~O4OZt=g9kxf?)9r<%|?CdpZ~r-$CWkK>vp-VX1iQy zwhL7lNpNIYXeAi%VRAJ;Mb{h}5AM0;u29B_z`injt+sBh4z|I7(FV6zv8#0(d{>wI zn>EY*6|>x?$+!#sH;AHe6M3s5>xuRhym}@`1g)3>`$}6r7*& zY%;U|P7Z}%#t!qip>7plFvgsPLzbTiCQU#hHaUpRuoB5f2Un;R(SI|!)49X8(m&IHx&IgduOT#fPjLH{N-bGJZVzP;1; zE&U@u0{Z<{&2jUsiN;M`_G(wJS)I_kOTqa1&uYVR35Faa$b=?rL<{;WD+bw&I!5lJ zittnO;I7@N97(oht4KVD5{&zHFP^|Xd?>YJ@I8|cT+(03_T&<2?A7KzJ1>7TT^IO8 zdmgMJt(l%mHt?2;?=kLs3!O6f1aa)&4fz}6%jZYs|4Ld);I3{<_UTMAJ>4iR`UOlf zy~p$871{qkx%ZgbvbMvYm)_-j5pD!}F4wVK(w!v#TFt9!j?*tq-8hYmoe?Wm_6d*d zmkRAG<9=?s6_!&h>fZQ^)GMOL_Epoa)^Xcv?{#)AQB7jWeqA$Pes5;A_mny^w9kn8 zBJ+L7MMkiQfWJG^^GCf|UGLc)UGS8jlh6t$`kzJK_Z4Z85AHST^h(K3-+Xv*%D#2) zJLbF#%rwedUOIQ&sdm7VaoSV2Q&%og0J#?v;CCdo)%=Z`u^Yj_pbeBH&L*YYOwX!=?!B=Tq%3{|5IJdF}2#59}-21bKv?s|MzL3*T4! zpeX4u#ccd-QzL$kA=)U(2K&yc`P0{*kLw2?_NQ+=pRhlDBl%!R2e=XC4>Z|)YHb&F zGo}7;vibSbJn9eoY2-7J9I87j%GBUp%Io!)qqhCM{`>-?OE(bhR`utTr2Me(s`whl5K=NdIQx? zHPVR{SuZf;iz4H70fTc%_zx8q#3|Zs^Yl)&ZoGgW^~sU<0>dVt&s2&Vum6=34)?cB z^8JvLR)~)qul{~ZAPNvmJI;Eq+b!50wr-ath#NsCclUkak3{VSV?5J1fuJ$SpZZE` zF&qHe^I6z9!VmFiQ$Ful#J0$ACmr_o@{ZbvuJ5}%5%0_Q^nH49IjL}#n=_I7ywZ~u z4<|4g5|<|Y9kL#w@2l^~Z54mP&Byo-Q+$jsyN;@&;OnXMVrPH2G?qm^&yw~zq;u~4 zcEr;Qr}>D=r>jz=_mngPrNz7(cV~;x^DadFS)A_cFT3ra-(v%Zzf8X%{F?Uxzv3z| z94Ipu!Zg;7znS(YEm5+}WN?Gstk_IZv@m#MIR<8(di8+AhrhuUrb9?IFdr&Dz=$(K z2a-7dQIQ_FTU55jri9aXZz5}{m%m`-+`zKZfByaXU0rSHV@t&;^6!IoiYpgGiOB!y zxF9NCt)EWs8H>dAN%m^)$ zkHlLD#c^a7^iK}tlR(S`6i5eS!6S|zzdC$|a87X*$%(J-P~$m5&Pe!1renRv%g6I8 zMj9E{enNK}Z8x(*Xeb14VQxyEn?$l`KdWuIiZ1vWR7ykHLOGvx!@tPB^FV>U$0D!$ z@44HHQy*lZ{QKo%r6d9x<^RBaq{yl;QM!rQe$}5RD}_9~1%^~Y$~A#>RUE#tKauX= zx_x$@IK3N6nJGn%oFMM+lTV znBGmo6rz_2q^sazFlbXKaF`}b;?rx?v*vpxNYkkb8VBE#^#wb%VgG>?Pbpu;kCO4K z?yEM#TF{AbJTmWt_va3Rtni5x-=x1jy~~pZl+t|?rCG19e)}du!~t1RP7AaH6#WQ# zg1xj1SmyLsdMFJIfg5RCOBiH_Ab6oT_--|6jHN<>o;B{fEJHD&CdI%?ABKyxm+GL30YmI?$KR zx*MMPfe2mp^pviHkV}_^PGQ~O9_xNJ{b^bh_HMMh$hs)oV_~nJo9)5ALd3jUAfXVQ zl)(?U=^Qs5MsvkX>iJIfpQ<#d1#wUI)rbF>ozdjS;mvv*skKY8GPG93gU~^#&6cCn+sNT6K7bO?7xQvwpYje?|+^($Y_kfD!vfcPwzsxU`04qfY+dJ9i$Cgm4I-xm1JZ@gyuc*;qXll{y153&~d z(x)d_L1Y4BU>C&2W@h;N{&Sa!(0q?UFa30sp8AXVT)t9bRwDoU-;=$Qyl==M6sZtz zvBbF$59~`d`Rn9hw$z0wXwrc`tT7Ij6cry0`3t||e^)l}@wW`6Gdc&;SN zx=Htg^pLV*rPPxsx`UJ7iQ~`zeD&nzp^W2(mXpT9I|hAgYh4VH*eSBkvUVHou5=`! z5~wBKkaH?&axILST`7uZxXTEPAI}q%*>xrsX&59e5YN*nhezpC*nCt-EBi3p!H_GI zbG_meyU6;ginXK{buqQF*997mJhIy9BA(stPKFAGp-z!pyhg!$2A}P}=WRc1>19m+ zmPD}!E}KPzPWb5&QI%9p2)!SU+T@q~^!?a29q4$2KBx0|E=*8Kw$Pe+x+$p$OS2wfV4iY>T}j1!oLRI=W}6uq5n}T zI+oL*(|&raf21W^+%@CjM$<{)%E)-}(}Bz>S5if9jdt|Yaaa|7ImQ^r!F1UKlwJm( z=0De=_f^|Q#*d#)Tu0HM5cJYuObq>90l{SvZCLp?qPdz69Y-!nz=?=1Mk=;AUB?)s zTb&x@G%d$90}16N?g38^DC&saGua7#e+I_W;T5OilX9b;;SDwej#B`yj%$z@)_k&bkp6Z=L-O)-eA0Rah|R~*>)x?AL-|%igoW;Lh6G%6a03C<%dx+!43|T;>(;K zZs(Q@xBLeGg@X&=d)|w4F#2)w7_u_tab$s0S};W1_l?4Cr!=E7^h4>~N z^;Oat^sj3U%^$%jCaKiE{y_b(iHQp}rXQSEV9Uyt5DPS4jL(N~ODf>9ebw~_sHE%A z@Bgo=nNc2}AHb?1Q8;yZ40=51`U+}&Xv&b2Xb;FiLji|DrFSsqSD5~gUTD*Rv}43? zi3+h)epwE3fYyw?PnWBD`Yd$Ei=9$|Y=G(?qn@r6g&Z*26~S6`euh3C=}N^Uo*Dgr z804D8Iw*2#(4DuLF)GmIY|N-@{#eL z>lot2y)^3SKBv?xIUD>9R1_-UqoD^3=r2@(jPI&>O@qIBY|3wK(2Fuaoyi|ko8SeU zqu*L!zD^vtjp^|-+B@igBG2h> z6v!8W$KZ<&ypmO=?xl+VXnz{57+` zTZ4QBvoyxFtiM(6V?9{f!TZL%B>(40j(q+B{^Pexw#;k%40=)U!rw#SpnU7n3uF9M z(KCV3*MWeTuQ3le&Q)L-KE%)HKe`Ht#?F{u0nZHeo+1C34n*es;(|(c&s?{v1+g@MqESu46MAd`5V~IZ9+a4{vbCbECaNd^{^;jMr3xH}NytF|eUlJvZ7( z${$d_o8!{o$fjPG^ZWwy1oP`q+4*Ozmuf>E-Z93b=>TQc6Z!cY-uTI#`Hw#@N%s{k zFgJ`b9ezf?dE?WdV`|;;Hbhuvy|gti(w+fDpZebW0j=pGSg~H5<78Qdf)5_| zJXyw#tsQrE;{7e$c9XQRlSsCrq>bGtYpmFixW>vj3Gz{@eEM8u?O-A2V;13qV@do7 zBoRJ-{PM&1CQyDj>4tXu$oV4rWWdiLv-V1Az|b}gTuwQ? z`Bb`hNIS$C@A0`PYz(@u=w4CBs7DGz?(z9ouu;W44(ZWHwi)?AW|e2k9}z2@v5p4j zTfB$dKhKb+D!^6U8gx|XBrF98D6RBNh927!ASjo2i_t_028LcFYL7DPQ17!InZ_Y? zs2*2yYmF;tdw3cT&*kCv!U1eKQyb8@?Tklp@E&#yf_NKzfj^Mdcg*vqFj3Tl>3}%_ zzYXCR<-EvB0*5C-&QR%$^&xUVCH2hVcpA%aGz8kbexwD;0B}6t8ewP0P>9t)~KB4#s8<3B;S8D$aDv#RFHTiO=`P9IAQB{1SNAf`^fBpGsamn38 zfIKK})t`?s06jyJpK<4uC^Ij&DzS84MU4pW*ot5Ha=HL2W_r zN6-fM1UA37-E)5B9B&EoEOu~zU#MF_IS6urK$(fI|a=J`5RSLhNK6iw^E+hkjgax9zfmgi~p|RmURUo{Qsf zaa>~AeIb-o{F)#)?rd#4eR|Vps{FM;VCCU-8409s*y+3m!SN>eMBL+tM6ZA=b^2|* zoJeNki&6e+_m8Y{zl6Bn)zb4m(~CUB{0m70N2Erm8;`o79aQ|Sv}5%7G8`{0ig2N` zzJ7vC;gUQY0}Xj-&JytvIJk8|r+7AK=_H~D^4cLWSWFgBK7(KPo@bOA-jwIO=Ww>d z+YvpI_q@=f5*YH4n)n^G?xGt!tz*Q0_ed=iwB?=U$|_ov&qd_XWhvE;hMWcli_RTd zlEbTpT$mO6h8(l2{MQV*br}v5#sR)LIR2>*8|__9|1SkJzT>rrJAuspT+*fN&Q;sV z69M3a2g1M)?7)Bg@n8~CO_(D72xdBuFdFtUGo5b0lBuVTG9WA$ej+EjgA~_NFU;F* zMSi1a!XV_-9vlt14FU*m#!Xf7qh8mD4<+~c*q0Y!N40yDxRsH|N>3?rXb(Pmk&P52mwx8OR@y#w74pXk}>NZd-i(mV_0ujVhFM18Wb zG*jT@*|@EU$|IqDbiKIm(B+4`3?aVV=l92ovH>dz?kyy#Ji!)|&4(VJ^_wo9v2k)ow=cbctNqc82 z%jxvlLZ@5Oe^mg{&&zYs3skb&Awua1F+6R)=cx;nKGjbzrnsPMg?WXuVbb!1eR<@LWw`pG+XaCFOz$ zKO3n5?D5)M4@Hjlu2j3#;9H+$eO(TK^4iqphaS@Q@ml4C7kgIkS+819*Yq#B=`6p; zM#OykkDB_P$4z~YsYm6hX$X&nIHit-xmm<$XRt9IAydGkB6tP*NZAOmM07o?R8TIZ zJYp1`B+{v{PSpcAks>g5IdkJ_NdewMtGco{Wn zzwows>YU~`R32bujjx?6i*;O{F)!BH7;!gDh$|pFdg58d8}6IEU1E- z?U?`OY<Yn^3q;Co6gX~tg z_9jYg*gKrh&dVeMXD2JYchKI4MZ9FYe7sgvP$9z)Sk`;^57%)beoFrleBWPRZ8%ur z0O3p?)+aY`_a1yHR8ILG{Tw{rl(85b_+WDDir9Uk>G4uaPfrVdTU+R(Rf?BYfQ3Bs z$M{Xx>UVU7US@><<4Ul^TnTW8lokh=**LLNnP~ci5$kDcvDG*Nx#oE1T!IB(rZ zlss@XaPXmhxn*C1Sfnx%U}a-LFXT13hh_NR3w3$VmhuL_A0>A4WTY@O=rZ9e2JkJK zgcXkw9a-_F-pCs^N?HLQ;&M6cbB==4bo(SLHpUiJWJQ(B`V_F%y3ZMFcY16lhCpBw z58jM=Wb@rvAJtZ}X98M{-?RRK$yOkN>aLN{Sh5Lw{1{Vb5fm z;`S0tnf~U*=6g~oCcOGi#LvTJ&<#C6HO5SGF#J-?g)(Y~br)p)eM3*+F8rq7mS!v> zeq>PwM(1nD`{OZCB4;UQm@;Ezs7*M?gX>7dUa930IM=vgxUFl|_nI%SHBWIi;{@yf z#QqTN=u|5HS}`m*fd}PUCbEs7xZ>e}VIOiJxx|W{t=IQY)~Js!zMy8%bxJi=y{y-D z{a&tFzXv8$ze${P8i%}23%{JnYF}X4DosU?6qs%OdFl3HHMCNSr1;PQ18*0U2T$ zbO_kWEq=3+d?$QQ>5(Jf3o_A+H-IwD!k;GxFO+i{{BBN{Q$1Mra1Il^H}p1jEtk&3 zdrCi*Ry$rxc6fSF&_x>32P2)*sj0TnsVs}~R(F~shtD#iMSF7Hb<%X`0BUQ?c)iukG%)vbE)_E2X) z7xqBD6rM`f^L ze1+whTS^x5%etIo1=jSTRvK7D?;7DRMaT^csqNm*fAx^3($Q$>`UQvhNOvAjn2#z~ zN4o@V#3oB@*(oXGWMlqx^kc7*n>X7ni}}_+zb4Li2R5?b&*QwHiuoz1ODi>n)C0GiRRzL^q*>_lE_L*kn+_%aY#|^P@B*=L~S&UIqGaYDixH%z&8YW z23{M&ok*AW85I8&D~2<4WYxALo>cw(ZCVH4!tQqM#@HC2%$TVN%Ha6YMhJ5izt=MEouM_uxpN7#m}q4pxj`GS~4S!I9_D@=UHmTz5MbwtG5W#B7#$ zz$Ax}byw?k{NgVZ%?7reTQjSrm-Q7-)y`~*h|ril)*UWBU)`8rcRHIYWlJig3^!hQ z?iRAot$}efZhnT|nI?C97A!=Gfs%---wpq>l9MRnKx6Po+&;hDG2_pu=XllFm!%sh z;x`wmFu&KaaNOm6D)pplE7N#qX{E7tQxjTkbzfNb+D=93*3crDC)#>?(gRTMh<-@M zCw4B`_-h%zRiIMr`!U|fulaj5`5p+B@49`w12NF+WQEMt?mJctXQv1U^aWJ10e&MJ zq&DLYFOS=RAF5tgH?O&_V)?1vp6}MWI+bG;Oq7h(zZh%krqf~@$(qW6M!7B`7rWyX z&)83m(5rg;iE>kLots=otGJ6D3nd~=GLK*@YE`kUbC_R9&c$+B#z_h=S=#h3c2atm z%Y1~&F5rk-M7PN@Y<3~wo`!e)_}@_cBPNgIZ%Bm9;y=ZXQuTB$jx)gV?t^lmLzj+X zByRgpq3YYMvjL2l1n82oL(Uo95!G7ys{?#3<0H zT)J>KaDL=;n1(WV5n;t(y2dlwx8V`PLl2-!xNigHm~6IWcu*aIMrni|lo^W%Jr4(v zcw`)St!`P&zmah~+5C+-iCl+euW~$FLHyYag3GB$Z?3`A;KPCq!tr6o`ATPN7R0hP z#ybo0%gSzqNAd;Z@l~zdp0R{2Vp-?QzgF{^HOJ$!3C5#1G1Xp&=@PR{EU|Dxwo95e z9dC@S)2!HP8C#5h;+0?7<5bLA_uO<6R8!@Xapq(GK_v`|D~RGT)2+Z#Zp5 zk}5vNd*9X9$oIP7H=f8=wR;MET-uXHl(h1YDhSv8`o}Mf`+76ou6VyT-=KSqOaju< zFTyJ~VjCk&EqFZ%sE}jOFxpuobiKMhnX-X*GC0Svm#^C%5q=!UF{hO$)Rw{Ys-NT` z{o5n?unO8t>TP?T$H=2I7w4DZ1^noT5P479JEVuRsQ-(!SM~Zy%u*=);>@46-tf41 zm(~S-9KTBxG@n;-x{L-_A+fwsu+_FJ`eB#Qi>`1*N5%Ys=)N`2)7%?p>e1a zQ#NLARnhWYJ!*h#H+b%>$XtxUr()9uGMtSv);~`r$Tv*sE+D@aY>Ex945bQ-_!{3Rz=1 zB!?xUaiQ2j7g^=1O24!&Z9}0GavwyJYBu>$b!-?}ZTvGmc89EAAz8%JyX=E{O~em) zemNP%D0`iacOTU4a!<{58Llz4^#qOjuQ$&{E5mR)^kkO|0Z1evn~5HQ~;&5WAI?XUs!%bnXhz#j zp_)$4o=W+ve)-;)zv!=C|NBa&lyH%nm{2YY^U39G!EQyQz6#E8({WHe56p=LBJs-( z>9JBhHrd7%h=_}=FL2G^m7G%$;X|rrkMc$2tH?T?UVzxtT{wlwLHKf!%%b~bST7Oy zzzpzABFzmzEWjs(KdZkzL*XWa_MYt1f@lU%&C?FK#yW=vPReg$MZ24jFxJSznW zaC!@+p`6I`pO2^>jz`7$;PWG}DCEcgj%*rdI<3qJeFUG-h5`%5S=*9sbdkM5QoZT`d##B z`#bfd0sB^>r^?gq;)>y;20>L5lN>&wZVihMB?kn#A?eIhT`z< z<#TCg-+>}P2ok9j++MZX+KgY1xW({>gpoqRr}DtkG>)a!C1Sp^57^JwJ7q-*t4oL# z4F^8a>%o6<24AlBo*W2~&e1=&>T_k7lk*&zn-04p`kJcgz2mD?YG@lm8xswG2Jx3j zLSO!&@b~?NAz5(vXy$m&)uFwN+ayIB*A5g+#~sVMB0G(juN!_-pBpCQ*>69;e6mvy zM;2D3m}bArcpA#~@LV$$(1_o|&lr#1xu~>v1lm>k@y7E#)O-1-uSMEJrz>ge3PS#Z zt3k7xaky2dAf&Dv8rA4`^Er;;iQ@oUFKm^0zDTw7g>*q5`Vp-sd1VRF`@wKM%PTTC z_6zrnap3j>Y`@D{9rK*;M0qfBR2P$(=U{p^2$=Db4y?>&C%v5McIH3T`ZXz=>EY&u z6NgjktYjt?dgZ5g7iJZ77|-digx`4Q;n=e*UrhtO%pi`lr-3()MF^UkfQc?9BiTIv zEO7pt1Tjv*2q3dEDyL9Bz#(-wf|BQ3rFe1*qAAI%)_MUmc;F}`j^Ek6&2u{zhGqRl_uubp_TL*D-hWe}Z>nbu{D&R`uN!0FEi3jDJqB3ycKl6RA6GCY zzQs&I*S}t~Js+N^JsZ_e*V96`i}w0CL(hZ|d@Yzh?QLG0SiE%T(-xtGBL`(2l=h#lEg8O8Qs7K0_#IRr>cM z-EQBl*=|q$pJ+EzYw>L>hP_N`h@0|)oGUAyQ;4Oj&yHeKNL(hgloD#=J(Ua`1kyQm z756RE<4IfjwXt z5k_i4tR^rAjPq0Nt}2@7CH#8&3$6N&$-n!>QtYoOFPQ^O&f!>??*Z?{BU3Bj(A1A| zRM_soeVyv_-E#bHca~OiSAM3ypywZp{}p*CWM{zpxF5rx`d*u`ZWrSkzvgpmj_Z{Z zjq5O-uGa8DI-f-IXW+i1{Fy5T#f6>pM0Yq!{ESBVA=pylu4%>PuMR(384;oM=w zzw>sBy7@I0-%n2ZmQ$%+2bjkEg}h^_;#AyVMtSizD0fw{3#n@0+4z2t7#C7kB*KsK zQY0VohdCH>Y`(WwQmMGKlje`qFlP6-YI^HYl~42iHOJvK6OF@0`Jw3OJWseD*o{xG z$@Sc8#ct(by;qn2j+*7ac%t%$=h0;OooMOLw`@8cfYRHsGr-lHVazd<`C6G{SLuO1bbU53{%v@?RHM67Ax}kWY-6Lg>_vIV=rb?=E$M6n{FkhR)#&!@ z4b0CaG>w&OeER>4?#B&|`{RzEnTT+v+^(pj@OQ7z6u&E8JL7m+MS7|FxHP%HaNHk* z|Ep4QRbeBYPtm;vSEV!bZP5iwB{RI59nc6KeQQTM(kxSp}=tQcaXk=U-&<*qZHo2kDF)Bnlx*>0&%wd@mI?s^Tl>ovyOfU>&r z+%DARRdInCpVJLp%4M8EOmRAaJ!H1?Wch1dqAFZnpl^57rz9 z*O}!r+jA=T>R?@5ZpaPCjK(r2H}qsaY>{a_xCKw`sX>jzug(40FvWx~}@m4N&hiCH9ENu^~8b z#Zpni1D(vU-`=!K*U#UN&+kzGQGb3>cG6`PW^Z7AuDn1#te$dBh7YSJKgCCd`LO!m z_X+=$=~>(v+PJ(@bH1Ci-PN-g{#dLSdI-E4|M6KFG#GCL{0pjd44)f*OpyU<=%@KT z%}Da?h<}1+Se5=&$t~h`-KE{Gt^3q#&3DzD&zDX#pC_bKHnwa8NkR#eo?)J-@$Lsx zwhUq774gAJmIO^;IC>m0z|ip_S_B$i=XIUp2n{JwF;u%+`!$xYWXYK~tJ?coPO29FJ1MPbS-axB>g`ay z{w+1W<4^mH)0apNx!=Gm*51|LqdSMWZ{7Ipq~DXR6`hFKwIIPDn2q^wTYtXdlvpXy&#@rqPI}6P#`bvz`$?_Xa~dj_ zIa4B?nHmxVxytOn1i?!fV*PFtc-t`r^5ODL3YWBL$` z^a6OEKu+Yt>hDjVZ^HJTKE_&cX>MbBA{?-(bD+J}qf@e-$PUN(uv?2|4ox;Le)N~E zonE~@59uatU)nV*dgPM3;b~aSt=+s@TGn^@ao9b-S#w?ain*>t<(?s|E##zASZBsN z>?U%Ii4BfFxL`$BXGB(qU<@10Wu{;pT&yoN7VFon7-RSx z!$n4!r!I#8eR-G%!M4^A4-$}v9+PgXJ1+es8nT2P^gq-30x*{yjD8zaac! zbtqIsfoyj`H8>|Kp?6!cBit6JUv=1j1im;rUK)#Xj4scTn&mmjERR9|Om-T)^uekG zkL&y&s+s@w6XcI`0{w&6#yBtKApegKDPdRqI~RU8!As&hCmh)52pU|2v;16!$Nym zL|zNX{gh85&!<2>F{g*Va<68dL5i!(Rn%*>nVI9f**;j9>POJ)>F*v zTC3^ztQdSNb{D_CFkR2)%BZ;Er|3^?X_m-7qriYu35@+F!GSFa3_E^wV(RbgLi7dl zT7*H~F!Xj1BveL*UM?cAY##oO7K|eMw5keXeAU=@6cPaWoco$OvFp*9lZV@%CHfvu zPI2`^kvI!WJFtH=UJx}Fb5ZfJENyqKvT?*#Z+HT`t(A*5#JsX2`QYRDZHYg1bO!!) z<{bHfgJ0}BcIc~wpN33F|bv_V|-2) z96a`H1^ApuklM?w7<@5zx9-&CyrpJ24KZ#*%BdX1RlM;sl;@KUt9zpr!5h1RD(;JXCat%LzHU9N z+wIFW+wH1}+Rbf;I`uS7=4?7g)H3HVniQ7tas3t6Td`YIORm@DpVEDglhngRN`J0p zV}vQS%V|)%z(y3J2`DqhfDC{ub-6FD+3xV#2#?oE>RHT^2}=~3S@y72tE@1}cmX}K zy=gUd=PtSoS>yIhW2{tX^P+wXVgJiFbi2P^v)vyv+r9pEVhZ#mW-r>{d_^ttfYE2z zlZ7+OWL%x7>o-=je(8zoN82%X`P!gy6-fN~rg=h{sT-OLJwO6$AcLf*A`1z87)pWh zLpoPKpAaQfPw9I7FNiBQsc~p360pbd9yW_12OzdVxst}wBM6QnH8l7iEl|q=tt}-T z9G?lLvwa3I=ZMmumWCwEB8aB1@065Rrs@CdHn56UAY0hA!LDSx&uBmPF37J#U`2qF zd~paYGyPTT@7HvqphJd=JY`o(MZ46K#({c)tXVy4Bm5KtoKadAb_L|FJ+m5m_Q-QzQ&3T$*8A4!!)T^Cf$RBVv;sO50n{e zTosgjEA034+S=#NS&B`RACPOdgHErKskjWGd{k?2-=*aVIzfwnmz>CeulZ*z1a`u+ z#Z>5@4g{$2`G*GWQOHeMw5BNT>%{Fp74%f~A#6j^hj6Y9^H~uD;lUs4fy2?3@!>wt6q@E|N z*MR(~Z1No`21_arF>JH!r;Oz9XIK5)deK9*B4%ST(c7Dr8j_Ah@=@u$vLT812bt$> z<8!Y2K#BT}aJdypw2w;S_>wu5bf%1xL{gQco?xVl;q+)?_Z*Wsh(?%kg4E7BcN$A! zHJ@Jdyqn52gAX(Lfp!cf9rZ#E{prK%NlkeX@`2}f-e<**!Psj$49h1SW~vKwE-US) zBh#luI8FlF-f^1!U({wr%$~@XTU(S@dZ~9*SF-l0L)H|Xx7N_P z6XH@=5eA!vwkbJ-sCL}%h!PVE7aVoSwxCx+@!-g}Ri*3fPyA-$FY=rO-RZ29`h6WH z{Q<*tdSN1mA)J~SiB~;u#4kqoT6#4b&UhXgE%jJyI-GgXa z-A*rpGeY*_k9?&i>9ROywFns`QLdD_2eaK6-=z}#^SVn2cOY_(7{v;7mQBfg_CMc> z&zFS?Er6dU!rys>;@$G+hMt3=O31zVvIxB+6vx5|7n*MNg<6U*eW?t8?*B`EId!+e z8@dg?ZSZjcznn!F9`%p=@y3HMw+bPvHh|hVAk{ooxQ|@RIIWi67;vQPezN&pa>6|B z(LXxOuRwn4chcDw81F=YN@QA85LccQ3k3{cQ1XqRA5<$eU{ccRNt77ho_62J^TRxC zj-1yPNRUsK3ZfIK`W~`xQ`!dWK;#>-3yA#X`rAjo>c8!~(~JERSvBvEb*UOT=afl; z_2<63GFB}r?Sp&p;(EoQJm`NB^a$)l0*BCe|ED!Qmm(d0&F9zT`$s0?`~5l0WwBbp z6EfeGltvaEf)ck0ie>=7qxhWut-zH4ii559_Fy}c|9hlr6#s>eVm2%D}v>ti0GAxT)d)>`E4mWgK3tW303<> z)&*sMnCTy1qR)G(nXe~bOTO=#ezOO3zc_jQCglZh{q@#K->~7G=i8RaS5jyJrB;%2 zm?vzfxY9dB@>hIaD8mD)m7@y(S8ZP_ONCEG>!H_kDLUktfSJ)7(0kYSo;Tiin#_9$ zl~23nIQ1`Lqw`{?02PH(H23Rzhfx2YvRkS-IVrnkWA@xikIO4pl@|gAId9y0Es2i6 zuQ55_9YOIqPJd!Boi8qe?}8t!9r@11U;T1LTFojRK7+D*iy`vje5gM^4r`Um|0zAG zOS2}SCw(66g5Up<1Xf4}y)t3N+~+);lL*{5O9VI+}# z|ABQ`8BpQ_&QMRHFBRv}OUf9c*(%d7XkOP`xDLUVz8f?1*I_9Lc`_J4kOj`A;Gsox zm-BcQsB3jRWIw&4=g4A{a6V{Y-WdPBp{E;bUYOAV@Dw&1%;@;k+%U$RBx-@M?_G7Y~hg#T?sag$tFc<3oO<1v` zSo#erbLf0se;hCbnQdq@y@+C>Qmk6g1FhKJx^(lc7&drHPcOD&9Ssz8dQ3H=Ws#mu z+8-%sThxo6(qFrbXu!}JVBShjvQmU2P;kAJ`53a(L+{;=`49i5R9Ct$2XhY$J?fk@ zGhH@?_@1x=!LD1fOHOx}{=hIm`IDl*iNpDy zwpkv3!)>#4^Xbs`+LHYV?OIJ4X^wvHK>eQSz`Ypx&~ZrHX@MNf9+Oug-`_nof z)_JMUXHot6Ajck*G1b(906liQ6+6JP57AjuoR{B6_;09PA^DeVkIQ4bMb;mYBjA2j zM*lb|q19dJD0H`HL70X2>gUsyy}bH+uwNk0C-H}0^J6vjX*W-#Pn+ES=QemhABK)9 zH!YJ6A86{XYEwvh^gh+pZC?$O`z7j>u*e?hhpia)FktYDKPT$ZTB{!TFvl9Vs~?Jy z#}U_y|KJ^BA7p_##`f_n`!YX}pKWbxZ&izcNtX8RdK~Pknp5rXi?n+cK7;-nU!WWR$LjDS}|@_eKIT7IXgj_2I$6RW82?nqZe`d)Hd zMXA;{v5+6~Y}BoOc{Q8vQ-@D_OF7q}`tvDNitya(siaaaQ}8nK!LNA(&zh*h`B4uf4Z{ldLN5gzt2N%#@=H5h6y=CXTNR&~=9a6chtZ&%m@y&ot9B zFh;QH?yBxCr@E`?s+yig(5pfM3M&{?P>86IMFkfW6gH@sz={D3C?sHr!fG}Q;=8cH zjpoI;|NnEI`*rTETU|8`S$^+S|4u(u_nv$1`FzfEo==3I>={-A4Y#i_U5ZKz9dn+F ztsl}YhRDI`Of<_Rv}?WquXcJq^55%nqveZzdx5G^Tynt(GnXZvAij3LF%$2H`d>m1 zBL7=5^P^j3p9r7Zi|=zoy*BeZtcUQ&gLWdHTc&)GUhAc%oQLh7gOl@6?8{OA{RIDw z%eGA4i;%_1hyEQBeAE=aXaC8nY%!9yYZ?1*6eao(+8Isfno%I431ps>)?1xiZ?G@F zfwl7Al`j-0MjPe25=+B|&}0rfE~aQs`syP62yF@tNy#U4d01u0JJJ=XRx)>(uOD%t z0@IHufzQQ1m`mn3Q6eo@P4$2{5g%$S?F|tLjdM~ty1O_2glz(S3*#m zIm&Dx*a7Px(37#`D&#I0Bu3@}KCUGlTDSez4;NI9s z#1YvcCK3M=CwG1z5vSZQK|iiXwPQQI@vD)@7dFqiQQP+yneBsFad!KH{U~!Y%Jze_ zUVA`zJ@$43AFuEwbeP0rPRC2WUY0a2I6qO3tNnf3l;QgvWEb71{d7-eKS9K>zb8PVNqwLqF2?JdoKQ7|Le1r}eyE484({IquhWZGa;mTN{CXKF7QL{V_S- z7TzVEmUw{q?K73RalG#_G+;d*gc1 zwATy>ntsGmDN+B?U@52jy;N4@4Dq))7n){t zXWB&zx37qkHEGTws7m9)J+4>ZoWeKU!sPQYM+T-Ij;HlGH?!T;rA(H$@cNt%8?%k% z`{doSlN+~uDzFO6kz)3$rd~!L!PuXQei)5()uec&4kd8fv6|;-zw05fcg8P;} z4DXk!U{L!REIAL0McaBOU=J#ED*2W8bRUZOXl7C#6C?aa0}@V}{4)3dadK}o?ZE>= zSL3;ZBG2(DnO@7>KX7udk-V&5w0X)bo)#k}kgRGR(LIy79@@cc@!3OrP}&wwqHeS9 z`*e;>i9b5F`<*S`+rZPrSNP*uWsQ?tWv~OB*z>eUdNRb{JjYcT-d^O3;dRbGcD+ai zYp&YYo<6j3NW54hzl>wE`BW_xl72LKE;jQGj|+daefmc+RdFXK1$p=Z8^pPtg`$7H z)}ntFw%;t)de0hL1}owoW++{m_p$y2pPpl*6r;88Z{65WneWC*y#&K-S@@;{WU)sl zux|F&x~t7kSL>DO5lrjyJWxk1xvuGKI_PL4mz8}({5qgwW``HQ7F@+(cH|*6s*h|h z7OSIWpo|d-3b8}N<;wgDt94GJG`_tIS|NYhhAmT#>9H9y{`|8QTf+9H<)1B%f{{`- zPBoBc9a2Jmk*3#j8eiG70q=C>uviaX3-MELZE6|?;j>8P&6!r4xXO!AzxP!djCW`3 z-FCk`$4Qm@WcQo&&oTI)IJc!eC+uBnnn6G)@-}(g`IG_Omu0O}7h8IqzVFu^->|(6 z>o6kR&X5<_g1MS~^gyiC3xeaT^8>Bly_xm<+TzvECVcw@d6U{9N#onpGm53L!>3@9 z1ar%F-Q(o$4BJKg60WD&I;@+hNeBIZvyNXBJyh0oTu5CbP-Saou(d5f50!ki^!nya zJOwjOhTe$zQ;D~Y^E~@p9?Kt`&yQ>RTs&^bW<+nt5zLL1GGgMDq`x=*eC#>Alm2@TyYkZOTp61 zwrMhX9!#kO=$PJQE9^kyG+9pb=e0L8KgJVsMQqVYwm&y+oT4%E=EMBy z`=W#^Ra5;ca++W*h?6(U}@45#GZ)29cUPm!<#TpIIo%q?%Y0 z{2F_dehy$TixW}oSkU3~!7)JMg|+|wfb5t4Z2Nh%nS750Jm)-%eE4)forNFVhi$so zMwM;(Wg<~e{U@SKx_NGlQEoVeKWSr)7+eBFcg^X{c_dF5P3*pezGsuTAm) zvy=OYPZ@tf+kJIryAks*eja&o+6@K`&}TzfShHl`T;=3oqfXjjEmHe<5G&uTwHnr1 z6zz%qf0KE!;C05XBfd(k*Dd}1;v#)zA|8AF+;VAVJ0E;? z?0TT~?yTg!mG57_X>i^70d5w2=i^7(Ab>JLK7PoLN#yURVI+j-u$1XZyFXYNE0v3( zT^;gJ9-b(tI$NPf&tjq1egd6ZhFsfmzJ=%T>HcQsyhm)J?0LT+(g%$4BL@N%pr zfxhrH+Kx8;hIiNw)NL61q;WSUdJWPnvZLQ`)zI=A{yDAZRhjGUBlddhyq+Z}MpLLk z5nG?|zEoE`v01_gKX`e%j<{bY_9fMKHbw;cBSi8hU?O$5iusMhTQ_fz9HzaZhZkm5 zJ-vJlh7w?*^@9BZ0o+8%oLTq?Jf{KSZlq0?+<&l9GyYwz^S3!{)WlD<)Wd4mTyYFLB<@)IDXx#9 z#nYp++l>mECD$`0PC))NRTNWsOTOVpTd9nfM$7BP%KR zzC@xQVO0!2-LQC0_}>oh|dUVOhzUpI_WLgN&wB+`>R#eJvXH=}L9oZub3y{nJw`(wtVA0rwv0&`2T%ie_$ zbK}o~)#ErH*ZQ`pU$z+awQCmBFI!akK|B5E?$FH$?3@@1kIN6pCrQk&Y`ha$ry6z% zi-PMgD96Nu9jX+@5#5Mb#G<>+eL*o_k-JX!^_lbR;|rT-f$?BF@)b{zFL!O7ul16)n|HL`wuOSR(8@uHZF!|na-EbwaYnD}^xNBvQu-#?=5JU_FY zlZ({O#9ni*lRHQ1-xIID_-fBXXSa70E>7ybby5089-a@vc7nTJ8qLpQ>tKeOw5nIc zn&h*z$TtUDK2Y%H^EQCQIc^yH)6Aqq;Bw&yZ~I9&B@qqH6aryu{(V(BitwBkzE9O} zCsBW}F3QzWIE*##vG8}o{+8#WNI`?}swodza%Y3rPcIecRM;yFrmzAAUnBaqD7&Bp z-VfG+Z{`TGw}1Z;d5hEix0&<63N2?5YnZXYIp)Qs|D(v=c>XTi*zSHO_tz0Td=lH2 zI1h|c=0yIP_F^q^vaZTaIq-Ae(^LNw+D|{u?5Df!^T&Hyi{SJl}A+_9j7BcyJC-(!t%YLEl+)aO6?X)v! zWQTs=Q~9q}$Jw(a@W*wnw)Zoc;|i1K=+sNj|Bl+rL4{Pq{h$siPDU{#|7j=ppZswd zLOm0BDnWvaqfMWOL#v&k2Apofqvm?>WN9h<)_m=pGSDAXHVki-_$z{UN|jn(D0mQa zTL*M?Fv}LC#eILsn`QYM7Q1{FiqAI<=)NU$d=UpcdwkQUrW#kp;^=ZgrYt%PwDGKI zPG4EEb-(K55W`K+VaKxmA$|{ik)A9Xec1V?fy}oKDHxJ^7IITb}zXWOVODFg9p!@Um z`8mW3nA(nY5S&9kul@Ad%zlDP(Z!l4vh*=07%hsj@2KgcjjgV9av#?wEl3_qQ4^TQ(QSlsfFg0_jM42;^%3z~mUy4y?Z|7z z4suDr_y*?o&%c3VDc0XL`lBEX-Fz7~HVsGh9P{PT#?1JXoB|vtmHtiaD?(7_ z4c|xh7;xf^%JbXP>e1x+%GmqBormU>QM8sKQr{n?zt_X|DTDr|JUlV~qR*3l7tTX| zy0XLAn`Y+c`y%;yzRJwM30`_jz_`|X7W|y`KFV1W@`z}A@_bR)A^Gv@SgAfeN*)qF zM4a z^iTWsAq@aR1)QjQFL>y1F$4xv9R`DeZbE1MwQ+Q&!m_a_wWRw|KYY6XTjqMad133Z zEj}@5Y-`pL7g?9^J9U=B2~2!CffocB;b9{GN#LOrd=(+*B7Ehf{DZG*w6iW20taevw`7>%c%B4E_^{M9;ZCjxQO~g}Qdhng{|opt{2^M=q+ajp&AmYgLoM%> zgeRH$lU#ZQe}gXvu`a)fe=4*O)?lT{sd_I3#;~Y>NF9-M%4pF(%rvm6e`xCfQH_zS z(=@ghI-1DZ3+~_)uFHIY$eBgVlqN6|<_^zy_;erbxT_uaO^$n@gGQ7vvwF#a;o_h> zEvRSb_H{&PMGB{YAI3)`6MO!U zxGNkedv67HT#Nqfg%p~)T!q}L!FXguWoNiqSyDKhW~vm8tB!M`saVoVNGVM~vkClIi4{7?#$_!&+bvPP_OrRn;BT8Nu+ zdk8|rU=W$%C4t|*wF;CYQ^zh(G!enW6|Y*8^e$@3bFK2ISCStb68(}P;8Gy!pxOhl z?KW18iTD7LKmOccX%ct?T_!I&qUC#n{OfjNHTrnak~bQE^0K~6{TY`y(jSrg38zHz z0MCa_^1rKCuZ^m`haCqxS}tUw#rpilVx2`<@{CwMIA`5Hj4*r5XUStvuR!Z{6FO&0 zr7=!?Xw@rz--O;^F~Z-A)E|2RiSt?kPMoMh8rZ#C^@`+!_kkc+;=Q_qVzSQ^{E#2= zUTZ#Kag~cuTZNrJ>=MB{WGs4q4&lFWeqvWguNGi!T&%7YM+bd0HEx>Ec&WvH;!mBG z>E(ez7#LFfS(($vqrSo<`0jF9cK?O>xroB7>)YDb>S# z*7$MUMTRf5Mo`!MbZwGW81}pZ1!X2eLFbI@ zvtfD0@77qs_HTw9)AW~xk_*$lz7Y$$&eGqGF35MO$Z9cOyTUL{)BQ4 zo94$GBw{6%s`-cpF6rSgM%odSKVIcLG_Jpp#lpK`Jqkd$DJ7Gin_BK1MD}G=piruj zrmQI{v(~}*j_F!I%9WG$$ms0!4l-Y$L8NV+pGUd5Kp6qq=SU`WP;{0Uk-02Dycfo4sR1t*o zQ~}~Y)>Bm8O#v2O^Yi)LWtTrihiIIdk}L*9zS6%Q>Q~4wpn7&30+uK5dTpXSgd8xIVDiHC8TUKsUyBYy zJ;L{~Le@T0njYODo-^`A(9VSdCK>zB#KDgC_YCH5V;U=`rem4MvP9jj^;)VI#(;*Z z!GK%spI*ChcykekaNH)@bZfoD?nm`u50Ceg*@+9F1w*&G`RT%Rp^7Noy*S@mbW?VI zAVM?x3BA~+&vBuG6tVY5!QJSp;^?%9;dsJ>!!igPS$}*iyfR(F>s#XedA~K!$#G`gU3VoY=J|HSBeADcGL4KbI6?7ifGrFvGznm+c7&6RzO@sgqWtmu}6QI`(L~ z=bUfUOVBeSXBs3BLIxPKGTllL9jinHjM z9dz)3{_`C?jP3}3NQpiCAC_n5AIAZ4mb@ctp6sXzMP0D{e$9DS3N&reN(gB=rVRL*w+t~E>Jcgq(Cv;?Zf2;w+ zIk1fk2^@?a%CPpWct*7uq;w>{%4~hzrjMC87tJbyvkG}xwMgOIXIf=Pmh5sXW2S=_ zSgxO)<;MHf(Dv}Hi@81zlC5NqOKE(OmP{{rz!CWD`CX>`wyLso){-OO`qA z-p;Rn7X&~dziV_1tXgHUlHY>gV7W}e^fTnUy0Q1BZa;c_EW{X^*8FSCOw1PPLU%RF zi!@|d6u0|h+vd>F5H2Vd?qyT)2>E1T`_&&A#yG#DIzuzMaNFez67+&NJlFxxikFH}co;e;?>Ym8xsg!2hGEeg)h3-=Giym>M{ z5B>MGer_cnk5shj`?P}0A7-yjMIQ2rk#EDYDd%@|m#Q(5cpweeNLGmO=47(oCdgPNZ$PVz_=c+L~~P*?%*@pqsD3%-!V<^u?=;iKOj zM4osy(0M~!MD7rl*Y=6fst@fc@)0#En@=P6p+!|AozInPop)v+Am?o!b@I$?oi9KI zpgZ8?Js)@klwmRP2f}vv8)0zts~~`4xZ5ZAf3=28MC9>jk}1|6w;->-Yk#4i;zkm;Fl`{^` zXQPC2dXOUJlV4?s4M-pSuPoUbC-R}>h1R~!>mUu2_OsKv`C0u75w3(Mv*%Ib9B$Qr zdbBWGVg)SvJC)#gA0&+!M7GrCQ~S};#zt|NU@>i|h1p%8Dh%uU46;QyQ-Xnt%LDtmFDziK6*}-EN!^$BV>e zQh$HeMGz(FUPrhh=6q<4Peh@K854ZUrixVQcp=!{?RhXL^Ut6nd5@)^khI4Hq9p4b zY7`R{Ji+sOIQ_zC)7D|-Rsnnq66ACci00!Us^7l}K?vIVG?ZLG=^@WqPCKW$Nv`SL?qmtNt!RYR2s+ zQuH$+WRI!Wh`w>4AbXL%=fj!rDckSafQ^#IEmWeIhu+Xh_(rWsu}g*->bOetZDVUS*eLfkHT|ZF~8B)d()rGACq`r%-?*A z+M4royuGpK)8C4BauLVtyMX8NiZ^2IwATp=#z*L;SiX3FoPsPu#m`}EUM!#lQ}KORuPV8%=J%Tt<>Fq=HS<&L$vN36=Z(+j zNWMXu>z^zUvFDi?d6y$aDcM`_8=vm4Wa6h!c7UI-JsJxPDrDtx3^BG2#H%KZ2@ML< zt`=OFUC2fQcMmaCe}j|zoFZ1z3km&QW2G+*BHh;Heni!nClc}X64+IdPuA?YFn8#A zeZl$FrQ+cWEnm%aIS&?6pX1Wek-2Gr~9j!^8n#vTkTUM zK(=EyZMIXTj`%Y7Je*7$RAi*5ZLw^ndew<}5{B57MXU z`OM~9z>XT_*^Cp5T_U3&CMIlkhx6m|I8wS`1k*10*_0rCQwHx0PX+)0b2 zLWl7m11@Nzq$K1?D82o0X2>_KiI(%8j>=h!a@I+U`bGIGj|mJCxL`E0%pLOru8YLH z?Z-J)J#(yOL-3*gRx%$5MZOC6deZLO)o7Ma_JPPtk&o*xv9C+MP=-*3HYCs4>G`64 z$(-iH=Cr?VA`G3#__kk8v`)tUkK@~ZId;c3A76_v9_eKACPR&*L)bkbK@fIw5PxtC z%B2bU0~-WJ5Z8`TbCCrcmJ?YRd_h7VZXpek=d5xg9VxekznzqFF4}&U!e6lVVp@^X zh_wNHmPbfJ(rE=ygY$ylcHlRu`ht6@?!)k)7Ngy*{VbJU5pMq$81_&4Y*}X`n%_R2 ziG<0e{v@@G5pJ@obDKR%9#-7nL~vMsk>ke?t{sfjY>1eR?VtZx{oCl)1#N-Li=9snj5Dtj63kiNE;8YDXEI z9OBbODz7CzU8MJ<;s@f>MJhjr?+i6=;#2y`)gaR`_qAx48^(yLXHxAu1Vlp@fgqt&+X!m4fMo&Nl%Ol(aT6LF36A>k%};E z3mv&pVmhKY&Ny5lzd-D>W90AGo!pnXgkQ_r4?$^X0CMPoP0(16I03*du_KC+P2`6{4>=^s8cCk2qD9S`j@Tx z^*@N7k-@R47x?-`Y*SeXj`LG(-(#8W`|DQiYdvpX4En{)z3=GU`<6BL{?5rg5VVu? ztn>XQd!FrHxn`bOe3!^XGy~M?zJ+fi&qo)Cv3H!PSD}ty**V|q8|Q)N$k&AYq^gfu zUV+PjQX#%`-$?K$Pl0wJb`abWJ>P`?LBn^9#l`Z=Oy$2w{z#!H_YG<96_$U^jpn4@ zVWNJTFKnLwcB6;UI=?uCq@>Hlhs8S#AEHs4b>SkXxU)F!nlk%vul;i(pH=fUC6JEq zxEw!1DGI>nJ_EY%$z0$6rPca=iSXAXXdF^A1siAmm6N+e*76^rJ?*bI@TH;fIT@kg zI8N=ClRi$Jl@lMQ&guhRp>NTq^TxsxG`fY}Z(yEm>vKjLG+A4xy5XEM`}1FX!I%lk z>-bQ=aFQllZn@cAHcWtKjK|Js!I2hP!{@6~?&jU7{~=h#2A zv&hI7_DxD9*-5+eJUfZ&xzqOtorE&p+Icy6(&&*cs2-Br^jrJu{*-l_6bI!{PT<@D z-#=~2?Y=w{PlL?P-QI#^+VXf zc>VfuSdA<5Qg3vvu%^}9_yYa(rn<)Cp#$4RB;w~6og8EZhe^EI*7!nBZp4r9R{%Q$ zO6^TMof82&*vEZ$9l=iX587{!WcC|K*m%F$dLAzgeVv>eIM|2=90I_^y7`Ar?)x$~ z*iY@RgJ9+d{bb2c5w)n&s1?ikz_lF=uh^A6{1+npAm3zpbOw6$W>-O$Lz?7+Svrgv zca$d8a_u$od_l!zeO95MRw;`G&$-Npb6`Dd9Cu4kbrOzp8{pzl*{lqqQo*fi=g;89 z-hDmGFik&5RY~1bhPG~DpL5@f>yu{dv%(SX%w#z+ zKWLo~r*?1)LWerC+>LK1;m^e6h_j6uchVnm<8dipQ!n>gt_!z+#WH>F#yAZib zn$+nIzB$g-^55y+O}+cJQbegvh)H>v^5*&Bcr|7jE2m)zH3YZ`=5PaFvGJ~X77(MFwk^qRQV+}<(9P|S7tPSi;+=OMek%k~jnDf-Cj&=0*KU_fL8g@E z$oZ`O^31%7ayWR-Yrh$Q3spi!eEc? zM|ZMA=`ot?OhRVc-SqoQa<2;fl0UEG`~PN+@1w28w=Mj`T25o=i3ccMoe@Jz(ikoR zmgDC%8k8CYII`Y3XBI%V*p0^?fmnoxW$?{M=L#+o9D5p$#NA~%XTdv~Ws=jl0C{7x+-zdr`FXIx-@ab(K# z}p5f|qoX+G?QlA)o@{pMi z-S=hA>)UpJUM~ha!(SV>=-PmoEJn}W>*T(pYvY}0SNnKQ+zf`ndr$`HxAx1)9=DFl zgB#xH_;*$>V{hpD$BULn`B8+A7ff8yOA7gWv4-&x_H#0xGknXz2jR)H5Tnv1NzEPT z8_G}kKi%O*mCm`{;4Nl8?@l?sfa?vcPgq}gzk%~|nu(N)TZc~)hvv*-`zN;YnQ#)m z`}4rr4W1J{tVH>Z+E{+PK!zyg=gIf${d{qJn)mU^&Nma}v-T^kC(8?c^|3tK8>hc_ zU=td?9=eu@Eo0intdy6-Khz8YOo;DpxOWl0D&>EXa_lU0jm91ozHj3EJfH>o!bB9c z1}TAun;^S_@i~mD-*Isd??<40QG7lvZsMV&60GTg!7cPuk4vFfE%ZtJxhP`d z9ot`_jW`RW*Q4*Xwwic{A*;1-ry&ZKnDBoWpJ?FeB2TH_AfuN42z|03t|uq{Pu#VY zxtVfhv;b<}5jj}1{U#be^%`czy8m?My8lqCb-$2vU>)K|F76usgi(X<1^0ZVeW7{~ zqkXS%avzJF3wuz>X6+fCfg41`-C@Iz&Bzz-i_(|=uAYy&)a3kX_MY(hNEiy_=ZEt+ z@to|}k*6Z#NO~!eU!p3hq>_c=lX@;oFH-W~B>$c6HvK*r)XNyXWTY9?+?gK5a4@zK z`+cEyvX5!Kf0Q{7p@N&O$MBNvKdF=1-gO>ya^KTA{G_(;A2Qo_PpkH|UT2GQE=_Ho zi&(m%tpRnC*jjzm$^EUivxn^r=O^Q3z}BEp$XiHk8M19J&Wl5MKJrQ=Xu8ghBJvix1N{#qItJV{Uo0F++|gzJ^OwFS->RgW+2@66={oP!1n2hk7i2 zKaWh5W^45kT%!F=yq-9XVnZf>Ax$4gNEY1VJh9}?k<+vapOJ@rn}q)!e-Lp`=)3rQ zi_8|If0cEkEboOm6^FcST78w?JPzSmb z4gnq&K7ZPKA}CSlKH=xY^o}st^#6NqMH~|MurOgCt(%yD6L|XFr+ZnD+A#w?;%A2r z)Ou-_m(Y7Mj>hQ0*r-2^2&s-oWWI!xOY^BONYRNK5z`RrZR68@0M;G#Y@#axx(*3H z*RcPS2VTwpVfpZLO-@Nd4l+(-5Ck&;S8lvgoj28BK3Q1d^OA35nsc9b&3cQJAJ(6q zc8jrCZKfgSu_o? z!oR_{eAACSpCtBIp;zVfB(VnhqE!8P$rmqk0(sl# zM~I(EpBWP?Fke7)jp@>Ot{TelhS5Izb5TH zxGi#up#6wQKRyK))INoWc)I3-w0K+tlc(IG4?1FP+kZJm!#6k|OsK`lv>x ze{39BpzNZ-`=fmsF4EXTI(UZ8OdEp~+B7l|W=8AL;kV|m-L587wtKt-59ae->#=Oe zQ*uEKutiYj_~uH)cR!i<4|SJ_fsxjZWaBD|KpHuN4!E)f4vUgGsa@3Rw)B$rxrZ1qi(|S8kd?=3h9K#t|{k>2Q34%EDVd)U9>{AL&@pWx0nW(+5TQ|5K?d{%*& zOSmt!CN;#sCHfJ5N?3k0j#j<_f9j)}^CaXC=A)06`w}W_FZjD>FoqF?ASc6CQ7Wok{o@ zgu|o*$Eg2VdIdeUY=QC{>By$}=_-|##D{peX}-Y*gzo5O zyr27`m2WcwM$OW*I&nJbws2WSdlw<>Mhm@jvoL-@9@Z-(pV)N;`vUSBzL@xb5Pb}h z*|}i1O*8C~iy-yLgimMs6y*GnDHP6E;@9@q0grjoX4p|iy&pKvKu6_`HVUOm9!s^} zKpZXkp#)85_0u9?y4NTnQc*;27+Y)y?e$}A8tKhHwsP_#FntA~FKaw+?1zVef6^ClL;AY5idh^b zqcm_D=-SkkcMnC3oI}hAn>gSp&(S?QZK+NJCxyBQFpi2nNBe$!x(~?i(cXMgH*3o6k5S2y{WZ9Ur#u@YTol zoh<*l-tNA}$t`grS9(zrd8=i8vWHKFgyBXL^KwIJW;^KRLWxwUh^DObpFwbaTZc~C ztbvkMekJQGEN|?{V~-x09&bRjG(F8DqRoeq`xS|kDkn%w&n-moicG->zM;1J7! zJGx^OAtup+R^!gOFpJp|k_2YlWj%-QYqo*g{b$BOHwHFQ)_YivxgXt#mzyu6M!Ya#Pnv`l^U&E+IDLheY#6_%4+(Okc{hIg`u>sEeQOiLCl!Mm5t9iAqu^ zN2y5YFLHv(@F2^h4kgGjm8_gC=h8Gezt76?&&6D)S?4w3D-5ed4SC5Q$SOCM-}T?3 z`)Fi7%duRJwkQyviw)@hNLK&Q_%GV@q#Dh_x~ZhyG--{Z=j7&8f9k_ppYt;7Ghx@K z!}(=Tr+Ft=H5DO!AM)RKjLy0-|1#+U7RXgkw&?p0XnS^MwI_4_ab{|uI(NW$Ymwy? zT!nn1X*jyvDdzpo$Fv?7c36*gBqW28Rnix%5;{K!wWDs<`efSaXZA}d;Y`=oYFCjm zI>DoB`!96TUMDqPkN;WgHhp5qdK4}$6xSGpJm6)>ewc!HeJr*L?@Q=SiJs-Wi+8DF zPO;#x_y@FKzn3-6E({i<&26=w(+IG|>fW2Qd%t4ggu9*GUn)*ulXyUYB;PuKw@ zI-YunG_t0u7&nPeBjNMn`_-d+0}`UfF$t6e7Uoy4GydR4w2&dpgK5^Gy^&uIoc9`O zVo+eJ-_A((mz7_;lvBP)f!doKFisR z`TU~$c^|}lt^&Ca(op~%&;)~$7 zCebZ675&dn?kE0K`Kh-1Wf4C>*MNo778F0=B($^r{Qw@GYwCPJcUEg3V21p_P`}M@ zkn2&8+|hl2795|{e$TXvaN+fFcj-VIQ#KTT)GYjQiIe+?KPgbRh3^BCVi^Aic*e3b zFnb~TXA}xp^_@?6flMF@m>Vu>Sm^^nnPRNPF1_vUrq zI0E0Lzg+6~)$8+l*tw2xpQ@Cnop<0~*7+y>+{v)6X3j3?yzRaue(^R6^K7>3WNf?) zU7axYkNU-|uq3hUg&qAL|dw*JccBeeQJw0fTk&lKJ3~4es zSx5fRMnqw644#M8lv!J<*c8cxJeC}$F*;k1tVYa9mJ>Fd3yoJqKRj|h7!XTd5M1ZL z^SQnFFMb&WuP8(SlPclj@?!)V-v#$wt zIq!pB`dH?CZ|wejH!5L_=~i&zeq5*tgo$jN9?B#*0pqVw4YY6mr}-o ze2Z$m>XQ*N?*lr^KYz%1g1JJz-G+|pHNdcZ{iD@7lt=^b&e3WL-{hPIHvTfUMbzph z)*Iv7rhmQm&)MfdE>7|9b~znTSu5X_yjEDKf4x&t>GtP$(DHonP01h5gJya~K~L7) zE%Vh1c&qb)&0Od;o89P$e~nh>lQSuyDHqQSD-rps_4%PGuKWH>{Pc}h_{kT@le5!~ z%35+{(nsqCr>l3FdxMkvyo2$KD73{F9bzBeWf0u=wOxOm*)AwSwL@nNS} ztDPZiOo*5sNReqOU=*X%_*e@Z9cioown&*aY5Rzi1FrWQ`kc1&7n$vRq*Xg#ntg16 zJ>fp2d)(hzWBinp`>8gac(VQdEx?W;ic-Avxc1}UW%lD;t@`mle7@MTF@D^ag-K5$$)?kNvwJC*^`m>Uc-dBIDj z2SXDQhUYc@mkSU>m}a)ngW)-}2^}UaBL5~qKU3Ox>P%&>Tr7b6t(42fad7iovFW1& z4dGA1OQ;`=6lLsQIYGF3kxO@8pD-f(vAfeQJWIZKyY;{$5?3ifuWq3G6kngfpFQSm zaxovmc_Gt2ri=O@B*`X~Bxpu@#)-T%qQII)aUv5HNtNeF{Ud84GXF{Er?)rm$ApMw zvw3c9X>@W1@mWgaC({~`&G-Gc`Uf~MFm;E@jmh2teW8I5vrYlXNnja;ktT9XXTOoDs;-5)A}if zSEY}zc_Sk}4;k?Ci1X&p8F1ZY&Sb=STcq=Tpg-{9#^KS1*@uJ3d7tyF{qt1zJnNvm zV4hicMkW=sd~JJcf5F&#T4oWVO`@+5;w!tt4(UkxYyt@?bR^~90UtVu)Dl4faJRJ< zF{EBHdXvr#=nU8JKNd`HehTftr~9%jI^R9F)p<6BFA(zxXk0G93})FfcgD$0Iwo=g z*r5p%Zs-;vhN#cCSO|R+9hZ-4doIXq&y3xkbiJ^(=uz@)M0sedliPsx{*K;W_=EUk zx8UT?z)#$VNrk;&V1vHXw1M@v>G`Pofjg`&n!yrf)j6*s)6l$4Th!Uymu~D`?o*Mw0}FNmHk@`kGkuZxNltI{x8S=cwn&EiNYkK|zKm-YrStQp(fFzV+383w1)`ms4=BuAd6 zkS*RpjuAxxElW*(eN4W2!IIqjgXr)^t{?2v{&96!22jSWGyGSd!@&ivZ9@EaB1&r? zAI}v_W0gFe%lf)?ot3i#z8~Y|bhbZeyCO9rz1M!baAF*X3RALq9mYeNfV$rH*+{iI zj9*H(J92Icy8IzsxA$eP+uPb&x2emhO}!uYk|pl=68Ei3+}}Aa%s|stX0x^bpsxKN zG>Fc_KauVy>(&vgUe2fHe8vliac32T!$HzJk+6c|&gGD;n zJWsh*r2JqYt?R)=F?7X5o!)>ORd@t7;tKT}480@gTrtI&+%DaEfvKx1Hl68@q!nzoF7gjE-_QQQrxz)~KNG%Cod3LOOP{GXAHYZS zpa(W>JbiQDVDH*>8`f=E*E_U%)6lxjTi(t4;?FP~&$Nm%o9Ov94bp`Bf5=QRzIA$T z;Rnz!_fX?WMnwAi3|8f7+KE2{+L)Fe@{cz5zXPvWTx1d@@JpAWL5J)jD9le#w zk#@b4J0WtUJ;TYpi$~gi>NUhB_iz z<@>e`Qxk9UqzY6k>GZ5PYuOusZ&;csHS_K)s-x|8BP@JIW$H4C3b0{01?ibw-&UfU&K;$H>8dwC>ODZhf4lX%v z_V_!_KWKX%$y&cITuj78gEpV!CF3_3KPQP!u{jTc-Qv%*eJ=|;tmb3h(hiIJbz&dG zwO1h}g8SjxawKrw>b<~u(@>frK7toc*bkZg;|utWPxsZC^WsnJdC?E_oJ8~s;al2@ z8`QuXKv_K6@3e>aDkpcD;g{u6$;3R5Ff@ZWz7ZQLHjMjs;<@Bze)O&^LIy=>#lIXi=d<7TGw`J zpd8}l4m70PONM6}csDsB6M!S&*;D#h<&}lunU~f2YTnkC>x+6>W?W^v?$pn$jW=Wb zwbVm(w9W+=+BzcPgXKc(q#5{`{d<{a&hGjtX8dz+SjB+B=B zOA}qkfKki;BS20yAf_EaO*8mK#r6iYnIK#g#U4YiAxIm#peo8{W|bQK|Mux>ILd|I zkSWO!sB2Nb_RERYC_HSStUqLXWAP&y$1$Ft$_R4K3XjM(P#Jyt!&ak3vbb}t2KE7$Ex ztxpf&L}hlYRKRf+=jna$oA{M9NDhg*yPVggUAUj_i$wZ{doIsYlRsYL?Rs>Lcl~2)yl?$rwYPP@BfZPNjr;$$+Pknc=Ut5S%g2uN zdVhb7x9spW-oRmNyx;uWQQlcdr~S)O-kbmRDDSa*R(pL9t@bYd?`ynYE_s#reLVBz z`{ulF5k9=!bN*qu_wFrS-uxL|-a4emzqj05jdbt5%e}3CzS_HH-&Nk1kj{GbD(|=- zuJXSBs=d74yO(=c4XyI7*|^HP<(Mw7_|`7($zdrOeM^`7P4HAu%CbDZ~1q{|OH&bzd6ocF8WEcXsLsmr_R_%83cYR)_7zJKyo zA^qz6|K#2D=s$UvZ&>dAGupTmZ9D||4n}%2(ki5TUf<pk{0*K7PX=bd%fvECrylHcXL*Zl;2i~2nKIQsCK!@Wn) zpHKdx+xrmGKMwBY9rDo?-g6hP@ct2S8Paz@u)^#6>8riZ1NMGwh4)Jj_dm44J91mj z>wS05duZiS?~x;ydP|O2>h-=K5NR1w-ybgZK7Ytk@3GhH>mBo^eZA>F*w_2jr7OHA zPkOcYn|=57zI4e7?+&Dck@mZCh4%o;z76Tk2k+~h19NZ&%b2Ps-c?}yCqO96X7jCUaY3MrcB-5=TI-GcNS z(vcU$?=jy)xVGPgyS&qo`1^8&{2u-M3fIs2lU?3JNYU%3{VB>v@~`c8QTW}z)-Ie! z8FwK42I;tqcX{(j_aN>4(Oup;qzjSmK}suk?~fr5(uGL(Ankn#ej{CoWaqyJ*Y>^? z_mS*-7vkDINPGV$+()wSxB7h{p1DV#d*I_3pUY6r<>)J<`A_WfuKF{y4{7v@usR(ATe+6^_X`^SHA0M?^>jrk?uqK5z>=L|AMsNsZV>aMS2rb9;qK`5NQ;tj5LRI zG13)CUqt!_(tktxA<|Efeu4C_NXs@n?Y$1^Fr>F5or?5cqzcl9kUoL*Wu&ho-Gy{N z(xXT}Mfw$zGx)T30McPdF4EhPwjhlmor82C(ltnTApHPo7gE>8r@e!b-hy;AQXkSr zr1v1rAT^NQkMvQbFCu*v={}_Yf%N|&?X&4=?;xbNAiV==6Vh2oWuykug-D-3`XbVo zk-mxaU8MVv9!Gi(X`i8|y%k7rKzbX}TBOZLQ%L6{U4e89()W>mhV-vUU8kYHkoH45 z80j#iHAsJibSlyrNCl*Gkj_W?DAH$?e!q7LgIXw7<<~Io!_N^A}8ZT{Tx+z zT4*ssp25}u@*MUaz(WAf0pwZtPXT!bBs@`JpF+xhd3{{ra|(Y2_!(UP4d5++zrzP# zoqTPqcbk6rn`gzPU+MGsoq3ixCwfy#6Hb9<~Ur@ji;&qbbF zzIeFz5x@(ZZL%efYL9{IxI-d6x`YM%c=(!I?8-AMi)MDp(fUCX*$vEym) z`ZcD`{}tbFJIZ|jpONoxnhUT0ape1D`2L*czc2EApPf&8pFGBtb4uj*f- z@V%(t|99m3>iMU=&+GLq_}=$6lfM!9&UQsV>|?eiJQqtCHA+%zqca8Y*rU0de?Kz6 zy7|oo++iIg+u7LTo+X#TajrTZ`x(-&>btx{K$lmA!6LWz{M*w5dwO6`5A5lIJw33e z2ln*9o*vlK1ABU4PY>+rfjvF2rw8`*z<)>&T=%tos2j1@4GM2pco!fz8hhQX@LoXh zUG}KEGD@tio#*Uajy-g;yxNOyMO8FH(4c zLQmmNg=K|jE8M1Vi^BB^*D5?w;qeNORd}?*)e4VLxKd${!e_o=+VzyepDTPq;r$Bl zRd~0;n-$)u@CJp~DZEzU)e5gv=qWr;;ZB8hg;j-Rg;NR(3eQ$}rosaiE?2lz;jeEq z?Rs9}vkD(o_@Ki372d1xR)se!yiwr|3a?ang~H1eUZU^{8hg=K|P3JVHXD?CEs zp$b`{1-!UGlVuW-4-r3&{_=qSAQR?`nxD7;MJ1q$!SdgHpiTj31~J%#5foKkqU z!Xbql{OkYKtlu*gZd15L;gG@&3fC)KtMEjH$16Nm;n50LD?CEsp$b`{1-!UGlV zuW*IJzruSJ-mUO1 zg?B2vUE!??Z&rAt!W$G`r|?>ZS1Y_y;S~xmQ+SEOixgg<&{KGx!kr513abjs3a1nn z6rQc{OoiJNZc#X-aD&423fC$;QQ`3lk5zcI!qp0oPVmv zr3&{_=qP*v_@4XFuN6M8@L7e=D11uc&lNtQ@NtEYDtuVsg9`6gc(1~{72c)rPKCEC zyj9`N3U5?+gTm_+UaRnGg;y%PLg8f!FHv}r!V4673eQuxQ(;|URbg4z$&|u^5AQVn zcDBMZ6>d|wMd6Ub4GPyQT&wUzg~uyAR^ibKS1UY1;h_pwD(q2skir8M?yqo#!sQB= zD%?wzruSJ-mUO1g?B2vUE!?? zZ&rAt!W$G`r|?>ZS1Y_y;S~xmQ+SEOixgg<&{KGx!kr513abjs3a1nn6rQc{OoiJN zZc#X-aD&423fC$;QQ`3lk5zcI!qp0oPVmvr3&{_=qP+a z=k>1@KCkduh0iE_O5x8HKB4e&g^wzHSmA>T?^k%Q!n+mTrSMLLw=29=;mrzfRCt5J z>l9wA@M?uuD!fABWeP7*c#*;j6nYBJQ@B%M-M_BuW2eHp!m7fu!YPH9D7--7(r=k{ zVO8N2 zAkR130GaPby?%qjYZYFp_b*cTxL$u$;e!fq*ZWWD@2kIU=&maPx!+u-zc10>7wB(K zfA7@ab^Tq|-&6YgZ2f(v{@$X$hxGS){k>LyAFscU)!(c2_YwMgrT*^G-v{dN{q^^9 z{k>FwJNo+tZQt{Nq${7*-&?+8eh(?!rtnOK&duijUJ7s3bL3L}yXFQ3QyGQYZX4M*VpUs4GN#v>qGi` zi^6RR&s6wx&3Cr`E-0K*c(vXy>+h<Q7c!k0% z6<)3IT7}msyg}iO3U5|;tHRqA-l_1{TCW!r-lf;?R(P+%`xQQ@@L`3IDtug@e_Ve* zq44JlpHldY!e+rfjvF2rw8`*z@8r1(*v13 G@P7bDb1^jl literal 0 HcmV?d00001 diff --git a/tests/iPhone5__1_9.3_13E237/logs/.dummy b/tests/iPhone5__1_9.3_13E237/logs/.dummy new file mode 100644 index 0000000..e69de29 diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb new file mode 100644 index 0000000..f69fc1d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb @@ -0,0 +1,386 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/private/etc/master.passwd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/OpenGL") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/OpenGL") + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^stack-logs") + (ipc-posix-name-regex #"^OA-") + (ipc-posix-name-regex #"^/FSM-")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb new file mode 100644 index 0000000..5637d93 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb @@ -0,0 +1,1508 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/Photos") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Debug") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read"))) +(allow file-link + (require-all + (require-not (subpath-prefix "${HOME}/Library/AddressBook")) + (require-any + (require-not (subpath-prefix "${HOME}/Media")) + (require-entitlement "platform-application")))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdSheetPad.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileSMS.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${HOME}/Library/SpringBoard") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdSheetPhone.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.adtracking.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") + (literal-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.reminders.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/.+$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPhone/(?|.+)$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetP(ad|hone)/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]AdSheet(Pad|Phone).plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath-prefix "${HOME}/Media/Debug") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath "/Library/Ringtones") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Media/Safari") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Media/Purchases") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPad[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPad-.+[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPhone-.*[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]AdSheetP(ad|hone)-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad[.]savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]AdSheetP(ad|hone)[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]AdSheetP(ad|hone)[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]AdSheetP(ad|hone)[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-read-metadata + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage") + (literal "/private/var/run/syslog") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library") + (literal "/private/var/run/printd") + (literal-prefix "${HOME}/Library/Caches/Snapshots") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Saved Application State") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad[.]savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]AdSheetP(ad|hone)[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad[.]savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]AdSheetP(ad|hone)[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage"))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdSheetPad.plist") + (literal-prefix "${HOME}/Library/SpringBoard") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdSheetPhone.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.reminders.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/kCFPreferencesAnyApplication.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]AdSheet(Pad|Phone).plist") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath-prefix "${HOME}/Media/Safari") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad[.]savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]AdSheetP(ad|hone)[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/.+$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPhone/(?|.+)$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetP(ad|hone)/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]AdSheetP(ad|hone)[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]AdSheetP(ad|hone)[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad[.]savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]AdSheetP(ad|hone)[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")))))))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]") + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.chatkit.clientcomposeserver.xpc") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobilemail") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "ScripterServer") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "PurplePPTServer") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.lsd.openurl") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.lsd") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.calaccessd") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.GSSCred") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.passd.assertions") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.fig.movie") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name-regex #"^com[.]apple[.]iad[.]") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.xpcd") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.webinspector") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nehelper") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.TextInput") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.mobile.deleted") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.aggregated") + (global-name "com.apple.TextInput.rdt") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.mobilemail.messageuiservices") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.bird.token") + (global-name "com.apple.twitterd.server") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.eventpump") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.geod") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.ait.client") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.cvmsServ") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.cache_delete") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.dataaccess.dataaccessd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.revisiond") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.companion.camera") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.passd.in-app-payment") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.webfilterd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.dataaccess.dataaccessd.active") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.passd.library") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.coremedia.cameraviewfinder") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (global-name "com.apple.imagent.Embedded.Launched") + (global-name "com.apple.bird") + (global-name "com.apple.sharingd") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (literal "/private/var/run/printd") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CoreMotion") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.reminders") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.AdSheetPad") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.AdSheetPhone") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.reminders") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AdSheetPad") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.AdSheetPhone") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 31)) + (fsctl-command (_IO "h" 32))) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb new file mode 100644 index 0000000..cab1d10 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb @@ -0,0 +1,135 @@ +(version 1) +(allow default) +(deny file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")))) +(deny file-mount) +(deny file-mount-update) +(deny file-read* + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (require-not (subpath "/Developer")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-only")) + (require-not (extension "com.apple.sandbox.executable")) + (require-not (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist")) + (require-not (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$")) + (require-not (subpath "/System/Library")) + (require-not (subpath "/usr/lib")) + (require-not (subpath "/usr/share")) + (require-not (subpath "/private/var/db/timezone")) + (require-any + (literal "/private/etc/master.passwd") + (literal "/private/var") + (literal "/private/var/root") + (require-all + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist")) + (require-not (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$")) + (require-not (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+")) + (require-not (subpath "/private/var/tmp")) + (require-not (literal "/private/var/preferences/com.apple.security.plist")) + (require-not (literal "/private/var/preferences/com.apple.NetworkStatistics.plist")) + (require-not (literal "/private/var/preferences/com.apple.networkd.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist")) + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist")) + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/dtracehelper")) + (require-not (literal "/dev/null")) + (require-not (literal "/dev/zero")) + (require-any + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")) + (require-entitlement "com.apple.security.system-group-containers") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]"))))))))) +(deny file-unmount) +(deny file-write* + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-any + (literal "/private/etc/master.passwd") + (literal "/private/var") + (literal "/private/var/root") + (require-all + (require-not (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+")) + (require-not (subpath "/private/var/tmp")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal")) + (require-any + (require-not (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal")) + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-not (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")))))))) +(deny file-write-create + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) +(deny file-write-data + (require-all + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb")) + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any + (literal "/dev/random") + (literal "/dev/urandom")))) +(deny job-creation) +(deny network-outbound + (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb.xml new file mode 100644 index 0000000..04fe0db --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb.xml @@ -0,0 +1,24 @@ + + + + + + + + + +]> + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb new file mode 100644 index 0000000..2af0a63 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb @@ -0,0 +1,654 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/uart.log") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Library/AddressBook"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.BTServer.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (subpath "/private/var/wireless/Library/Logs/awd") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.debug.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.services.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.devices.plist") + (subpath-prefix "${HOME}/Library/Logs/Bluetooth") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.ledevices.plist") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/Developer") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") + (literal "/private/var/wireless/Library/CallHistory") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath-prefix "${HOME}/Library/MobileBluetooth") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.BTServer.airplane.plist") + (literal "/dev/uart.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Library/Application Support/BTServer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.TelephonyUtilities.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/dev/aes_0") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-data + (literal "/dev/btwake") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/System") + (literal "/usr/sbin/BTServer") + (literal "/usr/sbin") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist")) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/wireless") + (literal "/usr/sbin/BTServer") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/usr/sbin") + (literal "/private/var") + (literal "/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/wireless/Library") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") + (subpath-prefix "${HOME}/Library/MobileBluetooth") + (literal "/Library/Application Support/BTServer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.devices.plist") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") + (subpath-prefix "${HOME}/Library/Logs/Bluetooth") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.BTServer.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/hci") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/wireless/Library/CallHistory") + (subpath "/private/var/wireless/Library/Logs/awd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.services.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.debug.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.ledevices.plist") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") + (literal "/Library/Application Support/BTServer/pincode_defaults.db") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.BTServer.airplane.plist") + (require-all + (vnode-type DIRECTORY) + (literal "/Library/Application Support/BTServer")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/wireless/Library/CallHistory"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/uart.log") + (literal "/Library/Application Support/BTServer/pincode_defaults.db") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleBasebandUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOUserEthernetResourceUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^stack-logs") + (ipc-posix-name-regex #"^OA-") + (ipc-posix-name "shm_notif.tacl.R") + (ipc-posix-name "shm_pcm_audio_sco_write") + (ipc-posix-name-regex #"^..:..:..:..:..:..-tacl$") + (ipc-posix-name "shm_notif.tacl.W") + (ipc-posix-name "shm_notif.tsco.R") + (ipc-posix-name "shm_pcm_audio_sco_read") + (ipc-posix-name "shm_notif.tsco.W") + (ipc-posix-name-regex #"^/FSM-") + (ipc-posix-name "com.apple.BTServer.magnet.shm")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.BlueTool") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.marco") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.springboard.services") + (global-name "com.apple.BTServer.avrcp") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.BTServer.map") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.BTAudioHALPlugin.xpc") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.networkd") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.carkit.service") + (global-name "com.apple.system.logger") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.geod") + (global-name "com.apple.awdd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.lsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.BTServer.pbap") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.MobileBluetooth.debug") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.MobileBluetooth.ledevices") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.BTServer.airplane") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.BTServer") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.MobileBluetooth.devices") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.MobileBluetooth.services") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.BTServer.airplane") + (preference-domain "com.apple.MobileBluetooth.devices") + (preference-domain "com.apple.MobileBluetooth.ledevices") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.BTServer") + (preference-domain "com.apple.MobileBluetooth.debug") + (preference-domain "com.apple.MobileBluetooth.services")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb.xml new file mode 100644 index 0000000..ab808c0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb new file mode 100644 index 0000000..bdae965 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb @@ -0,0 +1,399 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (literal "/dev/ptmx") + (literal "/usr/sbin") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/etc/bluetool") + (subpath "/AppleInternal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-data + (literal "/dev/btreset") + (literal "/dev/btwake")) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleBasebandUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb new file mode 100644 index 0000000..c93080c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb @@ -0,0 +1,173 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb new file mode 100644 index 0000000..9b1f6ff --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb @@ -0,0 +1,235 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/usr/bin/codesign_allocate") + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name-regex #"^com[.]apple[.]cvmsCompAgent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (subpath "/System/Library/Frameworks/OpenGLES.framework") + (subpath "/usr/bin/codesign_allocate")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb new file mode 100644 index 0000000..5131a44 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb @@ -0,0 +1,436 @@ +(version 1) +(deny default) +(allow file-ioctl + (subpath "/private/var/wireless") + (regex #"^/dev/dlci[.]spi-baseband[.]") + (regex #"^/dev/bbcdc[.]") + (literal "/dev/uart.debug.log") + (literal "/dev/uart.umts") + (literal "/dev/cu.debug") + (literal "/dev/ptmx") + (literal "/dev/uart.debug") + (literal "/dev/mux.log") + (literal "/dev/mux.spi-baseband") + (literal "/dev/uart.log") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/wireless/Library/Caches/com.apple.coretelephony") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath "/private/var/wireless/Library/Caches/CommCenterClassic") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileSMS.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/logs/WirelessLibraryLogs") + (subpath-prefix "${FRONT_USER_HOME}/Library/LASD") + (regex #"^/dev/bbcdc[.]") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/mux.spi-baseband") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/dev/dlci[.]spi-baseband[.]") + (literal "/dev/uart.debug") + (literal-prefix "${FRONT_USER_HOME}/Library/SyncedPreferences/com.apple.coretelephony.plist") + (literal "/dev/ptmx") + (literal "/dev/cu.debug") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.apsalerts.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.operator.plist") + (literal "/dev/uart.debug.log") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.tethering_override.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videoconference_override.plist") + (regex #"^/private/var/tmp/CSI[.]scratch") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/preferences/AeneasCustomFlags.plist") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/dev/uart.umts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cellulardataplan.plist") + (literal "/dev/mux.log") + (literal "/dev/uart.log") + (literal "/dev/dtracehelper") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal "/dev") + (literal "/dev/random") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iqagent.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]coretelephony" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]coretelephony" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]coretelephony") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-not (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist-lock") + (literal "/private/var/CommCenter/spool/loading") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/uart.log") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/logs/WirelessLibraryLogs") + (literal "/dev/mux.log") + (regex #"^/dev/bbcdc[.]") + (regex #"^/private/var/logs/CoreTelephonyTrace$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-.+$") + (literal "/dev/cu.debug") + (regex #"^/private/var/tmp/CSI[.]scratch") + (literal "/private/var/logs/CoreTelephonyTraceScratch") + (regex #"^/private/var/preferences/csidata$" #"^/private/var/preferences/csidata[.]tmp$") + (literal "/private/var/logs/log-bb-live-stats.txt") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/preferences/AeneasCustomFlags.plist") + (literal "/dev/mux.spi-baseband") + (literal "/dev/uart.umts") + (literal "/dev/uart.debug.log") + (regex #"^/dev/dlci[.]spi-baseband[.]") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/wireless") + (literal "/dev/uart.debug") + (regex #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist$" #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist-lock$" #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist-new$") + (subpath "/private/var/tmp") + (regex #"^/private/var/logs/CrashReporter/Baseband/log-bb-$" #"^/private/var/logs/CrashReporter/Baseband/log-bb-.+$") + (subpath-prefix "${FRONT_USER_HOME}/Library/LASD") + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]coretelephony" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]coretelephony" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]coretelephony") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist")) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name "com.apple.CommCenter.lasd") + (global-name-regex #"^com[.]apple[.]CoreTelephony[.]LogChannel[.]$" #"^com[.]apple[.]CoreTelephony[.]LogChannel[.][-0-9A-F]+$") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*") + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.apsalerts") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.operator") + (preference-domain "com.apple.tethering_override") + (preference-domain "com.apple.carrier") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.videoconference_override") + (preference-domain "com.apple.commcenter") + (preference-domain "com.apple.cellulardataplan") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2)) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb.xml new file mode 100644 index 0000000..f81f602 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb new file mode 100644 index 0000000..377d218 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb @@ -0,0 +1,860 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/Photos") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media/Debug") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/WebClips") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Media")) + (require-entitlement "platform-application")) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtube.dp.plist") + (subpath-prefix "${HOME}/Media/Debug") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal-prefix "${HOME}/Library/Preferences/.dat") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Library/Dictionaries") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath "/AppleInternal/Library/Safari") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataActivation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath-prefix "${HOME}/Library/Dictionaries") + (subpath-prefix "${HOME}/Library/Caches/Safari") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]DataActivation.plist") + (subpath "/Applications/DataActivation.app") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilesafari.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Media/Memories") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/Library/Ringtones") + (subpath-prefix "${HOME}/Library/Safari") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/Applications/MobileSafari.app") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath "/usr/share") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath-prefix "${HOME}/Library/WebKit") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath-prefix "${HOME}/Media/Safari") + (extension "com.apple.app-sandbox.read") + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]DataActivation[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]DataActivation[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]DataActivation-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]DataActivation-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilemail.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.OTASyncAgent.plist")) + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/WebKit") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Safari") + (literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilesafari.plist") + (literal-prefix "${HOME}/Library/Preferences/.dat") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtube.dp.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (subpath-prefix "${HOME}/Library/Caches/Safari") + (subpath "/private/var/tmp/MediaCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataActivation.plist") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/Safari") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]DataActivation.plist") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Mail/AutoFetchEnabled")) + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]DataActivation[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/asl_input") + (remote tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (literal "/private/var/run/printd") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.DataActivation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mobilesafari") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.youtube.dp") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.youtubeframework") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mobilecal") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DataActivation") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.youtube.dp") + (preference-domain "com.apple.mobilesafari") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-exec* + (literal "/Applications/MobileSafari.app/MobileSafari") + (literal "/Applications/DataActivation.app/DataActivation")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb.xml new file mode 100644 index 0000000..31b4e67 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb new file mode 100644 index 0000000..2e35458 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb @@ -0,0 +1,238 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb new file mode 100644 index 0000000..973cfd1 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb @@ -0,0 +1,305 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.IDSCredentialsAgent.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.IDSCredentialsAgent.plist") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.logger") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.ids.IDSCredentialsAgent") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.ids.IDSCredentialsAgent")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..237fc87 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb @@ -0,0 +1,495 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.idsfoundation.IDSRemoteURLConnectionAgent.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.idsfoundation.IDSRemoteURLConnectionAgent.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.apsd") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.logger") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.facetime.bag") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.imessage.bag") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (preference-domain "com.apple.imessage.bag")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb new file mode 100644 index 0000000..f018d1e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb @@ -0,0 +1,305 @@ +(version 1) +(deny default) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${HOME}/Library/PPTDevice") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imdsmsrecordstore.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/SMSMigrator") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/SMSMigrator") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imdsmsrecordstore.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath-prefix "${HOME}/Library/SMS") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.open") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.search.appindexer") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.searchd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.message") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..8f38c47 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb @@ -0,0 +1,493 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imfoundation.IMRemoteURLConnectionAgent.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/IMRemoteURLConnectionAgent") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imfoundation.IMRemoteURLConnectionAgent.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/IMRemoteURLConnectionAgent") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.apsd") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.logger") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.awdd") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb new file mode 100644 index 0000000..b1c4ca7 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb @@ -0,0 +1,617 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath "/private/var/tmp") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileSMS.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imtranscoding.IMTranscoderAgent.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mms_override.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Media") + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imtranscoding.IMTranscoderAgent.plist") + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.system.logger") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.pegasus") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ctkd.token-client") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.marco") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb new file mode 100644 index 0000000..d4b30c5 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb @@ -0,0 +1,1260 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Debug") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Photos") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/AppleTV")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/AppleTV") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/Applications") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.apsd.launchd") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.storebookkeeper.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath-prefix "${HOME}/Library/MediaStream") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.celestial.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${HOME}/Library/Logs") + (subpath-prefix "${HOME}/Library/Application Support/Front Row") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Updates") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CrashReporter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-shm") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appletvservices.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (subpath-prefix "${HOME}/Media/Radio") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath-prefix "${HOME}/Media/Debug") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-journal") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences-sounds.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.soundpref.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Radio") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iqagent.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.airplay.plist") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Documents/var/nrd") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/Ubiquity") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.datetime.plist") + (subpath "/private/var/logs/CrashReporter") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.frontrow.") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Media/Memories") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.LaunchServices.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-AppleTV.log") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (subpath "/AppleInternal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (subpath-prefix "${HOME}/Library/Caches/AppleTV") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-wal") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/iTunes_Control") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]lowtide.plist") + (subpath "/private/var/MobileSoftwareUpdate") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ConfigServer.plist") + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]lowtide[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]lowtide-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]lowtide-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/.+$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]lowtide") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]lowtide[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Radio") + (subpath-prefix "${HOME}/Media/Radio") + (literal "/private/var/db/timezone/localtime") + (literal-prefix "${HOME}/Library/Preferences/com.apple.apsd.launchd") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (subpath-prefix "${HOME}/Library/MediaStream") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/tmp/MediaControlServer.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.datetime.plist") + (literal-prefix "${HOME}/Library/Logs") + (subpath "/private/var/tmp/AirTunes") + (subpath-prefix "${HOME}/Library/Application Support/Front Row") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.storebookkeeper.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.airplay.plist") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-shm") + (subpath-prefix "${HOME}/Library/Logs/Ubiquity") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appletvservices.plist") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences-sounds.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.soundpref.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iqagent.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${HOME}/Documents/var/nrd") + (literal-prefix "${HOME}/Library/Application Support") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.celestial.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal "/Library/Application Support/Front Row") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb") + (literal-prefix "${HOME}/Library/Preferences/com.apple.frontrow.") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iLifeSlideshow") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-wal") + (literal-prefix "${HOME}/Library/Logs/awd/awd-AppleTV.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/kCFPreferencesAnyApplication.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (subpath-prefix "${HOME}/Library/Caches/AppleTV") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CrashReporter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/MobileSoftwareUpdate") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]lowtide.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/.+$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]lowtide") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]lowtide[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies")))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (literal-prefix "${HOME}/Documents") + (literal-prefix "${HOME}/Documents/var") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-flags + (literal-prefix "${HOME}/Media")) +(allow file-write-mode + (literal-prefix "${HOME}/Media") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Updates") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAVAudioInterfaceUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IODPDisplayInterfaceUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAVControllerUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IODPDeviceUserClient") + (iokit-user-client-class "IOAVServiceUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IODPAudioInterfaceUserClient") + (iokit-user-client-class "ASPUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAVDeviceUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IODPServiceUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAVVideoInterfaceUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IODPControllerUserClient") + (iokit-user-client-class "AppleNANDFTLUserClient")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.absinthed") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.formatreaderloader") + (global-name "com.apple.atvitunescloudd.xpc") + (global-name "ScripterServer") + (global-name "com.apple.absd") + (global-name "com.apple.backboard.checkin") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.trustd") + (global-name "com.apple.coremedia.wirelessdisplay") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "PurplePPTServer") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.mobile.obliteration") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.coremedia.formatreader") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.uikit.GestureServer") + (local-name "com.apple.coremedia.customurlhandler") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.frontrow.tracerouteix") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videoqueue") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.CrashCopy.OTA") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.backboard.workspaceserverconnection") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.TextInput") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.apsd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.networkd") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.fairplayd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.adid") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.bird.token") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.backboard.system-app-server") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.tzlink") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.cpe") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.backboard.applicationdatastore.service") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.securityd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.webinspector") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.aggregated.addaily") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.mobile.softwareupdated") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.marco") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.corercd") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.sharingd") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.SBUserNotification") + (local-name "com.apple.accessibility.gax.client") + (global-name "com.apple.airplay.xpc") + (global-name "com.apple.frontboard.watchdogserver") + (global-name "PurpleSystemAppPort") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name-regex #"^com[.]apple[.]appletv$" #"^com[.]apple[.]appletv[.]" #"^com[.]apple[.]lowtide$" #"^com[.]apple[.]lowtide[.]") + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow mach-task-name) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/tmp/hidmonitordsocket") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog") + (remote udp "*:*") + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.soundpref") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.appletvservices") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.voiceservices") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.storebookkeeper") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.soundpref") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.appletvservices") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.storebookkeeper") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.itunesstored") + (preference-domain "kCFPreferencesAnyApplication")) +(allow process-exec* + (subpath "/Applications/AppleTV.app")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl) +(allow system-info + (info-type "hw.uuid")) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb.xml new file mode 100644 index 0000000..c27b781 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb new file mode 100644 index 0000000..671670c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb @@ -0,0 +1,186 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (literal "/private/etc/master.passwd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb new file mode 100644 index 0000000..3ca0de6 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb @@ -0,0 +1,1171 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/WebKit") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]MailCompositionService.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/AppleInternal/Library/Frameworks") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (subpath-prefix "${HOME}/Media/Safari") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mail.composition.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/Library/Ringtones") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilemail.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (extension "com.apple.app-sandbox.read") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]MailCompositionService[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MailCompositionService[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MailCompositionService-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]MailCompositionService-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/FairPlay") + (literal "/usr/sbin/fairplayd") + (subpath-prefix "${HOME}/Media") + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mail.composition.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]MailCompositionService.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath-prefix "${HOME}/Media/Safari") + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]MailCompositionService[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") + (literal-prefix "${HOME}/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.suggestd.suggestionmanager") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]dataaccess[.]dataaccessd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.imagent.embedded.auth") + (global-name "ScripterServer") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.xpcd") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.webfilterd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.itunescloudd.xpc") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.webinspector") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.TextInput") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.aggregated") + (global-name "com.apple.TextInput.rdt") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.springboard") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.TextInput.shortcuts") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.bird.token") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.coreduetd") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.securityd") + (global-name "com.apple.voiceservices.keepalive") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.GSSCred") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.bulletinboard.utilitiesconnection") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.sharingd") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/printd") + (remote tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CoreMotion") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.message") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.corevideo") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb.xml new file mode 100644 index 0000000..c3c699a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb new file mode 100644 index 0000000..5d50517 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb @@ -0,0 +1,9 @@ +(version 1) +(allow default) +(deny file-read* + (subpath "/private/var/run/mobile_image_mounter")) +(deny file-write-unlink + (literal "/private") + (literal "/private/var") + (literal "/private/var/run")) +(deny job-creation) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb.xml new file mode 100644 index 0000000..c2485d3 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb.xml @@ -0,0 +1,21 @@ + + + + + + + + + +]> + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb new file mode 100644 index 0000000..41ba880 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb @@ -0,0 +1,875 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/AppleInternal/Library/Frameworks") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.calendardiagnostics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.timezones.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Logs/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (subpath-prefix "${HOME}/Library/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.eventkit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (subpath-prefix "${HOME}/Library/Logs/Handoff") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (subpath "/private/var/tmp") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]mobilecal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/Library/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]mobilecal[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobilecal[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobilecal-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]mobilecal-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/FairPlay") + (literal "/usr/sbin/fairplayd") + (subpath-prefix "${HOME}/Media") + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}"))))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.timezones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.plist") + (subpath-prefix "${HOME}/Library/Logs/Handoff") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.calendardiagnostics.plist") + (subpath-prefix "${HOME}/Library/Logs/Calendar") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath "/private/var/tmp") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]mobilecal.plist") + (extension "com.apple.app-sandbox.read-write") + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]mobilecal[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.mobilecal.timezones") + (preference-domain "com.apple.calendardiagnostics") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.eventkit") + (preference-domain "com.apple.message") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.SpeakSelection") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.mobilecal") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.calendardiagnostics") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mobilecal.timezones") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb.xml new file mode 100644 index 0000000..31b4e67 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb new file mode 100644 index 0000000..9551d3a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb @@ -0,0 +1,970 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath-prefix "${HOME}/Library/Maps") + (subpath-prefix "${HOME}/Library/Caches/Maps") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Maps.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.weather.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapsSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.internal.Voltaire.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mms_override.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath "/AppleInternal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.skyhookwireless.wps.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath "/Applications/Maps.app") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]Maps.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/Library/Ringtones") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]Maps[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]Maps-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]Maps-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]Maps[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/.+$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]Maps[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]Maps") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-data + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (subpath-prefix "${HOME}/Library/Maps") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.internal.Voltaire.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.skyhookwireless.wps.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Maps.plist") + (subpath-prefix "${HOME}/Library/Caches/Maps") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]Maps.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]Maps[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/.+$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]Maps[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]Maps") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]Maps[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.internal.Voltaire") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.weather") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mobileipod") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.voiceservices") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.da") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.Maps") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.skyhookwireless.wps") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Maps") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.internal.Voltaire") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.skyhookwireless.wps") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.itunesstored")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket + (socket-domain 39) + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb.xml new file mode 100644 index 0000000..31b4e67 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb new file mode 100644 index 0000000..b21aeb1 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb @@ -0,0 +1,1154 @@ +(version 1) +(deny default) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath "/private/var/tmp")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath "/private/var/tmp")) + (require-all + (subpath-prefix "${HOME}/Media/Debug") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/Photos") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos"))))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.legacycamera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.act.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.airplay.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (subpath "/usr/lib") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanocamera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ImageCaptureFramework.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cloud.quota.plist") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videouploadplugins.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileSMS.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (subpath-prefix "${HOME}/Library/Siri") + (literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilemail.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.notbackedup.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (literal-prefix "${HOME}/Library/SpringBoard") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaanalysis.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mms_override.plist") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.compass.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ConfigServer.plist") + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (subpath "/Library/Dictionaries") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath-prefix "${HOME}/Media/Debug") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath "/Library/Ringtones") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.](mobileslideshow|camera).plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Media/Safari") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (subpath-prefix "${HOME}/Media/Purchases") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$" #"^/private/var/euser[0-9]+/Containers/.*$")) + (require-not (subpath "/private/var/containers")) + (require-not (regex #"^/private/var/mobile/Library/" #"^/private/var/euser[0-9]+/Library/"))) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow[.]savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.](mobileslideshow|camera)[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.](mobileslideshow|camera)[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.](mobileslideshow|camera)[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobileslideshow[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobileslideshow-.+[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]camera-.*[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.](mobileslideshow|camera)-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")))))) + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-read-metadata) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") + (literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/SpringBoard") + (literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log") + (literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") + (subpath-prefix "${HOME}/Library/Siri") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") + (subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") + (subpath-prefix "${HOME}/Library/SMS") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") + (subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]") + (subpath-prefix "${HOME}")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobileipod.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanocamera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/kCFPreferencesAnyApplication.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videouploadplugins.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.legacycamera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.notbackedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cloud.quota.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.](mobileslideshow|camera).plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath-prefix "${HOME}/Media/Safari") + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow[.]savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.](mobileslideshow|camera)[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.](mobileslideshow|camera)[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.](mobileslideshow|camera)[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow[.]savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.](mobileslideshow|camera)[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Siri")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")))) +(allow file-write-data + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") + (literal-prefix "${HOME}/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (subpath "/private/var/mnt") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.da") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.InputModePreferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.videouploadplugins") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.youtubeframework") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.act") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.accountsd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.cloud.quota") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.youtubeframework.notbackedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.legacycamera") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.nanocamera") + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.legacycamera") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.videouploadplugins") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.nanocamera") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.youtubeframework.notbackedup") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.cloud.quota")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb.xml new file mode 100644 index 0000000..5885e3b --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb new file mode 100644 index 0000000..4054433 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb @@ -0,0 +1,178 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (require-not (literal "/dev/random")) + (subpath "/Developer") + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/ptmx")) + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/")) + (subpath "/System/Library") + (require-not (literal "/dev/aes_0")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard") + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-not (literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-not (literal "/dev/zero")) + (subpath "/usr/lib") + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist")) + (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/usr/share") + (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-not (literal "/dev/dtracehelper")) + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")) + (require-entitlement "com.apple.security.system-groups") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (require-not (extension "com.apple.sandbox.pty"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-entitlement "com.apple.security.system-groups") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (require-not (subpath-prefix "${FRONT_USER_HOME}"))) + (require-all + (vnode-type TTY) + (require-not (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (literal "/System/Library/Frameworks/UIKit.framework/Support/pasteboardd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb.xml new file mode 100644 index 0000000..4162129 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb.xml @@ -0,0 +1,51 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb new file mode 100644 index 0000000..877e74e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb @@ -0,0 +1,192 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (literal "/private/var/db/icu") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath "/System") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb new file mode 100644 index 0000000..b7c8ef3 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb @@ -0,0 +1,195 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb new file mode 100644 index 0000000..bfcb108 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb @@ -0,0 +1,201 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.StreamingUnzipService.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/private/etc/master.passwd") + (extension "com.apple.StreamingUnzipService") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.StreamingUnzipService") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.StreamingUnzipService.plist") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.StreamingUnzipService") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.StreamingUnzipService")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb new file mode 100644 index 0000000..b27ec1b --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb @@ -0,0 +1,1118 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobilemail.plist$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.accountsettings.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.accountsettings.plist$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.OTASyncAgent.plist$")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebSheet.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath "/Library/Dictionaries") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath "/Library/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]WebSheet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath-prefix "${HOME}/Media/Safari") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]WebSheet[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]WebSheet[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]WebSheet-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]WebSheet-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/FairPlay") + (literal "/usr/sbin/fairplayd") + (subpath-prefix "${HOME}/Media") + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))))) +(allow file-read-metadata) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.accountsettings.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.accountsettings.plist$")) + (require-not (regex #"^/private/var/mobile/Library/Mail/AutoFetchEnabled$" #"^/private/var/euser[0-9]+/Library/Mail/AutoFetchEnabled$")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebSheet.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]WebSheet.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath-prefix "${HOME}/Media/Safari") + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]WebSheet[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging"))))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") + (literal-prefix "${HOME}/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.mobilemail") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.mobilesafari-settings") + (global-name "com.apple.marco") + (global-name "ScripterServer") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.librariand") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.webfilterd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.managedconfiguration.profiled") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.cookied") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.webinspector") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nehelper") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.TextInput") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.aggregated") + (global-name "com.apple.TextInput.rdt") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.certui.relay") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.mobilemail.messageuiservices") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.bird.token") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.eventpump") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.securityd") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.revisiond") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.GSSCred") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.sharingd") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CoreMotion") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.da") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-exec* + (literal "/Applications/WebSheet.app/WebSheet")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb.xml new file mode 100644 index 0000000..c3c699a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb new file mode 100644 index 0000000..122443c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb @@ -0,0 +1,202 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iapd") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iapd")) +(allow process-exec* + (literal "/usr/sbin/accessoryd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb.xml new file mode 100644 index 0000000..7f2c4ab --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb new file mode 100644 index 0000000..50b4563 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb @@ -0,0 +1,416 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.afc.root") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/AFCDEBUG") + (literal "/usr/libexec") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.afc.plist") + (literal "/usr/libexec/afcd") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.afc.root") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/Library/Preferences") + (literal "/Library/Preferences/SystemConfiguration") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private") + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.afc.root") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.xpchelper") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.lockdown.host_watcher") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (regex #"^/private/var/run/lockdown/checkin") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.afc") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb new file mode 100644 index 0000000..c53cb0a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb @@ -0,0 +1,433 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Logs/AppConduit") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/db/MobileIdentityData") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/AppConduit") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (subpath "/Developer") + (subpath "/private/var/containers/Bundle/Application") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/Logs/AirTraffic") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/AppConduit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging") + (subpath-prefix "${HOME}/Library/AppConduit") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/Logs/AirTraffic") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.atc.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.misagent") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.lsd.open") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cache_delete") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb new file mode 100644 index 0000000..1d73ed5 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb @@ -0,0 +1,381 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/System/Library/CoreServices/SystemVersion$" #"^/System/Library/CoreServices/SystemVersion.+$") + (literal "/dev/zero") + (subpath "/private/etc") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/ApplePushService") + (subpath "/private/var/Keychains") + (subpath "/private/var/preferences") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/Managed Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Preferences") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/Library/Keychains") + (literal "/Library/Managed Preferences/mobile") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/usr") + (subpath "/private/var/tmp") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Logs") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/Managed Preferences/mobile") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicEffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicEffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") + (subpath-prefix "${HOME}/Library/Logs") + (subpath-prefix "${HOME}/Library/ApplePushService") + (subpath-prefix "${HOME}/Library/Preferences") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-inbound + (subpath "/")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/ApplePushService.framework/apsd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb.xml new file mode 100644 index 0000000..f81f602 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb new file mode 100644 index 0000000..81c89a6 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb @@ -0,0 +1,241 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (literal "/dev/random") + (subpath "/Applications") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (literal "/dev/dtracehelper") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assertiond.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assertiond.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.lsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-task-name) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.assertiond") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.assertiond")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl* + (sysctl-name "kern.ipc.throttle_best_effort") + (sysctl-name "kern.memorystatus_vm_pressure_send")) +(allow sysctl-read) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb.xml new file mode 100644 index 0000000..972d53f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb new file mode 100644 index 0000000..1f564bc --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb @@ -0,0 +1,19 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb.xml new file mode 100644 index 0000000..c5c1c88 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb new file mode 100644 index 0000000..b5abbb9 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb @@ -0,0 +1,455 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AssetCacheLocatorService.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.AssetCacheC") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-inbound + (local udp "*:*")) +(allow network-bind + (local udp "*:*")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:*") + (remote udp "*:53") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AssetCacheLocatorService") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb new file mode 100644 index 0000000..aa5d599 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb @@ -0,0 +1,185 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/db/heim-credential-store.archive") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/db/heim-credential-store.archive") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb new file mode 100644 index 0000000..e42d3fa --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb @@ -0,0 +1,114 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb.xml new file mode 100644 index 0000000..857bf1d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb new file mode 100644 index 0000000..270e152 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb @@ -0,0 +1,327 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.ocspd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb.xml new file mode 100644 index 0000000..857bf1d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb new file mode 100644 index 0000000..342a2f4 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb @@ -0,0 +1,764 @@ +(version 1) +(deny default) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/dev/random") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.LaunchServices.plist") + (literal "/dev/dtracehelper") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (vnode-type SYMLINK)) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "ScripterServer") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.assetimagegenerator") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.TextInput") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.TextInput.rdt") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.aggregated") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.bird.token") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.securityd") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.webinspector") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.sharingd") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.SpeakSelection") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml new file mode 100644 index 0000000..857bf1d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb new file mode 100644 index 0000000..c4c6054 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb @@ -0,0 +1,683 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.token.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.avvc.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.weather.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.logging.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/siri_recordings") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.siri.backedup.encrypted.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath-prefix "${HOME}/Library/Assistant") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (subpath "/Library/Audio/Tunings") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AssistantServices.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.siri.") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/local/lib") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.siri.") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.weather.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.token.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AssistantServices.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.siri.backedup.encrypted.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.logging.plist") + (subpath-prefix "${HOME}/Library/Assistant") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.geod") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.marco") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.BTLEAudioController.xpc") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coreduetd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assistant_service") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.absd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.networkd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.absinthed") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.logger") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.weather") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.avfoundation.avvc") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AssistantServices") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.assistant.token") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.siri.backedup.encrypted") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.AssistantServices") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.token") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.siri.backedup.encrypted") + (preference-domain "com.apple.weather") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.assistant.backedup")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb new file mode 100644 index 0000000..915b281 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb @@ -0,0 +1,629 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents/")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.librarian.ubiquity-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.quicklook.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.clouddocs.version") + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CloudKit.BehaviorOptions.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ubd.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Mobile Documents.") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iCloudDriveApp.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bird.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath-prefix "${HOME}/Library/Logs/CloudDocs") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]bird" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]bird" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]bird") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${HOME}/Library/Mobile Documents.") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ubd.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iCloudDriveApp.plist") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bird.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") + (subpath-prefix "${HOME}/Library/Logs/CloudDocs") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]bird" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]bird" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]bird") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Application Support")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CloudKit")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coreduetd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.FSEvents") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.apsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.cache_delete") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird.ContainerMetadataExtractor") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.ubd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cloudd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.mmcs") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.iCloudDriveApp") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.iCloudDriveApp") + (preference-domain "com.apple.appleaccount")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30)) + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-info + (info-type "hw.uuid")) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb.xml new file mode 100644 index 0000000..82828b2 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb new file mode 100644 index 0000000..0a47bd1 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb @@ -0,0 +1,600 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (regex #"^/private/var/mobile/Containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit" #".+/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/euser[0-9]+/Library/Caches/CloudKit/[^/]+/[^/]+") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write")))) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (literal "/private/var/db/mds/messages/se_SecurityMessages") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (mount-relative-regex #"^/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/[.]DocumentRevisions-V100-bad-[0-9]+/") + (subpath-prefix "${HOME}/Library/Logs/awd") + (literal "/Library/Preferences/com.apple.security.plist") + (literal "/") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (regex #"^/private/var/tmp/CKTraffic$" #"^/private/var/tmp/CKTraffic[^/]+$") + (mount-relative-regex #"^/[.]DocumentRevisions-V100$" #"^/[.]DocumentRevisions-V100/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/Library/Keychains/System.keychain") + (subpath-prefix "${HOME}/Library/Keychains") + (literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (mount-relative-regex #"^/[.]TemporaryItems$" #"^/[.]TemporaryItems/") + (extension "com.apple.sandbox.executable") + (literal "/private/var/db/DetachedSignatures") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.migration.plist") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/var/tmp$" #"^/var/tmp/" #"^/private/var/tmp$" #"^/private/var/tmp/") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/CloudKit") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/Logs/Ubiquity") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/run/diagnosticd/dyld_shared_cache_x86_64") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (literal "/private/var/logs/Ubiquity") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/db/mds/system/mdsDirectory.db") + (subpath "/usr/lib") + (literal "/Library/Preferences/SystemConfiguration/preferences.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/CloudConfigurationDetails.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]cloudd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (regex #"^/var/tmp$" #"^/private/var/tmp$") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library") + (literal "/AppleInternal") + (literal "/etc") + (literal "/tmp") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/etc/localtime") + (literal "/Library/Keychains") + (literal "/private/var/run/systemkeychaincheck.done") + (literal "/Library/Logs") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/var$" #"^/private/var$") + (literal "/Library") + (literal "/Library/Security/Trust Settings/Admin.plist") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (regex #"^/var/tmp$" #"^/var/tmp/" #"^/private/var/tmp$" #"^/private/var/tmp/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (mount-relative-regex #"^/[.]TemporaryItems$" #"^/[.]TemporaryItems/") + (subpath-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Caches/CloudKit") + (literal "/") + (regex #"^/Library/Keychains/System.keychain") + (subpath-prefix "${HOME}/Library/Logs/Ubiquity") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (subpath-prefix "${HOME}/Library/Keychains") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/tmp/CKTraffic$" #"^/private/var/tmp/CKTraffic[^/]+$") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/logs/Ubiquity") + (literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]cloudd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000))) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_com.apple.cloudd") + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write-xattr + (mount-relative-regex #"^/[.]DocumentRevisions-V100$" #"^/[.]DocumentRevisions-V100/") + (mount-relative-regex #"^/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/[.]DocumentRevisions-V100-bad-[0-9]+/")) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name-regex #"^/tmp/com[.]apple[.]csseed[.][0-9]+$") + (ipc-posix-name "FNetwork.defaultStorageSession") + (ipc-posix-name "com.apple.AppleDatabaseChanged")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name "com.apple.AppleDatabaseChanged")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.quarantine-resolver") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coreduetd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.datamigrator") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.apsd") + (global-name "com.apple.SecurityServer") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.fairplayd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.awdd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.networkd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.windowserver.active") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.ocspd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (literal "/private/var/run/asl_input") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.migration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb new file mode 100644 index 0000000..63d6d8f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb @@ -0,0 +1,210 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (subpath "/Applications") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilephone.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.message") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilephone") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb new file mode 100644 index 0000000..f99f488 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb @@ -0,0 +1,724 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath-prefix "${HOME}/Library/HomeConfiguration") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (subpath-prefix "${HOME}/Library/homed") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homed.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]homed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]homed" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]homed") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") + (subpath-prefix "${HOME}/Library/HomeConfiguration") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homed.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/homed") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]homed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]homed" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]homed") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.corefollowup.agent") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.apsd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.bird.token") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.pegasus") + (global-name "com.apple.revisiond") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cloudd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.homed") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.homed")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb new file mode 100644 index 0000000..86468d4 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb @@ -0,0 +1,491 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/root/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/root/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (literal "/usr/local/bin/network_test") + (literal "/dev/random") + (literal "/dev/ptmx") + (subpath "/usr/libexec") + (subpath "/private/var/root/Library/Cookies") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Bundle/Application") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (subpath "/usr/sbin") + (subpath "/Developer") + (regex #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/CloudConfigurationDetails.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist") + (regex #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (subpath "/private/var/root/Library/Cookies") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper$"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.processassertionconnection") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow mach-register + (global-name "com.apple.nehelper") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network* + (local udp "*:500") + (local udp "*:4500") + (literal "/private/var/run/racoon.sock")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote udp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.net.utun_control") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (remote tcp "*:*") + (control-name "com.apple.netsrc") + (control-name "com.apple.content-filter") + (control-name "com.apple.flow-divert") + (control-name "com.apple.net.necp_control") + (control-name "com.apple.net.ipsec_control")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl* + (sysctl-name-regex #"^net[.]inet[.]ipsec[.].+") + (sysctl-name-regex #"^net[.]necp[.].+")) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb.xml new file mode 100644 index 0000000..c8ed3bf --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb new file mode 100644 index 0000000..3c3cae9 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb @@ -0,0 +1,466 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/nesessionmanager/" #"^/private/var/root/Library/Caches/nesessionmanager$")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/nesessionmanager/" #"^/private/var/root/Library/Caches/nesessionmanager$")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/nesessionmanager/" #"^/private/var/root/Library/Caches/nesessionmanager$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (literal "/dev/random") + (subpath "/usr/libexec") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/run/racoon.pid") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.networkextension.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (regex #"^/private/var/root/Library/Caches/nesessionmanager/" #"^/private/var/root/Library/Caches/nesessionmanager$") + (subpath "/private/etc/ppp") + (subpath "/usr/sbin") + (subpath "/private/var/containers/Bundle/VPNPlugin") + (regex #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (subpath "/private/var/run/racoon") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/run/racoon") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/log/ppp.log") + (regex #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (subpath "/private/var/tmp") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (regex #"^/private/var/root/Library/Caches/nesessionmanager/" #"^/private/var/root/Library/Caches/nesessionmanager$") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager$"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.UNCUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptom_analytics") + (global-name "com.apple.springboard.services") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.neagent") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.ocspd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.networkextension") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-exec* + (literal "/usr/sbin/pppd")) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl* + (sysctl-name "net.key.natt_keepalive_interval")) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb.xml new file mode 100644 index 0000000..aa4f26a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb.xml @@ -0,0 +1,46 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb new file mode 100644 index 0000000..3a766d1 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb @@ -0,0 +1,466 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.quicklook.readonly") + (extension-class "com.apple.mediaserverd.read"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/dev/zero") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db") + (literal "/dev/random") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") + (extension "com.apple.sandbox.executable") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.quicklook.readonly") + (subpath "/Developer") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Application Support/Quick Look") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Application Support/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Application Support/Documents") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") + (literal-prefix "${HOME}/Library/Application Support/Quick Look") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Application Support/Quick Look")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.pegasus") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.system.logger") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.revisiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ctkd.token-client") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.corevideo") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 31))) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb new file mode 100644 index 0000000..1a731fe --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb @@ -0,0 +1,494 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/rtcreportingd.plist") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoConference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.rtcreporting.plist") + (literal "/dev/random") + (literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.timed.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (extension "com.apple.rtcreporting.upload") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") + (literal "/usr/libexec/rtcreportingd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-data + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/rtcreportingd.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.rtcreporting.plist") + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (extension "com.apple.rtcreporting.upload") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.tccd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlogd") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "rtcreportingd") + (preference-domain "com.apple.timed") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.rtcreporting") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.rtcreporting") + (preference-domain "rtcreportingd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb new file mode 100644 index 0000000..a998437 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb @@ -0,0 +1,67 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/dtracehelper")) +(allow file-link) +(allow file-map-executable) +(allow file-read*) +(allow file-read-data) +(allow file-read-metadata) +(allow file-read-xattr) +(allow file-write* + (extension "com.apple.sandbox.system-group") + (subpath "/private/var/tmp") + (regex #"^/private/var/logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/logs/CrashReporter/[.]Sandbox-.+[.]ips") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]Sandbox-.+[.]ips") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero")) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.logger") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.system.libinfo.muser") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coresymbolicationd")) +(allow network* + (regex #"^/private/var/tmp/sandbox[.]")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (regex #"^/private/tmp/[.]webdavUDS[.][^/]+$") + (literal "/private/var/run/asl_input")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb.xml new file mode 100644 index 0000000..3cfb47d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb new file mode 100644 index 0000000..943abf2 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb @@ -0,0 +1,207 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.siri.ClientFlow.ClientScripter.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.logging.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.siri.ClientFlow.ClientScripter.plist") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.siri.ClientFlow.ClientScripter") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.siri.ClientFlow.ClientScripter")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb new file mode 100644 index 0000000..7203d9c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb @@ -0,0 +1,139 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/var/mobile/Library/Caches") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-register + (global-name "com.apple.snhelper") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb new file mode 100644 index 0000000..0084590 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb @@ -0,0 +1,450 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class-regex #"^com[.]apple[.]tcc[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.companionsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/null") + (literal "/dev/random") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (subpath-prefix "${HOME}/Library/TCC") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (subpath "/private/var/tmp/com.apple.tccd") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (global-name "com.apple.appconduitd.device-connection") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.backboard.systemservices") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.lsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.librariand") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.awdd") + (global-name "com.apple.companionappd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.companionsync") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb.xml new file mode 100644 index 0000000..1460650 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb new file mode 100644 index 0000000..c05eade --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb @@ -0,0 +1,140 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write-create + (literal "/private/var/db/timezone/localtime") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-unlink + (literal "/private/var/db/timezone/localtime") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb new file mode 100644 index 0000000..ab9d58d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb @@ -0,0 +1,527 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") + (literal "/") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ubd.plist") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Library/processed-Mobile Documents.delete") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Logs/awd/awd-ubd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${HOME}/Library/Application Support") + (literal-prefix "${HOME}/Library") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bird.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Collections") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]ubd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Collections") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Logs/awd/awd-ubd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ubd.plist") + (literal-prefix "${HOME}/Library/Application Support") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/processed-Mobile Documents.delete") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]ubd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.absd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.FSEvents") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.apsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.awdd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.absinthed") + (global-name "com.apple.networkd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.mmcs") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.mmcs")) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Support/ubd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30))) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb.xml new file mode 100644 index 0000000..f9ff07c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb new file mode 100644 index 0000000..8e41b0f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb @@ -0,0 +1,3520 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (extension-class "com.apple.mediaserverd.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/ReplayKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ReplayKit.RPVideoEditorExtension"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/DCIM") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}"))) +(allow file-map-executable) +(allow file-read* + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/Developer") + (subpath "/usr/share") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.security.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]mobilemail") + (subpath-prefix "${FRONT_USER_HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/OriginalLockVideo.mov") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/HomeBackground.cpbitmap") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath-prefix "${HOME}/Media") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/OriginalHomeVideo.mov") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (require-entitlement "platform-application")) + (require-all + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/Library/Application Support/Mail/Plugins") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "platform-application")) + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/LockBackgroundThumbnail.jpg") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/CloudConfigurationDetails.plist$") + (subpath-prefix "${FRONT_USER_HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.Maps") + (entitlement-value "com.apple.SafariViewService") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/LockVideo.mov") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-shm") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/HomeBackgroundThumbnail.jpg") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/.LockBackground.cpbitmap") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.security.exception.carrier-bundle.read"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/System/Library/PairedSyncServices/com.apple.pairedsync.mail.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/LockBackground.cpbitmap") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-wal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/.HomeBackground.cpbitmap") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.apsalerts.plist")) + (require-any + (subpath "/AppleInternal") + (subpath "/Applications") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/Library/Ringtones") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath "/Library/Dictionaries") + (subpath-prefix "${HOME}/Library/Dictionaries") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/dtracehelper") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/euser[0-9]+/Library/GameKit/Data/[^/]+.gcdata$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/HomeVideo.mov") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.AutoWake.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.Maps") + (entitlement-value "com.apple.SafariViewService") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))) +(allow file-read-data + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library") + (literal "/private/var") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/printd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/GameKit/Data") + (literal-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (vnode-type SYMLINK) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2")))) +(allow file-write* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtube.dp.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.OTASyncState.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]mobilemail") + (subpath-prefix "${FRONT_USER_HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mail.composition.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.internal.Voltaire.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.OTASyncAgent.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMailKit.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MailAccount-ExtProperties.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.skyhookwireless.wps.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cloud.quota.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cloud.quota.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2")))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (require-all + (iokit-user-client-class "RootDomainUserClient") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2")))) +(allow iokit-get-properties + (iokit-property "compass-calibration") + (iokit-property "gyro-interrupt-calibration") + (require-not (iokit-property-regex #"-mac-address" #"mac-address-" #".+-mac-address" #".+mac-address-")) + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.wifi.manager-access")) +(allow ipc-posix-sem + (semaphore-owner self) + (extension "com.apple.sandbox.application-group")) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^stack-logs") + (ipc-posix-name-regex #"^OA-") + (extension "com.apple.sandbox.application-group") + (ipc-posix-name-regex #"^/FSM-")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-create + (ipc-posix-name-regex #"^/mono[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-unlink + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.telephonyutilities.callservicesdaemon.voip") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.appleprofilepolicyd") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.imavagent.embedded.auth") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.symptomsd") + (global-name "com.apple.calaccessd.xpc") + (global-name "com.apple.watchconnectivity.complication") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.mobileipod.MPMusicPlayerMigServerExists") + (global-name "com.apple.iapd") + (global-name "com.apple.coremedia.videoqueue") + (global-name "com.apple.FSEvents") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.AdSheetPhone.server") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.gamed") + (global-name "com.apple.ExternalAccessory.distributednotification.server") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.coremedia.wirelessdisplayserver") + (global-name "com.apple.TextInput") + (global-name "com.apple.mobileipod.MPMusicPlayerMigServer") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.cloudd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.commcenter.dm-helper") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.wcd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.Music.MPMusicPlayerControllerInternal") + (global-name "com.apple.bird") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.wapi.client") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.iaptransportd") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.FileProvider") + (global-name "com.apple.midiserver.io") + (global-name "com.apple.Music.MPMusicPlayerMigServerExists") + (global-name "com.apple.awdd") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.telephonyutilities.remotelogdaemon") + (global-name "com.apple.homed.xpc") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.xpcd") + (global-name "com.apple.diagnosticd") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.marco") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.cvmsCompAgent_armv7") + (global-name "com.apple.Music.MPMusicPlayerMigServer") + (global-name "com.apple.certui.relay") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.weibod.server") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.webfilterd") + (global-name "com.apple.gizmoappd") + (global-name "com.apple.passd.assertions") + (global-name "com.apple.backboard.watchdog") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.ReportCrash") + (global-name "com.apple.atc") + (extension "com.apple.sandbox.application-group") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.dataaccess.dataaccessd") + (global-name "com.apple.nehelper") + (global-name "com.apple.backboard.workspaceserverconnection") + (global-name "com.apple.scrod") + (global-name "com.apple.syncdefaultsd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.testmanagerd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.calaccessd") + (global-name "com.apple.lsd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.assetsd.notificationServer") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.MobileFileIntegrity") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.twitterd.server") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.prdaily") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.iaptransportd.xpc") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.audio.AudioConverterServer") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.springboard.watchdogserver") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.accountsd.authmanager") + (global-name "com.apple.audio.AudioUnitServer") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.AdSheetPad.server") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.dataaccess.dataaccessd.active") + (global-name "com.apple.ReportCrash.StackShot") + (global-name "com.apple.mDNSResponder") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.springboard.remotenotifications") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.audio.AudioFileServer") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.iap2d.distributednotification.server") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.iapauthd.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.coremedia.formatreader") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.itunesstored.xpc") + (global-name "PurplePPTServer") + (global-name "com.apple.librariand") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.midiserver") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.videoconference.avconference") + (global-name "com.apple.iap2d.xpc") + (global-name "com.apple.assetsd.messagingServer") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.managedconfiguration.mdmdpush-prod") + (global-name "com.apple.coremedia.cpeprotector") + (global-name "com.apple.MobileAccessoryUpdater") + (global-name "com.apple.iap2d") + (global-name "com.apple.aggregated") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.itdbprep.server") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.healthd.server") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.springboard") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.airplay.sender.xpc") + (global-name "com.apple.coremedia.wirelessdisplay") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.gamecenter") + (global-name "com.apple.fairplayd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.iapd.distributednotification.server") + (global-name "com.apple.mediastream.sharing-nowake") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.bird.token") + (global-name "com.apple.datamigrator.dz") + (global-name "com.apple.managedconfiguration.mdmdpush-dev") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.accountsd.accessmanager") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.distributed_notifications@0v3") + (global-name "com.apple.VoiceOverTouch") + (global-name "com.apple.managedconfiguration.mdmdservice") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.mobile.softwareupdated") + (global-name "com.apple.coremedia.audioprocessingtap") + (global-name "com.apple.iTunesStore.daemon.notifications.public") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.vsassetd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.gamed.note") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.sharingd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.iapd.xpc") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.springboard.alerts") + (global-name "com.apple.passd.library") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.backboard.checkin") + (global-name "ScripterServer") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.clouddbd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.GSSCred") + (global-name "com.apple.assetsd.keepDaemonAlive") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.MediaControl.daemon") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.springboard.UIKit.migserver") + (global-name "com.apple.iTunesStore.daemon.public") + (global-name "com.apple.instruments.server.mig") + (global-name "com.apple.ReportCrash.SafetyNet") + (global-name "com.apple.system.logger") + (global-name "com.apple.healthd.restriction") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") + (global-name "com.apple.mobileipod.MPMusicPlayerControllerInternal") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mDNSResponderHelper") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.sandboxd") + (global-name "com.apple.VoiceOverTouch.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.ReportCrash.Jetsam") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.geod") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.ait.client") + (global-name "com.apple.coremedia.cpe") + (global-name "com.apple.commcenter.mobile-helper") + (global-name "com.apple.bypassBasebandAutoBooter.msgport") + (global-name "com.apple.webinspector") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.passd.in-app-payment") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.ReportCrash.DirectoryService") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.iapauthd") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (global-name "com.apple.mobilemail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.siri.vocabularyupdates") + (require-entitlement "com.apple.siri.synapse")) + (require-all + (global-name "com.apple.parsec.subscriptionservice.internal") + (require-entitlement "com.apple.private.subscriptionservice.internal")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.observerconnection") + (require-entitlement "com.apple.bulletinboard.observer")) + (require-all + (global-name "com.apple.pegasus") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.identityservicesd.embedded.auth") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.coremedia.recorder") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.assistant.analytics") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.lskdd") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.coreduetd") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.cache_delete") + (require-any + (require-entitlement "com.apple.mobile.deleted.AllowFreeSpace") + (require-entitlement "com.apple.private.CacheDelete"))) + (require-all + (global-name "com.apple.mediaserverd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.utilitiesconnection") + (require-entitlement "com.apple.bulletinboard.utilities")) + (require-all + (global-name "com.apple.backupd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coreduetd") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.parsec.subscriptionservice") + (require-entitlement "com.apple.smoot.subscriptionservice")) + (require-all + (global-name "com.apple.Maps.SpringBoard") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.asset") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (local-name "com.apple.iphone.axserver") + (require-entitlement "com.apple.accessibility.api")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.suggestd.events") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobilestoredemod") + (require-entitlement "com.apple.private.mobilestoredemo.enabledemo")) + (require-all + (global-name "com.apple.coremedia.admin") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.bulletinboard.settings")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.harvestd.manager") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.icfcallserver") + (require-entitlement "com.apple.private.icfcallserver")) + (require-all + (global-name "com.apple.familycircle.agent") + (require-entitlement "com.apple.private.familycircle")) + (require-all + (global-name "com.apple.bulletinboard.systemstateconnection") + (require-entitlement "com.apple.bulletinboard.systemstate")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.nanomaps.xpc.Maps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal"))) + (require-all + (global-name "com.apple.safarifetcherd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.routined.registration") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.routined.registration") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.suggestd.mail") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.AOSNotification") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.suggestd.contacts") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.mobilesafari-settings") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebSheet"))) + (require-all + (global-name "com.apple.absinthed") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.medialibraryd.xpc") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.spotlight.SearchAgent") + (require-entitlement "com.apple.spotlight.search")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.managedconfiguration.profiled") + (require-entitlement "com.apple.managedconfiguration.profiled-access")) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.suggestd.suggestionmanager") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.suggestd.spotlight") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.unfreed") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.Maps.mapspushd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.audio.AudioSession") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (global-name "com.apple.bulletindistributord.server") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.replayd") + (require-not (process-attribute is-plugin))) + (require-all + (global-name "com.apple.aps.alertprovider.xpc") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.icloud.findmydeviced") + (require-any + (require-entitlement "com.apple.aosnotification.aosnotifyd-access") + (require-entitlement "com.apple.icloud.findmydeviced.access"))) + (require-all + (global-name "com.apple.SystemConfiguration.PPPController-priv") + (require-entitlement "com.apple.networking.vpn.configuration")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (require-not (global-name-regex #"-idswake$" #".+-idswake$")) + (require-any + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (extension "com.apple.sandbox.application-group") + (local-name "com.apple.iphone.axserver") + (require-all + (global-name "com.apple.Music.MPMusicPlayerMigServerExists") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (global-name "com.apple.Music.MPMusicPlayerControllerInternal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (require-all + (require-not (remote tcp "localhost:22")) + (require-not (remote tcp "localhost:23")) + (require-not (remote tcp "localhost:873")) + (require-not (remote tcp "localhost:62078")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/printd") + (remote ip "*:*") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/var/run/lockdown.sock") + (require-entitlement "platform-application"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.dataaccess.dataaccessd") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mobile.SyncMigrator") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.gamekit") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.managedconfiguration.janitor") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.da") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.certui") + (preference-domain "com.apple.voicemail") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobilecal.alarmengine") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.madrid") + (preference-domain "com.apple.softwareupdateservicesd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.atc") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.mobileme.fmf.assistant") + (preference-domain "itdbprepserver") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mediaremote") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.apsd") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.OTASyncState") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.XCTest") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.network.eapclient.tls.TrustExceptions") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mobilevpn") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.itdbprep.server") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "com.apple.mobiletimer") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.messagesbadgecontroller") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.iqagent") + (preference-domain "mediaremote") + (preference-domain "com.apple.MobileAddressBook") + (preference-domain "com.apple.nike") + (preference-domain "com.apple.imagent") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.VoiceMemos") + (preference-domain "com.apple.preferences.network") + (preference-domain "com.apple.twitterd") + (preference-domain "com.apple.mobilestoresettings") + (require-all + (preference-domain "com.apple.internal.Voltaire") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.homesharing") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.AppStore") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.NanoMailKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.MobileStore") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.coreaudio") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (preference-domain "com.apple.demo-settings") + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.skyhookwireless.wps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.medialibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (preference-domain "com.apple.MailAccount-ExtProperties") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.WebFoundation") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.safarifetcherd")))) + (require-all + (preference-domain "com.apple.avfoundation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.coremedia") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.OTASyncAgent") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mediaaccessibility.public") + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.internal.Voltaire") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.OTASyncAgent") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.NanoMailKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.MailAccount-ExtProperties") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.skyhookwireless.wps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow process-info-pidinfo + (target self) + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension"))) +(allow process-info-pidfdinfo + (target self) + (require-entitlement "com.apple.security.exception.process-info")) +(allow process-info-setcontrol + (target self)) +(allow pseudo-tty) +(allow signal + (target self) + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension")) + (require-all + (target others) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd")))) +(allow sysctl-read + (require-all + (sysctl-name-regex #"^kern[.]proc[.]") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-not (sysctl-name "kern.proc.pid.1")) + (require-any + (require-not (sysctl-name-regex #"^kern[.]proc[.]")) + (require-entitlement "com.apple.DiagnosticExtensions.extension")))) +(allow system-info + (require-all + (info-type "net.link.addr") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2)) + (require-all + (socket-domain 39) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps")) + (require-entitlement "com.apple.network.multipath-tcp")))) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb.xml new file mode 100644 index 0000000..d3f890f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb new file mode 100644 index 0000000..1cd194d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb @@ -0,0 +1,411 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd$")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/MobileContainerManager") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") + (literal "/private/var/root/Library/MobileContainerManager.") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd$") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/MobileContainerManager.") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/private/var/installd/Library/Caches") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Logs/MobileContainerManager") + (subpath "/private/var/root/Library/Logs/MobileContainerManager") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/containers") + (literal "/dev/aes_0") + (subpath "/private/var/root/Library/MobileContainerManager") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/installd/Library") + (literal "/private/var/mobile/Library"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd") + (literal "/private/var/root/Library/MobileContainerManager.") + (subpath "/private/var/mobile/Library/MobileContainerManager") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers") + (subpath "/private/var/mobile/Library/Logs/MobileContainerManager") + (literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") + (subpath "/private/var/root/Library/Logs/MobileContainerManager") + (subpath "/private/var/containers") + (literal "/private/var/mobile/Library/MobileContainerManager.") + (subpath "/private/var/root/Library/MobileContainerManager") + (subpath "/private/var/installd/Library/Caches") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd$") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/installd/Library") + (literal "/private/var/mobile/Library"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow ipc-posix-sem + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb new file mode 100644 index 0000000..8bccf5e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb @@ -0,0 +1,170 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/root/Library/Caches/com.apple.coresymbolicationd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library/Caches/com.apple.coresymbolicationd") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb new file mode 100644 index 0000000..787a2cf --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb @@ -0,0 +1,173 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Logs") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/logs/WirelessLibraryLogs") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/private/var/logs/MobileLibraryLogs") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/logs/MobileMediaFactoryLogs") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/logs/WirelessLibraryLogs") + (subpath "/private/var/logs/MobileLibraryLogs") + (subpath "/private/var/logs/MobileMediaFactoryLogs") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb new file mode 100644 index 0000000..19b1a64 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb @@ -0,0 +1,512 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") + (literal "/dev/urandom") + (subpath-prefix "${HOME}/Library/Logs/DataMigration") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (subpath-prefix "${HOME}/Library/Mail") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/Logs") + (subpath "/AppleInternal/Library/Frameworks") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") + (extension "com.apple.sandbox.executable") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.autoincrement.lock") + (subpath "/System/Library") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/DataAccess") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (subpath-prefix "${HOME}/Library/Logs/DataAccess") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${HOME}/Library/Notes") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Preferences") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Logs/Message") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobilesafari/ReadingListArchives") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Logs/ManagedConfiguration") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Safari") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (require-not (regex #"^/private/var/mobile/Library/" #"^/private/var/euser[0-9]+/Library/")) + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Cookies/com.apple.dataaccessd.binarycookies" #"^/private/var/mobile/Library/Cookies/com.apple.dataaccessd..+binarycookies" #"^/private/var/euser[0-9]+/Library/Cookies/com.apple.dataaccessd..*binarycookies") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/DataMigration") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/Managed Preferences/mobile") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath-prefix "${HOME}/Library/Logs/DataAccess") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${HOME}/Library/Mail") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock") + (subpath-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath-prefix "${HOME}/Library/Logs/Message") + (subpath-prefix "${HOME}/Library/Logs/ManagedConfiguration") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.autoincrement.lock") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") + (subpath-prefix "${HOME}/Library/DataAccess") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db") + (literal-prefix "${HOME}/Library/Safari") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Cookies/com.apple.dataaccessd.binarycookies" #"^/private/var/mobile/Library/Cookies/com.apple.dataaccessd..+binarycookies" #"^/private/var/euser[0-9]+/Library/Cookies/com.apple.dataaccessd..*binarycookies") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Safari")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobilesafari/ReadingListArchives") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb.xml new file mode 100644 index 0000000..b7536db --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb new file mode 100644 index 0000000..7f7e939 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb @@ -0,0 +1,166 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (subpath "/Applications") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-priv-task-port) +(allow network-inbound + (local tcp "localhost:*") + (remote tcp "localhost:*")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (regex #"^/private/var/run/lockdown/checkin") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (require-all + (require-not (subpath-prefix "${FRONT_USER_HOME}/Containers")) + (require-not (subpath "/private/var/containers")) + (debug-mode))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-debug) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb.xml new file mode 100644 index 0000000..c2f49fe --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb.xml @@ -0,0 +1,46 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb new file mode 100644 index 0000000..da7daa3 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb @@ -0,0 +1,251 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cache_delete.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (subpath "/AppleInternal/Library/CacheDelete") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath-prefix "${HOME}/Library/Logs/CacheDelete") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/AppleInternal/Library/CacheDelete") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cache_delete.plist") + (subpath-prefix "${HOME}/Library/Logs/CacheDelete") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name-regex #"^com[.]apple[.]mobile[.]cache_delete_") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name-regex #"^com[.]apple[.].+cache-delete$") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name-regex #"^com[.]apple[.].+[Cc]ache[Dd]elete$") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.cache_delete") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.cache_delete")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 24))) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb new file mode 100644 index 0000000..37135f0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb @@ -0,0 +1,337 @@ +(version 1) +(deny default) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Logs/coreduetd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal "/dev/zero") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Logs/duetexpertd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath "/usr/libexec") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/DuetExpertCenter") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.spotlightui.plist") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DuetExpertCenter.AppPredictionExpert.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.duetexpertd.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (subpath-prefix "${HOME}/Library/Logs/CallHistory") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${HOME}/Library/DuetExpertCenter") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DuetExpertCenter.AppPredictionExpert.plist") + (literal-prefix "${HOME}/Library/Logs/coreduetd.log") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.duetexpertd.plist") + (subpath-prefix "${HOME}/Library/Logs/CallHistory") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/duetexpertd.log") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.calaccessd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.routined.registration") + (global-name "com.apple.lsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.aggregated") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.duet.expertcenter") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreduetd.knowledgebase") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.duetexpertd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.MobileAsset") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.duetexpertd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb new file mode 100644 index 0000000..78f0f67 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb @@ -0,0 +1,654 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.notbackedup.plist") + (literal "/dev/null") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.notbackedup.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.migration.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/empty") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/MDM.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.notbackedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (literal "/usr/libexec/findmydeviced") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.watch.notbackedup.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.managedconfiguration.notbackedup.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/CloudConfigurationDetails.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]findmydeviced" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]findmydeviced" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]icloud[.]findmydeviced") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/MDM.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/MDM.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/MDM.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.notbackedup.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.watch.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.notbackedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]findmydeviced" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]findmydeviced" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]icloud[.]findmydeviced") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (regex #"^/private/var/mobile/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/euser[0-9]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "ProvInfoIOKitUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem + (ipc-posix-name "findmydeviced.boot_check")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "com.apple.absd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.mobile.obliteration") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.springboard.services") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.apsd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.adid") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.absinthed") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.icloud.findmydeviced.FMIPAccounts.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.FMIPAccounts") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.icloud.findmydeviced.watch.notbackedup") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.managedconfiguration.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.notbackedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AOSNotification.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.icloud.findmydeviced.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.FMIPAccounts") + (preference-domain "com.apple.icloud.findmydeviced.FMIPAccounts.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.icloud.findmydeviced.watch.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb new file mode 100644 index 0000000..736460d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb @@ -0,0 +1,592 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/usr/libexec") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.fmfd.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.fmfd.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/usr/libexec/fmfd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/empty") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/dev/aes_0") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]icloud[.]fmfd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.fmfd.notbackedup.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.fmfd.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]icloud[.]fmfd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.geod") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.apsd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.marco") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.fmfd") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.icloud.fmfd.notbackedup") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.da") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.icloud.fmfd") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.icloud.fmfd.notbackedup")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb new file mode 100644 index 0000000..71ca0f9 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb @@ -0,0 +1,137 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.xpcd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pfd") + (global-name "com.apple.tccd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (local ip "*:*") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb.xml new file mode 100644 index 0000000..cf8816c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb new file mode 100644 index 0000000..d78ceb2 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb @@ -0,0 +1,591 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/GameKit") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/usr/libexec/gamed") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoConference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (subpath-prefix "${HOME}/Library/GameKit") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath-prefix "${HOME}/Library/Logs/GameKit") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gamed.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/GameKit") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gamecenter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]gamed") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath-prefix "${HOME}/Library/Caches/GameKit") + (subpath-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gamecenter.plist") + (subpath-prefix "${HOME}/Library/GameKit") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath-prefix "${HOME}/Library/Logs/GameKit") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gamed.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]gamed") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.marco") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.authkit.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.springboard.services") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.apsd") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.lsd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.gamecenter") + (global-name "com.apple.fairplayd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.pegasus") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.networkd") + (global-name "com.apple.gamecenter.gsEvents") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (remote ip "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.accountsd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.PeoplePicker")) +(allow process-exec* + (literal "/usr/libexec/gamed")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb.xml new file mode 100644 index 0000000..c3c699a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb new file mode 100644 index 0000000..1f564bc --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb @@ -0,0 +1,19 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb.xml new file mode 100644 index 0000000..c5c1c88 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb new file mode 100644 index 0000000..f7430a7 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb @@ -0,0 +1,483 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal "/dev/urandom") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Caches/MapTiles") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/GeoServices") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (literal "/dev/random") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ConfigServer.plist") + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/CloudConfigurationDetails.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") + (subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/kCFPreferencesAnyApplication.plist") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") + (subpath-prefix "${HOME}/Library/GeoServices") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal-prefix "${HOME}/Library/Caches/MapTiles") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/MapTiles"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (remote ip "*:*") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.GMM") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ConfigServer") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.GMM")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb new file mode 100644 index 0000000..473c797 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb @@ -0,0 +1,483 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gizmoappd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (subpath "/private/var/containers/Bundle/Application") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Preferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Preferences/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gizmoappd.plist") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Preferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Preferences/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.carousel.tilenavigation") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.misagent") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.carousel.glanceservice") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.lsd.open") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cache_delete") + (global-name "com.apple.carousel.backlightxpc") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.gizmoappd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb.xml new file mode 100644 index 0000000..1460650 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb new file mode 100644 index 0000000..abce251 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb @@ -0,0 +1,394 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/root/Library/Caches/com.apple.opengl") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/GPUTools") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelContext")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.springboard.services") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.system.logger") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.appwatchdog") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.lockdown.host_watcher") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-priv-task-port) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/gputoolsdhelper.sock") + (local tcp "localhost:*") + (regex #"^/private/var/run/lockdown/checkin") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (literal "/Developer/usr/libexec/gputoolsd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb.xml new file mode 100644 index 0000000..46d08f3 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb.xml @@ -0,0 +1,50 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb new file mode 100644 index 0000000..c7a16cd --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb @@ -0,0 +1,515 @@ +(version 1) +(deny default) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Fitness.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanolifestyle.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.companionsync.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanolifestyle.privacy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.healthlite.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.healthd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/Applications/Fitness.app") + (subpath "/private/var/tmp") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Health") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/Applications/Health.app") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (literal-prefix "${HOME}/Library/CompanionSyncCaches") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanolifestyle.plist") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Fitness.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal-prefix "${HOME}/Library/CompanionSyncCaches") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.healthd.plist") + (subpath-prefix "${HOME}/Library/Health") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") + (literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanolifestyle.privacy.plist") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/CompanionSyncCaches"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.springboard.services") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.routined.registration") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coreduetd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.awdd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.system.libinfo.muser") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.healthlite") + (preference-domain "com.apple.Fitness") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.nanolifestyle") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.nanolifestyle.privacy") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Fitness") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.nanolifestyle") + (preference-domain "com.apple.nanolifestyle.privacy")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb new file mode 100644 index 0000000..fd7d877 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb @@ -0,0 +1,559 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (subpath-prefix "${HOME}/Media/Radio") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.TelephonyUtilities.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.logging.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (subpath "/usr/sbin") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Media/iTunes_Control") + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iaptransportd.plist") + (literal "/dev/aes_0") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iap2d.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Radio") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath-prefix "${HOME}/Media/iTunes_Control") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iap2d.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iaptransportd.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") + (global-name "com.apple.ExternalAccessory.distributednotification.server") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-bind + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote udp "*:*") + (remote tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.iaptransportd") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.iap2d") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.da") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.iap2d") + (preference-domain "com.apple.iaptransportd") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mediaremote")) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iap2d") + (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iapd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-kext-load + (kext-bundle-id "com.apple.driver.AppleUSBAudio") + (kext-bundle-id "com.apple.driver.AppleUSBDeviceAudioController") + (kext-bundle-id "com.apple.driver.usb.IOUSBHostHIDDevice") + (kext-bundle-id "com.apple.driver.usb.cdc.ecm") + (kext-bundle-id "com.apple.driver.usb.networking") + (kext-bundle-id "com.apple.driver.usb.cdc.ncm") + (kext-bundle-id "com.apple.driver.usb.cdc")) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb.xml new file mode 100644 index 0000000..5885e3b --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb new file mode 100644 index 0000000..e44936e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb @@ -0,0 +1,576 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/bin/sh") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.deviceproperties.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (extension "com.apple.identityservices.send") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (subpath "/AppleInternal") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.identityservices.idstatuscache.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.setmme") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.registration.plist") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.migration.plist") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.notbackedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.subservices.plist") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/IdentityServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.identityservicesd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/usr/local/bin/figplaySS") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]identityservicesd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]identityservicesd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]identityservicesd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.identityservices.idstatuscache.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${HOME}/Library/IdentityServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.identityservicesd.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") + (extension "com.apple.identityservices.send") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.deviceproperties.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.subservices.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]identityservicesd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]identityservicesd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]identityservicesd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.marco") + (global-name "com.apple.absd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.datamigrator") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.apsd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.imtransferservices.IMTransferAgent") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.awdd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.absinthed") + (global-name "com.apple.networkd") + (global-name "com.apple.idscredentialsagent.embedded.auth") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name-regex #"-idswake$" #".+-idswake$") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog") + (remote ip "*:*") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.ids.subservices") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.da") + (preference-domain "com.apple.registration") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.identityservicesd") + (preference-domain "com.apple.identityservices.idstatuscache") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.ids.deviceproperties") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.ids.deviceproperties") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.ids.subservices") + (preference-domain "com.apple.identityservicesd") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.identityservices.idstatuscache") + (preference-domain "com.apple.conference")) +(allow process-exec* + (literal "/bin/sh") + (literal "/usr/local/bin/figplaySS")) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb.xml new file mode 100644 index 0000000..78d5266 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb new file mode 100644 index 0000000..73ea0ee --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb @@ -0,0 +1,569 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media/Downloads")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (subpath-prefix "${HOME}/Library/Caches/Snapshots") + (subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Media") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Library/MusicLibrary") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/dev/random") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]itunesstored" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]itunesstored" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]itunesstored") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/MusicLibrary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/Snapshots") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]itunesstored" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]itunesstored" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]itunesstored") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.absd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.cookied") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.springboard.services") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.apsd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.adid") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.biometrickitd") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.mediaartworkd.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.cache_delete") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.absinthed") + (global-name "com.apple.networkd") + (global-name "com.apple.ondemandd.itunesstored") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.medialibrary") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.itunesstored")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb new file mode 100644 index 0000000..4f5d5d4 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb @@ -0,0 +1,419 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelContext2")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.iohideventsystem") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.xpcd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.lsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.fig.movie") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.uikit.GestureServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/syslog") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info-pidinfo + (require-entitlement "com.apple.security.exception.process-info")) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb.xml new file mode 100644 index 0000000..bc9a832 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb.xml @@ -0,0 +1,32 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb new file mode 100644 index 0000000..787af27 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb @@ -0,0 +1,353 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.librarian.ubiquity-container"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${HOME}/Library/Application Support") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/db/timezone") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.librariand.plist") + (subpath-prefix "${HOME}/Library/Application Support/Librarian") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.librariand.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Application Support") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/Application Support/Librarian") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.ubd") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.librariand") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.librariand")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb new file mode 100644 index 0000000..d4d54c6 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb @@ -0,0 +1,170 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (literal "/usr/libexec") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/usr/libexec/limitadtrackingd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.AdSheetPhone.management") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AdLib") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb new file mode 100644 index 0000000..4343b3c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb @@ -0,0 +1,347 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/run/lockdown") + (literal "/dev/urandom") + (literal "/usr/libexec") + (literal "/private/var/run/lockdown.sock") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Applications/Preferences.app") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/AppleInternal/Lockdown") + (literal "/usr/libexec/lockdownd") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/root/Library/Lockdown") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${FRONT_USER_HOME}/Media") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/Developer") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/logs") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/preferences/SystemConfiguration") + (literal "/dev/random") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/db/launchd.db/com.apple.launchd/overrides.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]mobile[.]lockdownd[.]plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Notes") + (vnode-type DIRECTORY)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Calendar") + (vnode-type DIRECTORY)) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.WebAppCache") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (subpath "/private/var/tmp/MediaCache") + (vnode-type DIRECTORY)) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Voicemail") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Applications") + (vnode-type DIRECTORY)) + (require-all + (subpath "/private/var/containers") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Containers") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Media") + (vnode-type DIRECTORY)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/run/lockdown") + (subpath "/private/var/logs") + (subpath "/private/var/root/Library/Lockdown") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/lockdown.sock") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]mobile[.]lockdownd[.]plist") + (subpath-prefix "${FRONT_USER_HOME}/Media") + (subpath "/private/var/preferences/SystemConfiguration") + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (literal "/private/var/db/timezone") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleEffaceableStorageUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "AppleNANDFTLUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-set-properties + (iokit-property "auto-boot")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.AOSNotification") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobile.notification_proxy") + (global-name "com.apple.mobile.installation_proxy") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.syslog_relay") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.atc2") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.crash_mover") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.mobile.insecure_notification_proxy") + (global-name "com.apple.ait.client") + (global-name "com.apple.webinspector") + (global-name "com.apple.xpcd") + (global-name "com.apple.mobile.assertion_agent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.lsd.open") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.streaming_zip_conduit") + (global-name "com.apple.symptomsd") + (global-name-regex #"^lockdown[.]") + (global-name "com.apple.afcd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.crashreportcopymobile") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.atc") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (subpath "/private/var/run/lockdown")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockbot") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.purplebuddy") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb new file mode 100644 index 0000000..660e72f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb @@ -0,0 +1,293 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreservices.useractivityd.plist") + (subpath-prefix "${HOME}/Library/Logs/Handoff") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath-prefix "${HOME}/Library/Logs/useractivityd") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreservices.useractivityd.dynamicuseractivites.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Logs/Transport") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/Transport") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath-prefix "${HOME}/Library/Logs/Handoff") + (subpath-prefix "${HOME}/Library/Logs/useractivityd") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreservices.useractivityd.dynamicuseractivites.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreservices.useractivityd.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.open") + (global-name "com.apple.xpcd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.SharedWebCredentials") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.awdd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ctkd.token-client") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coreservices.useractivityd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.Sharing") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.coreservices.useractivityd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb.xml new file mode 100644 index 0000000..4627e68 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb new file mode 100644 index 0000000..29a0adc --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb @@ -0,0 +1,131 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (literal "/dev/dtracehelper") + (literal "/Library/Managed Preferences") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/Managed Preferences/mobile") + (literal "/private/var/Managed Preferences/mobile/com.apple.mDNSResponder.plist") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/private/var/Library/Preferences/") + (regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds/" #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds$") + (literal "/dev/random") + (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/" #"^/private/var/folders/[^/]+/[^/]+/C/mds$") + (literal "/dev/zero") + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/db/dyld")))) +(allow file-read-data + (literal "/private/var/db/crls/crlcache.db") + (subpath "/private/var/tmp/mds") + (subpath "/private/var/db/mds") + (literal "/Library/Keychains/System.keychain") + (require-all + (require-not (regex #"^/Library/Keychains/")) + (require-any + (literal "/usr/sbin") + (literal "/usr/sbin/mDNSResponder") + (regex #"^/Library/Preferences/[.]GlobalPreferences[.]" #"^/Library/Preferences/ByHost/[.]GlobalPreferences[.]") + (literal "/private/etc") + (literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") + (literal "/Library/Preferences/SystemConfiguration/com.apple.nat.plist") + (literal "/dev/console") + (literal "/Library/Preferences/com.apple.crypto.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal "/Library/Preferences/com.apple.mDNSResponder.plist") + (literal "/private/etc/hosts") + (literal "/Library/Preferences/SystemConfiguration/preferences.plist") + (regex #"^/Library/Preferences/com[.]apple[.]security[.]") + (literal "/Library/Security/Trust Settings/Admin.plist")))) +(allow file-read-metadata) +(allow file-write* + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (literal "/private/var/run/mDNSResponder") + (regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds/" #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds$") + (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/" #"^/private/var/folders/[^/]+/[^/]+/C/mds$") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/console") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero")) +(allow iokit-open + (iokit-user-client-class "NVEthernetUserClientMDNS") + (iokit-user-client-class "mDNSOffloadUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "wlDNSOffloadUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.awdd") + (global-name "com.apple.bsd.dirhelper") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.snhelper") + (global-name "com.apple.ocspd") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.mDNSResponderHelper") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SecurityServer") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreservices.quarantine-resolver") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.system.logger") + (global-name "com.apple.awacs") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications.2") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.webcontentfilter.dns") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.blued")) +(allow mach-register + (global-name "com.apple.d2d.ipc")) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb.xml new file mode 100644 index 0000000..fdb457a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb.xml @@ -0,0 +1,52 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb new file mode 100644 index 0000000..5e3f9ea --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb @@ -0,0 +1,612 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (subpath "/private/var/db/timezone") + (subpath "/Library/Audio/Tunings/Generic/AU") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoProcessing.plist") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Media/Memories/MediaAnalysis") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaanalysis.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/usr/local/lib") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaanalysis.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoProcessing.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Memories/MediaAnalysis") + (subpath "/private/var/tmp") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (literal-prefix "${HOME}/Media/Memories") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.open") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.xpc.activity.unmanaged") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.xpcd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ctkd.token-client") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.mediaanalysis")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb new file mode 100644 index 0000000..bbcc4f0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb @@ -0,0 +1,852 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.rtcreporting.upload") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/mediaserverd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.settings.bluetooth.audio-route.plist") + (subpath-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") + (subpath "/Library") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/AppleInternal/Library/Conference/Environments.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.bag.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (subpath "/private/var/wireless/Library/Logs/awd") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.rtcreporting.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (extension "com.apple.mediaserverd.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${HOME}/Library/Logs/AirPlay.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoConference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences-sounds.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/usr/local/share/firmware/isp") + (extension "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Media/Downloads") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/logs/mediaserverd") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.audio.virtualaudio.plist") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.airplay.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (subpath-prefix "${HOME}/Media/Podcasts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.celestial.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoProcessing.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath-prefix "${HOME}/Media/PhotoData/Sync") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.audio.penguin.plist") + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath-prefix "${HOME}/Media/PhotoData/Mutations") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (subpath-prefix "${HOME}/Media/PhotoData/OutboundSharingTmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/usr/local/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Music") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/dev/null") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]mediaserverd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-data + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Downloads") + (subpath-prefix "${HOME}/Media/PhotoData/Mutations") + (literal-prefix "${HOME}/Library/Logs/AirPlay.log") + (subpath-prefix "${HOME}/Library/Logs/awd") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (subpath-prefix "${HOME}/Media/Podcasts") + (subpath-prefix "${HOME}/Media/iTunes_Control/Music") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") + (extension "com.apple.mediaserverd.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${HOME}/Media/PhotoData/OutboundSharingTmp") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.celestial.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") + (subpath-prefix "${HOME}/Media/PhotoData/Sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.audio.penguin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.bag.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.notbackedup.plist") + (subpath "/private/var/logs/mediaserverd") + (subpath "/private/var/wireless/Library/Logs/awd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.audio.virtualaudio.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.airplay.plist") + (extension "com.apple.mediaserverd.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]mediaserverd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CoreMotion")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAudio2DeviceUserClient") + (iokit-user-client-class "com_apple_audio_IOBorealisOwlUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleD5500UserClient") + (iokit-user-client-class "AppleVXD375UserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "AppleH2CamInUserClient") + (iokit-user-client-class "AppleVXE380UserClient") + (iokit-user-client-class "IOReportUserClient") + (iokit-user-client-class "AppleVXD390UserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "AppleH4CamInUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleVXD393UserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleH6CamInUserClient") + (iokit-user-client-class "H3H264VideoEncoderDriverUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleSPUHIDDriverUserClient") + (iokit-user-client-class "IOAccessoryManagerUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleSRSDriverUserClient") + (iokit-user-client-class "IOAudioCodecsUserClient") + (iokit-user-client-class "AppleH3CamInUserClient") + (iokit-user-client-class "AppleUSBHostInterfaceUserClient") + (iokit-user-client-class "AppleAVEUserClient") + (iokit-user-client-class "IOAudio2TransformerUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOStreamAudioUserClient") + (iokit-user-client-class "IOUSBDeviceInterfaceUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOHIDLibUserClient")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^stack-logs") + (ipc-posix-name-regex #"^OA-") + (ipc-posix-name "shm_pcm_audio_acl") + (ipc-posix-name-regex #"^AppleAURemoteIO[.]." #"^AppleAURemoteIO[.].+") + (ipc-posix-name "shm_pcm_audio_sco_write") + (ipc-posix-name-regex #"^[0-9A-F][0-9A-F]:+[0-9A-F][0-9A-F]-tacl$") + (ipc-posix-name-regex #"^shm_notif[.][^.]+[.][RW]$") + (ipc-posix-name-regex #"^com[.]apple[.]audio[.]abl[.]") + (ipc-posix-name-regex #"^AppleAudioQueue[.]." #"^AppleAudioQueue[.].+") + (ipc-posix-name "shm_pcm_audio_sco_read") + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (ipc-posix-name-regex #"^/FSM-")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.virtualdisplayserver") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.commcenter.xpc") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.marco") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.iap2d.distributednotification.server") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.symptomsd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.GSSCred") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.iap2d.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.b184_monitord") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.networkd") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.apsd") + (global-name "com.apple.carkit.service") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.securekeyvaultd") + (global-name "com.apple.lskdd") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.iapd.distributednotification.server") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.iapd.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.geod") + (global-name "com.apple.awdd") + (global-name "com.apple.NetworkLinkConditioner") + (global-name "com.apple.iaptransportd.xpc") + (global-name "com.apple.lskdmsed") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.pegasus") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.filesystems.userfsd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.audio.AUPBRegistrar") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.internal.mediaserverdtracerd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.b184_mcu_commd") + (global-name "com.apple.xpcd") + (global-name "com.apple.ExternalAccessory.distributednotification.server") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.midiserver.io") + (global-name-regex #"^com[.]apple[.]coremedia[.]") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local tcp "*:*")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (remote udp "*:*") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.audio.penguin") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.audio.virtualaudio") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.da") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.voicetrigger.notbackedup") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.rtcreporting") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.coremedia.bag") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.settings.bluetooth.audio-route") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.facetime") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.coremedia.bag") + (preference-domain "com.apple.voicetrigger.notbackedup") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.audio.virtualaudio") + (preference-domain "com.apple.facetime") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.audio.penguin") + (preference-domain "com.apple.imessage.bag")) +(allow process-exec* + (literal "/usr/sbin/mediaserverd") + (require-all + (literal "/usr/bin/syslog") + (debug-mode)) + (require-all + (literal "/usr/bin/trace") + (debug-mode))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb.xml new file mode 100644 index 0000000..889d903 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb new file mode 100644 index 0000000..3f50028 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb @@ -0,0 +1,435 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (literal "/private/etc/master.passwd") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.afc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/usr/libexec/mobile_house_arrest") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-data + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/GeoJSON$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/GeoJSON$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb new file mode 100644 index 0000000..ae1cfc5 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb @@ -0,0 +1,507 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.assets.read") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") + (subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") + (subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets") + (subpath "/private/var/MobileAsset")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal "/usr/libexec/mobileassetd") + (literal "/usr/libexec") + (regex #"^/private/var/root/Library/Cookies$" #"^/private/var/root/Library/Cookies/Cookies[.]binarycookies") + (literal "/") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/MobileAsset") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (literal "/private/var/root/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AssetCacheLocator.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") + (subpath "/AppleInternal/Library/PreinstalledAssets") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal "/dev/random") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]MobileAsset[.]plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+") + (subpath-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$") + (regex #"^/private/var/root/Library/Cookies$" #"^/private/var/root/Library/Cookies/Cookies[.]binarycookies") + (subpath "/private/var/MobileAsset") + (subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]MobileAsset[.]plist") + (subpath "/private/var/tmp") + (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+") + (subpath-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cache_delete") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.AssetCacheLocator") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb.xml new file mode 100644 index 0000000..feb0495 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb new file mode 100644 index 0000000..0a12bdf --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb @@ -0,0 +1,422 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMailKitClient.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/dev/random") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath-prefix "${HOME}/Library/NanoMailKit") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMail.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMailKitClient.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/NanoMailKit") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.lsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.da") + (preference-domain "com.apple.NanoMailKitClient") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.NanoMail") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.NanoMailKitClient")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb new file mode 100644 index 0000000..2519f06 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb @@ -0,0 +1,616 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapsSupport.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.companionsync.plist") + (literal "/dev/aes_0") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/null") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapsSupport.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.Maps.SpringBoard") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.marco") + (global-name "com.apple.Maps.gsEvents") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.Maps.IPC") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.GSSCred") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.routined.registration") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.geod") + (global-name "com.apple.awdd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.marco") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MapsSupport")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb new file mode 100644 index 0000000..7bfa8ea --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb @@ -0,0 +1,543 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapsgd.log") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Maps") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/Developer") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath "/Applications/NanoMaps.app") + (literal-prefix "${HOME}/Library/MapsHistory.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMaps.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.companionsync.plist") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/dev/null") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Maps") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapsgd.log") + (literal-prefix "${HOME}/Library/MapsHistory.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMaps.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.geod") + (global-name "com.apple.awdd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.NanoMaps") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.NanoMaps")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb new file mode 100644 index 0000000..cd3fc63 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb @@ -0,0 +1,532 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/null") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapsSupport.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]MapsSupport" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]MapsSupport" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]MapsSupport") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapsSupport.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]MapsSupport" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]MapsSupport" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]MapsSupport") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.geod") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.routined.registration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.apsd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb new file mode 100644 index 0000000..56d89a0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb @@ -0,0 +1,296 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.lsd") + (global-name "com.apple.xpcd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb.xml new file mode 100644 index 0000000..bc9a832 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb.xml @@ -0,0 +1,32 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb new file mode 100644 index 0000000..05f9ca0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb @@ -0,0 +1,314 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.awd.plist") + (subpath "/System/Library") + (literal "/dev/tty.stockholm") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Duet.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/usr/libexec/nfcd") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/nfcd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/NearField" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.awd.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/nfcd.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/NearField" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write-data + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleCredentialManagerUserClient") + (iokit-user-client-class "AppleStockholmControlUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleSSEUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.xpcd") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.coreduetd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.awdd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (control-name "com.apple.uart.stockholm") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.Duet") + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.stockholm") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "nfcd") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.stockholm") + (preference-domain "nfcd") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket + (socket-domain AF_SYSTEM)) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb new file mode 100644 index 0000000..4a4afac --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb @@ -0,0 +1,68 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.pfd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb.xml new file mode 100644 index 0000000..c8ed3bf --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb new file mode 100644 index 0000000..600155c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb @@ -0,0 +1,6 @@ +(version 1) +(allow default) +(deny network* + (local ip "*:*")) +(deny network-outbound + (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb.xml new file mode 100644 index 0000000..fa56c88 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb.xml @@ -0,0 +1,20 @@ + + + + + + + + + +]> + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb new file mode 100644 index 0000000..8cea1cd --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb @@ -0,0 +1,569 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (require-all + (require-not (subpath "/private/var/logs/MobileLibraryLogs")) + (require-not (subpath "/private/var/logs/MobileMediaFactoryLogs")) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}/Media/Downloads") + (literal "/usr/libexec") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Duet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (subpath "/private/var/tmp") + (literal "/usr/libexec/nsurlsessiond") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nsurlsessiond.plist") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.coremedia")) + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (subpath "/private/var/logs/MobileLibraryLogs")) + (require-not (subpath "/private/var/logs/MobileMediaFactoryLogs")) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (subpath-prefix "${HOME}/Media/Downloads") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nsurlsessiond.plist") + (subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}"))))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.securityd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.ocspd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.awdd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.coremedia.assetdownloader") + (global-name "com.apple.trustd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (require-not (global-name "com.apple.CARenderServer")) + (require-any + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.logger") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.Duet") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nsurlsessiond") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.nsurlsessiond")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb new file mode 100644 index 0000000..679836f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb @@ -0,0 +1,384 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nsurlstoraged.plist") + (literal-prefix "${HOME}/Containers") + (subpath "/usr/libexec") + (literal-prefix "${HOME}") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Applications") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal "/dev/random") + (extension "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/containers") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.nsurlstorage.extension-cache") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nsurlstoraged.plist") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.open") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.trustd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nsurlstoraged") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.nsurlstoraged")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb new file mode 100644 index 0000000..2ce04df --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb @@ -0,0 +1,304 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/etc/master.passwd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (subpath "/private/var/MobileDevice") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/MobileDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAESAcceleratorUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote ip "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb new file mode 100644 index 0000000..1e7ab80 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb @@ -0,0 +1,786 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.biometrickitd.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Passbook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath-prefix "${HOME}/Library/Passes") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/dev/random") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/PassKit") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.passd.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.LocalAuthentication.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal "/dev/null") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ConfigServer.plist") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]passd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]passd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]passd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.passd.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Passbook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/kCFPreferencesAnyApplication.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Passes") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath-prefix "${HOME}/Library/Caches/PassKit") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]passd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]passd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]passd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient")) +(allow iokit-set-properties + (iokit-property "reportStatusMessages")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.geod") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.securityd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.seld.tsmmanager") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.symptomsd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.springboard.services") + (global-name "com.apple.cookied") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.seld") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nfcd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.biometrickitd") + (global-name "com.apple.trustd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (require-not (global-name "com.apple.pluginkit.pkd")) + (require-any + (global-name "com.apple.AdSheetPhone.analytics") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.passes.usage") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.icloud.findmydeviced") + (global-name "com.apple.cloudd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.FSEvents") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.symptomsd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.tccd") + (global-name "com.apple.aggregated") + (global-name "com.apple.coremedia.sandboxserver") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.system.logger") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.apsd") + (global-name "com.apple.springboard.carditemscontroller") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.bird.token") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.pegasus") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.passd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Passbook") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.biometrickitd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.LocalAuthentication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.Passbook") + (preference-domain "com.apple.passd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb.xml new file mode 100644 index 0000000..b8d494e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb new file mode 100644 index 0000000..a2d5429 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb @@ -0,0 +1,160 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/pfm") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal "/dev/pfm") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write-data + (literal "/dev/pfm") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/dev/random") + (literal "/dev/urandom") + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name "apple.shm.notification_center")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb new file mode 100644 index 0000000..35e4d9c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb @@ -0,0 +1,459 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/com.apple.printd") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.printd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/run/printd") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/run/printd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.printd.plist") + (subpath-prefix "${HOME}/Library/com.apple.printd") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.springboard.services") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.nehelper") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.lsd.advertisingidentifiers") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-inbound + (local tcp "*:*")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.printd") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.printd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb new file mode 100644 index 0000000..154e16e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb @@ -0,0 +1,239 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ImageCaptureFramework.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ImageCaptureFramework.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.mobileslideshow")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb.xml new file mode 100644 index 0000000..7f2c4ab --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb new file mode 100644 index 0000000..70f9b81 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb @@ -0,0 +1,1151 @@ +(version 1) +(deny default) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.quicklook.readonly") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.quicklook.quicklookd.plist") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/AppleInternal/Library/Frameworks/TypologyRecording.framework") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.quicklook.readonly") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath "/usr/lib") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/private/var/tmp/MediaCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (subpath-prefix "${HOME}/Media/Safari") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]quicklook[.]quicklookd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]quicklook[.]quicklookd[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]quicklook[.]quicklookd-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]quicklook[.]quicklookd-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-read-metadata) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.quicklook.quicklookd.plist") + (subpath "/private/var/tmp/MediaCache") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (subpath-prefix "${HOME}/Media/Safari") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]quicklook[.]quicklookd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))) +(allow file-write-data + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") + (literal-prefix "${HOME}/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelContext2")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.mediaserverd") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.calaccessd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.springboard.services") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.pegasus") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.usernotification.notificationscheduler") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.coremedia.asset") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.networkd")) + (require-any + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.marco") + (global-name "com.apple.UIKit.pasteboardd") + (global-name "ScripterServer") + (global-name "com.apple.librariand") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.symptomsd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.webfilterd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.TextInput") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.TextInput.rdt") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ondemandd.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.aggregated") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.bird.token") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.securityd") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.webinspector") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.fig.movie") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.sharingd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/printd") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.WebKit") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.quicklook.quicklookd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.quicklook.quicklookd") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb.xml new file mode 100644 index 0000000..c3c699a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb new file mode 100644 index 0000000..1289c17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb @@ -0,0 +1,120 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") + (subpath "/private/etc/racoon") + (subpath "/private/var/run/racoon") + (literal "/dev/dtracehelper") + (literal "/private/etc/master.passwd")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/dev/dtracehelper") + (subpath "/private/var/root") + (literal "/Library/Managed Preferences/mobile") + (literal "/private/var/db/icu") + (literal "/private/var/run/racoon.sock") + (literal "/private/etc/master.passwd") + (subpath "/usr/share") + (subpath "/private/etc/racoon") + (literal "/private/var/run/racoon.pid") + (subpath "/private/var/preferences") + (literal "/dev/null") + (subpath "/private/var/run/racoon") + (literal "/dev/zero") + (literal "/Library/Preferences") + (subpath "/private/var/db/timezone") + (literal "/private/var/log/racoon.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/Library/Managed Preferences") + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/sbin") + (subpath "/usr/share"))) + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/db/dyld")))) +(allow file-read-metadata + (literal "/etc") + (literal "/tmp") + (literal "/var") + (literal "/private/etc/localtime")) +(allow file-write* + (literal "/private/var/run/racoon.sock") + (literal "/private/var/run/racoon.pid") + (literal "/private/var/log/racoon.log") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.securityd") + (global-name "com.apple.system.logger") + (global-name "com.apple.nehelper") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.ocspd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (local-name "com.apple.cfprefsd.agent")) +(allow network* + (local udp "*:500") + (local udp "*:4500") + (remote udp "*:*") + (literal "/private/var/run/racoon.sock")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (control-name "com.apple.net.ipsec_control") + (literal "/private/var/run/syslog") + (literal "/private/var/run/asl_input")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb.xml new file mode 100644 index 0000000..7c41e08 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb new file mode 100644 index 0000000..5bab0d0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb @@ -0,0 +1,355 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/usr/libexec") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Bundle/Application") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceSendRight")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.pegasus") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.system.logger") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coremedia.virtualdisplaysession") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ctkd.token-client") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.corevideo") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb new file mode 100644 index 0000000..d2c4918 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb @@ -0,0 +1,197 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreSuggestions.MobileAssets.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.webinspector") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (preference-domain "com.apple.suggestions") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb new file mode 100644 index 0000000..6babb37 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb @@ -0,0 +1,271 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.revisiond.staging") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$")) + (require-all + (extension-class "com.apple.revisiond.revision") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (subpath "/private/var/log/com.apple.revisiond") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.FSEvents") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.revisiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 13)) + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 31)) + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 30))) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb.xml new file mode 100644 index 0000000..e93d2bb --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb new file mode 100644 index 0000000..e679cb7 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb @@ -0,0 +1,654 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/Applications") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/usr/libexec") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-journal") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/System") + (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.]routined[.]plist") + (literal "/usr/libexec/routined") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/com.apple.routined") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-shm") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-wal") + (subpath "/Developer") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/Library/Audio/Plug-Ins") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath-prefix "${HOME}/Library/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.routined.plist") + (require-all + (subpath "/AppleInternal/Library") + (debug-mode)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/urandom") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.routined.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Logs/com.apple.routined") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.]routined[.]plist") + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") + (subpath "/private/var/tmp") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.marco") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.navigationListener") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.calaccessd") + (global-name "com.apple.Maps.mapspushd") + (global-name "com.apple.passd.usage") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.carkit.service") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.geod") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.locationd.routine") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coreduetd.knowledgebase") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:443") + (remote tcp "*:80") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.routined") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.routined") + (preference-domain "com.apple.PeoplePicker")) +(allow process-exec* + (literal "/usr/bin/ditto")) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb.xml new file mode 100644 index 0000000..49a8a1b --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb new file mode 100644 index 0000000..4b18125 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb @@ -0,0 +1,547 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/usr/libexec") + (literal "/dev/null") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/usr/libexec/seld") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.awd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.passbook.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.tsmreg.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.seld.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/NearField" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]seld" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]seld" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]seld") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.seld.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.tsmreg.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.awd.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]seld" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]seld" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]seld") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/NearField" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleSSEUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleCredentialManagerUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nfcd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.apsd") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.awdd") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged"))) +(allow mach-register + (global-name "com.apple.seld.aps") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.passbook") + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.seld") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.stockholm.tsmreg") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.seld") + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.stockholm")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb new file mode 100644 index 0000000..1de1fc5 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb @@ -0,0 +1,895 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (subpath-prefix "${HOME}/Media/Debug") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Photos") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/System/Library") + (literal "/usr/libexec") + (subpath-prefix "${HOME}/Media/Debug") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilenotes.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath "/AppleInternal/Applications/Sharing.app") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Library/Notes") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (extension "com.apple.sharing.airdrop.readonly") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Memories") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath "/Developer") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.sharingd.plist") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Library/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.eventkit.plist") + (subpath-prefix "${HOME}/Media/Recordings") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/tmp") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]sharingd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]sharingd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]sharingd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Downloads") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Media") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Downloads")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath-prefix "${HOME}/Media/Memories") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.sharingd.plist") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath "/private/var/tmp") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]sharingd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]sharingd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]sharingd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Downloads"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-flags + (literal-prefix "${HOME}/Downloads")) +(allow file-write-mode + (literal-prefix "${HOME}/Downloads") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.marco") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.calaccessd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.bulletinboard.settingsconnection") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.apsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.bird.token") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.passd.assertions") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.voicememod.xpc") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.pegasus") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.logger") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.passd.library") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.xpcd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog") + (remote udp "*:*") + (remote tcp "*:*") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.eventkit") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.sharingd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.sharingd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb new file mode 100644 index 0000000..589f253 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb @@ -0,0 +1,821 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Social") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.tencentweibo.xpc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.weibo.xpc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.vimeo.xpc.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.flickr.xpc.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.twitter.xpc.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facebook.xpc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (subpath "/Developer") + (subpath "/Library/Ringtones") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.twitterd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-metadata + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Media") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.twitter.xpc.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.twitterd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.vimeo.xpc.plist") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facebook.xpc.plist") + (subpath-prefix "${HOME}/Library/Social") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.tencentweibo.xpc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.weibo.xpc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.flickr.xpc.plist") + (subpath "/private/var/tmp") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.fig.movie") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.geod") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.pegasus") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.xpcd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.twitterd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.weibo.xpc") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.flickr.xpc") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.facebook.xpc") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.tencentweibo.xpc") + (preference-domain "com.apple.twitter.xpc") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.vimeo.xpc") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.itunesstored") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.twitterd") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.tencentweibo.xpc") + (preference-domain "com.apple.twitter.xpc") + (preference-domain "com.apple.facebook.xpc") + (preference-domain "com.apple.vimeo.xpc") + (preference-domain "com.apple.weibo.xpc") + (preference-domain "com.apple.flickr.xpc")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb new file mode 100644 index 0000000..b90ab2d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb @@ -0,0 +1,222 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/System/Library") + (subpath "/private/var/db/UpdateMetrics") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileSoftwareUpdate.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/MobileSoftwareUpdate") + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/MobileSoftwareUpdate")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") + (subpath "/private/var/db/UpdateMetrics") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/OTAUpdate-") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/MobileSoftwareUpdate")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-set-properties + (iokit-property "IONVRAM-DELETE-PROPERTY")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.MobileSoftwareUpdate") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb new file mode 100644 index 0000000..3a4aa8c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb @@ -0,0 +1,367 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.StreamingUnzipService.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (literal "/usr/libexec/streaming_zip_conduit") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/dev/random") + (literal "/dev/urandom") + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.lsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.lockdown.host_watcher") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb new file mode 100644 index 0000000..a266fa6 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb @@ -0,0 +1,501 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath-prefix "${HOME}/Library/studentd") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.studentd.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}/Library/Safari") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal "/dev/random") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/Classroom.app") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/studentd") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.studentd.plist") + (subpath "/private/var/tmp") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accessibility.AXSpringBoardServer") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.networkd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.logind.client.machService") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.pegasus") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.studentd") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.corevideo") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.studentd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb new file mode 100644 index 0000000..b1fe990 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb @@ -0,0 +1,310 @@ +(version 1) +(deny default) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Suggestions") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreSuggestions.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.CoreSuggestions.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreSuggestions.MobileAssets.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Suggestions") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreSuggestions.plist") + (subpath "/private/var/tmp") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.syncdefaultsd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.reversetemplated") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.calaccessd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (preference-domain "com.apple.message") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.CoreSuggestions") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.CoreSuggestions") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.suggestions")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb new file mode 100644 index 0000000..a67682e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb @@ -0,0 +1,416 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${HOME}/Library/Caches") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/SyncedPreferences") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/dev/null") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]syncdefaultsd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-not (literal-prefix "${HOME}/Library/")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/Managed Preferences/mobile") + (subpath-prefix "${HOME}/Library/SyncedPreferences") + (subpath-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]syncdefaultsd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb.xml new file mode 100644 index 0000000..ce5746c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb new file mode 100644 index 0000000..43a1e55 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb @@ -0,0 +1,135 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal "/private/etc/master.passwd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (file-mode #o0001))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-priv-task-port) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb.xml new file mode 100644 index 0000000..c45fc8b --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb new file mode 100644 index 0000000..da7dd71 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb @@ -0,0 +1,131 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/private/etc/master.passwd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb new file mode 100644 index 0000000..8560e1c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb @@ -0,0 +1,83 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/")) + (subpath "/private/var/spool/mdt") + (literal-prefix "${HOME}/Library/Application Support") + (subpath-prefix "${HOME}/Library/Application Support/Containers") + (subpath-prefix "${HOME}/Library/Inboxes") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")) + (require-entitlement "com.apple.security.system-group-containers") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox") + (subpath-prefix "${HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-not (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal")) + (require-not (require-entitlement "com.apple.coreduetd.people")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Downloads") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb new file mode 100644 index 0000000..1d90015 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb @@ -0,0 +1,344 @@ +(version 1) +(deny default) +(allow file-ioctl + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb new file mode 100644 index 0000000..73c6b66 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb @@ -0,0 +1,386 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.filesystems.userfs_helper") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (literal "/System/Library/Filesystems/exfat.fs/Contents/Resources/fsck_exfat") + (literal "/System/Library/Filesystems/msdos.fs/Contents/Resources/fsck_msdos")) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb.xml new file mode 100644 index 0000000..78d5266 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb new file mode 100644 index 0000000..badad35 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb @@ -0,0 +1,276 @@ +(version 1) +(deny default) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Media/Vibrations") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var") + (literal-prefix "${HOME}/Media") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Media/Vibrations") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Media/Vibrations") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb new file mode 100644 index 0000000..fd5e662 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb @@ -0,0 +1,417 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.app-sandbox.read") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-not (subpath-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory")) + (require-not (subpath "/private/var/logs")) + (require-not (regex #"^/private/var/mobile/Library" #"^/private/var/euser[0-9]+/Library")) + (require-not (subpath "/private/var/tmp")) + (require-not (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers")) + (require-not (subpath "/private/var/containers"))) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/containers/Bundle/VPNPlugin") + (extension "com.apple.vpn-plugin")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow iokit-get-properties) +(allow ipc-posix-sem) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name-regex #"^com[.]f5[.]f5_sslvpn_plugin") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb.xml new file mode 100644 index 0000000..e1b6e67 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb.xml @@ -0,0 +1,53 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb new file mode 100644 index 0000000..6386892 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb @@ -0,0 +1,251 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.webinspectord.plist") + (subpath "/Applications") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (literal "/private/var/tmp/webinspectord.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebInspector.plist") + (subpath "/System") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/tmp/webinspectord.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebInspector") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.webinspectord") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb new file mode 100644 index 0000000..90586af --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb @@ -0,0 +1,217 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/AppleInternal") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleBCMWLANUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.corecaptured") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/sandbox_bundle b/tests/iPhone5__1_9.3_13E237/references/sandbox_bundle new file mode 100644 index 0000000000000000000000000000000000000000..61b6772019da120e3ed531eeef96dabe72d53ebf GIT binary patch literal 425970 zcmdR%2Y6IP`?q(IE}Cq5vZ43hd+*YF4M-6L0qHfAO#!K*2#6?%D5%)cM3JI`APAy@ zARsDO5wRgQEaba?bN1|RWCJ8G@BjMV>s-T~XJ*dKJZIYT%sB~;q?bLToHHD*B!?s2 z^Y3f3XRIfU%Zhh<+@6~Vmh{Va4I?|IDm9>o0K#+bgd<1zJC>Rn#Yb?F=LszR?Jv2<6bU1KHZx`t+(T%e5ql+ zp9;*d^-D^;F#YH0c3wNy&-0}D%d+zQ~G&wAIsW{n9-dk_o zX|<-6npSsO34*R-1iQ@^MKh-YDKkoyzzh3j+)_(CdX#d*O*QTaJtQA8wqxsEk26;zoGroEVK_?^OsFsHZ_%C>6SEg&eX9}lctU#=o&@H ztbNYc{HDH={C$754O2EuN%L%&V%;-l z%I#BnPZ=|%$CU2;J7!8(f?b+Lt1Wh1c1FHkW4fokDYNaAwo?K}e(fpQ-SL92`PIBF zp0qspy#HwOvB`E@icc=i&&4KN`g}3zok`m#eKBb(LDv?7t*OOL$o9S3@2`Ew^WWv) z@zzbU`#9Y*bW%Uc?lY;6slkr7d3oQ@OT6-`cjL<7+6RvOwv*aUszb1Jt2wFaq@t5* zPAW{$o|w3wVBNEK;_iuQ z6ZcMhk)Z1Zf?b-$oUeL=eI@y|?>EubFWu95Vn<&NJJ!!@*WO<98)cz=9aE>JO~}NM ziGNH8@z#50!l?=GO*k{*AVJpw!u8UAy04_*+K-xWyDx`dYx}3{YyW2!+K=`4t)1o* znop=nuyialq11$k31udP5p;zTGHYK5**}A`v+5liZOT4{A^6 z_kZo*|DA>Q=STVd`$D4%jY{*}ILgxP&>h?E*mTFCJDwou+DOQ(ea`*+4@TN0`K_J( zBkkU$*GEqD<*;M@yu9zPX6=+*<8b)z5B}4Hk=A9U+LFz&qz1q5%CW)5Zm>K2mTs`r z|17RL+S||D&&{6VBmI5fc0}6|X`Z$ttn}y+H;lM&d-RC&1YJKu|DF2j`dYev?bAJv z-2TArc3qe2o&COVyEeG?9d7q)-+Oq^;c1@U!>xJ?4F7J}@nHpqe@M`E1lldK_}|k$ zW!RKqc3uC8_7l9NeEM*3?Q;+FYrlBt;-P7tMMJH6%MUFu^tU19hyFs)bspL+vS_u- zj?2!P@82o>^FFZe?;Vmf#4h(g(cWJ3d#?|!eV~^!ZpgSHLkL#A1BWCG=`dvAkah%J zZ3%XZEN0gJ->uA?*P8uyoL~Fk`@MCx(`HB;YW#P(X`ahR{?)vkky&UT=;c%&Qhi7X zg4M>NL*j=N8d7vfL4vOQ1iSSXb8hPeJJ|}f^{)5H*0e0N5A6Ft2LCbmTY{zA_NiO1 zaz=y@FCIK|@ZE!F z5Ohr=*ri$g?^!$J2aomDbv;J@!&zuwbg4P zYtz6d2Cf>oY2ZqNuH^)~%@(b8*>Tw!`TqG5eB>_~xQMzI4qSMR+Fxze`zQK4!FQ=%pmBRMzGs#G3VMh_Lbzor1V?XTa+-;uB*A<)`MOHkjxl<*QY+9Sfx zYv1o}Yv;}l!TUaN$6J%ICSfVT(s6OZ!h{(KixZ|1bWI^-)_$UCn;n;(dEeSs(i6Tn z$bo&|B%zTnhhJ;|PYvj$2EH6>K~_7SHLF(y)n50hOk0EOGduTQEw8Oz=2qCTHq(u* zmpRYBrGM9Se^Bi=drI*X?YspO3MO3aU(owZf9ij(|H=M8^*=$-b&Qa?mYmyqi+m+n z^L}Cf1^tuy`}LdA|N5+Y_Q*e*h4z6X|Bn85^iLpII`-|~yMLShefzf}=xRZ@UfTa( zpY2@Okjs&|?UFK|Y}M#rgXdqvtK)z3E#~#p-X6DE&3jAd-?PxZxEXI&o}2pLgmjZn z`y2aT`5kUPa@w_L?@agAes)jzcf6c=Id=WQwYNw9r7W~h>gS*Lh58jjy3yORU;Ccv zd#vxTeUB1!ebD!CU%Sl~bAGx}%~z7&(hb!9QlCHj*mc>ffuDgpo~8ZOEZvBW!FRlq zef;lolKUk08Ah<`ZPBN0pR#>g^eIiyRgz%0$YK#>``Kr&@1N>zm*nsJ!2N!1?-{-v zey#1F0=2ix3Eubi*-q`pGiz_Pdb6iPZ!^Z}yb#p7?A*q-xxjv?q8)pMjb#Y#{23`4e`oYnV3dLHF_wc~RJ^}O;IYk&5z%kXRe za}Qg;bkE5iM}0Z$SU)ejit>-?=Hc_JKQIdXMxTj}xqxUHx?9B-UtV?e)Fl zwS28O)2EwX`#@W7e2?q1-`mePDGTje^zirnneJ!0?eT(fkzAO;F%bZ<) z>-=?RXO}Mtx;}$;X%=%n^6%?xmt<+bu>ZpTfqg%}^ITt!z&^KrzI@(aZOt$Jj5COx zpGqBm?d^K3md)-wyK^ET@Uq)%afZ3uj+@?jnz^QTwk|u~roWza&nTa6O1-1AuHl_C z*B^MFonn=7ZQ9%Si~XMoKJo*1ydIr(j{$eNli3ZO5>-8?jE_*>1 z+MnxWjV9&W*J)p;#|YLv%R9~OG^x|_PUAY=$-m1xjV9QoS5z;Co2o&Noe_J42WU+=!Jk%jhOb@ccB zOC2{Oz0}dtepSbX9cOf0)o~g@*A#-4V*i`-zAx%4$=~uj6YHls}<|0cFQ z3;p%!r}x|N7LuTAW1IDD9yHhbHmlpLXtUfK@4v(Ul+!&6TG{b4%}Q-?m91gA zXL8HdE$tkwTDEH0q-8^{23!qWrg>_TR>_yHeDe~^XOcB9}O!jQ(MZ;$hYTO z;MWU*tKRp`&NZ{kwO4~cUdxWBI_%SpQLkKm{vf9@B6EHxF=r?u6;&hf8VDyPHVi9VCm**JgM<*jXjNr5OfV9WY#|Ceedv<^A{>tb1=Ync4EmUe|t+FF!=iaO3we`zfza48cCtol8 z5LA1q_@@ZP3w|!;bYcSl?fH;1g`NA>sD|GfS_g08m+ znYBMT$G_%hZ^xVOE6J~YpqDeH{v=-xzt;Yr0_(Nf6kL0|y?e9Jen@?lY31rvzf=82 z1WT$_zgqob^=s8HLeLdYuuHQThHT$!%^-jK{PFfZ{(90qAJ?;DZCg*$hxP2c?N#q+ zy`$u_V*?pjuT|2OwZD0L@V*cHZN%C2X4mUZu*xe_FT9?!UYUCT)cvb&8F-O@trYv; zoUeMD>)K@m@B3wS7yEJqYHj^|?IYi=W#x|G+TU5%zvdUHTcB>5r+~NKuj+hMXMdfq z>g*%vdW&F}X3=Vk9hV(z$3HS&H)SsDzoSlC9a~SnQLW=4es-PN{A}DeC=ZdT}KJFrWSMl7ITcRB&+X7*B)K_ zw%WFS>7F*V8oC^+2r` zYTZxJwSwR;Uq9W0?C-_w^nGbxN&b-^XzRt+iuUCQ)Z6+wnD$rR@6TkR{jQoS(b8&a z%?ULJ*PL3@l3LfSTeDQn)-_8IbVU;~Yo8z4zBhYo{=OP^NpG5;-l*|Ljjc6oJ^7Zb zhW|ucIiIVcYt5WBbDkqtFzv6r>YdF(`!%Lct1WYD%te~(ZP|<(lWN>nV@8c31YLs& zcAG8ceATPwE6LyYfjeHg8l`}TRDuir_D1lLA9$`8ULzds!@c!h{d6Pe z`~8{fcDsUWf4aKA@BLcaKLykN%6(t?8noY3eN*)`&n9on9eI;4iSF2vFdU?vSE>5Det^Jkf{gHoZZ?!t}x0<=C=c<08S}t$P z&Q?29?O3(5)s7N$eL%1^wV3mfzuH$)@V;MEZJsZO{Y?DKe&1K!dG$Bg6RQoXmgbr0 zt+#KrzSVjX0hF`}DxNB7p5!W)cI~Rvtx~#5yDB9Kx{4EQy)FJx*?(`k z=ex>h&GlX7?<#-8l{v4~hjv_dUusA5Q~S#8D>pTzStS;ze6dox=hsTVR{EvVwP}BO z-&?kx)jPND4zB%MrgW=S8!D}@bZ?~%)T=9{(&S3RDy38!O3>AZV7K04&e#0PzLKoI z|Mz}>y?-ldMi$!V3DEw7iXT)=^L$Xz(rsJCw2B)lZmakxLDwUM%-ZLC)$8Uf$v^S~ zZN0V?Tl;ccTi;*4%CCn#|oz^T&VB~LDxw_ zX69B)|57*3Q}r5BYNBRC|ql`+6V??dMhSYu~s+;|dW3>z?1se^vfS`QOXG zU;bVG{k{A<1iLhgIq&fRl<<=6em-ZulCHb`v?E7BjdiZkuC)(TXeLf5A8<+EIpRZiL za%aot^VWN!?7^}-%AP2@jiBpQf?b-$oO`%Kd?op{5A6GHWv_4FAIw7gs%8D!hnBsu z?4M;qy)8Re=4_b{%bY87grMs%A+z>5ANiYnCHb`v?EAp)c2wto>f^m1RQru(0==At zWfqp1NU(GqS!QsVE@eiR=|s@gfsk4IR><~>nLQ6T(pQpSdsi8IjPu1#nOwdccC4Sl zY`x3Ze64y;Zz(I6$4cAJ(XV}0eec)W{^{DaxBI3S+S_;k z|HcnX>-wPdf3IDAvgrGCQ>WDvvr5k@J)B@k9ZNSYUA1(_(v=Ci$`b4zvzYUFf1s3I zlE3c*y`0xdZTIE4{Fz*P-`hK0m3_fS{YZ9v!_={|9Sq`CB80^ z=J~pWb;r&U=_NLn*jeH+g0A(1%-TO#Vm0~gxa@ei=Zf2R1=oI8@$J4G_A~MG@{xbF z-^+=4JJ`tIQao_Yf3o)3A&~e>^57p+GEFMXXN{znZNHR2WUUC*l=H6ey#1Ff@vRo-rH@Pm4)_E#r$6> z*DYGNXqu-^QR|*Ri<~KPq{yE|4ij{}Pq0g~xD(m0M|S?o*l&gHlKj7g{6k?|yL8Wn z!fSjv>{vf9*Zykre)#@i^L{0Ds8p*hlM7ESJf2`lqYIBNd^;iVvfFHNn7P{@H?*)W zznu9ee?94*o|$rWEv&0UfcAlR`n9%x(zhG-PyT$D_r20=&E^EvezT{JsnaUOUD#dt zCW0kh{cT2pOxkB>szmbz6BIuA=?W>#Y5QS!mxq-ajJsg?g)a`wR7^@r~mv$2X0yNYGWDU_VQXIk$BGcH1Qd z@B2Ux_unHw*opSjJdfZ1MY8|GJX(esABScH2L%=1%Kc;rl7@Y-et)#}^-{ zxApV2Yj5xOH@p*E`}(o9W9?SG9P@I_-2|&$gJZhHG>vHz(~vNjP@iD8*zVGE8a>gM!;baya_z6SBA@r=@M~@Vbh-9fjeNWB-#Zw*?*o0jm60nW z=Mt=z&54{5c}L`&$Polx!wGhqZS99e=B)37`FMfa4~V=zJD#om-&ttiiT2wX)Q_wi zSthc+SI6yBi$_L9`n{YGe$K3Y&Ud_%5q3%bz7PESdgHJ2-_^|XZt%X}9pTshzKHuG zQVCYeW=AAO+z~N5Vgy0gaDv@ti#cEOe-5`x@@pU1_ou=?@#V0`yPw$~`37s6f$dyrsBcZJOf8yj|4*cgJYQ3Sg*i&kswxa?TEc8yv6PS)VCE6sb| z?JvQq|8i@`dV_7H?#n{^KufoCSm&^21nZ8g+xa=~d;4@F@H^eWzR#|$m(`kY_soH7 z(7sw&wXhO|Yt=sItDdcWVBh~YwLf?b+Gn=&?{}xpH z4A(iAf8HN)9dW%$uyotzdd2m)Yny8WLD!>%|5fd)zZZPRTNuld%zk9WnJ*4b;l&FruFGqTV=aL04F9Il^29p09m3H>7U zgU~afhX}gfBV^V-=d0c$zLJ7#zdZCxzlWQB?dN8p{oGLh$ajZEh2{x$ds~((^g_t# zkX)gk5_Ek4v)1137e6!S)gI;FrTjm=8)Bto{$B5Tt@*a4yDjD%fa6zmP7VLuoH2f$c32*$x-&<#hxcsLpshT~F-gcJ*L6iG-f zDi(FpZkTs!O7W1A#3!bd5KTPH>*2mqFcp>#apap1%OEd?W#Lj-4&DdL!~0gOG-#=S45*j3T}foREBePGdL;Hi0q3H-%HVzZskk zo5OX!hHwO=Z`rK=b@zbAss>-ar*WFI**dx z(VM@MH-BeXoA@rUG3*N4z;5I}2D`)4um^hNccgiGB6mUV1^hQ2rh`FvJmm5Z(&kApan^8xDqtQ-+xSN=P0W*k5M+52HUd z{)baeM)K_;BfR4uGX6(~+~FPnFmLMOG|wowWl5T6G#rLJ25LUs2{j+aLd}P9Q1f9t z)O?r#H6JEI&4)=)^IhhMEs^ zpyq=Ij!Q`jNip*wSv36(nGdNU^UQphE1Gy{=EGf3^I^VsJ}f}id{_uI9~ME)hs99y zVF_HFa<_LrEDe0VjH`RuAFOc?8Q1q2S>qa+^c5j1N!Pf8q~9O13R&sUjQa=7xL+Oe zpm*FuGwvUP8ux3U#{F8TasM#XxL*e~?jM2clGm$V#{HwB(buYfgK3ZIM>gaBaj0?s z1ov(8j{6r$--NscJ_WbJr)gI%N1Epum{CX2=e(i=&qURpC8NLOj_g?t?sx;3&(~h@84j}h=EX}hYCP2yKHl%sp zfrkUhQH0{VbY(hR$h=&d>RU@^d-<2>I3M_glyx)N|VLyJ*@8N&h?K zqDlWV-!B*<2*OKnddmSlEbNS zo|pSH&htTy^ZeYeab5swoEIejqGxXmy@`5GItq!@!~PF7{%d<i@(qcX_akIF*LmvT_^r99MpsQ@2B z--_^2SP4D_D^sqXV->jiF7|)o4?a~bv^w%#%qMZtvo%6%QO`j~P0>6zNPO+ky2KxM z)DcZQB)(o~1LEIt)E7-WB)(y2W8x1u8i^(zMt4tY655>S*(a%~$n$I_CgK=^sbVVWrso1yNC8N={-YxnDm~KlVwjpX9(k?H!KYM5MRL2H?$veYh>{j z*dKOFP6!>y{RznfL^Ez6{da5VU=u$`H1UvmJtTA}^=n>3r|hZQ7?&9t!$OCXu6Yg3 zyuKYyAm0c$366xC*LOh8>rqhidNlXnfZk(ZZg?m0iNueEv*9?H1joZvI04Rw6X9Yw z2`)*V5;_?^4X4rW<;hb;({AWol{`H((ZtUXO*~{hnH4${J`U%Y^x2|Ght5UsrF%SZ z$Q$XNB=j5Uy2fxL7Be=K+nKw?5Re z^B$$XjO52cH-uV#4#dve82Wgq<>$b>EwJyNfNkNE@a!V?f7k)}DcBu84g11ppzObA zq3plspzOcrq3pjGpzOcRQ1;)8Q1;(TQ1)LMl>L_uW&gblW&gbbW&dq~vj1L%vj4V1 z*?-%h?7!_$_TLUD`|mX<`|ou)F6E8TU1mP)6wUL1*ne+^?jb%gWw&VJp|Stog0lbi zhFbp6K4jT{Z$sIC`=RW=15ozgJ8*T%LG#>~C%+r`+*$YE=WNK@2O#tCu#wIFYW9UA zp+`yAz5q%8F!UI*(xI8B$IU!F5&9A7ny1jr)00s9@5fO4?~~P{ReJ=oYgV@Gen~&WS?}pa=EO15}JMT z2A8E@ZYcfoK+W&GQ1d$<)V$75e(jS5p!UgvE^D8>5n1!R5Y#?-6VyI=Gt@pA0`SaKz87^_^Su~)WF!}Nm2g?}9Wvibx=OjM`400A<-XET^SBJuJT410kIO;LUHIHjS&Ewio^SBPwJgy5h zkL$s4DfL|qO}{n}O}|3saU)j~;uBLEizXhLdE69g9yfDY^SC*(=5Y(CdE63e9=C#; z$F1S&ls264YM!(eO?i;<){YZyYy3gxX$K=~o+6Xp$<>*3jYmj&7gtwgr9(51yOA#= zqr0mI>6*vT%;TO=^SBq(JnjuOkNZH)>BC&Nnfr#hZl^sXoWn(9M@hcjIl`rRE4$X7zju(X`8x_~ z{*E^Hsr$na8ud`px$0HwS7Sd!XiV64X3SCcox!3e-GKMNiqgbCETV=RwWm zyP)Rre5iT6z_fFbYoXC^k!y*0UW-NZd?erQyj%0p$PjztUe`S?v;Vv9qkh>F%b=b= zGIqgo*Ggoya|Kj8k%_k-+6PI0(Djg4hB0MR*SH=w^{*98{gC<} zaji4?A92m}sD0~2lMZ?AkMX|B>IcYp-DqTuSIM_I+5e5+Pr5ddPyGYQ_mt~tWaWcq zTt7p;jErYp&ylWi4b8ZI9%@{_05z^RLyhYfp~m$~P~$ocu1ii={fz6EMbqDqalOU$ zD(M>6kall1?Nob6H_vrD)N|co(qDJIX6}34wUhP?cfKJSy(JHG?z(JT?-_Zj(Z*M4t1Y#u4Uyk-y^pMRLdretIs~`CBW7HG zAR0X(UZ3$-wCMk@)6W{ISDmRJ|@4$^(Ro{`cw4OxITrfadR4K zTz>{Nu0Mww*I&RJY2TORSATzH+I`0LwbA#C>#TWx--zb_Fv=td)IenoPF>5 zk@jeu{{Yn=$c)#YTt6eL-RGg&jZFLn*DuIwKV+Q$>iUg()LuyX@2)?*GGv@zbp2)O z|5G&WfsFHiTz{MV|Cn(;%y}troEyCyVb(ZxLY)`qf*Oac>&^@B;{S)Kzw+?*+Uh^Z zIL~KfjdNtu3xpLUUHu73zcH*3veKcM2RD%~Bje_<5Yjadps6nuY96?t=0O-#{ozpa zAOdP0M8b8+QL2}D5G|VVVbvdN+N1iB&2x4`J?D7p8|o|^R)qVtUW;W`JJysG~QT$9M{THaQU_|B)P))!^~kUBT_0+E zH$Y#F?}o@4FO8tacVnpW-2`fUH-#GCT9;*iHb<7eEui#m>D9NDSKrpeOW!s|zqVnw zP`~tr=-V!=J+kzL+}|;*gDI~g-@-`WPNLBlqHmY5u3mki(YG7-YkqWx>bD+H`u2p< zw-=PYy~!_q`#|a2*Q;+oWa--I#%EDT#je$6kj%m(~_IG_2n1V$m>4NH=~6n??`nS0>(@Lu=_Tt+!VocDz-N7i`` zq~4WbD@=Pn{D z2iu_L!FH&5umfryyashX`8w43;u_x>;Wc7=v z=dc&5pZ7ua^V?AUydRcdz&Z-m-|xUC4{-hu+roFD`u{zs{(m2;{|`~m5a;2r50F)l zSmeGm&k^%HKMXr+`r*T{0gWHyc2R>`Ayh4(w8QE8+I1%gvjQ+ z6O#U2*pDXthp_KW`VW%Lc_$?Or?3kq{pYarCjDp0=DZV{^UhzO&O3i4zJTMmu-}pO ze8gMeAFx~U#jwA)KOy-~(Tpp|c=$W)l8OIEH1Ux2CL_!dZml=atT)bZtv9*CZwR;6 z8)(*>+)(G8d7#ca^FpmR`JmRD{7~yn0q)m%XF;g*&KrqOB)$;TdFM?~=bbl0op*-7 z`7jjfywe4jB!`EG!KYzlxYn%*(X<Y^FXko>j6YnuGE!tqB) zuPvH%X!fhR;g0yx%)5Hfy@vfC>YS7P$D}u;9oo+t5wG{&jlKDsc=I=fIwx%gSL|p1 zht=YQg1)H%;&sB@kva9qmN@ac^2gyd}z-N^}4msLDrE4MwZ=z zO!}hm#iVQBgQPDBzZ+TU(5y2{%{p^W_`TkB2AXwd8I)afACz6Q9BQ3e0kzJogj#3r zhwGA8sb1EH2SlTuq%87j%EI=huSwDg*vx= z4C-8Q1KczB@$ijsZ0h6T*cX}3ZJ#7wcE%_=HWiLkoDtjsPozV@X#yl|FA9j-+_A02ce$xyHL;hJ@`EDLEneJrW_7G1P7-c z4*!7mUSu3Xa~^yI>OA-;)OqlSQ0KwNpw5AhL!ASkfaAO z&ARw0>r*}2W3Q8^sZZ+<2A+Ut;m7b> zcnY3_T3^3|6X5r7GW-EfgFnKMeb(w`3N5Y}QOPUABCf@ib)T8XFmKf2su9(RcQ39cns}JE81>bFC1Fii7S@8= z*J{JcunyEdSQplU^`(F>J{jVp~{?`kROX(fam*Hx#Z;xsBgY)BZ9{H043o>)Rt{M_B7OWPclJWbJRr z&a*GG|3@g_=!h}o)4C4HcW1;{WaWcq9~?)%jEwOS6G)eT56wO}5o#Zt1ho%NhS~?G zK<$H5q4vRPa9#3r)lWNTh^C!thrSz{Y1%Q%v`_6I-t32Sp!P!#`AV@qB*8CecQOn` zPJvpVZ9jT0vi7%mQ2X0ml&k%1KGgoUfcW$C`Th@TpIc<=T^zB5dbH0$p2yu0OOe$M zNICaL+yl43`%Hf>6HWUe``q$~6%p1x2hBdW(%b&~z3pEGwa+~Owa=}F+UFi5zxKI@ zp!T^nJYVf|Ymv3jJq)$at%KU<9)a5D*2B*1ACJNl^Vt7kKAy)0c#P+>5q<(6hk9O5 zK=t>N@Ey1b>iInd_57Zu-dmmQ|H!{T%Ki_xu-`ogTT{>Ta3}H$a6jA(KY%a7kKs#D zetH^|pPmlor@sv4m%l>!-5pyZUPYEaC?28Qt?(1L4QfB$4!?ps$RF=u|A%hJ>k)4d zFF#)lLEoLk$C17Z#yZ}N$o#(Mt%yAl@^jvb*vE60-?SHM93d0`cEkZ>^~Zjw{y--F zorr_T>KBOL^lrp^)Te%cq`x0=$ScE`(Mg9Rj*wsFe*jfJGWQ*gIDxG4KlG*_gR1Aa zH=okmBz+Wte`NeFX!g;Mna|osKOsFM`O}C~5thFJ*+)-Dd=_E(8_?`)pF{0yUqJ0^ zUqbC`U%^Dq1HXoI;2HQ0@!vr0qi5k#;=hGjug}2;kiUakPrrv+Pk(?~Pk)43Pk(}1 zPtQZGr$0ljrx&2s(_f(0(_f+1)8C-h)8C=i(?6ir(~D5+>7P*R>0eOm>EBT6=|52G z=_RQ3Gy{%HaYW{d)OzX^&HRI`r#D3AAwDrBw`k&_Sx@sqt*7}St@SiNvewfAQ0r+y zsP*(lsP(iET%B?gzX`2%>SocDr}Z?CBQ(+#iG9g9gsc*@|FuJx3sBW>lgK#^YXH!Yh5e{wJw%7_i_FYwJugP_f?LpWa2AFR`Hf6YMrcV z(yK*Qr+r!{A@$UVtm$n(q}n@&E!4Vs3)FYM z?O^J9_J64Lt^;(i9(IIU$E^3hT_QV2YTkE=>_)w6S68TZArs#{vL~|I*8{43$i(-G z?2W8;Le_&mk$ovw?SiEDi|p@}VNAWp5+Ze8qH$%Pmki{7+4;9dT6X>*`1?Wjf5}VP z|KZ`3p=O*WB;OV|PQxyc&%6KgcMGikg4+L$tnr0R|BZ?qO}fSjBz;WeoybauX8esM zUq;5b$noCs2hI4K0JZN=gxdEfLGAmKq4xbLQ2YK=xGs5`>SaDn7tMHpX5UXV<6>sy zEaWq^8`7@Xrk!dR`OI_oKt1;)@*O5$GW-svz+*5K2HFAhkTu@#f*SAhO+D=YP~&}} zkrzcSCSCQ~T!O6eez$4I(#U(LSK}Shu6rYwA*)@Ga+gQm2e-hLX1uQujed~veShRC z@A!shd_UmTXSG+K2cgE#Lr~*q4b-?-hoQ#zI`8;?1X<%~J=FMq6l#1w1~tAn zKs}$0P~-SUli{<<~w9KOz1Z_-o2@k;!7}oUqvnhx55f=8>|esqrd9e z0X6<#BVK;)>rnN+0afo#sCsun)%zw?y}P06-2+wcTTt)8_QGQ9Z~LJ9;cixg{R;#Z$20w zOZ~@TVR!<*P5B=|`Q0a>{O*sT{O(Vn{O(Vo-s_!$I@df6yTQ+(&NV-WI@kOH>Rj_n zsOS6@Je=~icYQb$xIW}PhQD~0eePrUE&Ppfa1P4u_>T5wB!3_IL!@PQK<(z`j`L7<$Ino9#|0?6;}D{&s#Sf4cyb zzg-ai1aE}*(!N4)YRb(~H^Cxz-y9VZW%WBmZ&y?(EOEChD$E-XDW_;uIP3=_U{4qc zyTT~g0Y<|%Fa|bpOz#_0LEat5b=KY=a7Kb_~C;@d&P!j5V zpcK^kKxwG+fih6%17)Gk2gW^1A7~DBKF|W{e4r)F#kg+;^YDCH!ve4k)VV=hsB?o` zpw122!MU(KoDVxdox690I(P2`b>7|?>b$)R)OmYXDEqh@lzrSC%0BJ^Wgqv1vX6T~ z*~h)1?BhOA_Hkb*`?w#JecT_)K2CtLj|V{6#{;44<6EKZ<3UjN@n9(XcnFkzJQT`4 zz738`85VUr{g9A6Tr~Xv8P6l4?jSxfWu$20p|OugLD|Qnqb&P)46^LwJE833u~7E$ zI4JvgJY1bJfxiW%{d}Tm%Cqc^$^4ZlYrllp6H|>WdjgsLb9&Sa(zSm=(i5X*A}bvl zdt(;)GBRdI%^_X(E;ROr2g=?^g0eS~q3n$mD0?Fn%HEg@*Co$Wy|nKx(X>zX=W;BF zT1@&7-UlzF{1T2uMwVYmJn2iK?j~LDi$$GFEH&-E$LOJUQ;xAmmO!Tj^%A(GZAA|AyzS#y?YhJo%Bh-7l$D!U2JOP#ONw{b3Q&F4X*wm+@0^Sdx z|1(j~6R+prt=4ui+cscxb*S-wAb&vkS^zdz12=j@?mv z$R~RZBEJ>27g_xVY2VvX``{LMz|52Vq8T61IhA_ffgX4eE`aaC``~-%E&t+uh^ zq7Fw{ehV~q-3Qbo|KJGJxHt-p{|{x?9fPv#j+0+@-3chW?jtCB?j)2w_c4?`_X(6e z_bJr)I;C{R*J-Hn^%>OnP@ls~#D4+vF@C;;q3|mh3%`aX;2Bs6egkX6v*!7ni~82| z%ekoU(QlyhJJIy3d6O;LJYXJ40tRd8UvPMwtZVdIltO?ZnvZheasTtfew?%YwI5xFK zwEPn9?@h$GlUhf&ik5%fI=U_Wq50SbYCa+pe@k?GWX;QVQ1cR*_zuw>ku^Ud{(7hA z&Xlit2}$n~-PJ2YzJur%-2=S`IJ=AH`9bRM72VV1?-kw0r1ut0I^?{tZ*+g^QM>v< zwF{a05~2qot6c-U=>wtKcdIua>D)g!`Zkk3G29Q z8GSo!j6A~RA8FE+pL~p)QPFo2Uo>^J$o*rCtaQb_-ZW(Sd()x(y%|vcULy6#-5P#=-TlD10>9Q6K_7 z2DhQ#2J&e?q#WbtJsxfOc~3z3c~3(5d7F6N8OcvYKOJrPc@RJEndoPuEk6$$Kkqpx zKks=cKko%7KW{UXo&6$g#P@J7!SYMk|KTE@Pdb$U_cD~f_X=!7zAdm8-@m*H3)9}M zQ15@YLB03g4xPw5U_tmAoI$?V;R?!q19qdFolx(2cfqH~_a@YN_im`~Z}vd>m2W}$ zm3yK5%6(9N<=aqx<$fr?@&MF(+;^b-%7ajT<-1UR<$F+m<@->6e(GmX ze&FX&{?!*y{?(UI{?%7d{?*q|{?!>M|LPkk|LQE1fAuYte{~MZzxoc!zxp1^zxn~n zzxol%-~0*6-#icH*Z&OVcV2+urQP#SOm%sEDGfZ7K8Ewi^E~C z1e70G63P!O1;?e7jw#D?Nk}dun&$$U2jyZa5TBS*UNrI0_< zdmTE{-(mlckzd%@#LF+V<01BZvzX@Ompu>3*CM7RvhqRWKei%YMn>zHHl)jcgvNht z3*|rF0_8upgYqBSL-~&#p!~;F4mplf>w**u9clbN>{@!>O98l90sF#4DEoCLdh~P7ikXcpJw$zXJqPN$YY)_S*Gc5->r9SGLDqX@NW137 zq?&fkjk$~TKF)cfDMxZ|=lqxjURjhsyb#KsTm<*bT@texj!j(>li43$8ncXe_4hrL zQ^Iktk<~ss{yr1GJZ1&?6fepjUJ2z7-w)*vuQKgp|2NN#{olwB#ymv2#*580$n&Xh zEnEa2Hu=`YtVh;3dIV}5+47@a`7x;9v)%wx;YM@c<1tSnYkWNcHNI?llUIJq~Vl2NJ8o&BA>XE(tI@EZ71IkX`31uJeg0kD+B)|OX z-B5n@9w__$EhxWwFO*-s56Z888@`W!vLEXEi36}U{?$8h5b{Bopzr@^UxM?!nD>#@ zzoO>XAt*ohFqEJB0hFJ61j^4n3gzd12<7J>T+-%Y-YF@KnR7i0b+U(fk}iqZWkPqO^qzoE_-{((AQ zxCC{+kO6hR;E1*SV`r@V<6N;fAnSRE@{e;vtv`97)}Opk>rXzY^(Q~n`cnXE{V50& z;Ehmzdm$+Q`X(s<`evy0DFn)&4~6pQT~Pjf813li43CXKRy#zUBSk`u_b90G9t}0# zW5}=Z9*eAT69@Gjj~m{CJrWPQ!ou)=`l|@kI#?8H9V`a54i=}JzRnV{C6P5gME(9r zsaQSlGO?v$E?ACyeVk=Q(>}?)o#kUIcx6%kctt3Gyb_c@UKz?CuL9+dSB3J&t3mnW z)uGnU8gS3tTCp|Z*wk9F0sc78txjycSlM}X`M(@Ap6ZF@vwy##VQhm~`I8M}8^>Dn zyb;tqM<%{WY%^rd_oh(u9hvy%u`Q4_?;(C`%h*=bulWv1ZynplD?|L|wz2KVuXW@W zsPd7yuYGK1WR>5+o8A$so=)C;q%&{3#CA3LIsZrgC#73#FVb_R_KfY0e)&^-NJhV& zBIUCGLw8c2*xs-@OfdKL70o>BXYT7S*~~M@eS=~Lz|nA^xo=SHt5?jJ*xEgTr7aI2?9`x5J)r1ndh(ney5Hq1q|goirwPG^`FMl27yJ zPN?}a7Ha;CgPK3%q2|v7sQIJ(38|A}Cwt2it0zr~ooeFQ|7mxdq-n9!iPt%TST=P= z>`XHb6GbyFA?=tQJImZZJ9Z|&N7CClN3_zt=L|`)j`+V1;Qzz+d)fbCCzuK|h?o7T z^MrZStMi1rh}U_-e0Y)c1yJ`dgt~tb)cuR0?q32+;D_A}bzZR)>b&9}sPl?@q5S=2 z@Nmj~8qe%^%e~{D zn_@ScdHGcA)86q1@xPvleby^O{IBO?pZCfT|LXchw|f2K>2YWLHThfq5Qay zq5QZ{;JB1eV^8yZ6OvDf=J`VWxX)t0AU-kWbJ4^@CF1Lenk z1Len^h4SORg{xD}nQ^>4`MXTxSbzWZhgi#R`w`Y*p8NzG!t+pm-OteP&;7#x5Ms9PKZ_j(Ne_t&MV5UGkzH}&$g-=$pzLa7^ovk^Mn6&eO%&9A6HUIk2iX6i?7mp| zC2|}r$@6r>$}k@OKzw1IUn6IcxT46iE5uF27c=#gh%0W|Q6jDs`Fc4^iYA}r9?sHn zWxTQ|`=Kn9{ZJ0dekf1Ap3Vw!`fghGgZ=$H?AJ>dY(4xoA?HC4T;xtwb{tTH;!vcyq<3psOM|T&Af7R zDF37d`JIlIajm@L4kEXXYvb()h#t4ZwS`+?d&WgVay!wC3y9y*A+BSb<##~icXaah zUuSRsb%C-Ix(F4lw=*e@Heb)vZ(Pj32J;z zh8kZ}$k)?3HEtTR#+NAj6#I~UJ~3`aoa}_exLG_$&6Al>^8}gr*>N6ZJ?}YC&l{Qe zq_|{cJ$H!xk`k9nxq8l!^to~KyfP%;U2*e?m)#+jO*bN`Y! z*&RKccZ()n9K&<7?TUNj9PxJ`FN5Cq8^+#PPJOaBRuC_HVFgElC@CvJPh^zVV&aPBk&+x5B0v`QKODnToTI>F+?NhV(*Bou&U$b0N}ToHVhhxJi&u%a-&5$l#I`ug4%*Ih z%t+o5_gb7~KSAuE*W=!Zv+O5m_V1lg`~EJdef~|jh5dauH0S?N?*-n1?MUAX^`2oL zOrTwFL%na<5B2+H2jC6q?Ei2O=?9_gm3N`uKfDL^-r;>1#_#zag1Mez|A)iK{{htd zfg@1opzO0>q3pBYpzNsMq0Zy~fI5%A z2q0Zy~g0j>8hO*QCf%<*uOHk+W8Bpi(4!3n4?}R#!&jocJe*@HaUb&&Z^U4GD zomXC{bN+l#=luEMTv!0khXtYRzZ;?Kzd}&<-%U_<-_1~VUkH@l7Yb$fxuER6Fetk( z9LnyCfU^4{q3pgWD7!Bj%I=GSvioA8?7lcCyUz_}_r=3;DTUod-I`}bMAKgoyRVqL z1o4R}#YGbjjonug%I+)Ww(P#r$g=y&K-qm|q3phLP7>`53+w& z=Ks00>^O*>R@KO|(~zA%?#KUkD_;$FP4dZ}gXF8_u8pjG(AaZz$d{2(*Ikcv*>lj? zbM>L@xdu?@@eQHuxkga-Tw^GEt_fV1+*I|`&Ss)%C&UhG;ciX3&SzUvehEh_BWu4S zp7b{EwxrAM5OwZ;i-~XNZjUUx1ENOcR+A+{Qz_f3m zdl2<>bKWYNeMoXw=U}(&H0fvCYePwwy>=Uvy*A9;&;Ac(uib9s5$;i>>p6`y&*=^$ zs~kIiw22?%zSCPD%k1#Hl!%yG}sPVEAYM$H=e}}7}#?J%Puko`QS>xwHsPXd<{E**6Ujy}b z>erg`A9g>2+~+a&f2hAxFIm68vL2S^zDJ?{Uj1Y6SLXEwsPpHIP~-7&DEsjVSf2b( zLfMI%pzN`ypw6eChLuTw2Ffmd7RoMt4$3Zl9_sJ9yg>U4I5xXqM3!A=$T)rpS?8E( zP`^)*4u4H~#r-lIocfA;3;l7C_Ca&r_$t(S<5sBi#%)mNjoYEl8+SmRH@*gS-uODy zJbDA}nY+uq6OK*Y<$jZLHIJbA&S*C*NqhG|eGl~()b~nzp}v3GNBi~t)7#MP*zZ0- zyyk(Z@1NcwUf(|*gt3ly-S2tRMV-&S4|P6!24jj58cOz zSNWp8i#iVVUDOFP4^Fy2GV|x8`xEkabABwE{F1vmKXqd-8`-j(KXadU%g+7G{RMi< zZvGr<{38?prTc4S&4aI?<^eMCXWZW)Yd%2i=Ckf^sYiA*B>kNGJFg7M_r3cE;$=6B z)sud7|3tc;E5wdI@4jH#_p@l)2eG4nb^l`W|LT?<-PQSVeKco7zX zf5M{hFIWt+|Cn>Jf7qXNE_R9bWF%*}9r2bu2(bs9@wwtHdk`AC;RdMhD00J=o7n$h z+b7unq4xKDQ2Tp+sQtYFlwDE~YM;LmYM(Czwa?!Kwa?!SwaeZB;;_W6=f`+O;=eZDl*K3@i|PASX(*{%JvoM_6k_W26@Z{F6r4B5Xc z8Cm-`GV64e_^PC9ora`Wi?5EXbZGYX8sy8!s2N|2bnWlZ?C-Uq_V+qa`+Hre{kzAtmm(MFM_(k7B*&61s>2+^X>%t@)V zC|k6sNJ|GY}+XI+i<1Fyk*IX~B;zrS=HZc6kG<)U}I-~Qzy+ zq3HcK487m(K<~HV=>0YVz27R)`z?;%Zwd5%t3vO$k?8$)Cwjk)LhrZHI3RIX+SqWv zjnQ!Zko#?1+W2t4-K}9dhWl*-dcRFf-EWhKz2ELZ@3+b5{Wb-?-|oe!iThIb+x`2W z*YF;|gP|PJ{-fpcp;WniI8`pEG2L=GJ(R;4X)`(BmP@2uK9V+z*m8-iKPPQ=*xsD9 z$HH+vs$u_;ylHOQ<7vsf2}9mAkM(Ugo4(f1EOLVu5D3;G`7R`fl@kJ0xKx1sMLeuBP-_$m4x;&${s#Lv)ihR@OW z5O<*OA%20rhxjG>9^y{)J;blj`|)e^e*6Z#AHPNK$M4Yl@q6@s`~kfme?;%cpV0g9 zXY_vj1-&14q4(pj=>7N`dO!Y--j9Ev_v4@F{kR*wAOAw{$2~Y8@psz4q1^tXq1+

+Q49db=lDZ=a3U+r4mV;+&ZI!j$;A8n%bL zM|ghhLaxJSkqeajb;$^1dhgi9Oy3^4NW*kw`X#YGOy3Z>RGCiuPx+5VE{i3YZ~c$d z?^lG_`kk2hSH-SozV#|H|C-pf#LmZ1|6j*))zy7t{g`k4kD>m*9;Ic@W_+NZ%W>YU;W+*L8j;&$w}$;66uX`6e-^n-!*L<=hs6em`9osEn7=hL zRKt8^er4>AFn@TglKI;sBQ(rMjxQdL*W=^!Lc39g-q$0;dUwV~v)(6>Q5x1m&gWgR zu}t3<8KYr3GJRZZJkvKs?$$6JnLZ&#y&iu%GEteHtml1S`5u|F z{>Xh{{rh7NvfYm(4`^6l?T1Va$MI0?VV3hcBF8l?Hl5hxLbf|IHUpR9qoLeBqTxIv z`#0M-UL2jHVf(tV^0C<5Sh9bDp&fdh<;~CMq37udwBDPK)_V)k`tC`Vw;fuDwnK~9 zzU|Oc#MXaLqwUaQv>kc|ZHJ!4U9)!$e-8J~Cf`Qeo9EH?;03&ldTuG!nM3=Z+U_zw zckIHKV#|r&j=ZelIFRYD#8xobq#KRl8$< zvV3p+i}L7njGjk1us&Q)eff7RlJ+LQOZ*R(&87XvHq76P{+`2s=zCDrxC0|)k+hST zAI0`q1K(l&1JLoVn&|sewXieuYhyR8gWog$T^D~wK0iEPtw-#**+J;|*um)Y)%s=0 z{W}EhFCNNt`-_L6`+K-C%N>C$@kn(4k3#qVXmtM@p!?qt-Ty}D|3)`PkE02C98J;V zNJEb!9X*Z=^f)rnx6vN` zeW4Cz$=??`75#moj%AVXe;b|fC61#r>)jCPQr4B_%@5UjnC;i~e>l38Me6Q&G+8dE zC(bDAUY5*ru;F8gGs}9ECG#9Diqig-yp&F)R z7+<&p!}EXi_oGK(U#vub?>dhD-gN>iu?nkjBp$=8$QeH=+|ATTD`u^e= zY{znAu|D(1q2tzfqyGy$9(|8-0v^HqiP!)q;YOz4gZ_{4Wb}WGr(jpMcQ5*V-TSZ! z%ioXJQ2rjkwd~)6n8oy|==k_U*phPeFrJ9h@Kl_RXWCdrs{rR-zMeed{I4dou`hiohRl<7kfpJ_# z*2AA!ZpZ8N|1pj0z6-PPSLT1s{NJ#UdhvHGz&|h_|HM4pjk!pD8@`{tr!4tB?7#6& zw)+nrPC5D)#}V(v3HTpQ#%jDDBju69AHpckz#8c9WgmdEiEH9qtcCNjHa>-Q@L8;j zFW`ar64t|4@gQ7<2jg0-k8k54xCsx%Ig4rk@t;Yw|M&sZkH9T>B>H>ZN1?yheKh*N z(GBnu<~PKbh#R5bJ8z7SViWX#s+*$!Q=Nv3FdY|T2KqnMndtviXW{?8ubxxhwLIB> zK>B%kA-11qd_$z5ys$jk-XZ;qqVi&vw|{{wUs7I5?D81;g)x?^t}ZJtXTJSH4E@3i zv|o4(+AnN|_6wV%{lXS#zpy3FjJI+>=ocQVp&TRqy4K|LbfU3q)rVt!{AnctzjBeCBzITih$2{F?%3&2Xte(Ci58o#|4Z7o`G%o{OxG?J?;N~``RC$;cpgs2^Ks-d#{cmQj{8FNcVv3wZ028tE0}&UK2CfI zK8cs&GuQ`Tz{{{V%UzBm7SaCW8^l-Q%gnzD9hbYB<6A*|4X(y(nckLibRDjwe(a0u zu^;w$o%SCuz#H%i?2nt--vKz0mli#Kwf??cBq??=ZuA3(=BA4JR9RQ!kE@p%Xx?|c~lNK7xE zhJC80m(Sqy_atcliT&T%nRq+feFS?@9%rHDaW+~W=b+{BQM5chhW^g^T=YHS$1(i= z4_YptK+ENPv|KJg%jJ`3xm<{r%SC9pdPow2>F)I20@{D9MZNJ3?q>Q1 z+`{yC(f=jhh@Z0lChRzp_8%R;ejk0_x*2^=`vLkp?;oQ7U;GjJKgC<{O7g_5=>N}t zj0f>K+tBB^pI|!Y=~K$_fsyUypAmcCsLyXdN8cmbfxg%C1^OP*m$(ymvR+z*@qcU@ z`MUfYrd!Xd?-6~=^d`*z4jV_lFaIGmUwt0@BRc;66MBFDjQ-#EFX(-~3;o<*S>OBY zH_VLuUj7Hu{T%guqCe61iFTv)!e3~;um`Od{${=%7GAioTpJmld#{7HS9OCd|E}*uzXqt<0l+fx`z1}#z`_OlKuNE>^Uo$M>&3y z!~Qrvk;`<)C-Tt$Z_P*lueAU>v0sJgdPTT#LUBb2>-j&sNPoYyB9@Agaf@Rr%5V#o z<2J0o?bs}}9EN^;bKI0@QIYJgx75(yW9SDTTaoMsAIEyt@zxb>Dw6$bq#t~I#R(P3 zel>>vT3ht@GfzZ+Kl3E?e}PWMozKwzV*~EHcIf{AwMTzfvjf)0Q?VV#+Y#;Wb;3#X zTRP*QMAwQgm@&R<#c8SIK>C-bS9HUi@uyduk(!S5hc2w>ju+sW*b94L4?GLIVNdLY zXJb3;g>CU1JQmNz=6D{Kmg~`e%MED1r9awl z8Gr*4H&zU+u-|f%hU<)+*PAPDW%`iBEgGg{=(h|)`z^OsB>OG56WebYjP_fGp#7Gi zXuo9`PEFhq%F~qi@cqkE=r>eWB=h|^nr|o2e7g$Gw@2bMyc5m0N8$hS<+~~#<9s{b zj?wMZ?_;?i>qN$d>E^*qCodUaF@fdG6Os87D<%;;A48se56e|oPp+84eDh=sdGftz zo_rsgC*P0e$q%4;@`GreJQZigAM$g_lONV_-u(O;k?9pPng22SHv`>IVx~V*F^kyu zc#(K^#T;VuVr0J`4aebrvz?IN&PD6L$62li_xn7Itfc)%+u`|GM!W!z!zVF~ap{E| zS7vlk#eVr$_??!gneTIt#prX7XTpBa{-e)5o(u7kiWivg{y&fI|Gs!>DtQ`0f}1>0E>w*OkiN@CB$K3@;hS5>TLy60n`ZxB1q z_a^hBku?=-*`C)QiPu%EC-!_H$Mbf@TeuWAgmV6lhUmi8K(EMngz*iAJSF=HmWd zuXT>c$M^Tw^YLD5pFQuj-h1tR&M}|-9zAZG(Bt+4b|v17=2=_NeC9Q*xBYD>DE_>oJl6UUyvM(MZ=hyx&{}Q*UI1qHX#0h&QR89O3GbUC|Jczk? z2urXM&&Eh1c?c%p1y}`3v07qm{W1Li^HG>ManZQyn2I&f^SUOQ-_%Ns?f=@?CZSH^ z|IH)nCDu)}->;Y0fcbiS>!Zh)nDT~+jfg$Y$DqfVnDWMn#}a$Iv01mWCW%d1p2rud zZ%`;3blm@k>A3$7(=q-}{ot~8i6^qWwq++I zw#QCr?EXZS-y!j2;=;#B4Hr-j&h;_3%h zguEk+%O)k#9}_2I$#dNQV-HNlt(2#s{YyIfJJuQKIA11?WBf7;yE1(?I-Z?_j$`Md zxy?g z&-;Hkj<_4zPjyd>^;12F?Pt%${;VhYOvA7E{P~HD=U`9VjJ?qDoZcAkXA(ZAybt@+ zcK<@O-S3OG`~5iIS|)J+k1guVa4Er;k&oeF|o*%h1k>ys4@Virtd?k!oLH|#E zIS#-(@d})XS2BI;gdJnAA|Ao`)YbS9@TnFaSlPNckz6br>6!dfVqMy4D{oMWNbFv4} z=XF!j=V%Y2&k-L&pNBn+>&qW;eaV|1)zF_{$d4c6{PH=`<1D{2`b6UN#8`fev##8 zpT3Ufr*EM7>6>VN`WBj>E=AjqWoUl-HkzL>^%*yV3k`58G2E!u>y*AMT^v z_w@IpdD(%mU;a(}kM(fBA^YiI;vr(!6PZsWsS=l9l_ZaEf`;uv^0KN))skX)8HT*< zsHE8TRY$k42HIcOMEmPnXg^(>>CMaPpn2KRNwK`3E^)a3N86YBX#3It&C43%hkXC; z7^d$UX_VBM*zpT>KOT$j$0q20Y>Mv3X1JNSIc~=m=(tKt+(ur~3LQ^64jo5ojgD8f zLC1aCqT`+9D`8xq9orG^|C8eP|LFfvpNKwh?||#eJ0`{2pH3R~8;0lUomqc>uli)> z`zh;l3fdl@niPAUej55by$j_YFFqHZmnRX|r#uR6X^em z=QCYToXqEX;fst*^u`w`zW`stKDZb!#78-Peen(Aez*cJ!uRoF`~*vJi}(NNIKU-n zJ9{bG&R&MLvzMdo>;SZ#y#j4#uSDC~tI&4#YP6jlh_cZD+4T+u6Zr zJ9|Ca&JID_*`a7VI}B}SZ@^*YHzwT_uEXIP&L^auy*cR?%14!t&`^${oxK%pXKzc2 ze>`sH zImI35^Ta#xi2MJfCpiyoXE5ObK6f|gKllHk+;*69+Mj!prZAoD4|@NfbRV(x7~1Lk znU4Gaq^Z=0`+v&)eccB!-2Y>^|3};DN6>cqQM8?&hTQ+VT<`xi?627Jr-$`%`NW}} zo`JSwGx?m?-7NIFn~f>>6zkC>f&QPkJMq)lfBD>`XTtW-{}T_O{8_vTZLimr%}bge zZ#OYvV;TK_e0dAv%X#Ybm;2%i`PhHgO&H$8vQ0R$y;@2m3F7H|f3jc4FAh zmFRZ9kJsP_I0Qe$y|cOh#~X=1#zqwzl0LzqGdCoy!V$|iB(28LxCYB`E#85j;#If~ zhrYHUX+7RU{29xy65;-z*#D8;i2phM&-xcdzDW9#*l}ugeEuuSTQU9D*fR1>(zo$? zb$tFi%3DzXJvNVQN;=~HG_?DhIS#h_TjK5hkC@5+`zf^dKgZkqUyi(PLi_w1*OmF^ zRz6=D{XOZAc>9dB&)bszjJMBNy%YQAFEqd0j^>enqwUfTv|ZYXwoCt@?b0r^UD}Pd zOMB3EX)oF??L*t8{b;*%0Bx84McbwS(01t{+AbYJ+oejhU5X^f+NA`vU8;h%OI2}L zd9~!~$>s+~X}F${cBw{kEy_og*VIssp#I{Ry(RQgG+Ah^c+oc9L zt-N6}?GM-OF&gHFTu+UYk4=u{AsDWwCdskuw<&u4Hbbwc=IHg*0==GEGQHPREA)Cg zE;)8RwI=p@YJ*-+ZPDxLc=UQ|hn~;vvHfz!|Iz;^KAazPNRG7ng?6wbwxZs4b1B<# z63g}c=}fuzJ157dJ0(8dskpxUw6L9}(Jn`BXE=|N*bkmZ$;_uRnv$HF9P8(i^C&Gj zJvr9TV|dRj13iy2(cfjsLi^op?9F{?4*FhJE_#0Dq32gVdVUq4=T{+meifnTS222i zm7wR>>FD`&26}#-iJo6)q374x==s$ZJ-^OD&#!Li`PCim_j;h`*SYBVbsi2YKR>xw zIKO&oIPS>#)jPRQIKM8?P>$jJx)43T`o_<%e#D+%7oq3Z#pwA}ik@Hnaa#E$@$>7_ zBlkP~(&fn`*}wK*NWXMNi0zk%slO`uYU=GbkotkigNUui&~IJCbd{CYCSOOr{T7CP zYcSexU61x#L(qO}DB5ogL;I~8a7Oe-m&^G-T*LOd{3?-~lSfeRxGWOil6)(1jal6P zhxNNHtgq|G^r2rHgQ z*mhMLEkE3^-I07}{5r&N9ZrZZ@2>drCZgBj-RN~V3B3*{Gria0J?M2fh2_|<-An9s zcprKl-j7~~51`lKRCN6x#C+aMc?ezqhtc(a1YQ3}(eo6zT+KcN2~xEbw_x8OGX5q*}>)&Ymx&v)bccSg- zKWKZp3vEw#qwVP)v_0L6wx|2h_H;iED?gC@UuaMN)zFS0?dief%Fv!3(ol|}J&mNq z+S7!TSbtrG*mkrk+KyI3+tH(NT6y&pjyLU84Gr`0JXytYuay#ej#wLgj#vkMj(9Zs z9I-C?eqKHF{k;0<`*{t}_wyQ}@8=zZzMt0!eLt@;dLMEu`uwp8#_vBkZ=0pG;CJMI zh%{Hu+ePD$@|G#bQNAhCN<%qP-a4f%Xy=j z^6w(uHIyUe=cb%b`L~htG?XLdJyUv9zBbZJLpf4@LCS@cua5Ll%DMliyjNM@l#AIP zeareO`{N=F|CfPHCzh3_TuS|vvP)9>;|e4W|CfQ`|1vJaBmXaB0P}a8?Fw|9?aHu! zxc^7T*{%-jGce^E=JQQtkcRb9+tF*8E+KMV%3!ARJVN5@Q-%<`|B(3(OBsqw@D|pq zGuOU;E=IvHe;(+8zD!S<8P1m{mHjSrtU zPieGjg!_N$Czd^(@+|dJ%AQG?iz|>goKHyob1Bb<`uQpILj8Q>XoSyWLVb?^0`&c} z7bve4S(x%7vE!S1Hok;Cqc5kt%I8a?uV^?gkmIu`<+V`0SVK9|-YiLZo#or!U}$gN z;JmA>d^6=O>TPc@v^Pu9=RV8O=RR+v?agwuy;*^_H>Kfs!rx1Im;Wb8Dtj;Gedh0Z zwGutAh$;Udv~Ux)fHmHMwV)FbtqQ@#oF*_`q%{#?E};>mg;l~%5+tf>8fft z|B>Y%m0BxIS6!K|hB94E4bxdav8;A#UFxTl9i3VSS0Hh?PLSo*OFbq`S6`W~VQPag zT|?t=y&%hLlxkivv8=H&U6a&f!*orI!*td!B`;}~8vCBz;kX6!H-BzPx%c6%a1Z(N zad-e*qxo|i>#;5RJ-y@6@5{Br_2uoua!aEpXt>@m^>dI zb33P=oEp1N$B^fqg66rWqIvFVXr9{z{hgXbyqodtB=k9CGJ4;hf=wA`NW~VIhJL>+ z9dBm(3=H@G*pl)1EcAD9veEoD2Yuf!7tM3?&~f^F9L47g(ErIU#3&ZwPt+Hq;|L|_ z|7V|$j-Q`_Te#0U6Hj10&qBxX&qluo*A@L9+&Sp?-@2jSf9sBZ|E&l5{kL<`@4uag z)h6{!Js+!2>6v;F$9H%|uhib*ykh*HxaOn_Qv1YXkng`; zoZ6rAmXk^~lw){*;S%&chfC4tBbTAiM=nR7j|@Pck6eL1AGs2JK5`ZMeB^5M`N%-@ z`N$yj`N%cs^O0-O=Ofpl-`g6DeqZW(^!{K7dVeq!y+0U+-XGk6-XGkE-X9D{?+Wf@o=2b|)_ehBC_lU`}rlmec zy?GW=|9I*X#MWcz7pF5_W#yBpGpM&;#LzF!MDy@jXdXTr?H8Xy`^7nEzxXuHh|YDn z>ic1PK1ltD`ePD4)G%M;h6x|1 z{{QbcuA<(&dNrC?uL+;$`9GRhe;VR-sT-(wzpY32+u``Lc)T%8_j&3U#O}w#eo1Wp z{T226|6l4i>_^WNB>pz_J7V`Uviwb{-{TV89M1b6G#p1HuildSV`?m~#*kP46hA&c z$B)l1Xx{THn)m#M_S0LL-n{yEG_U@H{b63cjoAF>Pc*Oo3(c#yqj~k;=<(iRImde^ zdc6NZkM}P0c<)A!_a5|k??sRIKJ<9+N00XbmfJYt-_-wzJ>I&I_qz{0@g&IKh;8?Kh;K` zKh;6+2aZO+k5dPiv4C`#uha?|C#t&%Azhcb867>D6)3Jp33_KeT&+jbO z*F5WN%FVO7;z075bI{)_=!X6tLU;7{AbQ}{i|GH+_bJZ9g|GAcAJdp`Pjvlyq3hQh zUB3&^_3MMK--YP<^+ngOAG&@Qq3d@swqrh}=zC-R(choA1bu((QZ&!I41J&Da$H|N zAdT&!AG|_Cdw^ja^(yy2q9M_~pYGtxr*HZ8E*6T1nuFC(E z|8IPBNLnm!9Lj#Hj1Eh?AuX0SB6;JDX~WZEc_UUYdWQZV&A)C&^T838b3NRG=7qPS zdEsqn9yk(v;VAU`@}tpw?{@6Oei?&)uYD|@Mm!EXGv6}w{fsD@$Cab+vsK_29FG-v z2b%BQiGDwQ0_*#Gg!_MD-;j5IJajsmhdznsp)=4t zbS74tG&^k;R-ZCEZC;vr=u>HP(qiWUl7~K>Ha8w4dFV4~&&FdU4}H$hh4Tij8_!^ooEH?fvIzJGfr#-;q4;%MhFA5!?T#eM7zdJyQQ|+IPg(W5@%)XFC4>H|+=N z%>yyyft%4ha0{9T{)py*KcRWx&uAX_3-bTJE|)y;Hx1kC^7;M$v_Gg1zyFVZ|9V>} z|1)hnvH8tkXnsS?`u-i(-}UA5p+DM*_DBCP-B{Z1T{seV<0RZe{R6m{cpUxuKD1xn zk9#OTfDx|mf3Y_HhsWSSY>kJ|?9O+xiCd(%BzAuy>vLRsD_nwY(miimYdBt* zu&%6a`tj+pd=Epu*N)Gd7qmx@!wG0Ua3Y!ybU^cfj!bX9*9pz{PGbL z`H)5I`H+oo^1e(Cng`^fc|aa|p5)_n;sWf-_niyT_iKu9F6G7O_r6Qe@7tb^eh>Bx zTuA+y_&T12zE62JzDwK{*Wx+o_lCQn-y80ZzHiwB$1H9st+yeQH?{SspHVD&wrODS&^ zq5sF0k;~Hu#Ou}fgsz~x1@%{A^T<`{|2Kaels+)sd~Z zd>M?MFT|7&Ngqn=d4uGS!_seHd7dXo{f+6v<1se7dD%_rHxqk)AfFqNPF@%CLOi}Z z<+r9sj_--LVLu#+{c#iyz|lAmZ^yxCK9h}OnQuuf4&!HK>9Oa_QGB2Lr5sbJufTL1 zkB*PsfxfqYC;FcL1U!o4dKV5MX8vJ*ceB3cg_9^ZFPx0#WA~tW;1o13yBE#N?!(1+ zKfa6)pwGFdqQAHGAf7pk{vY3={9!b&d;}fOdlXxe?@YrHoDYxTjg&u*J~w{?-LC2A zc0Gx1*9>&KW}@3Q3*D~S=ypAY8;R$jzZ>>6`nzLuaT7j+jw?Qkjwe2c=9BaAT%3>Q zv(IB6T!5wc0-7H$#DVxCy8m9n_2n<8vma@vUeVA_dE6G1FB-Rq^U*wXaeD0cw_d}> zd~ONH)4cTc^jKc{2AY??NqKnx599eLzxS{#ed5Kj>jZhezdU_KdMpn`p6|bt{%(3K z55@31O7Ee+le7~3-67V8cJ_nxpPAl%80lv}3bFkxG4-FMucF>|7^z>KzJ}O(4E^w0 zrmL*{G<_ZQ_QM$Z;q_=gyaDZpKSTTBjc7moIoc0@fit3Cx?K96?k?E#>)th_|HwNbL9mvK>E#?Q%PqZ@AunL9h2; zna=j~H|9SivNip8V%r~G$9w#L;7iPR8@`Eu;tKo=Kfvv{8vn)(xC2Mfe(%IW{0HBr zz1oFeQNJ7goq#=9m-BZoo<;t+5B=W2esnzN05+liUu=v2;hNd>|9BGdp|D+%jLNXR zk&G%Ck!byd1P$$^alM498P(#kHe`xmL+fE*f_NPtI{c^#G(JkR*%#FqvJ0bX#bpv{+>w|&Ywa5kNyru4*I+{7fYzm!z|3l%gG-K z(DSJf{oRS8`2H@&Hj$Ey(<%3QQGa*h4D@#=&cu3m(f_00t2i6|zC~B`_d3qOO>Ad3 z+=|_?JLNsl=f>xvzu$2l`a3G;qrW546a77vUg)?|Z*=_Vf()<23p4s)73|0Q)lcZF zVf~EjC0vwoaXeQ0`BKX5=lf&J$R!z<#_QF7{xZt#=P$?RkpUT3#OrkgpT82#SFXal z@M?Sr2cr4VAe@KS;9|TMJ&wyQR>Y^Ho^hxLuK%VZS5WGcn^XOhWP! z>hIQ2k0BqJoDpetC+EREI1#7dWV{#e!~5{a{NVwXYyL2ma`T4=(fr{dG=F#)%^w~? z^M^;#-{YKyjvGCO<;?eS{D|@=(B)4@m;WTX{2A!-XX0w6n}znvv(fzFDfD+X=b-)i z)9859Tyz}i8T5Z1pGEuo=g|Is9@^i}NBjHd(SCjbx}7iJ`tpStv3~wVJ>1WS=Zi0A z#KwtUVLwzxU(HyQ5$m6kaiYZ;uVuvgXAI*AOVDwI*U@pJH_-Ri-b8=r@h$ZE<5Kkb z<1+O5ae1(pWe2tEee1ndUe2b2ce20#Ye2_6jhJ;vfg z8I|$t7s<;anNDwB=5zzz;{G4~pRuZ$w!76bkD}iE2bsQlW{vpt81lH9OjlW1E3-EB z=5ZMExH@PacQl&E)kX8TdT1V3AI;+$;EZTP*MmIn7!CUeY400nHl^M??pWsEF482# z_Dhsg-z>8^^}ZjC#4R#g64#hT{~zL3nQe&uzqI4x)3rwbua9!3Z=2aJ?5E>3>?fqW zedYlc` zb>efFZ;ga*ncaz9j+#IAK>NpYapm~)Gta}J73XL6WIx(JVnQF*^YFM*Z(_%lE5ELX>oEk*4@ z$h!~z) zyN2rt$PK=Xj{Xx?!L)0>~)iRR}M*dFuqyNJz0 zCZhTI-DrM33C+(ZqxtzgXnsBg&Cl;e^YiBKY9@u^wp@5s$&KD85` z%A7;&eDq%O(x-6))6d24@frLLpT!;c9QvGd9_}uGK65@^Uh#b90`}j2+HDNKFZTkP zZ!bji$QRLk^(B^TzWOq@jJ%ThD&;O;%~uyuZoax0n@3*DToSKW$KhT_$I0HHzE;AU znQz7Gk?VYE=CXLKUgvM4*ZFevI$wca=kK7`@w@2t{T_OruVg+o65h}JfY|jy&gTy^ zKZ?id|4n|3=Fgv?`SU6?e_oB|&uh@Uc`ceZe~PvX>u}}x4Vmk4XvK!i&)9Fa3mDo3 z$Kh(RpAV0Re8KV^5BZY%s+50~8L4?a_iJBM-kJUM4dwB1kC0b=ml?~ezGuFb(M_2@ zWXAF;B(K_>xg|4}S7CTQ^&|Q{Sr{M`UTCSens=B-_U$%D;|22`+xNJssBLp zrfv8+<0pTj-y8S~{ocTKG>`ck&0}_;dCX2UkNF49V|Jl=%x*M~*@NaWd(k{*ADYMP zNAs8iXdd$~n#cTy<}nA+JmwIZ$5f(uOe8Co$0VS6OcfkfUN!5eEZdK28rlyekExzj zlk!pJH8hlC$YW}uc}(rBSRPY{*gWQFG>@r^<}vlqJf=QQD{qix9y~SLP{aH%ycg6c zEB5_?#_0D3jzzyW&;Xr6Ntn&)&z^PH2>Jm(ZN z&p8!mL{D?MY;PA0+w1bHM3S$DPjFwAL>Kv7oAiM@`_pgtjT zX4YA(hy4!{pPki}*!4u_+b!!HT!KBq`O{s)b|U@Hxmo9B#rhu%{m=RF?duuezFuhm z(;Mx7E~ z$NS@3Dfj;PHuU~@Bzk{53cWubjou&Mj*efCLC3GhqW8t)&~f%MbpBEF{<$2z&#gf3 zbI0TQ@;kzHS{l9c$m=w;t9Nl7`@OG;tXF09?yN~!v33<{S0`uPlND=MG2E|CLGM@Z zMc;e954~@_A8kh;K;L7Xii=pU2k{Mj2;ats(RTF_^gY%`(f3%V;j*W=|3}|neH{J$ z$|unK*6HYb2Tv;HGtm3rndtrNEDXQ@kKUg?g|^Rg(DwOhw0)k7w$IO??enu}`}`c* zKF>qj=lN*+{5;w|FF@Pp7tr>3A=*B_h_=r!q3!d_X#4yM+CIOE-e)dC+vmkNto*gC z*TeO-M8oxkw9jv3y%pN$H#L-FXrGs&?ensD`}{Vs?elW9eO`gK&+nk^^Sd~${JnVl zyz^>=;we7Np^M6dgwm@bd=>SyLtE#a4}Ux}TMj^lj%4b3OF;`7A6hxu*G z`Xel7Th?EEu4=-c8a`)SC1HD(?XvSZ+&=H1-u8JX+CKjiK2QITw$HmmyeDfv^={YR zuwDB??0gQF9|-0DX8jjmo_e2iFns<{Rwc39eb`8LtbI?&c0W|fu9_V?u1H)h`zT`f z3$k7{va90~td(tkP*cNxN5}uO>tx5r|A{xU|BmMKwxe~?{aFufKkK9IX9Kj|Y{>Ls z{2y)K8)e7Z_r}DwqsL+x|Hm-?kGAj4FpU3W82`sG{*Ph&A01~t4jpH1jULZ7%)eSf z+w9|s-GA!wY=<7t_UL<)Cxq=eF}oviUq06XeQ(lu0Cr+NcSTOh?o8}_)cb{#(ed|F za02r^70uI6L+>}bp!s@Y*w4w?NmwP4oSn-2swSjpn4fW#gtYAc`y4tmJ0shEB{Msl z{pbG8LiaB*Wi~W;xY0blL4_H`=dVfc9&B(0=Vgv|sCsK6mYhj@w>@TgbaFM(1CO&c8qUzetzh`tnP&%{NP< zmuWa}F+5)#z;<~*aRuAubJHucWAF7{MeOs{tFvRzR|lfcR|ipk{vgD^n*jPhi1q6K@9!iFti`M0e$c8M)du);pq71P3Ze;H>2;bjX>XDy9IrJ z?N;>twcD`Tq*2);vHFxz+2vf9!z)H--yXj%k@wfeWRH!<$op&KvdiKz^8Q-X&xQSg zyuVhFeFx<&Cym!oj^X{aJJI*~CZO;0-G%n66Vdni?nd9|n}oj4HyIsQz6X7uZwmT8 z-@WMjeD|U6^WBfW&-VcOKHpSyT>3#=N&FDnFF%a-=Z~QGWsjo$^fa`eehlrWA4mJ? zC(wR+I@(V^iT2Yo(0+O*+E33y`{~(eKm8QiPtQU7>8H_tdM?^eKZEwu&!YYGb7((3 z5ACPtTe!rFdCFh_0G|~?*3$gt$aY8fNrRA81D?&T;PWHP@ zZ+nkS|6cY=VyDN@Z@=TQEZWBi6*9!g~Fj{R?p$Vs*d$8jpX& z2E<$O1pFOO!9T+1wq^fGd~dWJmT+Vz*PDD18DpHFVowf{)hIb2U(8yONWSU?<>*%G?EkRPZQAov^MYG{9Y6xyFwNAIUaL89~~cSgdT^+=y5m}-Oo+X{ofQl9?j7G-W=WUEztei65Zde(EWd0j{CWF zP8(wPvrgu{x3-keh#a5O&goch^?w@LqsJlk+_po`i8=O<9dbJ5#Ll;l==nxW`AIn^ z6MGywqsM`m@>6n7CH8nA{q1QvU6`-?AE{5wNs7nFbjdj>l!y2Kv1M6WPHLDgEyw=U z_0dV}$HVu7nK`lhwk+(wi2fgcr9KDkFLTl7j)$kuXF2w>1(bXLScvPWFT!)M7&l@G zdf#|Ddf#{k`rgx-Xn%YbHhrG)fAoI~yQ24x=b-D+4PB4!=z8=(?{e55bxoSUj`z}J?>%SP+mzUAMfd{xzkmzT|J`^Ix3E1gq5tRiGWvghub}_u_bQtAEJB}?FGin} zzlJ^^UxGd#e;xbb8|e24-bC}Hx6u4(DViTGL-V7z(fnvRnjft|^P_jr{ODaYKY9<% zk5;1j(feqA^Z}Y5eTe2qAEEit$7p`^37Q|RLi3~5XnwQ?&5zdNu<}oH)^nbeM%QUL zPmtrbA!j4yqsl+iP>vx#`W(%VzQ~E?M_&?~AAN=9M_;4)(Kl#*^es*+|1Pu#Q={J> z*&dJ|{gAVt>(=}T$#=Gd*nEeW`k!)srrtaQssAPCS7PfiP|5a7N>#!=mfz|L` zJPKD~b@clJHPHU3Ci;B07Wy2gHm)3hbZ#9ST5)u4-Q3u791QPo*F)dmu8+RI-5@s- zO-N{%YrbRu8_Rnd z^EdA~j@W*;HJbOdLB|o=qIu8pXkOC}&1>4DdCdvvemoIW=o>zoZ_x$}^d7s|fu+wv3#e+m&+jDfKz!Ih41cz8f}=bkFS(uUGS`bJ6qWJoIIAMbEp-SigjX%X0@1yMNU04aD-jt8%Z*H9xy5cOdieyt^7b?}#ZMlzT0) z=ifEx`A1Cob-9CyJr9w5@A}*!%-8b{sUMm}D<>q@jxNLat&6K;mo6zME zGoKN;BZ*z!E%EwW(dFJ2pN@LYpHaD^!}Rq3*s^R)?(LX_N9K>dPd<+AHxDY~bLKzM z+*tloj^;lVxsmYw#qrc1ng86G8_Rztu-wY%UAYr;WBCt~|J6-xz1ih`{$R?{`qCJe|`n+pI=4$=S67$ zycq4DUqk!nC20TrI@&+Kf%eaDqW$w*X#czv?Vp#S{qx&s|GXUSpI4y$^E+t&{4VnQ z|GDq89sK^khV4N5=MQo}qMYCV*HDh3fBqQlpFhcs_0Ow_?Vnep{qq{Me_o6B&z~Z{ z|DS8V&hP(gn4kH&zkmN3=bz)^8_{v`&vWe$>HpDj@h{`&=U2ph|1b9&&O`fiB>pz{ zJ7W7s&}+I)L66{fn;mf9QSDL0n&cDD3CbXyuXnIXuTp$ctUqRr0*9 ztL9b9i(S{qb$wJ`^}N`1jbZ$<20DIO6TSXwq1Rt+^!lrVUVlfU*I!-q`m2XtfA!Jp zuK`w@bWC1DtUl$KycT(0e~t1Q=f#c-a{V2f*CZYz*I(1TX7L!g{+j!_a2%2AuVvnG zl((GJN<%q@>#sFBe%S_Xm)fH3((!1!)DCTz+N15#323`?BHAu>K-;B`XuH%2ZI@0$ z+ojHEyL2-8T=Nw4zU5Tx!*Mh35a+X#Ssr=Kr~9`;v#YFZpQuQh>HEg=qUygtjlmX!}xvwlAln?aLWx z`*J4QzMO@&FK46eOINggIR|ZDx}oh$ceH)!fwnK_qV3Ch$nXE=_2M{{Mtf>FPDuOG zJFgGrqslMPP>!K}xe#q%`sT&jmwv>yFBhTh%f)E>Qi`@O{gL1Q&5N}!mui?F(mq_C zH;(h$_5#W8uL!aEJu&rHq_`Tt-v|Gys1 z|A(OY|4=mlABN`tHz2?N>vC!ThHF?qm(TD2=G{uYelhAx?GMaDQ!}^n9=G{wdzJ;vM{dxC=^}IiC zD)p6-2Q=i9#)l#g=6OHh_Nx8C!_?a!Jc9NIkA~0F|D*lEV5%Ha*17 z=WzLqP(CwnR(yHtd!e(@=cP}D`OL|iOYDAq8r`pl<7eXWvthdD^5zk{pAS2q*u3d^ z>JuUh@?K#7c%C8g!n_xWJr2lryqxzEF2PsB_3(;@^8gtKUX-^uFLpnK;eO~fK5w45 z1U-JQqxs<*XkPdxnuor{^xh9GMem1}vEAMey-jRhx*WY9T7ljVy@TEly^D?mzlYu* ztVHh@-bcrQKS1x7K1A=AK0@!8K1R=@PjD39FJ6UvXVd@V4!&Q$2F>f&qIvzN==Ye` z;V$aeVo*^XXEf8)yWJM(tn(2AXT|8U&AjxbzDyU^=sH+miIVSU)6 zdHaaN{W5yrvOk#<_*T}C)?D>V z^LysU@=6SOWiK?Z?2QM>pDsXu2fPnfXZ{zWp^V7@F-%-3A&Cdql_vCF?;4r4U5_@o5uEP23=d01*zZrY&H`3^Ksz7x%pC!l%qU1**>5zUkDM)TxJXr4S7&6Dpz^W-ULo_sHw zC*OzWyZ57c@dIdHJQdB0A4K!nhtNFsVKk3@1kGa~Mf2EcXde3*n#Vql=CMzpdF*sF zk9`u&V`rdw>`XL|orUJHv(Y^EDKw9rgXXbMqj~IHG>?4-&10X%Vdc-|&u2fDM(1hR zk4PT-eEtiRk1AiFp&UaVyAaJ|U(Ao?u`dyu$G(i_v9F+c?5k)Vy9lS1FAmq~)aYwR zUZ+Pr!})1@=I^k-ksoRJ6!Dwr|7gC2PvBCFzYiTf7dk{OY|nacM}N=cZ?u2kf%fk^S>A!jKl!_e?cb60 z-IKpNY{#Dbebn!d?A5S7#`_}s^Y@L7$7r7XFZJfh|Dk#E!SH#;|Is|TGQ^RBss*wA zno!_=trB9l^Kf~!P<~WFb*8gi&5vuK`Etzy_iwF&I>hex+UR~i93LHz>xSv-71Ss8 zI2^VCvHe9u>JuWz6f`P`org%=xZqe~j}x*TO$(af5^P@J_0~+od4lB0Eecu|#PVbe zd2%a0Z=QS{dVE`>`Ai!$pJ|KcF~>8#d2%~6Pj1h4oBy3aY@U1~nkRQa^W=_bp4jZj+d)>cMh6&=i(URJoJ3dXZn951qFq~9#8ds#UeCs zEk^U!60FDX1e}g@`1~385}t`m@htoZ&qnj!uITR$or7Oc-VJ>&(j9#s(gXdSf^+dl z>d!;(AI?YbA9|wq553TQyf>QvUx4Q0eK3swqxpYdw!{3tAGVBKRB$onZjYM(mr`#2 z-yfStE-AP)UavlfxD4Af{pIL&H~_s4uRyQEEBV}k$W;Yb6MG!gJbPd`FRv*W6wc>s z3a(?i{gG=mEZ=xvWN^W$<6<#3Ygsn5U`T;^@z8=BINv-UhoR>qG37TF+(hhoIUGGN zi7CIiU<9$}Cz5C1QgAEF@q9$;Zz~uXkCEv{6^y3bJX;z6FStESH>O}L)49D!{ynZB z8rHK+!+ImrR}_?o=_?9Gk8?Z5YpBPNFW*@ZY1M|~Hvv1~U3eyW*+e{YoOBZFV_rR( za`WnY&~eHsn8f*fFZ#a8eb|!u+>g%p0d&4o(fK}z=HCyY`R&8F8XrOP>qpVNc^aBG zKZfSNkK;gm0$s1^xW4?!f<+$77i8c|4KrU4TuAU%;=JZXxuVUE|6_RmkKy@0nkT)9=1Fg%dD2oePg;iNNpGWh z(sDFUT7l+C@1S|oyJ(*D9-1euMDwKg(LCt`G*9{v&67St^Q4c_Jn0iOPg;fMNvm;K z`I>@HL%Y3J!~RF|q;&-wC?8e6UPC#CJn1tuPuf@z%acAQHc$Ej&6B=F^Q5oPJn3tk zR{l*m&Qqh`9(kPUPrfhshvR9UgXA$kgxEZWnEEXRKT>ahgVg_2@H4UX81kH7n69$& z*Mi@uH_yS4=WIpuoZrzr=MOZ`*@oshf1-KLUpOPW-Q|+!{Hn!z|HZHIKiq@|@h3clTd@-D4ZeCFX%`0ja+W#~DkLDG%DK|f;gZAr3Q=Sm1 zTUf6!w%?JseqjS*w-cGqF@+6r2{taYUvH#gzaahkv4u?vWBodYe!VH5w;gSU?w{sp z``H3*KU<>hW-F$*Uq24**IO6H`t>%%wxey)e*Ji~UvG!@>+SIs_R|UI^ZpaDCf9KX zbiAh{o{OFEEv7pOS7K-Mc$|zLk5ka&aVmN|PD77J7xZ`}qQ@f%&!XK(#_;=ptS7(! zSC~d@|DztSbhLlWK=X}E^n1ryxVt>3FdHwg$SKTa`}cD_VCbLo(EdFi?cWQ~{pafTrKcnz;99nTkA^li553qi-YyLNWa&}>))dJR^b~N-4=dfJc{ce=o z?st#Z_rUe#=N2*@$M-x9#}`BU+p{p%{`TVYmC@dX7Zk?YU!?u*Q+Q!vto_x!5&D1J zgZ*$fUc~2Z_bx`;y;8K@>yNg3m!R$5rD(f%8QSh$j<$OP(01<%wB5TBZTGH1+r6vN zc5fis?hQiQy=%~R?^?9oyAEyl2BYoX^*F42Na3(>UJuo<-AKE4L*a1BN0r~Gp&UcI zcN5y~-CP)J_eK!g?%jg6d$*$P-fd{RHxj3nj|%&DYIO9G`HO9M4-(7#q)f2OZCQm-6^HUie=9%ECykAuPxF*bjU_z5Dw^bbo&o-`^j{ z_xC69&#wymcXilIzVNfKzc*;u-^l*nSonE-e`DC+ zU+{U`|1Z(=LAqx*Xcy1#!!?@xY0 z?@xY4?@xX~-_QCrtj}+SzZ3g@)>icWEaPEwSnh~ed$^5u@5sFPFV@TUaeKUd{2LvY z-GPqF?nK{*{s(;@dKWrQyBp1)_n>+2UNrCBhvvQe(Y*Hnn)m*TF84oNUw$yO3#HLR zN45(Ibvd4qB9BKx(Q!qwgBX%4CiJKR-BzF9v1v>sf%yzX3+u{21`Eb6pM$eZvOy~8~7C&YCj>j*s9e#)H z!+cLDI+1u4vAQ2R#N&?mBXK7@;YIp?{EN6Vov^JFcVudzbtHz+1Lql@HEUt ze-}8SF5~#y4k7X7MFWUEKalmfvgit2 zf>(3?l}4}9HlBY-J2bFpP*JR%#n2926F;x6jh|Q7q3zIMv>m!0ZHI<1z3tCX_M7ef zFk;)E8_@RWMzsAIjErbO==nJkJ&#AB=kaLtJiZ-0 zPsgC=?^yJF9fzK;W$5|Jk0o=ymKRkJd%mje!+7+(y#qaO??jKo1oZs9%W|B^=ZhkD z7fmAe^XfRwWXc_}!Li6**==Jp)t{ne*(Gnb5@p{o4oM%2a)?Q_A7A@oa z?OXPia{eyW@V{?J{o6(Fg!<)5{R)j%<2WJp?-sou>fcl9S8Dj5H{^fWJ}CN_`YB}} z6@7>+kU0F$8&dyC(V9@dx@c9XUu_)qIzsB#7OfBU>xw=N_3MnI<}VojFL49Mc;+;Z#9%7{nhtHn^?a66^8!m z2aa!L<>sO-)Z1TS=&yc6|1a?;^#2lnM*FK@(EjRIw7>d|&sQa%+KT?4=YlT?@p&p|*us-zg&03ZnDmqx?c;TUpOFWm(jajeOOjlXirnoKj9&ZfC`*<`zX@}+~?a||X0(!hpM2~j|oDuElayd?&H0=&KU0XVR}s2i#prsKpzFnb z1^e}k;{Ghh{f_L{vqJ2CC8oY>@j2AH-AH}6;_k%OW7zLK!hS!u_`LXj$FSeeNB4VA zbiemP_j_-2zh8jv_dYlydZEi@zxUO!-(7x{$VJ5$Q$L3B6J&i#!}_^C)Q97633?nZ zWx9vi&dYE*9=?AZKx{s81)7gs8RpCVKbntR9pZt-gQ#~ohrNc_{NmcM-0O-5vmEym zvL4qL4_|D?k_zQ;rCz^o%Kha(2xXVOz+~sa`++`9v?lKu2cew{0cbS5YyWES8yWEG4 zyWEeCyF7r7yG%vLT^>ZoT^>TmT^>fqT^>QlT^>cpU8bSqE{~z(E|24|@+XR)4EuSy zhW(6;yUZw_Mfs@mnHtJ5jJwQ6$6cN(j*Yv_A$Hv5X>{CWE;{b=3_9-eEKVzbu9*8` z&dYfk=7&e!%lU*)3K273LxiC#Z%q1Vq+oDp5-a#_!}HLR!0uM$~N{0{Y=*U0+3 z8`jVDp*~zcE79xceWn{ally=CkMH?@$ol*p;r<`Dr84g6_>+tiieqR=U5vKdH_$!w8C(F}qc=&q$hUvYY zzeTU-@51!l|D)IQrV#&7yqS8p`>rQ};$Ml~FUWki7XOAz z@Q-kw{jOoZBG>b_;y>fpGluK=ulWAl9^apTqu28e^m^WjUeEt9z1QLs2pHA-p`dwgo5$H%x1^|jICREOyp_b)j*OkcO8UPUy%BiC9UEy zl5ZSW(mK9eWVvli+Jx!amXKG3^}#v~Bi#R&MC!DSv@bcKBvQ8uG1loAIkCj+d&{B@ zB^^s*#}`}gSkTGxwi~(sz;>UPcP@E+Y^3$Vmrf48{Lam{rY-&lQUe!oiNd}+)Y*D&~dZauvtk;eOSz$en zjjc!c-05L?xg~k=>G6p2f|9~`IWnK3l9Dk0Vh!`h!_(KR9@#OL^$FwqXO=|xzW-Sz zU77yX7tYo&J@PvO=ah7(d{lWi4dvJ>aaNC#^C;i3;9PCHj`c*I|DIpcH54tg9|Qn`Y>N)dHqT*3)5dza&i3g$mdH-E{T7>fBf^reEw3W z51+?Y2Ohk<K*n5&i$0;pqS2+=N?@{T{{#M-Z7>T|YItn-8Xl#eKV+S0AK1Uymr{XxSpQZF)W$1WhlyaZfl!xgn zO737ihgXdMe^lLdoE7C8_wiX`DUp;~NYn)p8eO>Yp7K38qasJU?T~h3 zBFEBB+rgKp?SPo?ah%%Q=V0ZQ%fE`8fV*%K_34=trPU+rZF1yPE1x2*94oh4J}vTV z`<&^KGu_Xb;eHM=pEFDK)*jg|W=GDo_H(3d$H@Nynisj)%I8Nepj_KAGXLL1=D5>c z=uVfI=`K=xn=bNyjFv>MwDwCQm%06s{<)Fgy8V~C{fX(nLhY?TvOTPd+-U7rN3L=E zBmLJ#u6O&dbNdt1e}mdve`Nh^iriuCzl+@L_DA|}iQMM)-|F@!rvG-exBkd}v@>$I zwcjOe`H}0{dm{H+`Ce(|`%uTJ@3A8OfK`xs=Ho!*A!~n7+V+7g-{Ht3R{o>3a%B5I z5qT7k;W0dk$MFoFvi2vXwMV|cvyrE<+N86QXK>TP9PzZ!W34-)@w{eF|SzhmVSQ?5ncu=4BD%8}3c zBl0gR|5H}qxQP5uxvuB`jl=OKw!nW-?>qY!b)WYw)celtFoXCmwq`tV z4lpnp2o|FIo$Db#yoO5>|o24Bar*kmmEANBuZ%VB4(^OncA zi7Vi0KCdEnC9Z_sF#+s@(o zKkEOFJ&DUHZ-Rx1o8n61X1E5MqkivcfjzM$>i40iP`?j7jrx7473%k)XHf6Udlvg* zYt;Qz&*2bkgJbb|oPd!y8KdxPj7I&Rl^9%v9#o$4;x_c5o_p})UJRh}S1ew{IJ|=K zcnuR!&&4KU3?||JVaZV`QBL{tTqi>I`_!m3H%9jN_EBx|7`DTc_yV567u|Nq?_C|D z$eWyBza;HAg`xNVM7i((q5YtR9iv_+-s`+3?K+bzG3bs14k_!~s5fBNhFIfJklb*K&;WC_vD{vC7#>u!Ir{H%u74?63 zr{PJQjyGBFGf?j{p2>3O1!qNl?XExMI>_v(Iqv#Hdp=?=>iLLysOKZ*qn?jgfVwa6 z8`Sd=3sKKUN7M17^-A z|Er$k-vQL~H3w1eaXO@OJdCmUBPQVy)O!?;Vq4;4_%a^HH}C{rXF4ZQ&)=Lvy>I$7 zzDxZX?1n#KPy87_#k1HOe?dJzbPltK&to=Tz(bT@#396&a3ub!dY1DtjwQaLdg7}% zk@z>%b1c8(1^QpZ5!7GDY1H4qukjC@kALD~{0ryN{%>4Hd=ppUKe!(MMZHh!7CuE@ z`42Z!ejB5R@8AyNyQuqB@8Le;JX}75{2$H!#Ci|I1C-~(!V0ReuqW&F8Pxs6&*DGW z8o#F9bGQ)O;4*w3^?tNST+j9qg{vu##)5nwF&Ks(EQ((Ij(Q&+XS#meN*ur)7>oLU z@^PsD7Z#8DfAR^KpWks4aX0Ofa6cyFF!s|F)c?&$MZKpj4Nnrc#k1HBFX0P#72D%q z_#)oM4j94wy@dJ5Q!is4<*#5t?zeswi(*GCj;~=Ud>!?i-y3+E<>`cH@l7mCeP^tY z`&RVZ(asZ&^L8|QPPr$CO9s_L5ePk^NmeUGe>(%K`x zD~yRAjcw+Pi5_e9UrMXT@GiOIqQ|S8?*qd>$(;~Ak@$<;ucWoZ@L=ww=qZ%<&z&r- z9K#3aPK};P`H0+U(bL^>tU5M#hRUrShEK|!6+PS9eJ!mV!>8rWiJnLKtlYWM$}xOF z?)>O)C|{bpKw3G5ugYB*y@>J+xjE9xF}%>E+~~zvZh3C>5{$s5SPhq9P5hRATXL66 z>xbbxb5}&KqI_TON@?ZD|4mpOy^it&xoe`=y5(5)DC>!Gey7+Fy&j!O8=^N+ekymP zwEoDr?Yroml;2pmIeJTU=zJZCw?=O#)^(U|sOvDqTnE^p_SPR6|Luz2Z|!$S?{WJh z{r5(H@Alv4_9v$Q4{C4yk>lEd=wsIYVDurkKhpnj^bxoJk8Xcr`X5z$>yP29W*m<` zY3)zQ>OZsG7=AAIbo41aKJ;|-PgZ|M+Vu$J`HP>Uf3fnj($4RZ^>IG>99A8AKKi27 zUyz~mf66-z{x$j%))@M0^cAbWEUg|HkNz8d72D%)n2Nt+B3{D)UdI@`fo<>)Y=wVf zGyDr1_X6Y30cC%>`o$U_mTo_2JU$k@wXUi7AXFmlugCX7xp-)g$Y*WXuDYhs81f@{%zR zVj(Pn#jv#XD<$nZ2(tf|iFwG%%gXBG7m@!dFEX@zOgSuw6|KI4wCf}oeuMA366!hP z2-I`Ll~KQSiwqY{m!Fb2z^Cnj`0=q2t-?86VxkG(K}=@^R{7>9i^9tU9p4#h+q zg-JLTlW`)Z;1o>7nV1&i^shyJYD@eW^VJUZ{L~BB7~5lWd=Xn=2ke#ka?DFub?D16 zukiiqx&pG_c8qxyYYgoe^O{?Z?62KoUdQ(M2Bu;sOvE=afSoZ0-@-QdHnzfduo=FK zjj;>X$F5ix-@`iC-TgeY|EK;w>i6>xP`{t|K>dFHA?o+@o~Yl?KSKR}-V62n`Nyc= z&p$!^e*P)y_w#hr@8_SPen0;l_51l3sNc_fqkcc{gZlkE13O_5_4|1y>i6?3?4H>- zra#+nhhRTx+b^y{sWL?a9T)Jev#jBTWaM$xj zS$gA=%`uyp&QbghkK+#JWAl7Ulzc`4czB&|hjDF<* zm?IqLHU9V!HU1!0{#U(yugLojj>nv|_9vv}A+-M=cMA3Y<4&Xgf7}_&!Jlvm{*3zn zac5EgKkgS?gXeG~p2sbC0e9d<+>MveeXj!7=`P1yjd6lMIaegt;g=I+?MrM%%9jN=dYMswmg5w{NpbFO?UZ;S^j@jZ_AHi=dy3d z{D%>XZ^zuVes`p;2jutodok&r(ESX^eI|}avFI*Q3X#WYhO`T@5DF(xsDp)sZ71Dqaw>)#Z#5#(|sGr za#!@HMLRq*F1u{zoriA{+dTo_t!jzQ-gK2 zJ~@s(E^R)M`z0EBp0M>>-_wxk|Kv1~wtkWNCZ0xC-`LZH`s2=%(&~}=7M`Y7-^|m3 z`ZG>*Y4u2bOHV6ey&vN#>T5VpTde!ARj%hIp0RdOo@a?um$ddo*?N1<^SrI+<$c=N zdS2d#nDrc~dggz5A7uK`o&fz8ERKhm{mB2;&#!u0ZlqtLCzgI~mc)DF zFo22HKS6SRd3hhCU6Lo&rk^aCeu}i~&q#fm=N0Ow3~c9Vi?fiJb}x9^(@wv)BJqo! zmx#69bwF)*#4OLtYH#y}Oz&0C8%$^Mz>boBuSwfaUdNM6kC=9yJa5yk;ponuH?aj0 z)BY`K?Nxs+`(4jF7_sEsslU3Yo1}ktY1=DO-_!E}-*1zg9-f|j zf2W-frG39h{YRc&#Gmv1%HDjRA7g*~g!(Y&Q`?WVeY3rV-Oc>W)0^q#y8+E61>l3m1BpQhsA$ zj%P97ySC3osO^)O?Q@Chtv!Z4H!jz+46|}_J*%wWa?c94-?wf*V*0IAz4gPeu$(oX z)z}NyS--W?_9F~CHEq3Tqm^%v+`o{Kj;x1Gp6{q%o4v)Hft!gZ;BITb)w7NE+Ru>X z*zVa$tmW8&S`K37XP4UB{2=*ZuV;@R+@#PmO*_SPT6JcCYo&RP4@o-@`zBOU4gljp4U z&q)8-`e&pQ)BhK>r+-E|vi+R*T($NWJQv;mNdHTo%WnT)-TuV%zoPcmA6dV@d46X) zZTem}cV%DqTqE9u|JZbHc>b{Ia{b@pKRtijbh-X-)8+cVP4}kS+j1e><1Np>Hr-nu z$E*4I&vV0iJbPOR^_AnJQ2 zrhg%|xBeIwKA?#A0c&4W+ICV5OS8QYhvkeZ?k!>U4@&AY(lM-NR!Q$eR$fY4ztX7t zL&~7;4=IbfKZN?Q6{E{}t62N;(%M&W+gEhkS904&pzh16j5?mvp67+Cd#hrt#nrvl zupZX5={+p1eGRugaqx&!%Ug$b(ZSl1_3?Q5q@+9}9m9$)Y3glm<;|p(V_2Cb zExb=zc}r>K7`AWX)81#Syp^j_`DDBN$f%Y2WkHy@l4+9 z&=cq3N7#z`UU)b2V{ba`l;1yL{tIV)s@V2NB)@;*{S5Qr=U5Q?(9f6MTUvfstmPZ| zdFVOIAaOS1i%cAZS*ZJ``=aij?nl2t3;TNquv{mcY-!7de9l1c5Mqr#2T@V=JKZJj zbcvbnGSyqZQ2XWH)z zM%7zCWd6SMZngQ_ESbM8(#8*=@@?K7R=!-~}X zDFeUv?!#F~%=CZo?x&r`6-a!*dx%);`5m+3@1ItGO4=S&P>Th}PSp9#}>TkRC#C-le?_K-+dtS$<>EuakhkQ<$ub@xoIr)A0 zumuv+u7I?5q549;aH}umD`NG9rPU*!Q_NQsS7LFie?Z#t82OwBeWj?sx~PO?`X!|u zmqX>HePyk@jI?rOy5)Qi*>ubKDp-AaY1jQRtOdUpSH#6UA6yA_KUIW%US(euVx2eL zw<@vTPgD(82OsuT$CX&a7rH)-VG9P<^3}u(SlcbfuwUr+28INW4=2C>r2~ikmG4XUt^!n_ZvyeAINhJPx_irevI>P`JU5M z{p@;%)N|F%DX+|RiWV5*wDdh?{WZF|KRc`Z#VOO)Gd|qo8?TfK?UP(KTFLa&OE5jOO`+R=pyE*5L7}Rqr0s7y~ zjP)f@t~?b-zrtDZif#HB_Dpu7FWJ^xk}Mxh|4^LfOR?`S&6kP=oitxN+WWHGO3Po! z`hL;(g0*|m*WTK_=zEEFso5Q5`4^d<9JKId->b~mUgs5Qc?&7;=zE>=qt0v6%8~Ln zd~Z^|$LS=k94YVYdzb(G;pxz7cDf3m>N%wuu zdglNCN?Xquws7(nzCKpoTUt5NKEszud2UWnS~+sQ-OrbW8?i60!hy6~mDAss?Y2Yq z-vKJO?FX6OAm1=+H`q7CZHKfQs&Z?GOn;0PZ}WjH*Vn#ptp9A^9Jd_lKi4YH$6K>kO9 z_Q~1p`@#C{@$GZ_?REPR)9-uLTR-G_#{u7d%*r|7J7WC~`VPDO4!Qk^>Gz}Rtsio| zpMrR?co>H_CU<% zo>zPOTnw9$eaUwbC*U>f_p9%+I~`;?SA4&@)4A$ShnVU7uJ$$^^YH!m)w#%aaQr5nh{{go@(!aRB zgxmi?w?8rcORBx~N4DQG{?gc{ZyA3j>sQwQkUJe@I_3No-075er$fwiDyqFr2ZK|c z2!Ca!6CJE#4w+lUU&H!Wl{Ox!hDZ6{tE0aEhf&unsONe{P5&d-zLvE5+HO5@SX@>e ze_gA8R9gLGZap#E*W>;ttiGPKdJHQ%puWGMl{b)9jz zV6xXuJ3g6ze&5uthdd3i{AEkCeF9`ZU0-?ZPMHRcdg$$ z()uCSce?oBv+}Oe%8~0V-TWWe^twxy^L=Uc$aR(;{*SEwLrHy4Y1=EZ{(AX8vGR|l zl_S?d(*2)O-_=R?e{S`kNvp@O_KSM^zra5+!|MA;8($;WNrL_?E6ANcMU5-h;orpT@eXdld|X%Bh!5Zk7p0wFDAxA$E8gLKQkU^T&J(Y&zREaP{l5`weIeib@BVA_(|t(Daq_zV z58`TBH%yfihuzHn&;KVjANZgDFKmT>VDMOkEOx=x)~`+AIgB8Fo_@OSj7-lLh{OO! z;rUEoAR6}&$Ix!jLQlZQ`uX1RO1AIieUSGo_yciPACSR)POP-;ADLcKARfD5f=w?e zkciufQ>|aJ?Ii79kk$^FzYc*HF@P`8PUqK1zn24VSie^S z9qG5nc~x3JWO-gwJ?HhWODjh{_su{j>;GopE!ye(?2P(8iJ9)(fp>}ZeZGVG9*HUM z66i{-&qwCxy+AjntMhuKzI)((H%8ih5a>a<-kT-sWPKR;l=_PcdrI==M}dz6q49Sw z)cBj2aqlOpx9=C3-_HW+HvP{6LF@myr2iLzK5qZsZhvC>XQZz!4^)%GDntHaM8G*0qS0iVpq~9!Q<1=KtogJ9Z_f=C#@aw zeJ=miW9@cH+U=Is4p|?213y^(KFK)gdujDZ|NVhOR)0WJ ze^6RIa{M9xTe~BHA8mR^0>`PpoOvv86gy=dQ*7f3WI0X*P7!N=J&D?1iJ6bnfwRQg zU(dMpKcV*9pWSxUGcGw7_ys#=oeNx`{8r|9Nq_GDqx^2>#lRKH^JQHQTw?te&iYj` z`@v;t?PNs8Z-J}W2ya-w-=!U&uUWtAif#Wv`u!dF1H0g#*6;7YUl>7rlYTlrBlZ6T z{v)oQaVzjIK8lJpen6&kJK)4>Ir9Q{tX*ESLX2ipJFV7nqFBvkoiz7(hMt#3d(QF^)N`tJP|vA8ih92EG1T+Dby5Fs?s3%ro2!R<4*3bx^T72{&pS3i zJulo4^?Yw5)bqWKQP1~2iF&@b3F`UYrl{w8o1vcXZH{`rw*?j${8Vg93?KGX?DMg@ z{`+)ntJu(bLZ0t^CiYo3MxO6&9s8UcBhUA?Q9oO+$n(9CvC))A433gkj`nF zc~H+idr{9j`%uq0`%%v~2T;#9$D*EZjzc})9FKawIRW*2b0X@w*d)~R2Fa-V;Zsoe z!>6L|hfhP@58oDbKYTmX{qQfK?uT!Wx*z^U)cx=sQ1`>Xgt{O8Wz_xfub}RSe-(8< zd`Hy%@UNlnhkqS)Kl~f0`{6sG?uUO9yJvQeeVg^tA^4WG^@7|F|4wWd%F{F7l~#^+ zKYUlz{qXO_hVF;&My&hcyQA)he;;)}{0FG};d|hO%nxmQA06!ZzuPuZZ`x*86{Ryf6JoXD>)uWAXd($p2uTN|S^%~!zjc%lWOl+$-GWUWv+Qt5A7tHEP_shW7ehX)XSQ>-cb=R^QR{gJ>b=Q3QSVLO zg<9{sQR{sVYQ678t@nMX_5M9-z5jq(@B5j*?aqPNgTz|zQt!t-gt{-~FrHz%_!0Ge z96@~_M^WF$G5T+Fj>n!L*7qUxp5>GFy_}9cW#7x`*q>-O!8s%Ca}ziw-No1ovC8KcV}E5mYkYADwfzxOemV9kvA&NhsPBVV`9Jn|Vtp@2 ze!UiZo$2a(K6MNv z8>i!I8EMBAWIuQ)u3TJbKS0|L%F|!#zXEFgS46G%N~rZ7fm+{{X|MgD3Ti*78W-9R zsu64bS4Zs!52N;j8mRq%@7u;VwU~~^F}34D=X%^Q! zE;Js&aJ|2z1?v4JEm7}*cnT-;xlf~>OKgR0IKDiCdSC0asP|g5#>&jkbExMF+h7gi z=dlh(qMj3s!u7O|Mm+}@gL&ZvC-7AjxAjT188vF~$q@ZJCY zKH1K@#*OBCQ@+OF7N?tH+wVg0`*9z*F_N!)SbODbwcGR!zyI6*@=;tbrlb7@Y4>s5 zC&X%pme)U}U0z;#+-KA)ucPJl&rx~(3she3jmqnNPHGJi9$Jl=ng>?~p(=e|ZA=VsgV$^WS1++2(2#eGA)*3W!f zKMO3@bnllhwDO#|MYK~nvK|)4Eg{x=yYEtB-Ji59^f_@Wh_xKcQS0$r)Ox&MzS1pU z<(99uerw{^+4@~8?ejwM`nU~lEOmU|NPFJ@ANL*WS=%WRZ;snStnUF??rm{faV74s z{b{?j?E^VJ?~L2!9-q;U&%534Z;$)^?L{4*_o0r@-=mJtKhR#s=l!VT^8w~t|9AB$>i?h}L;c^?w84D<6q-0yRi)8`>CC7=l^k6 z<1GKjU1NEbuYN~u&&1^Y>v4Y&YrWh+trud-|BU;KSnCIMT_Elz)7APw>i>!R*Nt)f zX2;IcdEeK6akt%kfxPeQPTXBLUtoAY=3nQ{%HMhP*LLm1hqmjmcx{io{|B{Q=cioT zM*-q6r(k?|d}#YX;zIF-iM4$o+egv(BDfMCh*$nDCT;sbwvXcR55|Y`H`?}5g8o_` zB~k066ly(`My-c3sO2w9du<;Np|+25@uBUbJh9eC1=RLY5w(3(LTw)r7-V_x=kY4> zPUTNR%WrwT8q-%^uTHtHPdtn<)5-sCyP9|)vsQd4PuG^VJjn9biGP;<+Fy|4@naV2 zcuY+FUiA@ zb-ZqlQ-dw^xg4)sN}E4@em>{v_*T>xnoj<=`FY0XPxC{)t@qZb_5K{~BEKg8V^`MC z{o`IFv9^yW)NwD`rc3@uZ66+sz41Qk^*Q(T6KlH(*yqN^$MHE@PsnKo0r|~ z<`rUXH?N|$n~tdM<~7uI^EzsMynze&-L?~U3~fhty{R+P(f?0-3%_&7|I}X@!}WjS zO~h;;HV)|$9~y6UMUB7SLyeQVVIS;{8fUy89~x(TK&){~57c|GK17Y1dg4p-xc?6| zZt8^^H}N_B^xXO<@uBC~iSIv$Y}?Cc%$K&8&r#dU7p#|oEMIS8ouBn#emBxT12p!A4dk84zcYo{n#I>vL5el!TnQ$H9Za0sg3P*lHR zsOx~k@j&JXcmEpszx$VsgGaNRx-K_{>E{K%j2{~x8V4ie;BoQe<3rTA?>y4k4f zbaPPG>E@!Y)6GL&r<;$uPPYJco$eddb-IOEVDO^&91I_}D1HUodylNe@k`w89l1`o zG=7;IBiHG2PkpJyC^-FwMLg=`K9KX+7 ztm8K^$FYm?m)H(<97F1VjlWE+dbH#F6{eGycQyVu>UDfaJHG#pI=){+9pA5`j_)^6 z`|BU5{q;|r8vIM2%klkhY0HgvUF{#HpU?R>{ub>tenjH`;%^h*WjT=ePW)YB9iNf- zUVI+0uBRc(;Uq9UTMnswoDY>3^7A=!nN9&*gavU0hNF%jg)l$cRbecKMQptkODKx@ zoMH*ZS#Rr|2c(UY6t8n0Oi+H&xaoeLDM`KZOes{JDQ*49|EN4u*5Zc}%2BW7yl;6c zuaHoYaxL$DD_MC&LS@Re-1n_w$kqUejA|jRzpsm2gZP(8b|1*R9kF$td zqrTtgP~UGG)c5;5>idnv^~6!Q1EX<2#^5pZpsoXYu_mA6v-K57@Y{M0B*fYGA1m$q zR=m!MPhdP|ap-zlQbJ;a#@hBBs1u!VAP&Ul zeZq@;j@A!S-yz{8H%8jMobU?ex}GK*WxSfu(VcJPy4h<9Z`l03E^Yph>t=5zbh7qu zCg{4^I;XR=dMr^b^m~})$9MP~<-vCoLV2(Y4(Ga0SJZp^-$Ork!^7Ae_1^yX@g#nL zdT)OZ)O(sg!~>Z<6Ue`8XCF!1&d~DX#|feQ_z9nz7yL9KJt34Ik^J~s!siL0{D}7Z z(-&BEDES|IF`s=<@8``xUC#-k-p`wfbukO|e%`*Q_w)9{X4oI~e%@@<`*{bT-p@M_ z^?u$#sQ2>@##9`FdOz<_dm4`;4^3X_B9vX$pL!(i7XbdV3eTm9LV^Mi% z94ZfuN9Cajs66x)Di2LW<)KNaJTw`Vho+$N&{R|&nuf|l(@}Y726oS!neesk-?OBx zcVxZIPMAx1dgdHyg?a=bnM%v}&ZA$o#dgUp!Jhd5>r?#N-)K*lU+J?$g+fjLH2Tl#{)aR3@c1c?= z$b9ax`O@bT+y1=|wSRw4KOJX&z*@}jeyooN?D%mo;Sh0vSZa9=yYY|Mg7}C{|9HYt zYkxf97#4JnTYm9npOAJR-~Bvuihjy7r%`$4jP>LE-}-U>PkA!aJ&SkwetyBq9M{gV zUe-G26D|-dZ((qab1~tP8%yPnUzrZS|0i5w`SiUY@zsRih_(F4=Uz+r9arKF+rF+# zTVF`t_#@#@H*cWjjlbOW_P4vAFH;v;U16}n{9Nqmgmxo^ac#zS@EY ziR2I3+jW~q%CcTKu7{Ocp#Rey<`j19&+}o|&GA5H3;kbj@;V)(FjiLWN={ON_n_KBh8M$VsJOzhys$obPti7&e` za{ly+`q_Fy&YwCazD{|>;Mb&;qn%H_fjXb;ggTFW6LlWh8Fe1{7V13mZPa<>JE-%> zcTwk&T~OzdT~X(e?_o#mhRS>0QF-ruRNnglmG^p}^4^E2yw?+z_dY`9yHx8h zy9ZJE>JTbl9Y*D=A5rV^2<^2Vj}q@<`HtaUJdQdKI)OS5I*B?DIz{_sv_DO(|5JB{ zSnK~M)cXIKau5B_Vm$tW2k{*0dpVCM@Pe(UONke4{a#A^mHzsEq`sd}9=e)%#q!40 z#NSz7<%!==+XFHAcULSabl=?rsQd1UQ(qPzBp$|k zEP(eh3F(Im!p3=6iBxg`|o}p}dCt-cczjA}N&D z(DD=Q?0l&Tv92dprCnaIT2ghlACeCrPO9PdL+e))m8WW<@>Fe9o_Yk8r|O{c)T5|8 z^%yEo)x`pX>m@yo;lt`BHAzyQdLpTQQfR#)d8$EDLpMh9RHLNEZj9uqC)Ll^Gm@v8 zCN-x#VsJBQ^44>xywwJkx1LAk ztw>bfibCbBXw?7dh(V1PJgD)37d1Zcp~eS(JWcxmuAf2vN9DUXRKANx<+}t_zDq>q zyChV;OGf3p6jZ)TMdiCRRK9DA%6IKh`R)Z&zH5)lcQ2yyT?bUYdkK~AUPk4+S5W!x zRqUSGG3j;IYlq-#($*`I@7_pylk)V;PSVQJ@?B?CzI!Vvl<(dqR=#@&mG9m~<-0DZ zeAg8xWWHzn&*)&c|J{E$-oBqSfbCDmUnHOPuvqzwnEIYcA5pL4F;d?v>0@Hmqvg9# zXqT7wX;M1%%6Dk_?lV-r`y7?;zCh)>-l%-n2bJ$KaB489&n4ewN?TsEeAk!h^ZS2N ze`4hkWWKU(J~dyov*X)9)bVW)?R0z|%>3y1Is|om9f~^s4x_#_(;05l8JRS~rav-i z6!lA~mrL+|o*P4Z<+(3Wd2Xz=C;y}J+<1#8Bz;A_=I_1}iFN##M17buIcW;>r}d1) zQ4>P5$2PDsZoisZsl;<$)a0b`^-Q}L^F84gt@q9k&c)kF2 z9RG&)%5w`*c`k?LQ=VHytmFD(RGwRc%5zImd2SghkL9BB*m6`J`xdo+S1=u|-<7EK zyNdE5bGiSIc&f7|X)UqtgOhrGavdtatw%p@K;^lO_}WbJKmGLmd`GPOxEXbQZwu=C z+G^`Jah>YV&$E@A)q!aG^BKh!S(kXZT zkalO1PFuS(Ny>+sZ?ydPGkH$`5AUq<9?PrzvX1@t9G|E2uk)1a_pJ-~I_)l^uIpVw zUDx{+bzSc=>bl+))OEe9sOx&aq5e`f45tx{}cEhYB_GBmg5fU{`$LkAoHG^$MgR8IAr-TEIE`P z^Cc@k=1(q=9LlRmek_$`hR2PQP(poU@yLxim2#-i{dgl|U^XvMk-{l&h&Yv5i#u<%JCbxED zWSsGw`q^;~8D~7797TD=;7DoZXyc4%)HovsHO}y$#u;9;`~Okn3_og|5kQSIVo~Fa zIMg^J9yQKLK#emJQR9px)Hovb}OdsQVh*VI|h<3#k9=&>r>w z#a=}He}@jJ|L^b;zJM>I#v!ku#v!kw#vvV1 zIOHwVIOJ{AIOHAFIOJW_IHU_|9MTmv4tWnX4(Wy(hjd4cL*B>knI9y7$a?P(>>+Kv zBinV)NXGS0}dSmO+0>iZ@4r(XFIsn1RxKy2fbvuw=-K69x#Con^GU~YkV#=o`Pb1dvfXMPqx8>FH@p+cFW}@=e zEZU7_y!$my#M!9)JBQ_5?95G`N383@@^0q*UZqa@f>c05Z zsQcpApze!b%X}_!)+Mhe)_4G!kB!M2Y(6$7e@A_evq{==C|>AnPS*JAe}AXlO1;Km z+fd`M?be_CZ_B~&{}%5`-c7x}r~B@)^1aFXDA)IO-|vZaU;huN_f77{8`*SPRHYFv1O^{#Q@AH*8>{D~SD{)HMB{*4+J-b8JW|Dd+Ve^J}xE&4BZ z{!6}1tnW=uXZyH=4YKbh-{W)j-UPJk_Iar5_D)LZx_ubxx_v&>b^H9N>-GikZf3!h z!YQHcIy^<&bs@#J9x&{g>>??}QndbxN_)>jD1I>I0m^yrUrKQ-h$U(7%Pt{pdq?_} zNhxLR%A}OGc4bl?qFrisS!vh#6>B_P4mBPwj~WkGz(XuYMLdO-Q11tcNC~|kq%uZ0 zRZ^-_uJt1IevoRES8~YzSkZYnrG{HCwg1&b-8Whbb>C=h)P19mpzb%VgNs-{kK*5% zbyFV0j#+h69%p`UalFN_kC=~o*c+d~0azcu#0EGY8{)Uv2(_O##;tvuq&$h;vYMnc zWqR7rF>DR<)eNy#M;lLo_}d&>-X7|XKejGoAMm(a-7!E z)`#MSPMZ|Q?-qx~@lh#}DH?Z2rNr?0+Mc6P+cPoco)jOkwrekHyC$aGpAsO}_Kl3= zV^iYz9Bt1?eSAuS8zaA?B&Hw0^HCw(S||*E!`4?1G)FU+0uJ zF@pFl`sq1b8I$pL$~%pxEkjqAT) z`gy_LDSc8x<9cLVpOF$w361N~#&4OZ|I3+$8ZY%ljhFhN#!LNCW9HC~#D z6EbJndL147`hVA}-9J5t?^pS7E-D|+v;B+ne>;AW|0!2K`v#S77TSK8ld_2Qu6%Gb-O~!Kobgw&I6uf7`Gy+sAfPe%XP# zzOd8gYgfu1;&wC1|JVT)cb~=iKkB%=kI${_aQ=@G&JQX3Dc5mX>bQJ>avhfsVnyfB z{~niYKlzdEUC)Id!8e$nqu729`5)gQK8`y7W&5}GCs}^&SEne~`TJ?C&hh*Vj;7sD zsQ(}TGithLQPceeHQjUAnfN?v`WI05=UhacS6@P%m;Z`7FTadBFTa91FTaY~kAFj* zpZ|`UziW6P^SZm=-uVBvuZ5Y*`~1oB>ptVZQbO0w|7QI>M8BIUq3i1ZpsuU`OS!hM zTd4bx@9+1w*?x7s`wq*W7rdKt&)x5l{XQ?nNe%7yXy@}`sPp-J*p>B=A9a3S0H0;K z3!<+3hNI473!#s=FvejK)bGDVF@?Ao+W9{^{GZq2sQ+*GAnJNS3DobwB~j3U&N`26g;?7Ipk?jXHimhdO?@K^?!JM;*T-QOEBn z)bTqSb^MM&9lt%Ob_ga)TffNh zJ2^F#^7PCUY2|3g?=;l$yKQRd_}z|J$L|+V$M5#26@MUS! zL%W}z{iL7%zg)*ur(jFg^U>Z;zi)_NCvHOghFgA^`-t|iAHA6x`oCnIaShwwTj<`8 zl{trg@1#1Jv$0>Qj_X}g(T?-T`SN=f>wGy>-#ztx>UG>l>OV;BL9BYT>-rxuoxHrB zsUK0V^J%p6>0YSw>5oz8)1RQur$0rVPp6~Kr$57~!O!)%EdLkMmLJ1vuzY<`=gk>> zPCh4?nnkShsZ7-Q6fw)u*XCRENk7Xo{ZV-)n|3;{8i40HP7Y-G=Q5vzhzoNadN3xD z7lz;i#6z(R4#P?~oaOr38Id}YSjT@1&Z7S)Vmo&V+>BC-$dd8w4a0zvAmN}9YWz9~V!}4o9E|W9nrY>Opw#%3&S-j)i0FP=SX{h8uC2G z;?!l-56f7Zx&${NvArJ+^}I&v3akG%b-C4ltJvO;hE?*DA68-kT*ds23$9LGOS{p* zHPXIsVJ!W4IDeviu!_C!{Suh85@gKZPamG?v0MxIg2k)SpvB z<0-W9)LEvh@zgJ{f9ap z-FA;hcc|C?co(%l-b3w=d8qx-Nek_dVQJbQ^QGk{*8YgLKNcX?{#cM$`(rq<_Qyh~ z{jo6RGn^u6McsbL{#Y#S0XIh5ABz)fe|!-2J5>qFr#dCmN)cb}0R zsQvaK)P7qIwcnPf{}iV}T18^@mpb3AggWnzK%IA2MxA$8L7jJ3MU7jlq0Yanqt3q{ zM(yu4aBJUMX*IE1R;{$!>7o4{IghK8_DGt} zK9eNWcsd#NUZ@m2keQms=deGgN!y>%&THGHg~qop@cDVc_GvGsh0be{@ok5+m(oJx zTeR`*%c$|~D>#Pn)vKuYH+4k4&*?SPxb$_@?^kc2#-*LmPyL&i&U|)8{Z923>UXQR zQNKsMgBlmVi~7B%3ntR9D{B1v9_qQiZm98FcO1lY-bejT^Z};Oz6WX?{2^)_+!Hkp z{s=V=?u8l$e~cOje}WnZe~JYLf0mYx;ln;l%SzKY`17*L1AI5;CM z=*Gx6I8*&>JtO1bzG?j_j~LufS~=P{I2$z%9)KDL4@8ZF2cgEngHhw)A*gZiP}Deh z7-}3m95oIeff@&oM2&+-p~k_ZQRCn-sPXTYsPXSuEX#H_4mGYFj~drbK#gm^LXB%D zqQ??m|KptJDzru zSmTNlsBr}`%YDk$gO;25u>5`ob=>}mcDjE4GxnIx`9I!eJ^zBA5}(7~cpkIx0uIKD zI0`S}1pF2C9;3_lc~{e}*!)~g`z zrTi~!f`8j||4qAT)BQK?A1vtnoAw{|zU*7luBRi*dnfI-wY!sckIx(L+?DqEiobO7 z(ww%TSSr7Uq4H}!RDR9h)(MVt3bZXqto$l#YP`YkLi;lcwJqE>G;Ts0Hx+3cTCYV> z>$Mmv4?cj(gT+z#??KvY+*ATJZYs&=XxvnaSoyFtYTQ%?HEt@48aF+J`ku<6zNhl2 z@2LXnd#Z@~o+_cfrwG*dR2lU>RY84ERaMS7s2ZP}>{M_2FtL_T>ietFR_m`;+nSgU zAEDg@r?#~9r+BPWr|qL|EcJe<$57v2UDW%q9!I@DsviD8`4e~o>!aQ;)xbWdaodLW zIgQ&k!h%lYwoRz_Wj`tH`$XoadE2Jeu6f&L)~DPAU+$T?XF-T0A!hE8N%lyoB-+znN_#5p8?8zy?b;Wl()?bp>pnd`{l0%a zAMdl>XSvR`o^$TZ)8kl8AAQmE(GN`@XRzGWQUA;V#GXI3{&gn$9kBE`!obY4Gp*kY z%shwvv|c?3O&`QeADlUq*mN=kO((=mKR0t2vFQb=FP)c}$#zX2$o#C#>^R0I-EYmw z%nQertBgm{{%3l-n*7YdaJ>pN93N6YN@Ny=?Ibcw!u(Hp6h!*X5+WdAP692d^_ zSPj3AYb5bV#oBaM{JcRni6g+h) zz;l+0NzYcd%xn z&n;bn9dQ=AAG6W@n1k-eTy#I?q5Cl(-H!$6eq4#}$3k>J7NO5oU4>nkz8HPJ>T2}) zs%y~x+$GqL_*(RNtn1L{r>;kzyIP9&+uneVn=C{7ZEr;TZI`3{wkyzn+ndmS+ndpT z+gs4{aVuJ1y$#o=ZqH2DPw&uB&iz|IU74A#pWelJtE;{{^PbFf{S>L6-kW(}X1acg z;X7XUqt87(fIh$UAdbL?a15@(3HUHJ<~%%teqVI8F+PgcS0BS#mU|q}r(XF4`drkL z*qrsALhGYXqt8PLz_19O?`s-_G{q=RU{`v-5e|;0JzrKamU)SNTv);~Jj}7O(o%vCw_1AYY-_1;) zSET;>UgrC8jMQI0$lMUeNd5Ig*9+GHslRT_{DkQlvp&{zJ%s74_`OYN{q<9{{`whO zf8C7MUq46duV0|`*Dulf>sM&~^=q{L`VCrt{T8jiZb9p>-=X!_@6mqnAJF!}k7zyi zC+vhj%&gplYj$5%7x1sHa?P&k+A87yY4z&OGPqhE{FSMTgH(F2L ziPn?tNXgxW~O4pO?q4nhYXgzrsw4S^xT2F3(){`5e_2k{qdU7MQp1eC+Pu>Hq zC+~^YllMaF$$O*qhbvpO-~`ZR|6bZ4|a zeGFQk?t<2*k45X#$D#G<<8fJaSAUn|=%(Q~{Qde-_pFnd?{~*eWc#h7lS15w^1$iV zlY4~adS;zM?DI6pdZ%WcMr?f=IgVc8xI7NF8_MZEXgPg4%lSQ=zIZ0~!}WLueuVw; z3mkwy;hDGt&%#~EZ_dW)MONWPeMAj(gdp$<7oz~I$A@+LwJAHJR zJ|^pe`1g?OF*a))vDfEcFC_MPr}5}G@Dhw4qC6Di`MJsq4oOt=y%)}pwHD@iGIgzA^IJ+MQFYD zDzsj^7_HY{ji$?M&~&*3tEgXGi-U=;!yLRGleiRz&7k~8zw5Nj>6C*v;#}&-%W*Wz zt-uDH-<#0qp>D>v@fMuO{9DoIqHeis_~w_5Xn$M*kn^5ww4FHOuvi9?g0zUQQinf1K&f zBg%iwh@Q-PDxR;7vp>!BX3T#En?`H0o{i_L{in~N{in~P{ikcu{?ixG{?ixH{?nJx z{?nJy`}7rDJN>n+S8;UBYgw<8KD#J{u^tmqUt&pzQWxdUQEQ;1^I9}r` zqj$32jbkJ|zn}G9SpNO24a{E{eV}1^;|0-&S^xiYOdn@$%(CA7an>gG!*u)!nvRK? z{%O``V$<_yXnH1Q`sZ0+5Sy-%_Q#i5U-3JpV`ToMDlvfQ^>TbOP=U%OO&m-RjK zJx-*a|3lVK;dp-3u)jz>{+Fzu!}7mm{TAl`s$o8|-tSr4!f|cYFdbR%kF4!sy+5+3 z_jBAkG|b1)4)`l8YQCBJ>fiVP?!xiwlN7?Cmdp)$?UOzj%{w`>Je^;hk z-*13!uOUvy-SBDZosH1?@a|~6dk?f8z9+83z0msm-e|pjAGF@SFZy1@erP>=f3%){ z0Q!E!foMJbAhh0oFjnCqXuZBM&c-I_cUGFB&vP`x#h8IhusJTpL-9szfj&Rg5?5j? zycZ8c&r@skJhj2c@Nj$*+v2l$1ipan@MUa|uj7&UHFm)7@F@HVkH+7yBd$+%%CqV2BnXglm8wEZ;!XXC{<4=1ASgiCNSPQoQP8JEtU zl0B8{aMSEdHCzV_?aFCryRr&xS5~9X=cMo+ticCyIyxS589t3O@OiAoSMYLNhcoeg zyaGSQS-2Tz<5xHbzsI>~`*I#`$NBgdF2IQ6z7idmS%|yiBDB4975co;V%#6E#zXKL z^gWOz+#j|-uO+tKdmWC&>(O@VQk;Z0U==RI>3Abvfy;3YuD~ntCR~g+<8^oo-hj8_ zO?VsLfw!aMKX;(-0o{qd2ec9&!@JP&ox9O-p?kP*4`)B`CANKbAKE^oX?XxG)_SutY`|K&SefBikK6?gj zpRGaLXV2o8)N|QuNjG`b&ud6G$o=p__Df8klzLIabPVmYm(ljwE7|Gx*{j61&t5~@ zXRo8}vp3N8*_*f|^;XCa7gn$PZ+=)apXV92W?SCBlZ~N1i?pxa3$g91^!yL9H!$D& zEi(VZ?2m|@kD>jwk?qvgeVqLX^KE}&Xn$=&+h3oe?XSu5`et*<%V_Sg4exgWBBB({E!v=>%Q`zcKSIr|r; z`~UPhmF0iM8TcFX>qWnZ{71umRd$8c@53hJI@d*KselXZ?O}w0^%2TEE{Ht>5pL6ZiiUud6yB=fIqF`vXJ! z;~@6KdfUP1aUX)#*BYbswI*mittrdf{%D4uVg_1YYmT-%4n^A?EzovHOSE0l3T;;$ zhPEqOqvy2^e#!Yc9A{HsZp-g@evd%^@3I}!tk3SKc zMknQ*9M4zV2R+dL5$%cokLW4r|A?N7{y*qxn8IFYd!#om!#=nYPsdf*7oWs__#&Qx zZ()D*`%we%b37Bj$FtD?8$BESztMr{|BVhp|8Mjh^#4W&qyINL1UukR^#4ZB#S?KD z_QCV;Y|KR4aamZ1*;t7=9Dj=_Hz$wS^P}^ao{#=7X#twv3(@~2Ey69S;+zB~Yl?G9 zxUT*$DTentN^xtdEGLPHnzEd7=I>xWhW{t6K>we#5+mB@!*LHBfd}D8Y=P&a|6e)^ zJJ*iR8N+sb4+pu=F37o%xIX(kHr!|9jKh6~^?KHh&zTVJw~I8qSCft}$+Po-QaRN*wp&s;(^=p9 ztp>f{h?#y_PA#$b-3;`;BWC*LIWvhv`=9u%sw;A4u^--d$o$zkbK)3TZf?#zrrS`+Y;a9P`6C&W&NaD{_{H^;YEE!v1ba-JEk1CTngs4(Y<_TT{2?+=_{s z+j8z;`i|7?%I{JBGoAPUa_(Vz{hGUTR)*_&moeA#ZVk(6M%8^e_hJ`(D6DtChIH^i zSnomOkPeXbR_Cn3k@#>}Z*|Tim_clN&wL3(yWz2%bi3hkwpUmEM9z~r>2?FsZg?u^ z>6~=C0mJj!&!F}1HE6rxS+xKDIkY|TJlc*}i?$7qV0&6(00Vjxa+J}b6&xQ zb6?GQo8uT)^IFd9@o^ySh&OWHjANu7@m9{dI7ZqL>s>D#H`0!HC+9t;XUuw6!*mSo zi1*QU#0O|QVguTK_z-PBe1x_iHlpo^kJ0wSCusX&6WV_G6m36zhPEFzqwR;!(RRZZ zXg%#qw4U}AT2K2Lt*3p1*3-U4>uFoidfInrJ?(q6p7sM;Px}$Ar~QQ1(|$(lX}_TL zv|rJB+HYt*?RT`EwiT_XZA0s6+i^_lkDNa_KY7(VG@Ku#p7vMHPNq*v{jFg-hI-mR zXg#eiCtXjAa?|y+dT2eZK3Y%P1+Ay;ic3-ra&5ORtZt}bdl>rB8|9|^(RWAt(f7cA z`_HZC?3J6Y2Th$|`Myu?zPai09YguPUvB#T-5s;^4Ho0w? zZoYCjx?jXhKO(n1vHRB!-9KWcADP>M*!@KA*Q0We=6BpLWPZooPH~JZ*E#nXrkf8U zzuzU7`#0o+$ay+0_xSicVK`4+S)q#|_3puFy?Y2+?;eWQyU)dC)x-Q<(%pF)(p~!Zv%>!P z`^4eAj~hA8 zWNsO;zk{q_ky{?NSCKoM{mQGZ)UaR3bsLd8GQMsYuG{(X{*8+FZ!~({#-P{j0`$6# zWqGgLIP|(*7+<&X#HOQ*(Can1ty*KHztyq4!ra=%Vud-mH+&Q15*O~Egie<`j{ zO%3;PUiGy9-pAoPUe)}b?;E9Zqwt-s8vLB~rn7zDJGv}4{oc_G^u426rhDGV2O4c= zxtY0Xi9I#oneY9J%>N{J6S4C#R?_8qKG^!DZFo`n%*)TQnRmrrZB)zkc*X?vKQd+ade)Q`k@U zi{(Q8^$VJR{mOEV7yTBN+nW1(SbuBocJ^;xv`s_%#&~Y@NACX}r~H%o=68Rg`Q6`P zecJzMe)ms^>vE&K^#1&7J!0?Y`g!i(E_u7=rOzu8H^^&9?EWI#ZIrhguEss`y#Bju zIBp~#+%s>lyr@~k?_tOX_hx;|uYJ(t+!xIU_e1l+{n32z0G2l&JP^$X56VlI^9K`~ z4<3T%gN@OAunC$EHbu+%W@tH|ftK^l(ers|IF6QiEwFynGVd_9J1=Ub;d~m;jauim ziDP}6`!8KDI3llYUMTI>}mi5lkP5m&I^ zC+9^+%tPyGmJ2=eqUJOH6Q9cOSx%hBbjNpk#q)dP`c$7h*5kUKuHm}=o3HoFOXurn zuzp>2|GWWt>3ki@*U!v5D=(d|W9Uyl8}08Mh}NeEq5Zk%p!wQhG+!Hn=4(UIeC=E` zUmJ$zYv-Z)S|*yWWuf_6Hkz;Hp!r%Zny=-d`C2}juN9#AS|OUR6`}cB0?pTo(R{50 z$D~U0%0jwMYB+u*Un|e6Wcs93g@)-E^0nb;zBVE+ov)1~HeWj*&DTbu`PyhSUmJr< zQWu2tys&!gf6sHMS6`Tyu1}B0f9uoy|8L$b&a?R)lAlcsvH2M>_vxg($;|gYMdnY* zyOh}Z81lQREXV)<=2bD@{0>8YSB>U(DKx*ULG!!mXnuDYn%~Vp{{PqCCBM5|!+A*m z{uN<={C(nZpUg(@lR2z+De2Gr%6i#6V)Lo_Xg;+d+?SO9Xg;-&>E=g^!f{=dx0vmC z+{kfWop%kfzk{rQZQhcwy=(KX57+HF4f}=UM@#c=i1Q;1`O&g?|89);Z#jDZu0ZeK zo6!6AW|lWUx&_UTZsolBT*Ga|-p9A2`OzI{esm|AAFV{+i@z)U?%jF!68m2KJ?MM! z#$z}i_o3h0yC1i&p!~=2Om91h{)hkEudCP}@7IUp`}GlYd~~%jK8lXRK8EX4kH`1# z6aP(D^-9y*u5T915HP7;@J zy|AC|7t4k8^#Pi`Hn5!e{D;_p#DxY`zlU97}C$z@$Y{V|NggV`q_e}pYPE0^F7O(Zhm09rkfv$O*cQG z>Evg8kM!^h^XEjr=KV(O^VI6`{Ei;aR`htbp~tfw55Yfh%6$6&u{rUdco_bL9`E1S z0e7PBU;cw#unv#MC_k#6&3@I(kLvX!u20-6+9iKiV*63me&_~FZ_aWJF(cY7zfn9N ztD7->cWfH%k-uj=9Z5%f=kJB}abM=oiuTd4UE?dF{qpyZWA%GF2jJG!LHP$_qUNCd zgY(n{cAuM0B2P5$9=jFiJ|^V@~}Jwn6&Bjxas`R&8q0eU=k3Lu36@5OV8~WVA3FvntyQANY zJP~~^;v`(3IypaGe)rIDU;SHtpOT+0zfa|N>#9%7@0Fh}zmf90cYdGzboq_pxrEcv z=aT!P@2mAg-;+B77tv1XkB^gn2cYHrnK*&tISYMX?rijZxqekkKZ@y- zQs--!j-j3~8m%Xc$xqi4E+Dp^Fcz&Rj6>@Q7ozoq@wg;)QMjH9t0(;TdUAhF%wNED zGapCt=}93rpC)Ghl>AGXZ+?l)pPE07*!dXp@hX<9tEGv#r0_YVrkeP`v1}T z#j+6Jn12)V-M{5w|5k+9{rh+N&0+d2`M0v1)79rPZ$s-Rw}<1nBmYkJ+v|WF*UJ36 zh&?Xk_wUKS8&~6fA-&wI;XEPrll$`@$WOPIFqAJ3#^>Xq_^>+mvK-+3h*$E*3T6Ix8!u5JH|1DzAr#eozj_H?2 z>+|1^r|V0Mm%qdG0nxkp?-5%rs^4XMAN?-d2k5wEx;*$O|HF{)ew6<)=g0D3BbuIw z$&WwD|CHGCxCuRv#7zGze>1V?6Dbcq&;Nq$dj634U*>-m$JnI%O<$XjhvWY@AODv1 z&BwQp|Jt7V4v*t_zYqEG4{?6{!bPTE@(cwE1HisK=aXtXg<0dnvXU@^U>YWd~^>qAKeqpNB2VW(Y?`pbRRSy-51SA z_ro!%{R<8(FdscY!+n9|qX!in!t_b0gEdUYkdHP-^U)>+>3p;)vH55-G#|}C^U>yL zK6)rFNwp}jTwGY)Qp5I;`}MGb?gi=l7s)5vgxGwNnE7oBj$pp`GcvzjL3?87W5`F3 zWVyP!4h2Us-+UB9K6*5ok9I`!(N1VS+8ND9k3sX%F1W1vSbvxOJ5Iy?`TO;wt_9tg zZ+#fqpA*9Vxj)Pg>HI`Aou7moSJ3_s%k?bi5!UZna4P#%8=a!zzB8T?omTLF^UdDO zH{a}o=9{O7^(p_+e6t_Zt#6)z9Y|mO@o1i-9)R6RcV~v>&nh^Z*!}(2fyAckLCmig zol`KF{WQNs;voe?i9H_VcZU_6i>om+q>J-3oDU?w%qqw(NavRr^2;37_kPbs&qE%1 zpXa0Zc>#KV7qYzhWf7WRCO8k~m&L^1?GX!9DzG=B){i%IG=bo&eN#)cSeWfy`W%BI8PT8j0@LgtcL4iJR`cWfcz}P>3nTM z!9@k;LlX)nvR#k!V)QtPnSM#ZWMYqZ5_-JEOrKJ4DY3_m~D(c?P_WYE(`lHUBiB0lZ>j`f*E1G+5+-D_VaQL^YuNBm-{KyYiAXtpOgJJp2POd zALlaN{Bd49e?G2HEeQ8zUiFp#=e}H2a0ly|PLTURbF>?#o*>q{H;@ z-yZhI-zN^&w7Kka|?zPg|3-X9Ny<9e{*A-3aj zBgeU_;9+8a2U&l0!6RXNs|y|r_s63e_6xZ`9xr$zzCSSBA5X^n_f))pPowGO88p4D zLDR{zEbsmC9D08|&w2CySW9fWc>%pYUPSMYm(cs;W%T)+jTiBJ(0|gwYh2&wiC;&b zuYLo4zWPn{dGfcg5&6bCwEu$i652m+6WjiI2W|hni?)B>V?UoH{k)H+rw^EJdfI^g z&WGsp(gXE^gEgdY4DHg!h3R%_6Wqpq z(G;yGHDf>Osxu0k7pB{_NImJ$!WM<;b}feIxLe`~+Mlh^=b#TmpM!3VRoDh=@Nis3 zx@wD#>m7kU=iLsUC2o)Y-_4QuJ$AsK@hIGeN8_Wc-w~g}PWTtoJEPBcAA>&M-35KV z`&jh(?&HwsyN^f58@r<8jor|8^9ks9V|R3%@kDf-@g#Jd@nm$Iu?ITN*b^ORJOv$R zJQW>hJPmDU_d=f^?~Oh`-UpY?KE1GCq0f)^)o}hX^y{C2J}2HEeNKD;`keTg=yT#{ zq0fn*jXozn5PeR35c-_>Ip}lZgVE>2hoH}i4@I97KNsy!7=}J4ejfUqcqaOscotf( z%|`nTa?o*wT=Y5dJoGv7eDpc-0`xiYLiG9mBAk$-{70YfFGip1FF~K{FGZj0PhvML zL!aj_N1x}fK%eKYM4#s$jy}&n0)3u;B>Fu6`RMcfqezc!Bl`b|eLj5*`h5BY==14g z(dX00q0gsZh(4b_9(_LjBJ}z63F!0b7o*RoPeh+jzXW|geG>Y7`egL^^eO1`>6fC< zr%y$nPoIW9pI(JNpI(hVpPu4AIh_5hA@(`2>FBupW$3v440K$+79E$r937XRiH^%( zfsV`1!d++0DV&WB=guj-igYxtW^UoUI2|G5^79K9#4$21e`VpqI7Y_h7r9 z;=*f~o-ylc4bw4<%P&E{?{qD`gV*7Qcs+iCOK~&afM4M<^gWOp(f2@>;|aI|eGlX& zw4du{{26b-`5f1+I3aa=;ceJr&h3SF#Q7eQudFP*6I;(&S$J1G9l8FG7T%3Hcn=Q4 zdvP${hiBpa*bg7TUicvPz=yCKuEJySVeEvDUPg|DHqJf6t@szqM%l?*;6OFQVg4Q>Cuj<)~aK-+(BqV2!8a7=1l;oDr-yz2EDt}Ak$-zj{L>623LYM73p{r5iF z{`;UX-TvD^Z2Rv+wEg!H+Wy;!w*NlHC8w((}w{xAX2O`V=QMiNHCE4wXiw(*K7;x`!(Qn7411&FIQxX<_AT0v_#u`<*4w}6K(=>TbbyBT1Ty`gqJxRw zWjQ21q^L2m?Mmc)G;#mJ`B2+M&CvRH2FuOo`%lf;ZYug^>Y+FtTQGg$3ZDN%-;-#C zz9(@Q`kq8<^gW3-Y{%!}4kz}x@wVu5<42(HNwmYAsrE%jv7FCuAIbS@RMWvYoG)bm zIu#uq_PbM2M{GcR4C@W3?X2NBZR0O^9=r?I=RJaBu^}FZd*Jby!|!#)QtTGCcS2Ej z;!(uNc{#D@B;s+z+J^l(8S9o){&U>ZqMk*k5PO}ldTMlP(P?pv)t5%Sih9Sf+Mm~l z?beI>7M&ip-?!)tmYWjw)36=m$x;8J0dcIp|GQvH`udzjZ2#ifX#e6sw106B+P`=X z>)WmvOuVjYNYT)ubbB5{d*xitkJob;dOgoW+bfx9dnF5PuVk~l?Ufv~y^@QzQ}WPu zN`M z6#70#4f;OEbo70W%h2~ZW}xqL)S~ZmT#mlaF%x~C;|lbBj#=pY9JA5)Ip(16bIe8G z=a`4K7w4nzb1XpL=eQDmpJO5Ct3|Y^=qh5*r`k`vnCtF+c{Td{?lnyJ{f;H*eR?f= zpI(PsQcH`j$7IdYq8nJ=_d76*GcH5l&$$u%avhhW@9C^S-_yAXeNX3R^gW$hkmvu4 zZbhE|FS?!W?O=Nt-V?e5e`dKm(f2}DqVI*=g}xVZH~L=4J?MKO_oDBG+=rcO?=O0Q z?fG5^lCL~i^f0mc%0nSvS!EpZ6|C2@_K~7T!~MBh!+Rm=_=%#&!u|S0(c{=4dZOql zmLE|2q=x(kxv$q0Jsp-?Q}j$&ZcWj1EH|w7Sq<-n7@IFWkG|)>7Qe4uHSGob1z$wd z=Syh%d>Kujub}7iRrEcm*SL<}=dTlczTZI4^PA{-ehWR%>(KMO9#_wJyXYPE!*(dL z{<}r*#WAw|_lrJ=V`O_9iav~EWV;^~ZH!}N`yUs56358zY%2ORjZ%f@0V@G<8T{#|7=I|r9aSoX$P7g{mJ<J^8&|u`f12^Y4aexw2a#s;-I}C3Yuv z`&d0K+9R=N9IM~e*o)~?qrDUR#M6=TX5Ykqajcd%`zK772PO`{`gkzQO^FWDuzlmn z(IJV(ajf66{U-P;Hbu*yX81R82JS;Wp*iav7#*5uLF|62`AETN`!f$qv`W|ydRU@O zB3<6JM#~#wrXQX-g4lAWEn4mnGre7+J+b8v(yw}Cq66Et+(G6al{h+%F}!EgF--5A z=oFUkoH&;GTT)#T$6&Iii*d-GkoSC!OLQf+{5u}qA7Xx|TjC^Q_veIoes^@gPK=jh zKKWFS#L1Yb>5({v={r(AmGvqAnZ7f1YN8L*>(}&7oR+ZO(#x3qrMHIVG^46-;&kkS z1HyX!G~`QXg!TFxhkOZHZ(!m~9EoRz^#&%+#th;?tY^Nh{i@DM3}(8|Ibyv7Ylb9- z61#sovg+JKCd;*|IxjH{+oQ4fC9+&rBA>WxRbC=HESHza!Jfpq*dCql^2q&NkVp`> ztSMC1FAA~qjWeoB62;gBOIhCZuZ^mciHb0t@;@v``Hv&nPp7x5sZ5Lr>2kP+^o4Bi z{KQD?f|IA2ZbxaDkD>o^OoDzy?xR(4JeK{lKXV+@?a#b0oCdY+4>=XtE>eLtUg>T=3| z;<@<8)b#U#3yJM7UxfCTUlsBN%73)K{A#A#Uw%zE&LxR!*^cJ{IqvHc*Ax4@$oe-V zmWJ)!khqck%&T6eVLy@j=kmmgM7sWoq5gRj>wEv*jPCC(=zVu9dcWO<-v76=y!FpJ z(E8S$oJY&MmBi);ccJyryU}{+J!n1jUi7)Y`_S`nKil&>JV0E79piNI5YtT;tKxL= zFxr3pNJtl}<8<-pf73KjG4$uHLHpaD zMf(Y!L;DGyNBarZqWuIfp#20dqWuIfq5T9eqx}T0p#21|qWuJ~q5TA}qx}SLp#21I zqWuJKq5TBw(0+pTXg|T*Xg|R_Xg|TbI41R8;)8Jg-q&#bkbZ&G#Jt{r<#s)9=qAz5bH;mFr^qMbhtYiQkD$zsUOA z5?jOewk7@u$G=^}aU$t=N8-;o{bESJf3d#l_ir@)?nKk?KWO@`L(^|moKC;>(DYls zIGuiXAvXQ)il*NNX!>o4rr+Jr_6zBh{oTE|WpR4{k$h&)5Sz~sGk@>meVFg@AoKSv z-jCS%81kY0S+1_`fZ_w0Z$5+}A36xlhYm*bp+nGos4(^($jzIIDc1)kdICy*X zIvyFe-=X*@w&!(3j{E51j>P^RvYpPwop3dFVL$V#kI}H7$aOrn__*S9K7`>q9v|;# z*LXj>VJQF6>)0K=jwiCb`Orz|bv!w~jy;IIjy=)qcnW$QPerfeY3OnHLi3~EIG(r< zTE9OXt>5=W>-SvmdPU4nmp}cB3;2DH7rCxyhS=*$%<-RHJdpVwKQez%@j1lK$8g;T zvs_)>km8~7b;oes&qc5MF!Z{ghhFzg^txxE*F77TRp~$|iuX~dH^SYOz*S(zSUhj%N_4z;Av)f> zh~ss<_bRj;T+DR0e>J-PHRygWLH{@6TJ*cV*WnPn9{sNGQuMpNH(&`aL&raF#8J2$ z9cNvEjyV3J=5B9-( z@kRFcKI}()Kc0yX;6Qv3f8u-i5254Nt8ggOA4dO2;}LAkb2qE83-cev*Z98XW7wSM z@E*r)On(CZ#3!*IK7~Fv{51O9@H6PR_Zr;HcAv$u#LuDijOWpD^0nwV`3vay_>1WH z_)F;c_{-?{_$%o6_^asn_-p9+`0MES_#5c>_?zhX_*-Z?S%;>R_2~Hc+vxcCJNPWV zi!b1N==k{i==k^tXu8^fj(2~Ej(2~Aj(2ZF$GbnqF#eD0=58wfl=Ni%AGzM26>pAX zK}1^>Zjs# zeg0={SuYCtX}u%4zQ2ZimtBLTtO6>CE4!WMAh0aU;&Va;iN)9J>oB@g3mb4@Oi1-NHgv5vP{a=qioNu+h)d4ME zj$*kT+>b|>Se|z*>CEq59Cgz0yLu4cAw340VHZ3MkHz+Q93F?qv)(09*OG3;o<}{I z=_g=s?2ez2AD+l^t)i1kPL7w;k@Sc3z*ktWC-!IgQ}7%-6*KWPw7uI4{oZbGv>&Ap zuASbuA_$Mpu&v3er?-N;Q*Y01F;qdf|4u4eM0$9{B9NHKj+i?X%TuqU4_MUH7svEXbD;m zx)!bfT!+?wu1D)XOVRqz4d{Kj40qy<;dhsp+{FG|9IeoBKGgg3X7v8N1-(CSMf0uO z(EIdu^gg`Jau2cBOT91eMeob|(EIX!^uBxmy)Pd``+Xlm zum39ae?=Zf|6k(~^gF$)(eLy=ihif}G4wmVkE8v_PoVwxPom%HeG0vk00ZF`~)4B*o6Hlk3U7ho-eT@ z=lv@*-}xG!}H5hmHeA zrRj0NdgwS{eRLdf7jztOS9Bb(0Xh!Y5FH2H4IKw;gpLF5j*bKFfsO<2iH-yAg^mO6 zjgABEgN_64i;iRLhmHg8kB$Q#fQ|zmh>imuRO&e3!KH@~d;Zk^`^Kf|{JaS|4%n3G zjsrGB^Y;uie{YUkQY}gk#biy3(v~dmI3R{`z*gwE)M03PZ;ht+HfVZ398K?S(e!=< zZcVi>ZHI}P_N7O%J;wntj01K+#{rK*#{rK<#{oN{#IN&kpxJwu8TzhQk zacs|VK%_i6zVrlQ%cHKPmPg%;LwSUZ19mSxsnmS^L=EGB>9}X<$xN>w^(^gy4e(T! zA5eRWhH?s7uXpKbVY%L=y~1+6OHXIHVYPiUi~|~5p7llZk$&hn(-~Zs<`LyTW<&!@ z&t$sSM;&K6i|Ngne>OIa29^$r=d0t0=b+<=gVFRo1Wn&V(e!;TdOe1r_v?9V$MPbR z*z1*rUZ-sII_03(DHpv?dANE;erW;6VLcyNzp%6@j*;yrN{izd*G)Vj*c_l!FCUf?krtN>~X01)Lm%(>29?CbPrm8x)-fK-G|nn?nmoS4`3cXh{w!a zHSHlh9#>)WnpM*t=68BUkCd(^_IK3l^(fQ5UXNi$^myqL@qG1qJ;`*h*HhRudb;$P zcs@2BTD7M1dGeR6s%Mq_!oioe{R*ArElOGB(AO>t(u0+Usw80nE!U^`Y``(<7(T*$ozLpKM3>RFMTh} zf8V&;@5^AleYx%%@KF4a>AOcCm2M>VeL?MyALEefPf9;!{k-Z;8uC#jU-+!_^Duq0 zhUrNA`HRvo`F-2Z7~0QYk*@0MzApWS`L>@iw4cAlu`IU*FU0TA_Vf2>`}qg7{rn^A z`@hXUq5s?bGt(zA{TI9xf5j^N4Qudsti`Q33%B9y>OV@i<4XLK{a#qTL&JU}{{#J3 z>CQ0yZw=Ftc6(jvKX@zFOS)c^#4sPL$Fe{5lhg-qTs3VM;tPnWAvDRTYM5-0bUd?R zvQaW!FW(KVmlHF6_vD_$*3b7q>*vHw-z&K{vGsIh+;yMizHHz6IWm90EPjH64vZy~F8SQ^zDbW1{AmK*Gpu)#hWf(EVZ9#4;rb%$^-7+CBk|O*Ua#b7m_gi| z^=uy_^ZO+G5x1)9n>-!cqp{@~vYj)MXA^g=IxE>fEO%CN0QMw46WgQnT^`A|1||m+ zx2zeYtbb03olnel9FiQy^e!C#Q1t(c&qc@Co!+kIykr*XaZHq{A>Tum%SmQq7t9Ou zb2ZFI(n)@@ApAb%KlZIDO%~z+EW&}9z`|Oiv5fWo{Umx_j5De#lI7S1N3opw zdL^2#4@dL$5oo?X63y4oNAq=;&#M`o920L(yHs6}oXmKN`91F0E~5RPjP~3gFT_^S z_$2*om0A zv4FCU!_TyfK_V+JF`}?m(`}?m!`}>#R5WE)c z@4pW1@4p`H?_Y}c_uqh?k7elpP2Y(2cP~f#*;kY&N73u|7j0+=kENpSTw7&wc?N*LV>f_jn1{&3!rfN_@W~zyE6TwKzuhvw!+ZysMq@D6^a`&=ye>hSuzaL`DW#duNhUACbUzYc3f8j^C5jQ4X z|KsE*{Eq$N$oiX-pAx%1hI0KgmaD7Vocx^mmg^YG^)JwV@h{PS@vqQw{cE&b{{}7B zzr|(MTih?o)$cUyKhh5SA^9`&?HB)%?YEA83bFM!r`xan3%_4K`Zf7GvHxHE8~Xpn z#7y6s+(vAFx7y#m9qsS_Bh25C{EK)V^Z&%fNX&YFC;uV7fp{n0jKoZ@OGahsesLtO zSGEi1adcE)L;i_O-?gj(vHjvm+^}pnV*ACB^V+D4;|u3iEpPWg%iBF!ZW8zRUg-b7 z?T!Bb+dgqw z#nCm*$};$U`>`VV<0ElrszX^vmb1Nn6zQN*&C$jo9U$lHn6ggcJRVcl85aWA%vWxU%D!Zu-zmNylB$e)4W;Kluq^JKf7pB(|SiP4_3o@yTdEc@I2; z{p*Q?@f2Lc^i%N_JS}XeS6Of3UYs}ezUdRkr{mkiebMvX55MEOoWXupM*YhM5WAmP zT@jsGc2*o?b$N7l*}ynf>uZDfy?W8$vU9@k4lWzYa%IsF4cjqJM(38GKH8r#3iCN{qtXAJ z8-uoMFTir9k45`K$Kgc05bZY_kN&USMQDHK1hn7sVzl3KBF<#~CFuP#3B7+Nqxa7g z&WHEUrNnm-PsO`&8rmOFh2B?OgwVg7Li?9%(EjD=X#etMX#esIw12r4?O(VY?H8Jf z_Ag(7rjuE?cKV#M**LmpPT5?}tM?^_`*I$7U(QGG%LVM`$mq(lg~VQG_5Y+7q5TtA zq5Tt!(f01uEN^@F8qA26lwHeo(~H{Py^iU&cdy5$(bBRT;`!=*z6{;ojm$T_EXS77 zin5#H<3$Yg~8p&DYU>+BcYPKkb`nKKd4#kFLWlskh74W3uM$vUgbCep(Fu zwC|$*e($0Eg72gKe;=Uze;d&LzYo#=zmITh>f^GFn5g-<>=U+UKP`rS+D&Lb?Wbrz z?Puuywi)fG{T%J5{Q~W${Sxih`U*SOeqHtr+q0h*$@jl4`<~c*e@n>szcUW`KGIM7 zL)lLu-}_NRKW#exwe07R5B^&A3pR*;E&HA22h{$ip*%qH%k5=b!*bipwuR-km+fG= zVYPo~=%+=>jX%r&V!G#FEjRu~$3J$W;~)Q^kqVpp`B zXn>Xj4bk#pH?+KHgx>GFqy2n)p#6M%qWSV(XnC=Bc~m_-+NXS9V)qXzKlUr%KaSP> z@BpS)LthDXk=1M1zA;tG@ z%R9y~l0G|?caCEuogP!(C61AH^0DQ|6Su56E@=ChnEvA);#N|cu}e@m*Qycm-;CB`A&LE8Vx@^WJLyA0iLV%DoDA4%+fSH|;)qx(N1 zUXJ=5nqqC_m`sW>l@Ja^)j^m`)_~8a$@^CR-pYIH=+F=bbszb_vdbOf9^s1EAB=6L+-=V@qX+={q6y@UH>3v zP)~da?bld^_G>(h_G>(X_G_$0`!ya#kMl9KpX710pX3R&pX5ojU*jpXpW|t?f8!an ze`5{Wzws>EzwsQ}zwtcUzp)nW-*^G--*^%2-*^e_-*_4A-*^S>-*^@6-*^q}-*_E8 z|8Jn@|4p=i<1Ms*V;$PRu^#Q;cpL54cn9s*co*%@cn|H*cpvT0_yFzC*nnQo57GXN zkI?>%jrbFOjP`4Mg7#x8L;Eu}qtEGmj_c-rQT}C|4w38pRr%L(jO@>M z<=@~2{1!Lj7Tkp2$IBu88b6e$`!#;laG$38HGVE{T#@eAK>8(q4YBgsls|H*v&Eim+3{Dt;g{EhZo>_q!5{z3aK>d=0RsKS1W zdKLU0{TB5#?4Q3+`@dp0=G$-4fc=owk zU9k_b&*354-M3uZ<2Y=K z7vm9Ve?dF6pP)V3PjDpKPtbwwn7U$QgLb=tM#bU!teF2=oNmicg5)}R~YrtupQ%qsBcBTI9AV}?Q`4V{fTYA3_$C9 zXQJ)!vslk|)!D@Bss>gJsz|rPF|@-$!E}^T(k502iR` z?6GJ&dmP%%z7TC^k4M|t7oqL!31~a}V)Qyp#I@5WRa}CjYbI4p=DeAXF|_Zep!J_i z(dWmeqV4->X!@=~(>ImwkiJuBy|0GzV!dxVGX7sNgXx|h4deezx88R-GX7t2MLb_^ zug^ly^K9mu4(4FXXl}*4cscbv&qvSm0xa>NyWyHuYFSSF*b-ksrZ!T2h?uTkdGqy?dKJrh2=i4*c_Jo zyy8oi8&>;;hW53w`R!NeefTxn-u(t`?|zHse_PP}_&cswN%Vci55!(CB!B*~;-@%P z+q*wAJrVs<@oPLC$)|s-_&tu*e0pox&+Qf4!hUYA*uipz(H|PNZ(I=lS@BmKtL@#t z(f006G{5)1N&oh9E6ABFl>Q&*ec#WhIVoKdjM@JTUXky zX;ayj`Ib+IqvaDZ(~qcZPi#5W4lSpMnSNwt2V%=Bqv9ePfBg=KJ zJcjAES2d&R*vc+pxnnDjW4SgQABOho@nL$m%C5-!|CJ{)e@m)+24hEW2D`6 zQe_Wf_xogYzlm9|XJs#9_xqH1{;BBxpB692eD3EymAx@h)2Fg8(|4p!SJtQf&-9(C zewAl3y?)Jr$}=jhxAZsWJ{+K7InAg#yYejTf`h|)12x>ggTi{}7>D~8S#Mb75FCj^ z!+OIi&&3Sl^H|UP4Y?08D|5np%KtE*@*i!lI=x*@Ze>2{u^`IRkY17P6jl~s7fgit zMH=QK>larh`JGl(rIjVv9*s?B$o`d8jv($@HN3JsEH}Ke0(%lyVtaJH%OmM^WaZ@0 zUOit~e^iL$_A1{?UNvnD%XOc(YT51?!pItM+Dx#)h*L))kG(e~*A zv^{zy+8$kqwnrDC?a`~y_UK}?J$g0T9=!%_k1j#mqt~MC(d*Fm==ErObSc^%y#Z~H zE0N01 z^ltQe-GjDI??v0E_o406`_cC41K1BAM7CeKDo$6(?>t=jNE{=-_ju)M+<=ebMtlr6 z;S=$47~WHR5`9nYDfB(Hr_prt436dZ)}Z|Y&!X+)=g{`?^Jx2cE!sYQ0c{_@i0e}? zRi@juFKf7;F?`qlRqivtYyTSQ`e3&EdS&|mBj3Q5#BVZvBIV0lxG(X#%JlzEt|#{W zTDB9u^ZHI@)Nmv1rgw20)89kC^ZGu=S6BT(<%Y`icMXv58hlv!QDyqO1{l8Uxe@&? z=f}8}`uHdKCvL(d-*fyF{SNGB=yzZ@qu+u39Q_XL7wC6jzeKgdm#GV*n`mT#vY7*H}(+pyRnVY z@5VMkzZ=^W{cdbC^g9+A=yzkAqu-4^6#Z^&3-r6OEz$4BwnD!bdl>q?*w*OxV%wnK zi#;4$U|XC({&)oXeb{#B_hH+k-vd4p{Z4EL^gFRfq2Gx;8vRaeNAx?fozU;Yc1FJs zdkhw0m*MH}!yZfQ_hFAizYlvn`hD20==Wi}q2Gr+0sTH~cl7(PC!*hnJqi6j?8)f& zVSAw8hwX_s;3??$VNXTB4|^K=eb`>;_hEaZ--qpkejoO9dq$}jRusOr?n4U2!SHpA+--XRbzYAM{eiyb7{Vr?~ zeu4?~yRgORcVSD=@4}X%--S)0--RthzYANAeiya^{Vr@JPDqUyJ{()j88Lk1@N_)@ z$zMhdKObAq88v)#JRP~-lZTJN9J~OB;aD7uuXN`!82w5*MQ1 ze_4cn|K%zilUh9d8m@C*_0<}#Gjjfy48M-)lTz1en2zE5FV~~re_1;G|50_{@jll7 zgrJ_iS1{p~tMH(d0PJ19q z=l6KL-fy?>=Xd_O-=5cXooipOdA+W8q{c*?OYHYw=Aqwzc@+Kr%VX&GUmnLkcd6uiFSUUCv=G%UYq5bwnwEgxawEgyFwEgxKwEcD&+J3tn=fz)jKiJ>bH0&?Z ze)`7PH<@qy?F!c4CbBZb*5jDY{8eLDGvD@ABwjOiEwSymYCG;*XglsYw7vK3u-y8w z?-1Lbi~Qe)vG20}5s{4=%GJp9O=I69wmlb#H;;Xv*zFn$I$ z+-CCWZD_mgM`-=^V_Y}>)3KjmwEWYt+gaZBE)4ai9bvsY$9@*Jw{z?+_G@V5a}E1t zJS6hP*xkukZO`3w`hCHcW8U=_elT$*q>O=_KCe* zhnnR-8i(tE9OtiNe-8We>)2ng8u9P^U*CzpX=sNqwte9bbbQaB==h$$(D6O{&~d~2 z(Q(5E!utLmdyv?1!^rtPH1;22#|^9X$bWG-=kYMdeNE)Qu@%H#e~b^0L{ciHBw~yY zi&Rdjl8n`MhpH*=fAy4V$oqdOHCb+Gq=ts|7!QfmN~xWU^+@}$*ZC-7+llLrbdS4um)?*u?_1DH|y}Jp^+fLjR zZRcx-*1wyh?ZhXb?Zhq6cH)-Uob9(l+i_dtK#sQ!{?2tck^Qp$^CWB*IXUGNrhDGh z_RqFVxBasnHi@)PIW;+7ZTCG59nX3?+U|P>b|CJ6w)dWiw)dWew)b{K+j~2q?Y(EC z?M$7~_TF=F-S{pk=VG+HOG;Oc+xs3vJMVeu^*$eM=k12J^L7u{uSd!S;rjJRxrqH8 z8o5xz@fZ(@^h~)p8LREEz0h{pOVD=MOVM`N-e^1QWoSEWAG95|FWL@!Iob}}4{e9N z0&R!wkG8vBiMG35g|@p6K-*mhqV2AO(013W(RSCtXuInWwB2QyK4%XPNbsgL>lfbi>9RGsPbq^jOA^2#nA4WfwsG5qV29( zXuE4R+U}Zzw!7w{?XG#audE;?A4irKq!h9~+g&lVyB4ACuEl7(YYE!!Iu31jy&Y|L zy#sA`Ek)a1<9O!8vXpYxXS*wsu8mKbNNl=xXNu|C1mlpdA?>brrQ99vuSpu(T@&%t zl*!?Ko0>8Ot3{@!OlSGN6Q^lN?~rumzLa~ya`&a&8t%ZK2(jmNHhMnipyzWgdOqi&=krlqKH;&H$Jw6kGsyqX zPkAC4BkO-MWkE7V*7sD()5#cF?=vY2lQFXXMJdlFV`Mwer7TXyNV>BmWhrsX^5=tY zmzegI_uGXqIWo7rjr}6S!83%yDrc1 zsOjV;rkhT_hfN}zQ{GR`SMR$I&~$4H+Md1@ZBPFY%_p{@`PWDM|Fw~iQ$8Vf{YZZH zY0CCwthT4`VEXXLXDK_A(~*4b^ORl5Sk2eI2>0Kfl-=R}+mrGY%MFcusbT%bLn2?N ze3OjT_VjPj_Vn-2eC~U+J^cr?J$)}aPV`5#J^d%NJ^g32J^dHf+aU65%5TIThnk)w z+MoYS`6I=4%0E-~aXoFv{R_?ah?%}WPSWfx= zZ)z*#`@g9thyQD%A-y{>{NG8&A-zNXuYKw%n2K$~|FutThx`t3>Z$yn`GNK>JuUTg zrrW-cj3+!JwF9yHr>Ui9rgmbvR;3+N&%$Vd#A`od4TT`|*+Q#$HRjoaIKK z-|xGQ{i@9VT#tUg?*^vZzIbCeu92xXu^x{bInJ9?Zy|O&$p4Q{9TnC$I`ua8Yef83 z4f}PCnr=jiL)6w?ld(d|Hd(n3I`_Ojs8ECsY#}UROK0xetA4K~z9zy#wW^z8m`+sPE z#=}ha_#Q#`Z#KG~IcWR*T(o_D9(p{FqV4mKq2JYe96e9-@lE0r==oZJp0B6S z^Yt`(zMetP*FyAsEke)Bv*>ww4m~f6(ettdJulCr=Vd8+US2@Y%Zq3~$xG;W`Cdl* z1zy2JxD4$-S&sIfyoxt7{WY{b|8=xI{|&T1X9e27vJ&lIc@yndS%vnitj6iM2JKf_ zi}tI$h4!ngL;F?UM*CIPqx~xHp#3Tva0zZiujjky_1uK^tGtKyt8B(K_&&akAE5mz zThQyi740AS5bYn?hW3kmgpSwz810|<1nr;r6t|XbPvt)0`P`x5`NYrIPsfqpu4E+UraX$b5Bhv>*$p49#690_08~(!opUm`MQzM}r|2M47cG%z0-|+{_ z+28Re+TZaPhTs2Xd;I=y>Vf3;(ck|~J(%1+hW7qLXnX%ZXnX&^XnX%*wBO=CwB5e~ z{k^zITB6;*658%x8EyBkg0}ltMce(Wq3!-fVJH4bw5S|2D@Koc9yZ_WKsthPWl#|I-TXw`q;G>$gGM^-o0G^-n_E z^-o6I^-n?D_1mKD`t8tm{q|@-)2V3t{%L6Y{^@uFo`H?H4?18|JQGjAv#>Y)K^@V4 zs7`1<)Y)i1RA(HA=U^$Gi}pu#!ISv^u4q5dd1yQ4`Ph!>-S7A4 zW4S9a2d~0H9Dw6+AeQ4G^!E|3#!1A3aS9GW`$LAJ{UO89cKhLIf7&%To#n2@88`xG z;&o|}8guY^;{Ggm1Afo?Z$#VqN22ZgH=*tPH>2(Rx8T<-Hws4+kH!?d6*KTQv^{+c z+MYfZZBI`@`{7d2ez-KWpDZ2iCyS!}WHFpGB_l11`*!}6Obz!fhJLbaw4W>o?I+7c z`^oaqezJVDpR54wCo4qz$%@c^vSPHKtOV^R8;ACj-H!H?-GTO#m7@J*akQVT4DBZ? zNBhafqy1!eqWz2$(EhTCXn)yVcsx!*`^)Z5OQdg;iS5Ulg7#ZYMfh^C`>h^A`>kf8{Z_NkeyfMkeyc}tCC*0st>&a9 z`mN>?f6sU1=Ar!_kD~oJkD>j$kE6ezHy`Z>c>?VRc@pghS%CI~JcagyJdO5)JcIUw zEJXW37NPwh&!YVx&!PPwi_w0NC1^j$^JqWFQnVlB1+*XJMYJE}CA1&pWwamU6^xZF zOM8|3W<-3shWiFd-(E|5gXu+OuWOi&p&w)g+7Ggl=fQrEH;L^BS%vn4tVa7k*5ItN zwQ1(3GvaS)SPzEp-@l!f_`SRJxN8>qKkmT|_ziBvz4$Kvf}8LUd=C%cX8Z@=#|Y2m z2Ur!iU`^bLb@4-dlzd|w9z*;Q`ultzqrcDh3HtkdpQ69dw;la`z8&cA^L>W?KHpCC z`~07yzst7^{awB<(C_!}Mt_%Y4<7k`|D}9?;;S_417D}LNl(-du+mr5-@i?>{_|a! zZvE%TbUl&w*1c);i_os|BRWp*r?8%%(|$=y)GLtx|26G5V*ejQ{poj>tEl)R?N8=g zf5K3I`U|Z;?L+HN`_cN-0kr<~H(Gx>i1Xry+%K-%KN_wZQvW%e7GeMF2l|iow~17Q z*!Bmf+pkk8ELSPoI#bzFlr!u*=)wTSI6Qu~W)qy0s7!u+Gs z>k<1sgSzPV42W58{q$pq{a(S*==TbUnSN|~Lt?*I&;b2j0Ws5$OFy32{w5@Dl-?vg z62CgqSVKDmGQDYfGh+LjkhppJ3B>k8AaRTIR>XeCwvYajsQ0Pu5+|bd z%ad5{BJPKiu@9bt?XWHO$96an+hcXk%c*z+@o6{;Pse&pKLf`Qcfc5)iMeG>*^RP9ZkEdWaJPo^JC%gddH|l|1 zi7&*9@glqed*Tqh7;nU0I2JF#Y`hfxen4+5A-)VJU>}^0eQ_pUj*nwMT!dHPOV}T) z@&8w%-wVD^n?>Y?M|K)nxK63-H?ejOH?einie!QEI@BgNcW;xrtZ{a!O`@hEFIYRD}G3mF4 z?T$&m4f+0WdJ6x?_kT6CYa4$>IU^Mv-=2n!Z%^mC4U9z7W5ixJj1P!pq-PTQ9IE4W zv(WLm+35J(oUpyz^gLpZQ%zs;lW_t1orgm7I}b(Zbt*>3@0OtBcgKbG+@5|1vEz2t z^rl=6^t+NV#;=G>O20c9tL>|k*gQx8Ma?> zCb9jBv(Wb9htYn;M_9k@DYJ>Ul+H0%tza4 zo?v;~X`V#eX%?XEGf$!IGf$)KGtZ#yGYipvibZHY#j|KX#dBynvKY-@mZ0g$^JqWC zQm1p?UqJgSUPSvVUPAjTUPk*XUP05JWoY`d98G^-MZcT-8k+vRj;23v;1d3C1)Bb> zMAM%)(e!5(n*OXt)1NhH`m+{If8IjVopqegL6Nu9*AsjHs^6n~2bVB^1N!}ojraob zyO_qfn@#BW^Y?HW(>J623h$%+QXk-Irf7U^5 z_$k_Nu^q$rf3Yg}?Pu7G^SKjEXFf;MnO$f)@&%f{>_*d@J<58%M8EU<6`Ia`jrJ>j zgN~p77VTgC4((t49_<(T0qqyri}t7di1v^C#CfxS)~W+TZ#&hVTEP{j7)3e%61`e%61{e%8ZiKkI*J zKWhcr&l-s)`dKTX{j8PIe%2~zKWkOApS2p=&srVrXRU$uv(`lWS!<#FthLd8);efE z>rrU`QC+m3wI15fS|9CaJsRz2Jtk^D>#@-W#GW6uU!-9)k!~M{_Ol+(bo*Hwq3L*I zG#zh(d&`Z$B&2U(h0Y0*)+i5pBtI`%5wOm$pLtOIxG;rESoD(i72s z(v#4B(v#8ts#EaHiEX3pSdaarNWRfNdOETB#;H;Bjnj-nzJc_Uo)JAWYI@i~LqBOE z?i4+X>6Ig$q8+gsc4qm$6VKL=pCJF&C3;R+u1oaXuw0kuc`P@0Vpk3Qq{iku=cD;f zH#Fbr&Uqaexggqu*ymRLuF8c>9}u}H+LPGxt>!-$qv?Myv>)ygG#|K><*$nLj$TIW z@<_hWC)zg|tNm}6GrfPLU-XLPbR>W1AH6aetNFuK;kX7y2ZZAq7`>Y1`b7q5SikY* zk-^a+$ym)FhNAhyFf@M{j^+>7p!vhKX#Ow)N8ok%FULjyTKMk44d{0dZbZL(Fp~2( zsPv|2N9sGnN^e%K+btTeM!O->Uvg`7G`|jG6(QKyMZ=}sibE3J-H@!#tjq;)eEa&#~(d`qn z-oofOVz*zEoL`LYM@e!y=ChvLqj!Ym$^WrqX=yah^byjO)0lp+Y^w5q)c=`&xNLfK z2Gc8--xs|nJTLbebKdXMu$(q4eIR;2cEnlX{~pxvoIMo&Z>Dj0&XE6`6MYy{@saR< zbE31c8Sz~H&+;E~|ILd&9_Ew(hxz3H=r|Imw=JI^eKOpCPiVLwk@Y+kU4R|&nK1up z4fC<_rqYGcMZ~^Wq?eX2jXsNg@j2{|i*W!h!NK@E4#yYyf4BbvdY+7%mA)K(2|MEJ zEa(0I3VQ!9L+}6P=>7jHdjG$M-v2H?qWq2MisbsVW9iChG40|$7wY$FSFxPmt6hx^ z+3p(j_aE1y^-Syi_OGmq^4>r9;gNVf=hOa{cbIN}%LcT+Wh2_(@-EunvI*^Pc@OPx z*^KtLypQ%be1IKs3;Ny1t>}1z57F&y!!6T3ihj)Y?9W8j|4H=IWQ=TQXLLJm#~rv6 zKf^EZ^W<_E`i*v>{T^SS{UN*2{*gVnwd~6%$49%$R~qgs4DImWL}?%6JblahD&pTo zzmF#R0g!h1AEJAsiGBbK?RP(-?d?C|@f^p`X#4UnXnXXpXnXW;XnXYUXnXV@XnXXZ zXgl;@Xgl;iv>kds+75jHZHN9FZHGRHwnHC6+oAtK+oAtO+o2Dm?a=?B?OhdUdsigp zepHTC!WL62$Ew5<=NZ|bYO$)=W@@!q_2hJ9Jq=tJs@3VUK* z?2h&DT&$0s@M!FS$Ka`WEVjjl$?aiik2?-+M?D^GmurN!%QZ&Z<(i=Fa!t{8xn^j) zTywNt?gX@5t_9jI*Ai`)YlXJUwMN_J+Mw-nC!+0gC!y_fC!_6hr=aa}ZP9kQc4)g? zdyJKx8aqAa{d1az`v*C{XT;8AdQn*i4bw5S%bkU`%XN$;+T}VC+b(xD+Ah}_ZPz~s zZJ#?AXO(q{d7sXRchw{JX=tB2KbC0c>V~#+bw}H`F2LE?18onx5R>g)lrMV5hH}0` z|9>p>|A#pA|HmwUTpH`m{Lud&=3f@;Lmc}5W6A!1mZSea){pt2|DWlmBUfPP|Hsh( zkD>n`L;pX9{(q$Z-|gD}ui?0m?GFk26Z-$zuKC|EH2)jU|5={625a-2`CWn+h({3n z9>8_zdjQw79^V7F0euhP#xVV+*vPQlO|hF=yhMM<=IaX#cwv%V{^d z4Si2^4B9_9Htc6gES2RwkH~(f#nOr0Z)87Wu_!Lb%y6G%XgE%!o|+ZQjwR};80x7x z{J+PWiym(tn$PE>`FjCcz9?jQ>#0S!8;iLP)_+TgEpLoN>#Mh;_0>Dj`f4d!|K#J! zq5fHh)<4V9`saAG{&^=_|D1rH?}_*h?Sgl)oxYJtvAc;aU#jm%O-8?0I0X-IUZjp?9D5`g zBl|l$HYXV)`SRS@qr@%C=LOv^G4I_y9eWJBOnN%@ICjVR*bAS)KKLYFi3@NrK7}Lj zndJI0lrtBi-`84%mNTD4%bCxi^|Qrjd&QFE^?9Dydfrmvo{<+~FA`h6R_l*1G2Qy( z%h)XPN^DtjzFL1=&UEXKuVRzPYq9_T`&%nwZ^X>^SH#|AKfRAuqW2Lo(^tjT5PLtZ zM(-zLrmu~?MeKcrjr*0Zi@nYEypNFi>tpXEV{DvSx*_&1%e(%K==zEIzfG|Zh+Y4C z$@!bn?Yy5{j``eATVh+o^5p+veILd?4$FTO+ZLAlD8ybbrnBBpVmq0BPU&Z{Ps4Jb z#kS)G#5=W@b85LN4S|p=phW+oAGAd^z(jlb(y-G&aWQ_E`SIelLjFJBL8vb8Mw~+q# zS{Zei-fVJh4bw67zaNE;L#&IwmrxIVFQGpAUc%96Iq4Ymy@X@Y_YxYQ;}IL8?IISpyh{_X!)TPT7GDamLJ-n z<%bi|^214J`Qc=={BR0derSu9AKIbihxTas;Z(Hza2i^EI2|oNoPm}fI-uo;Gtu(H zS!ns8BgV=)Wpw5|j)<;#a#}$^nBl>>q}H zs-djEa%5P>aANzVkocO65ybX0U5oZJ5i|X|jO&T*|3UWuhHyOYKkEzW)krkGx{2k6 zvA&zpc9dJtc9c=5T<) zxn)wu-5H5;3x;yb--pcogWX^ zd49$d#9n8$z3fRWVZ95&`FT3ysc>GO&R7_(_cI!$%@c*ka$p6^i)f(m>$q(0N@H@sF?^~Eo{&pl^e4Fi< zFRo|0`Qkh1dxsm){Ba|iKfa6RkDJi%NW6!xZ!`Mci1%?Iet<)83;NxNt#~Vbh;DZq zZY}#Lq*o*2AOCN974p$fNzcqjx3gar@f{hTWhC-ZBp=_zjHAJKf}Cp2IA z8O>LILGzVg(R}4MG++50%~$?F^OZl*eC01RU)hJ|EBn!Ww@MJU72n=eqK0F z=Vx|fzf8xG^VU7{0%G?Y`Tq+udxZ5}nAwx#91*`r!*L?%_{EvMG85@IhIIUruX9dCI9I^Oa|biCzA zbe!c)=s3%p(d%*xt{Xo(a}-9)M`x0rhwGx&7jDapH2;zP9fST(`&j%FkED~SoEOu{ zG^U$QrYDz=CYO()>176*US^`{WfoeW$VS(fgVrl@acfy#c)mu&^Z)nx3h7`W&!6dF z5!8IA@z!BnbVUoQm?ot^WJ2P)GO}u z|HA!<)GO}Ke30qQCO@EII)-}1LukEXCR(qUh1M$`M(Y)ip!JH`XuV<%TCbRk)+^?r z^@>N)dc|XCz2b4SUNIl7S3H5%C!R#}jRk0Z;wdzLcp6RjpFz|8g=o6J2u=5&MbrJ~ z&~$$>n(i+_)BWesbbl$D?!SPh`!AyD{!3`O|1z5Hzk;Uw%g}UxIhyXjil+Ooq3QnX z7%O`tb0z0*M0|yY^M|DSZ)UD$dQsUb4bw5C`)km2e{C||e~Z|3e;u0czm2B*>(O-o z9h_CRA(`%P{NMYM^k-A%ciexbM@YK8ImD*h#LWL7a|`oLpOE=mGe0DDK8AFC8_QKx ze3bcdGF``zu7852>z|_O`gSy3-+`vJjg3AYjdjFvZl zLCc%JqUFusIIc@0zi0kIY~-hVB2Axu5x$MD}SYpBeXx959~<@sWJuAoI;9 z4x#zPKjHt$|IvKnFw;#({|nPAGAm^zjyHlH?~%B2GOm*4@mI~NM(pt)u{yE&O%3Mr z`#)K=vJ%%9iEC%oA@=+r`%yRRC|r*9v%C-MX*mB#esgrzFqescnv-?Tt~N4h1B##ZQc zYK>ia&fB2%iWAX##Yt$r;$$?RIR(vU+M@M|c4$7-9;2-9RP;KZhF<5>(d&E$`*&%i zL)MwZUT3vlaaK5Qow7QH^W7<{Gs|5PIa|Z^HSQHTC+q*OPjt=dl4be7Yu5Rk56{g$R4~1 zXY~pDbD4(yL+TTkXY~#Le|eVmiC&R@8s;CVPxQ}DoDmizFFx1h4X;qo5fkd zNAt})(R_0Pnr}`-^Ub@^d~*_-Z{CgOo0HLea|)VoPDS&{X=pw<9nB~2LG#Ib(R}hg zG@qP-=9BlM`Q!s=KKUS;Pd_=D(cv3iC}@k@?HAmJ>T4Lq7Q` z%T-jomi0RGt^Z&p``_L`^T`!xKDiRjC*MT#$yI1Rxfq9z;dVad>_e=-X%6a+Jxpu?}hY@`ahZqYu#Ma7$SK)~pX% zpXUKN?rm8g5xYHPJ)dNKjLUI*xL%)X*iR%s*^%{GGC#qPpX^NT=jX}&+=Zr#U!dvY zZZtjI!}8`QU!wWRSDZ)dFJBXzK7NDdC*Pv^$#-ae@;$cZxPL(NjlF2T@gtgV{DkHk zKco4^FKE8;E1GYRu7~vJckU0%?|-mA74bi_{z|4lNcyucYkxBR!7z^S0Q%hijXqZg z(dX(A`ds~kK3D&u&(&e{x%v-%t}4*yDw3Uet}3C=Rb}+Ks)9aORnh0F8v0ySN1v-2 z=yO#QeXeSu&sA;oxvGP)vZJ!=W&2#!)o`7V=c<18F-$KiJ6gkZ4A0fE=yTN|JMmmK zB=)&F4t=hUN1v-k=yTN=XO%U{Hb0mVZ>nK^$oEkf*bL(KeE*{zxH z{e{eLlYJtw^D#VEC$U^b#mU*HFyH42!*kUZeXiP}&sBT$xjGenu1-UrtJ85_{0z6t z{&mo>e{R2WcfaI*Ux7Yv{n6*`O7wZVisgOY2B6Q|K+dnv+aO|}x2w_TZ7}-0 z4MCr`q3C(AJoF#Gt1_IpDlykP)XT5Ujx_&+=_7DIUWYY#?yko}#5bVhs&7QcDUU?Q zDc^*SKW05)y!kD}jyE5LmOn0vdr%qZ`0-41e0LW5dokJQcUp7M_SIbU`>lEC@#Uk(SAZU0A$oj8=Cj8LdUB;i;h=&4jr$y z7#HIbbiCU0=y|yz#r^1WjHF|) zhuCzCnCE&$_DbgaTqE<}%w9$8d<^N_YL=_0Sd+b$`KEIi(z&u(czKg9NjIoJBb|!hQyy|?;^Gyi^N}K?;&;^ z*lu(j7%}JR%W&R2PwaO{f4@f4-)~s%1?tJ);yw5s`rhpKxQzG*^m|Kt(eEw&h_5sK zCtQO+qu*cp1ve1?iktB_w7v0nY{2^dK)>_%CoblG{0kkowGWpO@5fbm03Gl2H#*+w zAhu_@L+E&?f7ox|cm0>x_v8D_uR+dnEZ05KP{VqRyG4%AX_SoB^VS%BFSZH#UTjnJz1U{xd$G;Y z_hL^#--~U5zK_!qH{Q?rqaDTjqBXJOiQ1s$vJ=tqL?@x+iB4ww=1->(Zz*k?(=I2G z?_tRI+H*dvho6exFQ=jT-sxz*cLtj8bzph(y))5#?<_RG>xkxeozVR5Y&5^?%yxT5 z&dE8K*z>8r7u1F6%_HRh*er5h&iTpt>U%-mnBJ86-LXmJf}9@7`D!`!LbRNE5n4{| ziQeBAqxW|&^!~mCy}vI-@9*B|{e2mFfA>M}@4o2$eK~r6_e1aRE70rIA3q|#5_jNL z==B^ z4jsR9JvvV426UXyjd+0hBhm3lH(`YP_hzhxx1jH3jY7xYj7G=b+=`CBxeXnEGX@=h zGZr1El!BJ;Q_*oaY3MkdbaWg}6di{XL&xD{pyO~d(f8xB&~Z4~=s27lbR14DIu0if z9fy;Tj>9QH$Ke#B<8X@5aX7{3IGhr69L_j&9M0|NIGj7saX6*uIGi{-4yTO!rA4GX zXFRd@n>r5XPVQgRlL_cJoQX_#9L`;6`Z5VkU+%`eWm9q{`H&CZ!eT$%lz6VkW2#vy$}#^pSk^LR*i9@8)`ClNoHGe4w5Pv$&<)gn*k zJjL>TCoa&C?jh;p!knkWatm{w3Ck_ad6wk{Ph6y7T#m8n<8x>~(_-{HcT3RmHP55z z=2Fi4MUfYBUL^LsBkAZ%IWH$;b$rb$Oz#m{ma{xL9Z64L&3P>utLf?MVgFX-yb<~kZYxfrVUAuMYckSLrziYQ1{jS|R=y&Zl zu)YS7jXCcUyZ>ssya`Q@-$T>m&1ic3KAIkXfFp1VI!*f9L$e za(l}Tr0zhUcng_`h1l;kiQouU>8)OvR(Z|JBQ_i_M7Z^M9rz z$bEWrZi6tN{6Ea6{U03% zy}#R|_xGvj{e2pGf4lsM@-uQfB-f`MOV7+L=Kl4*$2!ME$p3RAby`I_<({1zsau&C zi96?VU)QZfe58JRF6YmBXP4YWy|XJ`O+I!W+E08wW>P=th8?jxS}(l-M=-w!-iQ~X z-v_%0Zz1l9ey{9e9E-g$ikINlvP<0$+HrboxX#G_^~vqa{%G^ZzIacqdF*EvcExO_+mDok_9Nw@{YZJt?;Od`Eg-fZNq^`63z>d4|5t=vuoyc< zN^-{~m&5qEOuwDj{NWDbj*-&bcyhiz$9l@}1uVx`aXdcBcJE~Qv-tlBcqUF{`YTMo z3tz)YxB~CSRX7=!QU9KTYl)}g+c=H$FsO8T?tPrsVWsyd=k;C<<1LZ-Gjbmc^Y2&Y zKcMldY!@3%Dt##TVdhUOos~NiS0iz}GWB?5{v)|_!~8k9v%~y3#&PdcJfRB9&BLnr zDEswL{IT5mEH@+mxQ6SD@pB@4cc15UOX-uj3vv_XeGKLOr`V3^{L|=leFjb67ozF< zA~YX)mgOz)KZm<5Tj==q zb?9^XHfG{_Y|QxncklrFwE-RfzLD*8ioBbu-fvsb z`)w<}i664O_uDq~e*1{&-fthH_uD7v{q`w(zimhFw;kyH_8EG=?c_QPD*ZfnH`jMq z=`Q8^exc!hL+0egh5bVAw;ytUV*a$!A9MHO zY9tQ#BQpQz+~30dUvqy6^M5rC_aid@_uRk2{6BO52=o6mjz?HOR;thW+lMFMex}!o z9LW8f*z>D>@E{J1AIklg{~rFK;XS!J> zuWDW*-NcY?Rzt^&R!7H+)yj5PyJoDjJd2Kj;pX1i(b4<+i6Z1|c_IW-DeV&P#eo9_jVxMcIe9$hhJ=^m+ zM&_TIcUm$=mODM~45nK?#7Z0PJu|NZZbkBa$~PhZ59w=1_Rssh6MDa&&2rxFozeUK z9Q1xa7ro!Rp!a)M^nO1Nz2DDA--qmm_WyN9uaoK6Z07eMz6Xgzztcr|iGHV^>~BT< z;=EpYiF_OBce*6+(!4~ztsU5}-Yjpw(`9JCQy;Y7sV~~^bUE7Z)DP`W}t2 zU5WNPU4{1N4nX^z2BQ5=gV27btI>X^!DzqJ5VYTEDBABd4DELsj`llUgZ4XJi?Om1 zdDnCON5rqwaQ%^fryKG{GQFtmMh(+3^gG>z_B-92m*{u8h1h<&vKT#6YXc3z}<$f?doWB+5`SZGNDSb0-)0w9oxD5m3#>kEci#7$$E@-_d0!^aBl5n@S9xD2W8{6CZ}PrP#>o3N z-}!&xyd&@1{E+t})0<7+t6@5Z_icVc-?#Z0ec$F6H2wS)ec$Fc^nIJ((f4isK;O6d z6Mf(2FZ6wzedzl(`_cDp4xsPb{EfbEa}Z6B525MtKWKXVFPa`7M$_Z}(Db+hO^+k_ ziS)P(pE*UvXS zuBYMrAnEbZ`NuN7sO%UG(=nvS4bb$sVSXY#K91P*_;@ruZiJ@CjnVYD3C=2Onx9CI zn`u}dhUfW&{KWIz0uNAbZHfQ)T({2elAn04k>~cr5c}K`^IV^te+u(`o{;%%^V<$5fNKZfV} zoUk9~hW&Csm>!<%uIO`p9@{;G?H)**YPq9`-he8BHiqZDV$g1Ev5bPugFiN;~3JH z{>lBlGP%E3q3O#2G<_L}rZ0n7-t^^aG<_M&ahZ+}AvS#(il#5a(DY?En!a3vrZ3l` z>B|T-eYq}qUalwh`(!uZc)SsF*E%SH1o_gNmq@E$=%ex&)e>`x}%fLVAG zX5+1xgQ=K{8JLIvJ07cm_1Yd($aLRBD8e?h>lCB!FO;C~FN{OqU$`B858)2Ro>`S~I{hsv> z^m{p<;db_8C;C0|&(ZIZ??S)B^9AfdJ*#Zf`knVBGvZt{2oVKH#z+%Y(!iK8)I#3f~R9smaoJ0 zYlcT-b8LVo;PKc3n_x?9j;*j29w{fZDM*wPPDINIC*ePMGDcYL6!g2)ZSnug5A6$j z7bNmeq}1WMa4M< z=Q7`N1%`4(7qnc_6)jhshn6eON6Qu6&~in0oEN{q{h?gZL&JGS$^#b_^kTm6<@99z zZ6X(k*#0}G+s=JS*w0JD@wlJ-U&tRXL-WTzEVq*9qAzj1^2-aZU_GZr`f2Eo(McR{ zf3zL&O8kiBufp9p0H-s5AkM@=VZW{}7)<;av3lNyB;%pDgm@T!!~YM*U+|jnf7cd_ zAg;-L^*mpfjIYN7EO!GgXZnq}7DwV{ya~7C&G^KU)5Zg*c-ioB5vq%y9m*LhSiJGCe0u z&n?JfIj3t0`<0K5S1G_!;zAscMQFLE81u0Neb0IvTHd>z?N*B1QBcbD3hfgiju(^> zdwr4p9bZt6%W+Cb2kz8x-(V=`O+?>+xC{Nx>m+o$cca^#j78}3TS})EOe;u~2Qicf zr?WlFS@)p#(YOQo5H3KbI-Ouut2OmJogAZ~(EDt_JY&mNtS{|H*mIoh3%Y%=g z@AJ$?-{+ZwzRxokeV=C@T3&n@TD5 zYrKN3iI?H&xE#CSt9UWKhW+t%9ExwC@1L(g-%DAEBbojtdS9E9Mm zZYP}%<@azOe9!W>xBh^(x9&yLVe*sEulrMh{iHt^loloWb+N_vvR{qE^Mq|a=DcA& z`=>C}3y$~~`(gQhUqPaLzaM?C_yBIfztQ)L52EGzLuk4FAN2j=f6@BDVYEK*A6g%% zK;|S&N+J%Yocb&pW zt@-@_QH6>3XzLax-lMIDzDHZ13lrsZr2qIhw=%Jt0(n-?aQ$ME|%Ct!89(*p0IoYxZb*}qok?}oI- z`jUSa^?@#EeV{8^A2<)K51fzI2fAU^ z$rluM$LiBAD7>`L`aqAu3kwt13#kuWRM;~aBlUrc3wtGFq&{$o{}-+=QXlAD*oW!O zCSRsuI)?f{U$mZdIa*KZht`v>Kq&#qdeYTsJ!vpn zPa1;OlZK+-&m4w%JQu^!?`K|v)<>>I%kv}9a{hJbcQmg@>jgKU-_g7g{f_2H^gEh2 zq2JNG8U2ptE$DYNN1@-*9F2ZQ^H%gbnz!L6obNGceQ_*)&Gu7pCf6?&tuLgZ^@Vh_ zydOo&`!Te4W7SBprV=#Fn>- z!|y6QUg&c33!h*)%R|U=PZlm9b~y~`{ZlMgQSo%)Gt9SKjv@VDh?dJ2q2=;t(fr^! zv|PRzEtfCBdGY7nKIQVI8qTl#VY&N7)?YdDQsK+QzMqWj*DGOv-7l64`QCCg-+Pti z>ae}nui4AXa~0Vr?>h3;lhG zbz%GK3*QdQuP@xddfP?b(NIn>ZX4NH_--=BMuSQ>6~52$4J&<5Ilj#r`rVQF9~6EV z=5JBvZ`IK6j`WLfEBu7{(@H-s{0LVgap+e^=6_oFS(v}0aC?})!#MP-W9Wz8iS|Q( z&VD@<-&IJy%=!L8!}-SWz0f_(x4ix(T3-Ju94GaEw7mWe(=A7T8>W9(_&u@L<%mBJ zn}6+Pex=Bdg+H->-e*YsbKx(a@zZL$9%kdBPdqn(q4f}(Xm;WsMt1wYs#!z0~ z$NyW-*^gfD18Di?Z?t@K5G~gnVtLEU|DfgNe>oqPmk$$L&iM~5FIS-DPc_kUbS<z*yDnPJt%sI# z>!a^)AB~pNk3q}n$D-x*2533GA^Q6f$DzN!a6EedHbU>;#_0Xo1if#YqW5t#wA|Yq zEk~b#mVaBI?{&8f=|StFR#-XGy68lXt6ijxhWpvLZRDh)lan!Wzn)SQx!wD@t#ZBE zX}F(}cI4BFPA#$=d0NpKEbsL?9lc(}Oz%*17O~guO!T@DGreO`Ct|N3QZ7Bas59I3 zdLi@ADLOY9Bg=Iu>dJJ>rJ7oLUQsuuyS?+#?Gdw{?nM_7yS)pN^LwD%y)d~P^LY=U zXHlleZw>R2^UZx`{NF$g&poo;!9`bNM;soOAEGQjR9SwQhUJmtyr$^-u-vuEawC-GuG8?I z4zj)*if#_e-KZ=#Qd#aM4a+%yQt2&4w=#cP>FA&Kw zMftz9qSWwzX~rQvLXIm|6vd919hT2fmd`5649jO3hvkvu$|))c%jGJ|{;VM7?AZ`un(dV>g_P7vdD`g;UY?`)TMn!RhEY!F%va zycez4+=td{W}xF5??=Zovb|7`d63w8%tL5BW+qyXnZ@z1pq%kAT3>pE>Gp@r#*WON zgPn0Mx}WpV{d^SN&&SaHd>nh@d~|=FK>I14MEfZgp#2n2q5Tw3qx}@m;H|h2Jk-E70@35*?TMCOR&26|TY6_%^OV$7Qa?_wX(BdaOh1nQx=@ z%=KtJ^BuIFxdFY78`1Hb@1o;3H{q}N9y)$=Gw#Rt(fZ~GxMkXwqODvvzsHN5_YaG< zC1Yf}pB8BU99e(;p(rtKbT9F7#6K1#>bpOo z_1&MD?s(B(&~k#$&z!Q~iheIj)N_$~?jJ>eChNHvekb^^qDc6i;C)z|_3(e8-f^HP zQSbO0_p`o(Xg}8>)>9Gxr|940dXf6@;iCVN>%~y7tU&9Pk>W(XvJzUatc=zxtDyDD zs%X8k8d|Tcj#VeuEUtmor`0Szy4ZSUt>W6niSvWhE9(>=m5h;kW!>U>$r!0u*7yIy z`9$iK#}qeUdb7#LYM73pUfB?>S00DfE00I(m5tDPWn;8n*#xauHbv`|&Cq&fbF^N0 z0$Q(Zfz~TqqV>vFXuYyET7PVV*27Ok`?F3$`?F3)e~0%JEXB51j_q(Fw#O-WD%!qq z8rq(4I?lv1a5i?p$MH;DfM?+%?1)RT6E4HE@eS;ZYw#Rghv%a05?zWT6HeiN>`J_i z_&nT>=cB*3+YPOcc1PPGF2J9#2mXc^;(ojc?f2@5m8hp)jMcCg*2YV)9$t#}hxW#1 zcp2J1)(7n$>x=F2a`bm~`(Y=%0{vax{^;-OUWxXPU4{0K4M5vd2BQ6AgV6r5tBVu& z{a|8$e|HG_`@2KY-`^dE{{HT8^!InK!8`C;v|nxn+Ant<`g^?Bqrb;{16m)y5&b>h zk?8O7-h^|e+*~}0`*8l0TQuB<7}|qIqrb;{E53-gq5Y3z@J$?xZ($1hd%UUW@A0Og zzsH-7{vK}>zr+~&d%PLw@9}1$?Mqqc@9}1%zsH+{{vK~G+76Y6{vK~W`a8S@=(F+ox6yW~^=P}) zJ7~Mq2DDvjBib(YF4``&32m2p4{ev)jJ8X?kG4yFfVN9*LEELaqU};2VytXi@y9%m zBjO)vcpj1S{7Lb4rWcics$n{YcBvg`yVPf-9}{sWvF%cyqwP|=&~~XW&~~ZaIIC<= zvHARr_?H^ihoN2S>*C0rCvty$dV3=NHW`0coM@-|p4fIO=7;vEy~T-ks2|aO;-Ap( zK>Un;2jUm>I}pF(V*Cx4;_v8pApStV1Mw%?e)Sjn9f*DCcOdqo-+?%QwsZZB|JM(F zsQAp1M7smhZuM`7ZMPz>bUyX?|B4g!Fz1q(0uDEtPDj5lLCksW;BkiYs@B)fLhI`tS#BxE*9jeOdp0`Wwlg~3 z_8i=Z=i+=lmVl9Ee_dlIYnPw!-W8FnJ>gL`<6`f{FHMJ_MtN9=XdROVlS_M7)d`}eNIb>jz= zT!qo{0VM-De*5>ZlHao!g!W5bjegf+F#27KA?SB4hO)fxYY!uK-1%^H-1#-wo%z?| z;j$4WH?Uk~mb;Got7iH2#^L@#uER|wH-_W8sbnNpBff?I>pSsg4dc5penMna$!Ml~ zJnHWw-io$A-G;V5jS1@+TarR-yOY`um70vx(Dtcx^!ItA==z3 zC~`+hDY3_e@#7=$lCors@#7-pCF7H^dLP}%dKrjcG9j#gV#y?yYZ$pp!+MO5joe)_ zIT@?tWT&9xWT&FzWT&CyWT&I!WbZ-8$=-{O^S+Ps&-lNRe?vRl{mONFKtsC{hUe_l zupcu^9^wB?CuXtzHj#%z>~S5LK08dGQ!&O_UIA4PvJ>anms@_)3wcRtho zeWxeTdfSs>{(_RHh)r*f_%yNY!q4DDT!?q$qOkn4C5wqof1X3rpCj>-Wc++sZfVJj z#HL3tpy|<(_@!k0GQJjHR`Loi$K{+S>&wXRRlQd7Dt?QvC#PdLPj7_vuP9kbY`S*D zH^cN*C2Kf8ts|>7oS#Izw&bm3jNDJ_O5P?my*uLiF#Vm94NN!PLzdfEvWeJq?_D(A zI}*Q_j5p&~On)D(2YHP0# zI{ycn&i{#~^M9e~{5~|D-;bvA2heo>Z}j;*h`$gYLdRqNgAvk`f3X%G#$)k6^mmaf z(DXhsE|K0>LeulgXgXg7O_!=-X#YpQqf#AB?`w=Ry{|d07O~Hjn%>vOT&#n>|8W%h z{zqN({f~O+`ychu_dkwC-~TuUP5+L?b>kb3Yk<-6hU1PKm&hM5j6*#heP5*!`W>9c z>__tm`9C&`G#%HB>F$sE9h~M&Z_4}=ut}uFxR%NJYCh8n{~vX40v}mb<&WP^bhOJ| zL`76uMFlnWXb==Z?R3)JL^|D})7_w`u~PMt6se6`k`9ohn+5?DkR4?QS(;TqKomq| zM+BFdan#Xq935vIXPnKM(V74F`+m>8Z@aJZQdJ%JkHsf_c<#+9QStua@^kq$Z_uh zq`y=eknv(1K*ozX0FZWxm4KYT2Lf__9R$euG4BRs{Fs9Q89(L_K*o=G4T?0+8`z1^^j9=0oVeH>x9N*W;PvK*;zpgBVBd+ZzBG zKV~D|Gk(kvAoua30J)EE0{qpGi&XVsa@LA{-AmYuGW-GI# zZ)HM>H>00xv&Z9om#WQH0iO@pK>mT#>V(3N0HWNs*(u4lZFXAnZJRv-`8J<6Ln!fP z0C&7Woj7|E-n0J+$+ye`(vCIfaGI#0FqBR8Ib(TPC)WArvN?(cq-tN zfS&~X9^h$!lpjt9B%L?|kn8tTfaG634aoKV89=VnGf^+D)3X5gR%g$C7VlXLHyn6N;^dt9GK$QQ&?6u|@5csc~z1}Hyj>u_i)Y+N_?6i^0pD}R zS7yHicsSr)fPH{>10Df*58wvCF9U7{ych6Tz^@wofD%vVK0xx3_XCoT{2Czn$Oix! zC+q8gjGy%&AnEcq02wFiAwb5-dKi%Lu^s{B`hOIV@c$o2Fcz_%d(cL5n6>3e{TkMyU2+|U0Eko@bP zqx@^t_huynnU&%h?~B_kiGQe=_@5=9!TD=1*l^{cQHH zWnKMj_UFj=D)l#nf}hW?RKJ-0Tk}lFI7z<*WSpeG1LVB_dqBoZ`V}De^?v~5zW!@K z?(6>u$aqQr1ju+vzX9Go)IZPu3!d2yLej~91tj16Z-C^R{~eHg^KSvkH~$A9`R4xw zB;WjBfX4#<4v=w^eho&Z+8(Q zy_-<%tAI#<{@e>C{Z9yy{sKa=mjc3Gx_s`%NIz@)i{?^*4+7#@?4^K6f63g-CH-Y{ zFO~F{@mcJgfJlGE+^ZygkGWS$`W}21yCtB+KiCtH@ef{&_si95=3a|u#y=oD0&p+D zqjtP*?)4~t?2f$&h3*1k9lv32A9?>qLU|7ey~c{UH{tu#YXFK~ zaTr%b>H!G5@PTtH;Xkkv@ZG2n`O$*_$&cb0?+>1P51z@F9s)?d6wi47-nm2ZO#T!Q z_Tu-=9ft3aF9k&U;dAdd&w$AHfw>RjJ^cm3PHta4*N6P%?*JvH4bB~fXV!m%N#6*_ zb_|((NXI@sJhut(6FZ0Jw&4BmPTou?^#sKJx^?a&c;B`2!*fStJYTr;7(SyPKTIh3 z2>0Ip(Ya#*R|0-Q%6*Jb_T`UDxe-1~{{y02ZY~2j2{+!WwSz-`D+dP(@g9W!$$$$QBEk`MZSz)AEk-@kq5 z?A$!&^DEUHq0k#Z;M*~`9dIS!PDwwRP|^Y6*Ko?*sd#1_Ey6WBKRx$JzyZM100#k2 z2OI)C18_6orvQ%uJQL;l{m%e$p7D9_?Pt%O1-KIM0^}o|`z#>o+&O@xbLRq*&YcHH zI(I%G=^XPPyYs@iiwr)(mD?|#I}z)P^bZhz)t?WqEBGx){2uYE#yS)K01sY)ex{$m zm2=up;3~lHo_saSgMM5S#v}ILYtcWn_g;s31oqn-=620#`z;{sw>Pq!_$dR5UH0ZV z*l|D?ZbAAVcHBC5o5>FdyX+U|ZlBZn0Ywjg2O#zEcLGum|0O``;qL;Z9{z4X>f!GJ zq#pjufYig^3rIcuR{*Jp|0*E$@b>{y4}U)(_3&Qng=gyF zp9Z8J{uw~(;lB+?J^Xh7KX>wXrT@>{@x5^WiyrKa}H4|Iojj3+u;!GWYN3cj_4cLH~a$&!qo&27mptxxYa=^$vhY|M}c6@XT~T z*&qH^_J?22{T1S>4p6>#D5D?F@e*+@@`SUN7^cT$k ziKM@P&$535%6_*Tko#Q<>+zx;FJk|reJ>`I_5q5X?WKU!zr75Q`nQ*(To?NB6@b*c zy%O)azV^WLGWDwYJ@I{x7a*QrJ^va!vtIyFey{o03ckJO_r~{*-SIj?`5qwjJ+GgC z!@Sn_0E)injVRCkX&*rL=L$gXOK$??e)MKQ?x$}-e(HPn1*AOwR0|;fD0Fi#+{K1lb z5FygvO(^38i1b6|50&)y5F-7(gu;gbVw~PL|9+&Owf*q z=07OutN1MA2#EC6^J^r%f4)!B`}r(<7@+WBYXQlJt;74}>WKLPJd+P2Bp>!6z@v5? zIX{T<$L?59DB}T${@XA=B=0v8%6mYpv!muW;rm=?fU?epG2Vap!{+%dNas2Oly$Zh zkbKzDfaJrD0pvRSFd*02M*z9bjzxL$VIKwLy!;s6pMdut2V@+o5kSVF`UD{3P-Os5 z0~`fp9I7nfXLh*rIl!9$$5HR|c8n29y#X=LC+3fn_jy8j4~X?$n4bi^4)88XFNW8_ zYxmw>nJ-a4B0nx4-=5LmKy9kl*ruiEs z-%Wg$bpr@|w{ZMX?^|U)oVERn^S4R9FY;OP0m{6;1CaiicLH)=-!*S`1?&#bm+j$> z?O)h_-u9EWSGIq2`*AxmJN|xqddFYy_{okR?D)-&pYM3Z$$xV49Vhqfe8m}0o__1; z7oA=|{lllf`P5gR`ukJ<;gpfnj{oFgryhOEy=RP_@yw?lIWu$S)1Q9Z*&jap180BX z?1#^O{y8U|bN)HEpR?3r8;e(S z&#Oz`d&%vWeD0FDOGYpGi%VW|=|PwN?9#_Cz4OvbFFobby)PTMZ2jd2UB1ud%P;@e z%f5Zt-Ism-vhmArzx=N+uU`3yD_33l<|~(9`A=7T_lg%>anY4?SHAeFE3a~|KJw~A zuHNVB7hL_*tDd;(OIPi<`qHca>gtzW^Z9GWuX*U2Bfjw7FZ}A7OTKXD7hZI2&$WA9 z`=x6yx_0Ec!>@bc_5XO?b=U2>{@m+Nynf>PZ{2X^4Rbe4-mv+G-W%R?!y9k-pX>ka z`d?rFC%e?HH|~1puARGnvg_epSL}MtjpH{C-FV22``)W znK%9HruW^v-^~LzA9eGmZ~pbo-?}+>%aON?-n#MDLvQ`=E%)E@gx%JF1*1vfE7oYy(U0;0r?H|8=`u3-9-|LP&?s&-^|8@J{ z-Tuxy4!YyRUvlpH;a$JFtA6*J?ta?m6e4o-e=n-hcY? zjxW1k{`9>+zIWfRyznbmer3y7Kl|1ESD*Om559WH{ja$H_xD|QU**1i?|b=u7v2A_ z_y6E)$2{=J1G^qL_kn+X;JshJ{_96QxaPsbA3X5E`ybr(;8_pu`Hf@0vCl)@4=sE6 z_YeKsL%)9L7Y`ly@YuswK77){uY2S-5C8b#ryjoJ;Z=`JKJxiT-u3899{uGb-+AOq zj~x5xX^-Ci=#L*g=ds3PA9?IQAN$5*H$9ep{DH@>ef$kitbStdiM^lv-zWa|iKm{p z{fYi3uX^&nClC4N^S*ifH=q3GZQo2i^|`0!o*IAZy-&UIsmGrBz_(uYboJ>Qp8m|! z&piFRr~mNutDZUNnYGWH^UP(>aANO)zutAn^p%U1e8H^_yVa?D)>Udb6P=tp!c3;gM`LH`_qMOxoR+bu0CJxs)D5b!zF%Xsujm)ZLy+ralqI(A!%1iE`2Hsk((s zJwFvk0vs?)CDm6Q7D;ZWp5;+V*roE@oBsy= zUvzW%ObvtTR&&yQFGKP&XLzPocZ<&Y{Ae{(MJ<(jOQe`LWHrgxlP#C(nS6=kyKgj~ zH*T?v$jV=LLG9J$bXB^lUHPu5u1r_G%f&PQuL_v$DtDFeE`!t(QmS1wyzQ5K8T{XH z*9_jUOtH(^`+&5wNu>r964Fw%2$%u#N>>3{(tF~AZ{k-I+V4%kk1`+XxAj@6-<~RK z@PF)C!0&t*U9hLxKXtTH``|l4bFFb3ua+AXT@m(6D4#WMlCj2|+xZXr<%ACEJ=`@R zEBECJ@JT* zgKK7;W3uI(ySkAt)Q76&Tq9e@^-D-!=JdN$ZlO#9zlwOBN;N-~sk_cprs@o4N||vt zw_>R3j=5F0lyz%Pu{;X$?WETg%A=V=C?#Df@My=`;@}u~F-EVwm*SqSqk{<52+^AE}7u^%e zB~FC5;cw4`{#aiguQ?klZfV_mY^AstM+e6~<-W@i31Au0MLiF~n+m=)za-y7 z9mn$HjViYBa;Z`+3v=Lo$>|HHV&>}9p~h$-pB*TTl~DzCEC0bfxglwuIOi&CG~p?* z9%DR;Ny6=Frps~Gsje*;bk3VT*}KM&VH}i=S?c(I?q{4`Wy~%;kGP`^A;+jpm~7Vo za*TDAoii0?PM4GVv;w+@M!NR_hdS4))TJu*4qadMO28)bV$t=}m&s0GAqGP>C`)pk zTdQXZb$=PEe&BC)9R|oo8-;>f&zDBa8SoX}nr4;Xiob>O~O_Xb( zpYiv4QzqXX&94_I+iAV8mh0tg8CM$eC&VVQzRBHT{pn=LtN1xe9R%=VkFI+}wXa-t z`x|cE8FI_u&YgS-lp&MlqUuZMMti0+1@ezUKW9-OhXNR5DWTMRI>CEfxlt`;&}&k) zw(G@m8F4kna5+CIb{JNJT-^Q-qt{#)Jhk5@JS+{G!@efKG`6B$f--`F+*t6?h zJ%=4|XzxcdCpfQGspYDx$62AevRu)%6oeznM@q|_7|nF4T+ff?v$9`|WYId0;$Ug; z*S$aRhC~O{eFCJPV#OFpgys%v_^t>QC_worG(el&O1WC^t7d8w>EV2_0RhvMCuvqN zKognLxX8y<85K>Zg5)OSQpB9=DU{2TjY_&u&SnZdrA*Nc^`G;6_1ixzCx5};qT?LK zH!kd$MyQJ~i1&?54^>nI!8CZAJT}yHk@H3{Sn_7JKAB6`%ad-&%qrQ(0z9NZy^Z<= zM#PLxI+t;akoSRlTP3T~(eE0jBC`Ld4Fdq8BwM`H!|HcPz2hYi;C$BfJJ)xpJvnfp z)%++l3%QZ-T&b;EIYknpWW5IU)@%?4WPDsVoa;4&&!mS@MW!7|ayUO$np-8^MI)+Z zQ16=m25l|5LX%m<`c9#iOJ{PB=Ii+y_<8K4=*Y3WiwkV^&*}%}2j5+n^=Dl4|6@723mR!YdMuVw8Qd7 z4WM4nc1`xJ4Y4AK;wyra&m8Oc*4cip8PfCn}&g>G`^a`h15Uz!10ZIc9OeepurF{ z>RkZ79>e2zHn;-e{7+%4m zvqa?*T~_L5%CBfvUb9py`pely5zCsGxIYE;z-9==Y(7&;H%9YlbA2XI0wE)QY;Ta? z>-V6XPZ%+?$_Q5$)&F7nH&@Hcc*OJy&LGvuB2uo1d>7;;J-NBBZ&+_3LlY2HbiZ)E z`28lu@d7`NXHf6Vl=PUM@-k&P5B+l9IQC({^IF28o+N}o>%TyTK_6i}sJkU3?31ybfOtxAo@#4LF$9)22j-PI+^)K_T|ws0bmg3r zjI!?pzL-EcsJT-OOXR;&r7kieKjjLq{j56aviGcq!3p)UUboHC`yp$yJojNMy}xf@ zP{!GMFQe28Ic=tvuSMp)q~Pnta@7oj*p006{qAUEoP4A8Ug|qshxw;i^QzTEAEpVJM?}e^>P33{dXftCt!}P1Q_6Zuk`Hu*hkPg1w}Gamzau>8pmGn$8&o&rwGcL? z`Z~h5AyX=ElD)e+qtUGdo~WD~>}+9ml)sakCUKu^rQ8O$K3%R(4%Z>tk-hg?(du`x zg|WP^v^p4{jm?Xg@+`lZ?A|chJ!i|N^^(pCTlxmQPITsxKCq_Ma>3D$&L(tu9lBmq zVbU@GyG_ga1>`#sx~TIHVN08UaZd>D9$|dm{2m@0rX1~m$9o@ZpV^UzV4!U)|Abav zqs+c7mCI*5e)7Go=1;GO5KKvF$gLLhV(4IlTWc4-2VSL+AI){Pelud+o(wI$Rrq%M zbU@QK42QqwI>S?Si%_{k+Vk;rwr;)g=J;t;o%N502iB@C8P1J>~6!d4GP2{J*?IhY!z$s}Fs|4lVYH&rgufS;R9IKY6 zHY=yBy4GtUYPnNXsWGU%yN(d1%f$mYtdPCrOqDt%u$Qbugdv?lz6``7oiuPbiceY=X(HYE-Yr9u~3~l^4{@NeUCU!f_5YeJh zWjYGM2>Sj?=u4ZI@H^1QP3J4#Oafy3I-B2+Ux$tQ!qA-$16TX~(YtYYLr7Dc&=sB0 zS#4(-g3L+_EKT40p`QMF*ZX)dZM52mN|4DBGL5Ex{QTbj9TMh4v`{bliqQ00#dUL7 zy9IA3qjot{f2Aerzu?o+zS^Nu+jL)1zY^;w!#A&U%SPc* zbL!)bd@c>Eh_1i7&a~so#CCjYv3B&MUQ?KubWGWVzj6FO&1>R?a9B?dO<`~(N_~WL zVI4A*v88erdxdJwsm8xxr?p>Rrc&nz^MU++6aNBVgpM~^H<0{UoAUX%Th6Irlxv?J zh_Ny~uu=2T>#CW`1Vq2JnPR?RZ)u?=SOP*`F7K3si2N z9i4ir7~P3y6S;X|xpi2~W{?B}@0Ae2u4Z!ivZ>PAj{0RVQ#mqUPm3KNiW`sE1J^)D z_=MlfWND9rrLRDb+}+~qiDW*TW&gx9hMhCc%u#XxwwJR995-@IC2B?r~)K+JVS)@h%!~m3< zHNnR9-zgn|B{(zf=10RTjpNcOK5*%EaTzo`98s;=4SZubA23RrO=#lm4nCToAecrL z#`@i;9|#`SJT?b+8_0>j^oddYtz!GYTB!D@gu;*VX8ZJEO|g7jKE%ZbJ=2+-9!GUp zNA=3Xbg%1jL`UT{LC%!wY0tXs4f&BB;TtGb8udXqCC3`rj{k75PAAle+3J|jW%QyLr}{i{ZSr_dY={h}gT zlD|=@ACl|qj9!XX{JzonlThOSLn7K-4dUl~cjBQzPhBcXXR5<#|=6EP20VR;K&ovp(uRuDc~+F#3S3((2_-2Ob0 z+E9D4x!lN3_=DFmzTt|SnH&bQF5*-eUuS%DF5}_gx?M;f59m*LeL3)X!_hxEKNv8E zP3?V9CwlhY6-KYj1+GT+anbE9=F9PQ&zIwVC|jKSp@F+wR4ai$$L-c;`%{(r zzEQD|uWw=AhV0A6LQRJsZjO-c!yIX6`xlRw(#{dcHl5LDp{sh*8_mG`!|fZSxyTs2 zZTq*R8O2Pxc08nb&txYvVmI;7geO1BkA8o*UmxG3M|#yc9_=sQO8H2;eZ7_TcM7ph zVZxR^aIyYtA5ZiCYadVZ{%aeLQuGh-`_C&Mk^(|~19l;!bygl{iL&&^wa+;_eOjaK z*$t3I^2O+LlYDPOUcWwiUWs25Ep#}>QIdmZ-e!fov|IT3z4{wIwr|4CPFBiT*+GGb zzm=CCY8&WVfJyuP#_EZ59K)!PM`_|GHk=v5ikH$#ah|o$9|(^bCO;kG(G3Y&+o|0z za7*@Zb;d`bK5H#T)AUnk^88G>QE!a8V^tj0pnH*5J3Wt=Ib<;8_zaIh`C8|-UiO-^ zDU-`o`w)boTyxVt8r12ij>e6%QtQ~#tKEsrRK8r@C}9=+v0MebFSXByS?lYgI*7wZ z)5gtXKllfogjrv5_xBt4H1Ocp{dnSje#c__xhM4Ucy4pCxD~I9M+dg;sh)UfT*hL;O?Rp@wUAq=*SCmf~hG0)7g@=vG;7VHaCB4*Z)y2v= z4-G>roYXlu{(nxmIcHcr2-Xc2?P-7g2l^aO*0|mD%T0;>a)I41RAFSnkrknp zV8DmgT7J4|IW!(TbIVhqj1z%#WzJ4x-P#fEgGs9oZcwQ!OdtHv)ca2p>-{ym-nPkj z7~?mEs_+nbuVFW7r3()Kt`L6H3v{u#r!aU&@f4OeddSJL8WfQ^i+LT<>U>9~9@h>0 zN7KGvCbsW8i?uI0Uz^pwgrVSZ=YkAL4gcyx&kXs%QJ%&CQ8@+YXQZ{VY9BT|;DFJV zuof7FV42=)HTmZ%^`p?d?rdMnf=*X`*^*t?nf*<>T+|9s#ndLs(>_(y`>ntKYkpxX zg+9X4EnA994{;S_^mWA?--A z2YW^0In-d>cgBzc_wbqAo5SU7K5+9yqc~d1W%pG^LuP)&PU$Gw`B8yecIyF|%(T^ldIx1w1&t&WVGGorr8E)TiL3KkLacSnBy zs5fh?oHH;CPx;juqi~}CS*(1ZNQ-^&z?SoCB|m-h;lU~A*8T6;>n^m?C~x`sym_bl z0Vxagr|GBRQlKyNUDizQyL{((@I!CGr)CT*Wgg^{6+~o651nnJEPP ziD*q>{&v|Fk@I}I|K;ECxgx*cz4XwzqL%s)b zu-}`03-^a(`eifXM$pOKD=++!sJ&o}XC5~cGzR#ouT-1h0MK79!p0FzMAA!{KCqE} zQQ%2BobBZseGc8c_jn?{m+zVP^x|@JQIxM>CNI4)S`-f_Fc}h;Ci)$+9+B_s@5pN% zf5F3JeTO;Tz`~xRswntI8)G=xAFYj2d&V9_(a|72UCt69Q`u=g7E7;82pN-z;L0=7=&r8AAc*HcPUY_tYC11 z{Z(p(C|Vf2v7Q36PQ7}_;UhTU3ezE^8ki3?A7I59p#w>p|L8~$JS{3mV{^jkdoO`n z+7)aVB`>h7j9>76-SBW9##re%MZtT}PI2X8C=vNT6Bk6ss}1s*Gh?y1KG`v2eoHe- z&FU&5*;IQOdV_LbsNF$6|Np>!B0>l4s-b-0^XZ{e>9KeVkvNV-LI30so(y6xph6}X z3z9g0g61#{;hfSsk`s%*DIpypXC!7kw@lrkkLCvJ3>?l4Taz>#HQuB z7P7_1Ss%;QbRj^{sLd2B^>Wb*|03tkLlyRuMP3iedB=-$FK4BK_w{O{CITAe|ImBn zDC#g#ri2U0wxd>ubZ=Bs|M`wV-*5W?}ux(~l!GX=836sf*V ze*=0~CJm_N$0bU$*1_>}_%?IXy13dh>wW?OFu+8-o_^XYh3A~##~3-NYKbp*|+So^?uvFIIm<_BVQ+1FEg4niJX7CMD}e;@4o z&Ge^vQP_LY?qd6*9FK*)dQEW@=L!+?YQ2O)baNIz;N^3@e4Lf6r_~>NnddZVG;v-1 zxNgjE%}*J_f_PiaNWd-OpMv?V74g`xz3pWcm~QQNroZ%p=6t0*82V0=12%^j#L$|95;>Sn;a*8ZF}}_Z!C5JQT<9=-(&3cbLiOG-bY!1LI)raa zn?A7mS>}^I*skNZS$x|d1@TS#;JX)^jbF0qZ#ZAR1{HA0xY*HOBvh|(K7_lYDFGS1 zPC?e#{#C9Q$k3+;Kzz1IQ;5-yL)W{y9~6i}EWG|89Vp6)q3`Mdf%O@G;L`cr@eLRJ zx3xlTx>*!oZ{ca}to(xL+d|)IeZFKf70sgPqjuJO$yY>$mf7ZYjWsSIJuwI=#>exs zq)jJOpLo8W@HVgg#uM|Wb8e=dotWl7KrQlRKu@rP$O6X1u851xis<))bdQNJe2+yh zgM5^pCaUF9xlto3k$;2l$=ON1x8x9tREW1&<620E&ZXM?b#|&)8^#i}>A*Pl7#CZL zj*kZX!mkA1l>>bIt|gZlXTqF~&wHOP)nr?@>3*0VQdVr#Ml)4!a`HQA`~{zHp1nR( zaJ|rS(pe~D(YLDes(6NbjKIS2JVBW~ zXJV0tLDE9;Jgs{8ls<>UN0q#`53?UExk5YFYff>PtgmiZPk!Stb8CBDsN={Z>ys|x z+1>9Js9=~G63NBy6qK|0?4X=~{IF+?G5vco)ls-?RxLUaMLSXp)5A@t9xRiIRnoEDu9<KBG# zMiiVXPQPhn7M~tIsKYPVbgNQmzzLjlx-!Xa-;QhSnYsP&xv(P360+*y$6E7L4pu!h zf5F+U&7tZ{yz6_U2|!s*0%-y z9g+)jFaa5TT+?*6A;!Ok$}?TqUg&?cijMWP=yZ@D`yXkE5qIr)xbb`vxH2|hf_xxz z+Lct(TdN;~e4JL*K#sBIaX4Qw1ErV6rv>RI^uF%f*!&6diR&mj6oOtJjESYct01^6 zq77^RMs!#AkqgKr88{Kq#Yo2%r|TGFbn9D#+^%hSW+0)m#695c0aX*Rdj$s}7|+mr zI;!C|0#a_ZGkU;g(se7~)e&~xmPexb>h+q%_iLHZ)8Y3Xvl{exHRG8Mn+-|$i7f-Y z!<)kaX!^hd>mA0X|B(aJSadB&hatRL$0bx|BNo18I9ttE&=9Y&sGn62O*g%BdVv67>kSslm*(vXlxaKO{|lX#Ip(#xGyDs`yVDBJpJBM0(4 zWoBGULi&UI5(NDU%MYVuf*qW!rKjCd9_N+^ul^SQg^LT|dp?GHFeY&G7*JXAI8fl0 z7EBSZyw&eWhb&*gIWovJ{8{o*gl{rYUnQSK|Atr7{1IMal1rcK548`6n7C16`N3%g zwyaVOu|Uh!^g0N)qyiq>*IaLaMtTnY!T;)(S@j9{0qhzQh11l>qQ_I7ub|O~<}5jh z_J9&J6mS^SdIxKLMd=Ueg)t3CKgRr)s1VDQr%R9njArZwre4kS7oj`eUB+nzfQL0w?61a8KBPQ52;P?1J1FirMGJyK+XhqV}4uzAS_-wd{I=hfOGMF^8>sQ zDSq@@3$5411Gh0hepY{n9Z)2l{zf6Z2s|dQZ9dbN)2(@CVq}?f?g70_3Rol`u-3B` z$VbP?4%JJ>JF=*CHIwD_`2B14c=v|+3Zk^;wd}u5-eW)5GQjuNx+MSSOO8x`G5-nr zrC8@Peipr`_~Gv%a8SPW=!G@^n&_Fp=$k-5#A~es&T}0YhKcxD<40Ek(b!q*E99A> z%USY|?LcI&FK(!0_w0SESwIWvh7Q!~bgQ4F{vq|dJuicUY`VDI=NDQhSYJoV$v_+NvTik*WIUr4_@#-S;mb`jyt>f`4%3#$vQYmBu7#5*6EXzRcc0DV`ZL% z`6yjKb1$-Su#o#PtMI{558-VYPzrC56kF?G?m;T&@?$f`AFA}#$S$3!wsIM;LlseMPt2IgU3fdmt#>0Dgc)V~DN6z#CG#)$SRUCYW6N4b$ z7GDrdWc?lcz9}peov<8Wb;xf+_(i!dvXQ~%Nsu#iK5Ku7T~J9qb2OgDG_Hm~pV$23 zz~V)k!5yvqog)9L?zyD)I}`T0>NBdb1uoR)Ek#>YYCTqf7eq9t?_#!T&50^i}rDp&xjorJQAASH7SBgz2@@7M@6agx$d7pOrdvx9X$MbG2R%y`DPQ zFPe&P^ho{y>fb&-BQAM|2!Mm)R{MCY3FsS=0>nd0f*04)iGylzBy+=(;I*+TwSI~4 z;tHOi6M*xB9pUxXYJiG*$o9v{$D{2^-enWOMd7i1e4D*Euv`2%u!avIzo_r=9j#Bp zfWi40T^}J4)7%}@7xsPxZSZbj3r5?!=U49WmLSh!2M^ALdJUBOV7+)F{Iu*hK537M zlUkl=N{?9D_;oc+_mJv*+*e}f8-$KV&m&A^^HM<5L649p(P^iWFJ<8|2d}@eOrwA( zL~(lBF&>|uik-u2l9N;)-Cj*MJN>SXJEB_pUeosb^qX|6{c|d<(XHLb+njFgKHlbZ zYbo$Hqg(Cc^_F9lZtVu17~K;60jH_E8usN;7;tD{Fqa`?PKcdsVB--3{m_q#?Y3Wb zkZ3Mrw;I^U*K2ScF0MDzD9^-Q*q-h}!$dw+D3_cg@zZkC_#nP21~;;&>89FZEK5hRU3JE-|v z>Bo5bG_IExMYzz}KtDmIaB~@sftEb9db9Wl9MQXeNIV;ibQ048`TdZYs%9&wpT)2H z=>@HZx8*rM9nMxL9n&NE>6KBP!IF>k!XKb@7sKFd9b^8xM;oD_uk3EqR?(__E+&so z=X5_>avB&cI(HaJ4n-}wuqgHoxn@`UuUT^IG%gdy1->OX{^<`}{oPFeFBP=DJt{QQWKuL!f>w`g{NEVc<5ZQb_OHI%s-b>kpR+AH(n#+~;|AU(>lNf?c5u`M5qD z#_>EMqWv(HsrqsoGUE3h4Wyn9EmlQ8W$_T2F}S>9CxyF3|eaAivCWCI|Y3 zY$KTcO50_u{QUCa_zUJqxPSa!@3W&jP)Y9_Qgrp@{pPXN>n?dwsEcD5JJa{%kJl#%jF67L`QRe`-MpvE zmbujkNB6b}L)e%)V9nwJg&6^86QSdP!Z zI@UXN5mZ61cC3GUwSHNpZZj5;hfF)}Pi)8ai?qYpMk>Tx3JSQtQG0Qca?GH~S@V7b zv?H97#=bks=u2BcWb_SKMP$tbg#)I;eka*e4a=7E6_vVOTEhK3X+5s*9qwmS58yu$ zeM?9mD;mprx{Pv4f}?R_bPh|GJLwhwnkuyZjiwH!gu3`Au)H--vy3vslim zAW&SlUL;ChxEi|n(78l87b6y_%mi53SkVjkOzvSC|9gR{@7Yq{@b}}yZmrA|h6bG$ zzG4#JqDffu81b2v?i!1ga8T0*_z;iF;h1w4L*%mj6Vs_z}yRhp9iN>)U-a`jK2$5e@O<+~fa~dPy^beHc&5 zJRF%qSK8UEwCQhcYMn2IV!`Y0#QZ!w2HnyFG-J#JgXNcEZLG~{(!_~lMk=X~XyAkk=ek3$JWpd2Pi`{U|P$URpm7`amy za={ls4R|)>I0ybG4wCmzebMTXCspb}=@IHp7aHGiAa&}?V);TD4n%q^PLr7@e%!#2 z3^5HI0*-Qv-)s!;qUE$6IrhCU6U}%7sMAXP`Eu}}+|v*YbH1J%#kPlgnBcu(j;R~D zbOp+3{Zw9`c&$0n zulNWJi&}+zN%TJ4W%d{0RNxC%oyi@>JujW}ueu`N(P@2Za=1cQX-!9XtReKJDy>gS zoKNT+KQ8>jXw;*q7k=GePoxt!E=DK3V8HFhg-@c6h^LO=@Rth15@Km=VFw)SAmQBZk^LpnCh0@3 zg?(K&>=&k8f0fv-Cl+g0bUrm>5SPMlGNI+pBZk*_$Qr}HRH^TU=G`G^ufP9z=KCa~ zE3sGt!t~zO%WvG=ORb$4KO%IyeLHY-y4^k=y>r=gyL~(h6I|*MV*NXacs5RNqh4Oi zgLrF7bn-Ozif^0w_hjPy`_f|b@Bf!|WmD?MRO)NqR1^6lBF{4}ccxYt$@4BzTfWf) zgALxYqeeR#eP!86!viWkDgHhI;}A?7-OoDCLfF5hX1pi^{wVUoVYz7jXr0JWS*#d~ zupVn_*=l)u*v&RzO`qwdfkpJLG5%77+^CS+@1OkFiM*ALMnlgpIKoGI>v&N-x?ThQ z60{MAEOBI~rj3)G`P0#ly$LpdwJSxu?XR!J@xF8tQY%I8z!Z5Oll0 zPdwm{zLU8AzPi}@Tb%w=tyB|PNefbex+e`Osvl|-8i%NjrZGp~jYp+|Ru}|^Am702 zK)4g>@-BYHp^A3yr}e@%a2U*N#7<(^1qqmt{IA<~J8> zFuyl2xZw7_lzLKqlxd;6wDQ=ysR?biyAQU#w^LENC$tFmjkdm?^f0tLrXP~|iIYnX z{(2Vf6{r-){~G1->;6$9-vgoYIk%4wAO?DytdPCi{e?>5?iAsGK8{9qz;6`8)Mmly z<#QYGLpA&AD-!orY(L5U`CRR*OF37;M9EzJt+l7VbXn^8vZr#QQLc;0#ol~H8po*< zde!bYQEm$FbFB@uj=MN8C=qG0WdvK%yNXhuCBBH9i|w+Gn-pNObm(8~=FBOVbqJMR z!4`KTz4P}D(-%$J`CXX8&NQBH1q~b)WPF;iR3~;^slw9aAY@*osGx9Ok z3+wyA#PxmCBJxI7V6+X=bnH{c&XwKe~qSqHm{b4W7pE|DH*V0*%HpjJKit zBbUQ8R6s$56@%#-X|!*{BZikAK$mdWZptymV$JfP+KNu;gdWrxiwGkR2at4Z9{9bk z6!CX5k6XoW#YyBoEN7L|#RlTf77$!cM|$%NrWPL-?hwuoJI+_Wm{<{|UWhX5%hPo) z!Xx>Dh4`vo9?#g!9#QH%`B!zHnK&P(7nzUZ#FV@b(<8;hg@7{D>Z?Q-F`LmMmuYat~b{wQ#SB#2IoBX@p}CcukEug{?a&!ok}A=`iLgn3`S$C@DnZ_Z z3wEtXhlTPg*jYQ_js))kXrDba9ri!uO5B7o<((4pu_^U|j@qeDN#Rl?ec2aq^ml|O zLPJ8>RP;VqkM0TG>FuXsVOXU2+VKUPzYCx9C7p}W*@esb=Xw{m6Eyvvf39}_w!Vis zwNQS%=dUyUvF3dBVJY2>P3@1deWL;&ng~zrk3nbkka>o%Z-|Iy99~wTP3^BEg97`Y zH^ZJ`=YUV&&A2_!k)ArjT-p43ByP|5OuLrAKh5Izmczl0{-uyLmP2ybEE*Sz9dwb^ zuB!A)8#Xo+Iw6lkBxz=ok2J@Dk=4OJ%Tu?={uPl$e7(!TXxC!=fbW-6(2TM_*eLsD z(=T@W>p`@mb=5bCyb-MmIfQ60-*uXA!RR_U+qD{dXnS|GdTOAJucT z>VFfh{n^U-6dHiqIw^Rt;4dmaqRy9j)mE37dS8%OZ#Zg3`@L0vn@G)?c-Rb%xaOVN<`aCD!i-yME7xe@(nCEqK&?Ri*A=L!L8x>QdO3A}wvro=W+vefd6+ zzv!>tet9iZO1MZvOemK{`Q&=B;`Aa?UjuiznK-Dv2j=1ek@#gt^jNu3hiu~sh=_}$ zFL2G^liX7f<3pOENBv^*RcxQmuSaa^Vcf#xB7C_>X7O_}Y?lapULg)7T^=Y zpS9ngk#Lh?@+^F4`}mUOfDZ66^lD5FXdh3AZ>RsUB?s&lK1&XuT+u$hVv~E8HS10O zy?uP~bB^TS+s6|LYaN*%t2)9LsOdbuuR}ad<)-%Ax3JvQ+fn<1Fsfc>bvAy@<*)YJ zx3K)h!^S@Sis-YDfFJFU@pPrWA*rhSzQq0cy8k2lv(3TXt8n5%G%pg@pm%sE65IxD z6Fo8MxVxcuL;u>%>#YnDCmQ!HZH6NKg=%c- z+ds5GeW{nFU1~&@=15L1q8?d`1u=x%oCY=`3UQ=fw%^65vAmew(Hw!l_Cl^BG zOZ3lenyw9Va-SoynXo&euW6d!zrIT6hPEMcFwyd75Pyj*^yROKem~e4vK5y}D;7%E zm-aGllT>X%J5V?uPb`~;yk#N0UieLOZJd(Ct} zBYqD*Yd-q-qSD?G>R0W@n=X%1?-ks>7V8g_uV$<(2>A=H2Hk4M;nstKkh)%IRBPPr zbX>!e#s#*1*ed&ek!JZT`HH#pBi>H($`YdY<m;W>y*Q^|-hnp8}9M0*xl9^TLRgmA?n03%$ zq|;vszlH9@aaO88O#{8m6t1(Ufj5m!2%4Lai7q8G*}nfQbpM+KG0wpVAgeMir%*n? zC3U!hlJ{HXcykJ(Fuh3E&yLqcK}=F!%YTFRMGXT;vc@OEP_U@AzD@tc?k}?#t=M|- z72y^g4KeP9(dI|-v({%QpU>b+K5O0ih6T!vp>|t>i{S%;e!(sd*Ms4JAX@fhX`j(* zHv6ux@YM2ZZ(x|KIedV5m=s+}+)gzyoo+OAfN$1+a5LPsixv1n$PHF-eOD5vAu)~w ztwn<_P9{oqWE^??f{1tn8nzs^MsP95?K)fcO^JNn1&i@@QGHf3UE?6u105vjM!{e> zWoRsUU6elZPq&CF&JIhQ4d)zVwLaU@7TusyR~U_!wmVA~3d>Q-6ntqv2=BG{`S_v0 zvJ*NDTWgH-cqcl`i^0mxzI}bSCfDI3MC&@k!waD?E4?A~qzt8gYsT+4iR1T!-5HYX?Ss&eeAq1TXTz^iapzGgG?9Z<()}Ni~r`zeF zn?-wlvq~X~PlERPTPpQ%&|%*)?RzY-eQ>*s>Va)NYjnN0s=schb+;%7+Fq^Qz7E=L zh?Wt}G1>&3t2U;iP4}91-I>^~%j|Zws^4y-=1sKU7aNBF`%Elk((6qderD?bmx=X% z)ULlhE=zF^uHCk_pdJ5#N_|^5l=QECeTGobru6Tprr&;;*l!R2QS_UwwfMeD;VhG$ z;pmxOUZ1$wypGc8W*r}<^I3F%0q#rMpSfXC zT-ZrZ^`@i5&*+pNf-NQOnN~dh>O*L3`}lwf_YNceoqt-?!`E4SKe_2!Zl(4dU^?>` z@~@>zQ*nb8<;UBg+||S`q?>`Xh5aBgFQl!=gdgRl7#{J5IRbKQd2CE_>A18l^GA9b zb9g*8y}D21>ApL09$vZFJnWPoiqFn-h3kRc_|u78&z&lDBPZ*frvA4i*8if#>K|Q4 zt@1nZ+MlN!Ivs%0JE_lrtNDzz#!%<0WQ|>6>ixOIdhfLB-6}s5t63ASWzKLdaFUF0 zUKgs=nLZtO+|=_MiS-1l8vbHD^x9JJE#WT+C6hL_z@0pxQg?d|`jKhRZpOcj&X;C% zcPZqlSc@GT)Rwa-_gZ7-$G;_=?STK1ov<0*UbUO}JVMi1y%whbkD77Z?YKYQ{8@nr zXWH$GI*Q=*`U>&8; zruw3%ZJ)1z%?KAHU?1FCF5oaz=v*oF4ej8oP0mcfKibo8r>83(hoWoP+5L&@1_#X+ zO@Ewr>H}pXRQ((?jevIQ_RCMZ83t$$*n~ynP&U`Iu^z+vVp)TWe0_|s(Nj!1jP|Wq zy78-FHho%RvAD4$$R&|Ca4R3?4JQTxYma zGI^b?M+2UN`0Qq}+N2G!r|vOp^jXnI$$q*F4>mOiR!{6%XK z_l*PMil<+x4^ib1C@ha9ccX$P34e&axLb&a6Tw z?QOu{G41$fVmt0ytR2yL@oe$a-aLZ(TexW4&>P_`9#<*I3evQ*OuJ4`Y!?POd7ZB5 z+9sT1726QQTr-NUr~dK+)Vp1occ#-g5L{NNT%7PgCv#HJ-?U4&&)+Z1?@<5IKE60R z>9Go{b`zf`FOUywr(Uh_VeR14d{mSVYrlLz_?Jx2;;qom<(0(sZm)Jv&tmywv0)e? z@M`=gU}ex@d=c_5XfiNNxBQr56V%dA^LvJoWa*fHf?-&-{#DB@;&wf3+^*GKx>)yZ ziR<}ui>>EH>6C*b8)1@A!=h)HCu+PWz?4lROuQyO*vYb>2@FS%D+U-kK0=E?W3LI8 zy_`Rb@x{aWYF@WX?4&x5pBuB6TWpCj9e6G;xlCgay?@<{&w{ydVkgDBcO;$x*Rp+SzoO`oYu^8$eSx)E ze@CStJ5X?VR^*`;FP57_mw=%39_gO@%+*Wdwz|K3FW*DQh`_XGwPuPuB5TEB4moQl z-e%YJ^D1?Y)RlZ^`+9-qd}sT3TH`z0$Gb4!Nq(Sxd=_62;s?mbwvVqlAKN~jI3N4| zj_MPYA%H^S!L(l=;ff=1SZFVc$!j6GpYmxeeF@}Ko#B~aK9bRAY zb-EP$DSRTrABpWA!b8ONQ>^Ty-SkH)1>cHyh+kint`|#nG~Du23>LO@OYEFcXu|0X z)_Ifg#Fh+}9Y4M>&3E2L7zpG^gh5JJdOHXb8j+=!iwP{RhdyC`U z2lZ{GVat&Xw+RkUxHu$-Ux#);i{EM?F6YtU!bjmUFad}Vuuj9Us)*1TVb3i);1^g) z(9g>g=_ky!VbT_-pPlhJMR4#qvlZfVVnJ#zQ7QOhzC+z=>Ul$AJuNYAcj~Df#dW;# zI+W)vht<7SrEuq(XP>;m)cfkhdc#d~srq*#B6js+9%%i9f162CALGm$d@gm3Nmtrm zm)?vImf|76)3V+sUR-^}^xKyb`|a|@`pxTyHuW@J_GRIfX z2}=}NSJcdZr5Ox@5L z=m9d=0~sVe7u!hS!%z#&AJVz@`Gh#3df2q<|3F;1mgb?YNWdA#JJ>Cj9Dvvc^+q07 zk03aTw9w*zj6f|HwD#0YaC~Nz!44R}k}FDoS{kx2iy)f5c~jF~nYRD0*TFhofgE8s z2D_T$rO|%uKagLCz={ATZR$e#zzMM}C_E`#&?v`+3mHF3U|7n|>k>pe5L2q5dgOIcPR7Epw;pR7_dGVAHj zuuR%j$dBTpn5=`)19iq4*A*q-3j6)qzWz0rORCQ>Y_puFjNuQ^HNUrB^iaKs*;vhtjpe0< zq+>BWI-g%RWD)-$`@U^_&T}8AQQr}*wn9UFLV=9@b7jo&(ICf8J%BzqMe82N?mHG(g zUe^X}pLCdMF3fqXbdZlspBCY`2ps3l%bb6qHY;ZK1YRC((O&U6Y}^dYkprW|>YN}= zV5LMsFZ!@J2932MHPj(JG|pV=H_bm;Lp8EpllW{yK29!^7Ng+Gls>7b=H;n^^J0b6 zh%&MQPhXar_ioxTFY+P{EA=`pciNu2=-`13_b3E}| zfxlQf3A#Jfs7(YqO!@;x>GWWxgeja`5$0($tw&bFr+SLvh4a3p+4q}dZ+iYH^l9?x z(fS?f&SWQWA(m$3Wc~SkSdd13E+~gkHVzAg(AQCJr7X$RP+3-__OHEgu8(W zbdQ~3Y4|vt90aXt!M~r|$TG(}x21Vxf7pf)of2{Pd=D}c%PTZf(}Cpxp2?6#L=N(U zKI%AT(QysYG0ksC5BK8V_Vs-*%lP3XbtD7gXWMeUmsmna)?T z>H0*qT(1}0kx@j`8ga)EoDs4Yf8;Bb;SvDu@Irw}pK3^9qv>tw%2!H1jis#Co8+s0gDk1k0$RhNP&>RaFTx7X97Z@qR z_NB7?x&N5_a@y{LADBM)zQxCd{Bky8dbB_97n%=&+$w~u*#zq2gw*R)!-M5n=4rG1 z)`TNn53;QrmK)~rj{eb6eg*Q=gqtt+z<4JDRHo3QgShghSSVmvK+87)KB!h`z@(%# znyE3qJ?*}+^bNi?NA7D2WhiHB714<_EeG^{THBxw2i}-nK;$pa-#+%$pmg9)FZNHM z>OK_vQZsVSC6fi~&vSQm>{?XXhtJ@p&5lEPF!&TpO?t@ z&o0LI2WyzyVzY{8WW8%CjVw9@B_0zL%>W|jMC20KBTh36`SqrLS0&aDzKT)3y)7>; zUO!Eb!u5;LADoV6htM~4gr|lBGHKrtANPAzXDW!N8<2}m@8$A(C0#F1x}^}l&iumt zUN-w%;A!3&zRXnU-q_64l&6)`{ulnZvwKGL?b=WU2?NV>UPe#JJ29wzl#$nbug7Og z&~XP>ad^d|_bB?=yl&F>b;RaPOumrulJEUk{#D)IPh3wA?*4jO8orY}LU>K)9GHq^ z6~fCmLNnl-`%QlpD)kShoxezI=QIB|+POIG`KD?06IQE#rc#Iz2qhfPU$oDs#^X_t zuC$M*IbCTVPiu6geY`&HY)V&l2cNO`_>_utWq0s_v`5abbcSzXy7wloi-0j$y?Ol_ zAv)w^a7hkACTo4yLjG!yE+h)Fl^*-xUeWJZ1EBA}4b@|Tfk$6P@q{NDQ|$AuF#`QE zv3)_?A65j{mzevW67l--wcvfu^qZrg`_{?e2*Sgf)uRdj*X&#?YlTn6+hO)|sXFADkeSh+&MpW=)B3TKtwMb7<)_GN8ANl&^nqnYtsnpZDrV~Am^Y`>tj!)xF=1Y7$4L>BDBQW5fGFn|CB z?xojEkq#f`%wIS$GQ(CIw1Hi?Ws+w zsm@}hF#mTm4p3CD(Z6^>P@O{h&*zZm8j&Lde>Wi`pJydU@WHdF65@7JYiD|Q}}^*mDHM5gXFoWUG4 z|C>>%V_5s$s&nLi-C!Ot1es%LGyRBSqEc*H(Zf~hAXB?_Dun}{GSZt=YM_IPE>G!h zREqShWq+iwZP9FgT7T^^q9H?Phs@550Fk)<684a>M!Y63jg? z^yque?0m%>;(Njh1iNm{sktM=<^zM~9hxM5jLpjFd(0f5=tta65}BEFZd8djKa!tu z+k?2_IVU$$$c-?TzMC7#vYI2?-h0T%A@9~bnZ(ZqbfE;pRRQ{W$}gH=9jJ?Uzf1Ht zX*mDWHp}a8cx;w#J_E*HTXWuST&pP~tv2NjH|1;x?oGf$$01{<1?=hC+O@LlfUX0a z_ZU2E^A>|=WBYi3aTImTb@d=XkJGPGhbiYn1~tWb`Mr++M*0-U}Paw>In2b4Ct2M6&m&o}ixD`|WjT!$XD z_jF$GMK)NR&491*J0xxns@A<$>SgbLN1{11n4%MyDU6J3`Gzcqzg{H6p3U|8fm@4` zeu&TqUk_7ro>hM>AuC`#1Gi>wKlwsnJK+#5jXd9}zg944df>S>$HgidxI5Ank-nEa zR#8hjCKmBSUWK-`FRvE!4VzAJ1V3 z|4aRd|Lk}SjkCFm>nB$Xn*$n7Z?2dRTMLzzry}cze2ZpsAf1V4nOyCf&LOIuk&nFZ zI^1aaVeh;^MLRAzP=x8%a-Sgnw|k#Nx*zy|2|tMZZ%@pRZk2r^DEB;m&k6k6^m9-T z(U1G>L_ViL`y!*(OHDZs+n0mm^H9#0qyDcD`j?e$nXwmPi<2MYJH+&;P4u39YmKwT zNV8o_pZ^9b@qaL#vEW?O4n#ZxnI@-oh)VVN`|=xEEALzBoI93j6zYaq8rF;^bJ+J{ zisz)~F4BjqP2nLa`GhYIstkKaa|fz@nLEhWhkK!X+p}DDtIa3o)@5_=b&%hi;4C9o zAql@8q=!+Yk8fnE@acet0LuSbxxf-{h<<-Mk4tT)X|sW02dV?#PsXyVP`jXs7?lh7 z$+`=^s~1k%7Y$6C(y&AD0_Kq^@}2z2JxxJ5pCQ?UiNSlHV9N9f-iIb03+Q?T$*gA1 zCHq^h*3!MX+~)EoH%kSIsZfXU^tIXsu5u;UP;jeWp$xiSY-dofi82B%NW$4Vx%-Sn z{so8Eqx_4_P(<|_Ty912@(=tv8T6DfPICxvtS#cW*&$*P|D;OI`WA88{bKy%5vX=# zr`K^cV)=sRshdsvu1jnmjuj`j&)<&{H>2b@NJp3+5M7VG-5|y*VhO!N?qhCFmps2L zX`C-V(T}VBeOu%3Vh*y4zG?dDk;Hz2iJ`@QdUp41e=^zK_zji1SLV?7OnbhS*d82| zO>WQP^Li=#M*QYDcbc^UjeKNn`2P7E@Amh{_;_1%mvmb0158hr%F_imH?FtiX7`_u z!R%h1##LwfM2YU`mk~4}Fr=fw>yoQay=i-I)GwOnHGPJr4|l2L>Hnyylm16>cb-PGrV#CFq{GLEnH`fSA+vklbyq@99FWv!SBtip@&7dfx0>!tk> z^!Zcq591+SbEJ5r4kvJ)W7Xw&epjh4>T=yTcGR9`8w$rVP`J1zz&@9wKGAT3axPK0 z+Ct70P!y<$^JxLe5EVc;(s-w}$(%lg6e1n)l?iZ&NB(Xw^-hc%((?Rk-j13`f{^;q zBJDuNYUMDSsSTXQ{}%wMp`)B`&tb&gkU4y*)N}>^_4#X_BZ;mnDm<~Q^m&U^3;G(CvohnxZ{PZ>pcCp|OaXYnIrpcp+l zaC6?d0MRD~-^bKR;~Y^1T(Y0?r#0dV62S_++(#xH9@21=7&;XleM z2ddQmnmQneJ*7SJlL7sv99QA>_F`WQ-gEx3>%}TqbIkeLtwS4zB#Jfi%Q!AHpDOuW zJdP&iVm;qbT=b*u^FM}Cx!W))sKfWwAnMCRivGD{k^X6IzgepFo;0?+tcZJ<=5%G= zNBR?bdXA0Z7_EJO%Z5JMd^eQqc^u4^g|9n67JGOCo6X)@ceR;frCu(MU|JVuKssvi zbS*8vsNJG{iT;3|f)BMqZbePq&gE13dF#)w=BF(udK%KQqdb$lbA zoh*P?NFTL+^F*UKTB735ldaeiwzpaSs+)l#rJ#dqAkP~7#q1Z&{92CUCs(Y;Hysfc z>;7k9e(I@B6oCl8CBiqYTdnU^UV{1^S8njWJAK}5_wgy!)b5kqZ_+;pVSuT&{_vQ0L z7c3XOH)IoTZ-)rxM6itL`%0RBH(EYY4&P*a-uCy!t@)f=riR6>;*gA|TLLOMFV;Rj zs&zfjL1NK<3a#Raw8?DIot+~JW73G0#vTN1&{D@kUwE#!J!4f=#6S;=P$yT^mtHD5L&2}^0Zq8=aRGh@~sJ~?DLN@;fTu87l%K{WbJnrerpsB zQGG=XcdU<=w;`=1x@K)QHc4(tiRk3WXEP2mMZi()SKD|K#fd6aXF?ui9b1nwY)1EZ z(*7cHqg?-)q_%X{HvQtq7|lNPMd>#2kH!CWADsAI&mW-{X$H@Fa=x&9bNRz7mxk2K zFseC}pX%CzO=_4nleF_bm0Bq_6Z#(pbX|^P^cC_D@zz4pOzZze+}u2l`H6vG3-Y&0 zcUr|8NDbQmrqy-S34U?FXtf~PYR%)4r*|WNzRaOqrcDHa#!YJmUWxQ@$9e^+-wQrp z&w7#9-pc$KPuLZ)MaR|t+_)h{W90RZ`J3-&o_?FS{q0ly#$tS;rf0m1rv%|`c&3zv zfi+XAkrQDWzA=cu1cG?XE4ajFh zR9IE2Z$76|IHOM9pdWwj(?P6!z1C`2Yhkh{=l>U&7cH+db{*+eY`t#o>!V&Es!xJ1 zLC7c7qeS#K3lXSH5IPUW^r?K-?SURD6sgFvkMnG}zWh*Ij-eA_p_(11-tP!}KsW{~ zj=i7Gj$)NaPw|qmGI1Y!{e(ikG|7T5jlB2W-qpTL+xNsHHV&?t^=Y%vJC8o{3<5YK z=NkI0_@sK-H&qk zb>EXX?{PO#^1N?}H3A#J8zmRIXNISs@?FPc-b<(n=OXx5V)>^v7i2F9>prN*OgkP- zY{yM4x8vEhf69R`yG379Dcs2{4j4)u$@bXy9>n7rdH%bhI7VCbfl|ae@-IWcluH4f zugS&#zh0ibd2RUQbdX~g((&tV^Pcd|^)ogl4M}Fs8Ae5lh!_#F7`i9?AyeNr{e?TM zFSaEIF-nZXP&lrLWx-5UnJcEF;p<3Ce1GA~Ogq|)8{T0%P`6?1lRDg(_%%qgsE$6- zs-YD({0dXg&n2$6o%VX`yqLvpz&% z9s(k-FHEHGmYd!%yk*mR$)VdTet1Dv(9ROtK=P}h zcqV^q>F4vXjk&dkwz~!R{q=Yt(eQT!{@QHMrc5qhPRqZW+~XTC?uOcA+5HC_H67p8 zlE1aEQIj~;QV*+L)9xsCNTgW%Dc+Bw#l=i@QoEp8c0G-84ECo9SB}bC_6_g0m2x(p zDI6gYcjfcV?@=Cv^*|@v_xb4h7lU-_C1U-EQ^knWjT6tY_}hL;dee~TFxKSqm>@VH zrwvfD?+4@N(Nl5_#w^pLZwf$TZf&0VhX>oSuVBIrfL@CR%t62`F>+#JM>_3lm4a*oT21~nw0^vkYVNkID@Vo= z_P$yLUF{i_7|)2PpAr6jr)lSGVmrr|sGYIB<^+{GUh2OhT7QYvo`%nEPX-}Q>OFOF z`bHkg2SGcbUC(FIRcsy1P?J{mh*^_*mPPVS<18OIc>Q}1KunGs#{N_qmm9bo#KD_f z4JnCasFd@Kt?A<`B8pH>3%+OEZ^u!8s4fbX3qH0P(%kHe{ z`qsQVZH&F5UuNcRS;LI=<(Oxe z{|^&)9r?RpQ@f{B>Y)%FUd{H!xv|bz|VcpNc}%G{q)1cetOtm zFE)4Hj(&%M>^6vUr`$CNhyyat$>vNVLTag# zEMoF~m3rFivVSn`+|77g?X=Txgdd0e$MZA&VBFQd*6!}OJ z9`;Q3Kc(+!EYcHV(T9_-1!8`FrINl`q)if{R-Ru$)&Fb8|5t_M|JJzi&xGIklNQse zk$D_)_cN!IL5DA5aw}ktNYf%(`DIv({~472OEP_Gx0uc!c0ui8zp{sX0T(V}A0+pX zUpDjf&cb;@NYTT>6WRK}31*9;?%Q^K^r_Xq3QBJ_Lz+k*OIMTPex5|j^hz=DHy~-D ztqj6kkW-a>-bXRHHBm(3`^+T6*LGieMEj5_>4MDk;nOoULCd|LiX2%lxzqz@_#rxy zElQ>(v0roTh^=_^hL2dXoo+480fxk#+p8CC^AU+#mTAw>ZL3-FgPcnQ-=N&_{Wl3L z#r}tCKML0Hxq0)RAHHI7ZNs*6tTd~`cI|@P0)ily|IM5$!cbOJ?jvUmB=KtU{3Ch& z7*W5o^-@UZVL7FS)&e58eVhM21>dIv{+s&n4F1{m$-j%_q0;K?s=sMrdA4Vj=l!a% z{2HS4Hb8N`b|$XpwMRW`Mjv61r^1HP38~b&Ta7`hN*NNL8}TWuKcf2hcHM=Ty4?}g zXVjzQ%Sjw6HdFkAOoq$w-R1@k7Qtc8JUt5M56^rhKx>G|yAx8=dB7!s*I%}w~za>&V0{PzbX-d|$^^mFR8b5E=jO!WV!kN8{&RprnIM)?$g7^0s z?2ANzql#_y_M}{KdN^z67DY+`qZV_j9|+DOQ&Fivf&9<({UHwkMg@|nK^Zc1gcyQ= zX#j`8#5Q5J`8rc=cL*Ds(m?uS^bgPczc1X6ADL`FP9-M>kL_U{X_5C8{?5g61c7nU z39=yQ2(K0WPlgWV&?}3bv*gNI{SWbAc6h0rntHY=;S}oGF70_5zLG1GQPb*zWxhty zM6#XHlX~ar?S_uNu#k>E`>^Qf1LneS2I2dI5SmvH)$*~=QnQyJjPvT?Z>s?Q%J3EW zmGW^q7yj7uiY+*l^~_vpIiaky&k0u6POTh=P?)YzYC4+a>+B*Dco_jo7{8hZHR9j2 zv)}8K#Ve^d><;YLlK&|%7Dq6CZ#)9vw;@TTVz68j3str#aq80Rc&rCjGnrh<`&a2emGLllW8^AH2aD zI~N9JDvaS#0hKy3=`=B-D_Ce{ZE5}d3Q3LX)#(~rhK(kQmLVOyfbRt#pmHXNc4HeW zp>KGxz^NFXn2_SV*#DyaCkNpZgX@--YBgbA8X^Kp z{Ckv_COnxhs{b`eexG<4I4&b)nF#5Z_9LfN$Ou>ua1dRq+=hc)tjBp6zh7C?nyZr9 zi{Au4EdK}dSK_=>g)*6*9K$V9*x2R6Cj{Xm0vLOr2X#D-`7A>VO7hw{AW#3b7;Rjr*9Ys>2ueZ*%kk_U;`b6EMoVaiJv(yV zKp@76Qz`7=&lG7W8u8%D&`ky7A+B&2_#-6@O2|}}1bO@UE=Z1`jt@^P5h25ss9HOW zE~@ZC4<7AGDy!>aU$PEb3PPQ9dj-DT>eZOZ47b`?)Ohl;zqJ3%OKi=D^*$4nNGkAtIHLUX>w|vP_S9obp53_3#Ost67KHD*XK6mk8M*bJ6p;lK-XniBlc38o}GR z-aRgX4i@QZJhGfdsl|B`qt4a&@E{;e9I4}?EE&_$*kBTJcllcM`F6iZ7%Fjw6RZO; z+kxZHUs|4-&$yiCFYF06cOBT3{);JRQwJz~cLw})&M|abHL?F01 zkSWj2g}VopeG?ss8h!GVeM8E;eNfwN^_KuwZrYpGUTc>EW;~uh9XY``j#?$U%bdsQ zc+d*cuWb#XDc!VjyMOETyEhWv5AeUVyc{61Ui==9@R#m;*^xQ*q6)?9S}ozfjp6)G z+Hxd7%zQ`9cKsANwgL?+U=9YjL@Fx_tN-7!Zx9NqMz39{Y}|0a4h=WQ#-I zAlafb@l#L`EeZ{l2-oR)*!?g}0AN(|;8?4eUrX)4 z>~Tx`m=ABCqQ6xT>d5!6jK5D#1mO?Ub;o-p#N|x?qRIr_^Yai8p0xGY3_PS9P){&v z@KnM3S?1T{!_bekJ$A@DXBw^Qu0+nL)WJJP5s-}Yr+KjL`ECP$hb`=!zFEr(wk7)R z?bpU2+5#EsCJXM3zjge~#@RX?;do4P=-z&D-rM%D*SYhgCvgN`Fb%6)X+^E5i!9w` z+;2U;skl4{p{{<$E_P%+Zd9-${`n}h8&g%UwnPob8y*6dLD|Uu z5X6o7*$s1#-z@*9N4n$e_9BQq!FzlAJ#m2c=vKdGmh>quoW3P+KEFaSD$v+o0FU3W z%ZsIB%wJzU8g2t4fdIL#0vVRWhf}yW759I?dutkXE%z_wZ(b zGn(N!_lJW9?2IUx1`C9g0qRy}juK>t>uUG?_@z1Zbr|sc(#ocu+*?yTVCXf&MeC09 z_?cY>c)UA`?J-ONSH7*|u62D_D-sp74?B`>i1y z=O8vx7C2cu!0^s3x1jMEq;|yJWxl=c$ZDGBVpK$&* zH!e=N?z}2*kJ!4v^?k5x4S!u4we1-H^;}v2jI{spx@3xp91H#@iRe`55acCCgYbdD z-~B_90EP0d>J~(`M#M^a3;u@446Zl5=dXudm|^Lxsy6DymRUmX6=VBf}b3cDrr5(WS>O8_4hr67XObkr#nc)!zP4 zJ7EVY6pOD+4(EN%>|G>;^O&1U2_Quz{ zn$@k2j%?3#kmb|j{T6QNdA;-G`e}cVc^e{V+<6T=Pp$w?b08A;%0``e?d877qU4jU zc9UX#DW><~^u5lraVm~f@o@qhY@=IMb;OANiQ@9OaYdFMQa_WzO~cwMwa=Veuoe|T zs!y*nkzu@X!wCWu8QgrYzQZe75;;%wLum&f$KS;SMzNB_mjei|5tH9t5>M1kY~C;y z(L1E@roIt+{h>ca#WJJv@lJ{5> zh)D;1Id9T_H~SYOA!r^xa7u)K#o6(Av_|m( zcEy}mk%M}0YLI*m8-TNbj|HFd zDrGjHeTaW0WN)1)hmr=pbDQ6THO%_Yw#?z@%`a5AlAg@Rqs%?r>wl{n^&0Ge$A9NC z9502Y5sS!?`f}2WQ4l|1F4r=iJo}yoxZJGz3 zgy`*8>hZ5^K=2G?@v+dGsxe(#%<1U7Y{#1tx^NLv)CwD{Afj;P>8!tiPugCLMlB>= zX>_ZD3*|wr%VI)rE;h#|fq(p_@UHh7w6kX9T~bJq$xF zyb^u68Xq@KP6HxEa6M6COs`g6+V9}SrvG;o^*=;PP1k=S$37EEcE`L%?2Qux*`G7* zyt=TRrr*wK9F%l!p%KMC?1qlvH(E`KUpkcf`#3}gXtxFXB7d4Pky&3Aly+mo)OVTw zysfZ5m|1t+et(vvKTIXSknCKlmgD_2cJcgKgU|dM*vDs}f9^Ue=}T5oeK=&hEs;kd zUarPb#e?96arJelW~$zZdPkhN(O$dx^(r@K+H>N~kLj)6pWX2~_48Xro7}{1eMS7qShT|ZR(H2&m7cItUue74H1(p~?AWW?TQVU&FcJ~k)&QT&Z( z{)2_|>8&%+CmfIJfkA_;3a%mQ>p;4yX-w!)nD=cI!tFv18iadrNc{(b(t8YHCBKld z-&HSt84&rl5$`QiW8O$4)=T17MLF51dTHr2^7_Q(O-RM-CWUX@bcqL(^ygW5CrlU@(+!a3>z8p8xAq^QBXZ>=o=ko2IdQg8g*qpg{Qu~3dY7WD2l>u_!$)m6S$rESS&Yaskzp;FFQ$so?j2DSNp6|m)V=3xELwuZL!~(U5 zr1eL_`U&|k(#{2x%f~OfR3Pz|XNdR7V8EN&FXd5|(BAZZI<*X(Wx&A$yYT#Y!8SRw zvN6G7FainV(M7g@Q?9uL#Pc4{{4?_59S#3kP{LBuTAKFRG}pEOK>%kS(k(pm&n|=$ z8(s^j>y96fGO)aRvpoUQfZ)v#p)>EK$5J$7{>MZLI&2sg@))2`zs^kgW_n`a{P;|8 zjswoJjA%)WzbZgru)vX8Wa%4ifcqkYw@bLEn#df-IS@Rw-^!K)qsXT4ZXxfz-;Gh_ z4WbEN48Hm*L z;93(YuSLF{)p8!%d6pwz@Xlg-kMnRn_PVq-fhldL{M{h zckevQ&D7{6vC(%LJaO13z~# zXlu6lQaO`nzM9*_*_p=UnU~}&_J0FhJoDczq$6J*x6cm$UW1*G4Nx%QZt{1~p9dwx z%oEp;zc%CjUg3D}8#mtZ=iXt6F(({uc&|A-zv7*pe;Jg%W5!KA%JlqHF5OTEfgD`o z)Sf%Ub~=5i8@o<;CW#k+SmS6yl0$lWNbtte(?e<}mp+i59uj3@ zSdPy$p5w5!NMvEjSpZPM@A5y;xla`C`}dC9_qTy4DaU#aN{$9%u1Vrri5Rem$n6r3 z4gAE5$xl>;>1C#u5Nt?Wv?5H~!a#1+m~I*xrvXoD3` zfgXBg4HoNG5CFUqKO%>Ps=&5pV6+z*|H<|?k{4arGkOlx_wG3(7-5xnTKAz`0^uN# zwZI$#<=E5I_x$;C+q0XveggQJjfy%?aqATvoGh5JR~~ne2MSi7lD%{COlt3EyH~}_h6xyPZpbZ4&t^Ywit+4Va23xyxr>E}xR@lH>NBP!q!x&#)0zy*LrTJmehRPv^{a%O=IrTg1wNPO$ z;@$N3MAkL#YlcC3&dhM)45a{o=S%uy{tpZH_iv8d-$5@WQ?i$T z6yuqGzdX0qyjc zjcqtl<_GwnyI~YT`8^)m7w*uduGiCyYlagcUxM!wzJ&Hfnf-OL-q|oFq0~QQ-pBho zEhc_~qspb-v;YGxpPTW?=q(I<*zuo3@CaD5m|xQ1=t(~N8S5vBD~s$Q;%0N&PlBV< z-fQ~)s~^+2dYm8nSrn8@=O(9~K(1?MNr;hm_WNn||M) zTwXIYs027ka0mSUc7;3tmO?rWHoH*%?nRx;6M0c$eV0H{tEed4GyK!gGwf``N=$a`cq^r>J0n!W+e%22gfT;ou3k?S z6uELlIk=_6nQ^zVV?5U$<(5l2Ci}As1GP?5Jb3P6IotyWMeBGVJJlTo${j+ALu0ch zluA+9HIv^)!@noZ2lKykzqNlD7qsjce%p-Ux3vEO?FjSigN!L@cyj&xInFuHJ=dPJ z*q#-EaN9f041Ul%A3^O97K8zHWV>r@Cy~!Mdc@wa9qz;{t`V0ieG}#0zzq@huij+L zT}P6U)Iy(W*JOh3;I|-nm;4{hAJFc8D!t<=>{Z4D92~g-!3;w*hRD|7Zs6GN{yx*c z1Ll94s(*RMQdh*EainaT?4}8+X})B}1HEP+s(vJ;#&0wO*z*qnFaOgT#+NGz^KUBrnmIETSd)C*Ofzkz*k@xUOi_G1{M(@Py@Y$h8Hq{A@FS-rikD0f{dLv; z(f9)N!xN1Ga@)bbmI*>BkN4hdZGA2F$J6sGirh>H6(7XaIqA;)j~CiWEcU}^e<(ewxGWQgF+u(r)xIcJTqLV0Cq=FQfdfVT}wLvxOO z{8cYO4LVf?kffB1)sE~FfWtN2F;`kM5tvV7nx|hcx}i5EI`2N>RtTZ0?Z-@yeEP@SZn4oOlZu;RaxQMEf=W8-?`b7st_)M4p8k6TR*Fu#r8B z#p(hPn2m{93V2Up0Nqh}*R5k#^C~D%;Kzr zBWYoBMlWGHIiZXg&3z^*v;Ap$%v|ZANnG;3HS7Do3fK1=POB!0h}UxIJ?*}{GBvT^%hyxf2ku8YfN%UskhdS}*a1Egw*wS|GmVT;!aIcK3)U*Gfr4u z0-5qYIZ64Jy4M%@Rk{6N$33M6pP9+@TIjuoRTX=eqIJrjdN-_Ry8D7)Hhq-z$Kg-z zReYHLQXyV{{NQ+f7~+h0Z+z734XDW+e(sNg(r3)xcrL~@J)M&}z##uNJ)Gio zn+YDm@Y?G?TffxbFpiIB!=wJllH(dO%ys*MB_61yAWT|}-*{htNLFT&7hoKcbcX70}`24JjA1gIPE z$2`nKOmO0GQ7OqdF&i8%31SEu z~yCeUjy(o8YApo=scCAN;^Me|6B~NpaDcb9ri_aWOY~ajm^?u7k)~Ezl;9j zng7p)=jP|fotw$MH>?MRS6`;?>*3m??k#Fx%6n29|LV9I4a`j`Ut-2+Z(64z(v-eH zi=DHe+wiYJ-wGfsA(u(Knc=)D#GBdR<>L+Y-Lt{d(~o#JOMMqFit+B?@Ke0=?Q0{% z_e3C2(D7=sFR|m?2=7nB_-uOKk}&ZwQc3po%IY~rs>fGpR4vSjThAs;eB;L}^a*D~ ze%)@@J8IksLs9SC&Lb3rn2CSqA{u16DAO1WDX3*U!k8^^?c^l>NqD@o*KT&I5xDt4 z^kAdT8#{mMyIC0f{_TbP{-?+7`$_JB1E?Rlx%>Dhf*SlDg|9HYFH8>{-uD-S(i^RN z;Q~52YCIclgh52!9S;1N1?AFnQRXr})hl*LP2$(6cGCJ*8VZ!>Lp;vZlk?iDWvwIm zrA&Frs$?{k1d1p3UX~A1%HJdZ2lG?LeNfWN9K95zDQTX~j$$KOTgm-Csh{jOO~1cZ zh=(x2Ew*F0Wam#VGW(~_SA){$4G#Z>8Q-@H$M=Wh#y5VS9nQTpcX%Ok>58=m%t@TR z`i-FU6*JBSjx)ti=F5PuK@?RyB6bwTF4p%YAUvx)7#~==_NvG{NEWq>zcc%T*B+z3 zO48Qrc0naV34%}QkNJ-k&NEUhPl!i_OiZ!-o(i8h)*f&A@FPDeI^`W7Pd*ZqAj_x7 zX+}L;I&(3PxCmI&pVL`5o;))xpz|#9%x0t27*r#i#7Ga&*2rE@;Csi4A+J=%j>gHa zr%oyi-V_A1mubRUBEliZLs0dZPCPQ$SHvYW?nHro2eZ@@RPa{z6X)NXi|_@UD)kHl zsBBJKi^>3s`8vgXuGL04wJu=j#R!o1h#aEcBhuh_e6)5;<)Q94y1lxw$%O-dHY~oW zNO_v;_aAMA&FZjCi6?$dx2X9t?BE)V*t%A(XM&&}-i1RumUx~ww;R3wU=v@_|Hkbn zZlgGmDPPF5#}SqV?}#U!-r2fM8|5>~P;Qfn-xDt)-U)x_;+usnYJZv64<#S_p@d|J zgIfdM0zO6M&zR7>oS&j{2-JZqceVG7vE^VJ*teDi5!6BML_&b7BInO*$0CWs_lZ2m zu{*+IGyd;g9SKOhKwu(1THfA95O~JjXLwn#+Kz)B>2tsUYGu0RW$d0b&=?~atNGKW zuv-*DQ99qicQ?6xQ5Vf8_)csvF~VSWA6mmI%MKp!~ahzJdFRR@Db;ll9G%b zq()~DBr}0juGZ=9Yd2UgVF!SC9z>`)Ly?>Z<$FqR4OXTXwzU{kbKHC?A0`%|1*W znfJEANccLByq{#wSK(LX_9VFm*-)(>HmeN}~W=!d;wQojGh?EY3 zXYr@C4;iX-azs%2;3Qo$aF_L`#6b%^^?8WUDh#<8;v}a&KE(gb8UQEgXN5NfrR$he zTRB|m9ziV`c+V~54|>9#jU->wDw}OCG+f@GpiCTIa;ue?@-C7 zb*ec_7W1m?y66v*hkECA?o9q zzed*C=SE+Ed)YqD(hKGy4;(U_r0BhbKk8HH@2mp>$|;((Z_j1ANu5e&@s!WZTZ0_l z)Ix-Ibzm>Qhrj-~MsV5Ta{@##-#>B++lDfw5G?dbVJEgQ0nHK2IoS*K>mM`TT5rEQ z=x8^8jFW_U-^iW!5&gqTbUIObq%60hGU>5pmay%`9W@fisx~?vlquH zmngS}{7d}fly67ALhZl#91Jb=I@yq8{+8)D)T^N2hpg>UE4stgfNy=qDxL-_ftfBh!`%KcuARQ(HINI?KQWWDkommIDH@Ws#ekjQ6Q7`NFK*zy; zxCAD76*tOG+xk_s{+I&P%h)C4wC5}`>MV?`x7g^d%>F~&Mt3xQ=G0kY7=b~5cED}cb7+IY(oqSumE$!Jw3cG4l-s{2n0cF^) zf^y>5m7EJGt8y`k{~-1lqO%JjZfh~^QHUhJ=dkRW^C=^QZmGpJ`eZXs;j2V8E zcJzZFSeXf4br>}|6>QbP5P7uZ55v&R);|LRu6x44`=lLzjda55uUT{g^o<$FNHCRj?4;=F2Ft=;W;w?yiV;IH>)(= z+>{P(uB;v7fI*hl_L}aE>iYp#<@AfUEnBZBr_k?@-+c4+*IRG+0=U5cgdI9{!&0@i z()LPN?{6IQ{-!bSZ^?Tva(!ukWBoiWG{s;w?S$Mj_5Ilm|0TLE@^N`@tUQIQBfh3E zI7GRRO1azaIDX?ZZg$_g@0V|UW@e(?`p+8o{zf0Z$ZJmBc)$_rr93SO)n%tmftxg%?|Ks;+;M75$$qXR5XPa_M=uxfjfYG>8 zD{E&(HDbLo^)?2;$CmWMdWj*399T?mwR0nuMg3dg!@Sw8wG5V5YfY2S8|UG*ke@6j z(vZa?=fy3Kno&A9tsGf9QVE}m9649&3TqzloO%q;PG71QLXtvT1UN@I_2}P^XZ||0 zmnVfuV_i}@vjy3V%3&&|-cwPJPJ1mxy`=Xh?Gd++R30Ce!zW7Si^_Fp&)$A}lIVhb zJ06bjy6c~{ctZX=@+0A+g3?@IeNzS`%2u1E<^pS_jNuv0d3n0gz6gFfYLE*R)s%Pt zQv$bme*M^4lPKBfuVjCv@V1`*%$qh_wINhXtro9{z8ps0cO*}$+#o$Wx0JveVhX_w zZG!c73V2?>Abml~F(mqI^(#XZ+K%NUv}3Zy87J+o*c>wr2;wWR(7$vX%n#h^Lqy}< zpOF+CYB@+pcdJM-i4lxjcj7`1*pjjYy6&={)AmLk;QsvSI+%ljLzMlV!qNBkLBv9M zymd(D8H_aFd*hD}Y(LL+F+&PC4<|5@`--i%s1f;~l>a^6Rl-e|Qri#SX!`NG8T&DfhGf;+C5y=}Veo_0I_e{)KZSn!h4YeXIP7{nF!8_`hi1<|BseN0H*faE(dG6Iq6whdFdNrefEiy^P(I*jes} zXv-Mp)T4OEf7#6I=Zn@kgu|je+;RIkj{!TZ>AlBH?*~1a@VTJ$X+sk@B;M1C=3PbP z89#u`#M2IuPS!LP<00{OeDK`=arGG9fQ+aHCV`Q_WO4OolMkN32${k>L9-eCjbbR96g&R z-baWmR%gs^HKPn)ZNjAeQ~;xdG{Q+7duRiEAXQ(Qs)2!GXwE}34(tk{|EE$DIDkP{c+C7_kdORO*G<>zRu9&*Lab!w zcr_2b4C2*rmGa}tkyI1KEBM4Q<>KEs@na*`EX#8kGJlMwRcFabFhs1I!-qXxc>i1CC*w)1L>3@Z2}S2h7RpodYaT zSy^B58+8aALKkukI%`HB=h9qb6h~;86nOtS#Wv2u0Jl5JSw?_!Y6}H9u>;*OoWWGnz-qJ zAIR@x=Lq~R^A*y*Z!p-ez|XaI@j|EB3Z9L3MfacldnePnD$Y)H-wrQHT)Z7gBZZv))_Tkp|$%1(Lg5-NH zJnKDx|5=1U=t9#tP2rWC?;TaUuqn3R?hj$Wj>rOxU(Nb>zN$awzgWm;BI>q#?jPPg z;s7U_Pe9>&{d+OXFrz#ne_R`4U{5ttgqx76Gf#@Jk$2f7Pj4qEQLvx6DjnhwlQ{YB zG3)k@!ga%?%w0GCesF-Ug|9MP0U|m$I+nKurMu&05I!qKdj|tWtI%mT_c@e9I&bp0 znF7h<dgRZ&bJw9x$MJg7b9F>Z&iVLVwg%wD2{=EQKmr$2Aq z{T!dUgm)GHOBW_-OI(Ntbj7C)d%fqKa}Gd)NY5>GT8_`HgW!jO-B402E@B-SFbj%7AeX`7+2j=L5&Zoxrd#1TGxbX_Aq4^$Uy@M< zmr0($1gZRkG07A7H8Y+s7veVrBnQRsk+gq`^CKBf_%X9bpulzZ$QOeW&U{GcXOr9H zi~XntQA^jqqn)yu@W zaN^O3>mT+R+ZOw&6b?I%_yj|CO)!Icck8_C!*jU3Bhij3$SDQGK3K@r)FTGOG-D6u z5FCQ??Cf$jK1*fn#^QzX{T*eZS^fd|Fd6Ij@eh$3b+=pi^$LEEKF5|&Z{d6JOK&X1 z_u;|uT}{H6(=7@Seq6X4P<97fe=aD!%20Hkcka2x_!nu<7w|qqpRIL^hxlBSo1Xq^ zJ2s)a4{-3zA28q1rQs{>x&FABYfuPhuDyImoTnM~wM?@;Pmka%<*Wnc7TrNNW+Mde z6Fw`xf5?4;rBb=w>6!Yq!nAx#)$RaBq)BvVyPG06dD##Le-p3ne2z>_PZU(R`(O1 zxio4vr!kQD8sqLKFQSH~S$|R53F}wWpFdG>^M71OpFS~;KE(=oN_M6(S<9|W{%U<7 zI8r_uejq6Qa)9-;4BFgHhunw1uLSN3W?X+zI4&4LO~Yqw;LfS4Y4y8Cn26ka=cJ?h z^&osd1_ov+Ed5Gw4LJ!fi%OoRw>0Z- zBLhz#stZkI_X}R%KNOUZ^E0tq_%qZ0Zxr_bvwr{m{l9_vr>AptWFc{f;BIFM8%+_j z04*|I1=KJ)PmVR=>d08*)-0GlYkOZ%0j;+}-s>fi>^d@`;haDh=4#pCl+xt8xQBU%>KFZPh-6Y;8X1pu6Z z#vR!J-09EfCAbf63=xH(FYf9UmDwz+k-muEJinWw3LKuq*+l;uu};YIXGvZ`Sg(bo z7I-%OIseikJO?TA2{~=uX!piQ@O1HDys6ucJpIV^N3IVyai+jDol^HQLv(EhrQ3oK zw)=7^(D|2jP5H>UR}qwL)g4^9u13F7eBior-E%6KaU8`@I&(unCJkINI~clrv zUyh)L&|!|TgW)}N1Ro|NqWmVqKU3TIf_7)GS&zW}cACw44br?&eEJwbL*$c)5*jBX z1&o8iNz&DeUV8Taq#40Xh6QertSz69?09y*b<|uV|pAN3)RQ#}LmWU(6ckB8HJ(=`Jg~D{nEw`_1ku zJ5L^6MZjN?E=Ltp)H@f_l;@|B+mmsublLoPt1942#bl5(txL)8=l?k-$^B z8^*WO(oKjliM>Kfulx=NyW4Xm7 z{EfXXZ!qI|ZQ*#@{&@23!j5A`DYFsdq4PoMH1_+m%Vora_~&61ly1kLcn_Bff5X5B z{Z1VN`|tDfw)sK0VL~)RB+9N6uPii-Up9IXkjb*B;{AGhdapkGh+>|^-k$CJiDx`L zFMf-i2OfQ>aNghM&$};2o64Uhk6(7SLHHIU1bnk6Ao}&7^j=+`LppaZ8GUv(xsP^M ze$mT{FLo9Uyx0VMG37hSeJ`QEv+BFE`0Sr6G3lqCtKX?1n^~FRHJFx?cpuzt{NH}I z(Esga{!I{mI$&b)Jbd2i6)IX>dB@tL>p6CGvEI9Mc9RMpOlig__&Equ+e( zTS?C@sHhqMiIy^B4oTQlY_W!N3LHziYkui3X>D%`gp zpK9OcZlfvfe!@4+g|)fxmbvgBf)H+?c{_8|-v6rE`~P87wd~&iLVnS4dw*oLyuCl7 zaCYyHD45;*DCq3{Kbk9j#_avs?4I)X_4N0XEaG!tPY)-5Ur!Gwe_zi4r*L0S4=;aT z&j2U0uRVJ%d*fpzK-2hN%4nw@;rDpF`=C$Id^wmk!CIesD+_+IklyzRq9|XnJzzB8 zVHXiWRb64?2E#6i3CpRs3X!McycAd!3sxhKeJYwu_#ssrZFCfzmJS)#3qoCEVl$il zNFHE4x+p&^Y@hRir;JZVekO7uSN^O&yv%EW)*Jw&tp(XF)tmXmC2R%R8V@Jb)~&MC_SH7+9i}wBWwz+ z5u(OiSUa_~i8{-#cRj zD9Y)x{A#KaCSNx_ee9G4VTi z4`Ab&zu*1f;y@luL{7$Ph)qDdq-b(Kxa_+5>mLN)HsiUkX#a)?G2yBPeL2Y`lQ(Fb zlgy;}l83}^@w;YxmxUkJ=rtefhsEUh1>nw#Z4&?jD^$cN1c8V94R3Bzg@<~q#>R01|lXgjzdC6G*8WK zaWP({_&(v|a^91U?{?eeE^J*8Y*UCw%EqQ|P)weu;s2sIy~}VSWs;*LpuDMfhyI*D zTX-HIUtR&9;8XFnpmZYEtUbfPe>&jDvZd`KH$za%|2ILL`XEfZAWd!jMZ@+XteK!( z6vH0n*N~(QQ_vM-Gu@?X|35unjX=4u8&XKhpdLs6ribJ7D7|a|){{A2Cx0aKIJ)I& zj3D>SbU~d01mVdQ?2hxb#QWGoj^Gm}v(IVqf(|s!x6?ja>xbE*=6){i@La7QTUx#S z^x_%IH<#^r{ixw)UsJ!ANXE*2d$sA$0)B3HdRvVM*Hzr7ufX4=ujD~W_|SHjcun4g z=jp@oA%DX&m-i{kEGRGG(z9L85%&psdh-3ev+(}^1blc8e-b_m_|S%gc7`kXoW^Gr zpELNZ;Y0l9#r+ld*w2gb$4}t%Vtn}fOYqq=zgO{d3!ij(7=sxmX?=!bVajWAC+_o{ RVf!L1Bilb3f1UZ_{{tD0Lq7lj literal 0 HcmV?d00001 diff --git a/tests/iPhone5__1_9.3_13E237/references/sandbox_profiles.txt b/tests/iPhone5__1_9.3_13E237/references/sandbox_profiles.txt new file mode 100644 index 0000000..22a0812 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/sandbox_profiles.txt @@ -0,0 +1,121 @@ +AGXCompilerService +AdSheet +AirTraffic +BTServer +BlueTool +CFNetworkAgent +CVMServer +CommCenter +DataActivation +EscrowSecurityAlert +IDSCredentialsAgent +IDSRemoteURLConnectionAgent +IMDPersistenceAgent +IMRemoteURLConnectionAgent +IMTranscoderAgent +Lowtide +MTLCompilerService +MailCompositionService +MobileBackup +MobileCal +MobileMaps +MobileSlideShow +PasteBoard +SafariSafeBrowsing +ScreenshotService +StreamingUnzipService +WebSheet +accessoryd +afcd +appconduitd +apsd +assertiond +cloudphotod +com.apple.AssetCacheLocatorService +com.apple.GSSCred +com.apple.WebKit.Databases +com.apple.WebKit.Networking +com.apple.WebKit.WebContent +com.apple.assistant.assistantd +com.apple.bird +com.apple.cloudd +com.apple.datadetectors.AddToRecentsService +com.apple.homed +com.apple.nehelper +com.apple.nesessionmanager +com.apple.quicklook.QLThumbnailsService +com.apple.rtcreportingd +com.apple.sandboxd +com.apple.siri.ClientFlow.ClientScripter +com.apple.snhelper +com.apple.tccd +com.apple.tzlinkd +com.apple.ubd +container +containermanagerd +coresymbolicationd +cplogd +dataaccessd +debugserver +deleted +duetexpertd +findmydeviced +fmfd +ftp-proxy-embedded +gamed +geocorrectiond +geod +gizmoappd +gputoolsd +healthd +iapd +identityservicesd +itunesstored +keyboard +librariand +limitadtrackingd +lockdownd +lsuseractivityd +mDNSResponder +mediaanalysisd +mediaserverd +mobile-house-arrest +mobileassetd +nanomaild +nanomapscd +nanomapsgd +navd +network-filter +nfcd +nlcd +nointernet +nsurlsessiond +nsurlstoraged +online-auth-agent +passd +pfd +printd +ptpd +quicklookd +racoon +replayd +reversetemplated +revisiond +routined +seld +sharingd +social-services +softwareupdated +streaming_zip_conduit +studentd +suggestd +syncdefaultsd +syslog_relay +test-common +transitd +userfs_helper +userfsd +vibrationmanagerd +vpn-plugins +webinspectord +wifiFirmwareLoader diff --git a/tests/iPhone5__1_9.3_13E237/references/sb_ops b/tests/iPhone5__1_9.3_13E237/references/sb_ops new file mode 100644 index 0000000..053e56d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/sb_ops @@ -0,0 +1,125 @@ +default +appleevent-send +authorization-right-obtain +device* +device-camera +device-microphone +distributed-notification-post +file* +file-chroot +file-ioctl +file-issue-extension +file-link +file-map-executable +file-mknod +file-mount +file-mount-update +file-read* +file-read-data +file-read-metadata +file-read-xattr +file-revoke +file-search +file-unmount +file-write* +file-write-create +file-write-data +file-write-flags +file-write-mode +file-write-owner +file-write-setugid +file-write-times +file-write-unlink +file-write-xattr +generic-issue-extension +qtn-user +qtn-download +qtn-sandbox +hid-control +iokit* +iokit-issue-extension +iokit-open +iokit-set-properties +iokit-get-properties +ipc* +ipc-posix* +ipc-posix-issue-extension +ipc-posix-sem +ipc-posix-shm* +ipc-posix-shm-read* +ipc-posix-shm-read-data +ipc-posix-shm-read-metadata +ipc-posix-shm-write* +ipc-posix-shm-write-create +ipc-posix-shm-write-data +ipc-posix-shm-write-unlink +ipc-sysv* +ipc-sysv-msg +ipc-sysv-sem +ipc-sysv-shm +job-creation +load-unsigned-code +lsopen +mach* +mach-bootstrap +mach-cross-domain-lookup +mach-host* +mach-host-exception-port-set +mach-host-special-port-set +mach-issue-extension +mach-lookup +mach-per-user-lookup +mach-priv* +mach-priv-host-port +mach-priv-task-port +mach-register +mach-task-name +network* +network-inbound +network-bind +network-outbound +nvram* +nvram-delete +nvram-get +nvram-set +user-preference* +user-preference-read +user-preference-write +process* +process-exec* +process-exec-interpreter +process-fork +process-info* +process-info-listpids +process-info-pidinfo +process-info-pidfdinfo +process-info-pidfileportinfo +process-info-setcontrol +process-info-dirtycontrol +process-info-rusage +pseudo-tty +signal +sysctl* +sysctl-read +sysctl-write +system* +system-acct +system-audit +system-chud +system-debug +system-fsctl +system-info +system-kext* +system-kext-load +system-kext-unload +system-kext-query +system-mac-label +system-nfssvc +system-privilege +system-reboot +system-sched +system-set-time +system-socket +system-suspend-resume +system-swap +system-write-bootstrap diff --git a/tests/test.py b/tests/test.py new file mode 100755 index 0000000..131f571 --- /dev/null +++ b/tests/test.py @@ -0,0 +1,278 @@ +#!/usr/bin/env python3 + +import os +import pathlib +import subprocess +from datetime import datetime + +DIRNAME = os.path.dirname(os.path.abspath(__file__)) +MAINDIR = os.path.dirname(DIRNAME) + + +def compare_directories(actual: pathlib.Path, expected: pathlib.Path, log_file): + actual_files = sorted( + f.relative_to(actual) for f in actual.rglob("*") if f.is_file() + ) + expected_files = sorted( + f.relative_to(expected) for f in expected.rglob("*") if f.is_file() + ) + + assert actual_files == expected_files, "Mismatch in file names/structure" + + for rel_path in actual_files: + # skip sb files as they are checked separately + if rel_path.suffix == ".sb": + continue + + else: + actual_content = (actual / rel_path).read_bytes() + expected_content = (expected / rel_path).read_bytes() + assert actual_content == expected_content, f"Mismatch in file: {rel_path}" + + parser_proc = subprocess.run( + [ + os.path.join(MAINDIR, "sb_parser", "parser"), + (actual / "rev_profiles"), + (expected / "rev_profiles"), + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + assert parser_proc.returncode == 0, "Mismatch in sb files" + + +def build_image(): + name = f'sandblaster_{datetime.now().strftime("%d_%m_%Y__%H_%M_%S")}' + + log_path = os.path.join(DIRNAME, "build_logs", f"{name}.log") + log_file = open(log_path, "w") + + docker_build_process = subprocess.run( + ["docker", "build", "-t", name, MAINDIR], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + if docker_build_process.returncode != 0: + print( + f"[ERROR] Docker build failed, check build_logs/{name}.log for more details :(" + ) + return 1 + + print(f"[INFO] Docker build {name} successful") + return name + + +def remove_image(container_name): + print(f"[INFO] Removing container {container_name}") + + subprocess.run(["docker", "rmi", "-f", container_name]) + + +def start_run(container_name, test_name): + run_name = f"run_{container_name}_{test_name}" + + test_path = os.path.join(DIRNAME, test_name) + + run_process = subprocess.run( + [ + "docker", + "run", + "-v", + f"{test_path}:/test", + "--rm", + "-dit", + "--name", + run_name, + container_name, + ], + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + ) + + print(f"[INFO] Run ID: {run_process.stdout}") + + return run_name + + +def stop_run(run_name): + stop_process = subprocess.run( + ["docker", "stop", run_name], stdout=subprocess.PIPE, stderr=subprocess.STDOUT + ) + + print(f"[INFO] Stopped run {stop_process.stdout}") + + +def generic_test( + container_name, test_name, ios_major_version, ios_version, update_refs=False +): + print(f"[INFO] Running sandblaster test {test_name} (iOS v{ios_major_version})...") + + run_name = start_run(container_name, test_name) + + log_path = os.path.join(DIRNAME, test_name, "logs", f"{run_name}.log") + log_file = open(log_path, "a") + + subprocess.run( + ["docker", "exec", run_name, "rm", "-rf", "/test/outputs"], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + ["docker", "exec", run_name, "mkdir", "/test/outputs"], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + [ + "docker", + "exec", + run_name, + "/sandblaster/helpers/extract_sandbox_data.py", + "-o", + "/test/outputs/sb_ops", + "/test/inputs/sandbox.kext", + ios_version, + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + if ios_major_version >= 9: + subprocess.run( + [ + "docker", + "exec", + run_name, + "/sandblaster/helpers/extract_sandbox_data.py", + "-O", + "/test/outputs", + "/test/inputs/sandbox.kext", + ios_version, + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + else: + subprocess.run( + ["docker", "exec", run_name, "mkdir", "-p", "/test/outputs/sb_profiles"], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + [ + "docker", + "exec", + run_name, + "/sandblaster/helpers/extract_sandbox_data.py", + "-O", + "/test/outputs/sb_profiles", + "/test/inputs/sandboxd", + ios_version, + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + ["docker", "exec", run_name, "mkdir", "/test/outputs/rev_profiles"], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + if ios_major_version >= 9: + subprocess.run( + [ + "docker", + "exec", + run_name, + "sh", + "-c", + f"cd /sandblaster/reverse-sandbox/ && python2.7 reverse_sandbox.py -r {ios_version} " + + "-o /test/outputs/sb_ops -d /test/outputs/rev_profiles/ /test/outputs/sandbox_bundle " + + "-psb > /test/outputs/sandbox_profiles.txt", + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + [ + "docker", + "exec", + run_name, + "sh", + "-c", + f"cd /sandblaster/reverse-sandbox/ && python2.7 reverse_sandbox.py -r {ios_version} " + + "-o /test/outputs/sb_ops -d /test/outputs/rev_profiles/ /test/outputs/sandbox_bundle", + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + else: + subprocess.run( + [ + "docker", + "exec", + run_name, + "sh", + "-c", + "cd /sandblaster/reverse-sandbox/ && for i in /test/outputs/sb_profiles/*; do " + + f"python2.7 reverse_sandbox.py -r {ios_version} -o /test/outputs/sb_ops -d " + + '/test/outputs/rev_profiles/ "$i"; done', + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + if update_refs: + subprocess.run( + ["docker", "exec", run_name, "rm", "-rf", "/test/references"], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + [ + "docker", + "exec", + run_name, + "cp", + "-r", + "/test/outputs", + "/test/references", + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + return + + print(f"[INFO] {test_name}: comparing results...") + + output_dir = pathlib.Path(DIRNAME, test_name, "outputs") + reference_dir = pathlib.Path(DIRNAME, test_name, "references") + + try: + compare_directories(output_dir, reference_dir, log_file) + + print(f"[PASS] {test_name} :)") + except AssertionError as err: + print(f"[FAIL] {test_name} - {err}") + + stop_run(run_name) + + +def main(): + container_name = build_image() + + generic_test(container_name, "iPhone5__1_9.3_13E237", 9, ios_version="9.3") + + remove_image(container_name) + + +main() From 946444aec19acee82bc41e9f18c354238e063a48 Mon Sep 17 00:00:00 2001 From: CristiMacovei Date: Mon, 8 Sep 2025 20:22:48 +0300 Subject: [PATCH 2/4] Add test for iOS v8 Introduce a new test to ensure correct functionality on iOS 8.4 (12H321) Signed-off-by: CristiMacovei --- .gitignore | 1 + .../iPad2__1_8.4.1_12H321/inputs/sandbox.kext | Bin 0 -> 73728 bytes tests/iPad2__1_8.4.1_12H321/inputs/sandboxd | Bin 0 -> 1116096 bytes tests/iPad2__1_8.4.1_12H321/logs/.dummy | 0 .../references/rev_profiles/AdSheet.sb | 1102 +++++++ .../references/rev_profiles/AdSheet.sb.xml | 33 + .../references/rev_profiles/AirTraffic.sb | 86 + .../references/rev_profiles/AirTraffic.sb.xml | 23 + .../references/rev_profiles/AppleDiags.sb | 584 ++++ .../references/rev_profiles/AppleDiags.sb.xml | 45 + .../references/rev_profiles/Aquarium.sb | 587 ++++ .../references/rev_profiles/Aquarium.sb.xml | 38 + .../references/rev_profiles/BTServer.sb | 431 +++ .../references/rev_profiles/BTServer.sb.xml | 33 + .../references/rev_profiles/BlueTool.sb | 267 ++ .../references/rev_profiles/BlueTool.sb.xml | 33 + .../references/rev_profiles/CFNetworkAgent.sb | 241 ++ .../rev_profiles/CFNetworkAgent.sb.xml | 34 + .../references/rev_profiles/CVMServer.sb | 239 ++ .../references/rev_profiles/CVMServer.sb.xml | 33 + .../references/rev_profiles/CommCenter.sb | 293 ++ .../references/rev_profiles/CommCenter.sb.xml | 37 + .../references/rev_profiles/DataActivation.sb | 585 ++++ .../rev_profiles/DataActivation.sb.xml | 35 + .../rev_profiles/EscrowSecurityAlert.sb | 240 ++ .../rev_profiles/EscrowSecurityAlert.sb.xml | 33 + .../rev_profiles/IMDPersistenceAgent.sb | 253 ++ .../rev_profiles/IMDPersistenceAgent.sb.xml | 33 + .../references/rev_profiles/Lowtide.sb | 929 ++++++ .../references/rev_profiles/Lowtide.sb.xml | 37 + .../rev_profiles/MTLCompilerService.sb | 231 ++ .../rev_profiles/MTLCompilerService.sb.xml | 33 + .../rev_profiles/MailCompositionService.sb | 883 +++++ .../MailCompositionService.sb.xml | 34 + .../references/rev_profiles/MobileBackup.sb | 26 + .../rev_profiles/MobileBackup.sb.xml | 21 + .../references/rev_profiles/MobileCal.sb | 599 ++++ .../references/rev_profiles/MobileCal.sb.xml | 35 + .../references/rev_profiles/MobileMaps.sb | 686 ++++ .../references/rev_profiles/MobileMaps.sb.xml | 35 + .../references/rev_profiles/MobileSMS.sb | 565 ++++ .../references/rev_profiles/MobileSMS.sb.xml | 36 + .../rev_profiles/MobileSlideShow.sb | 786 +++++ .../rev_profiles/MobileSlideShow.sb.xml | 37 + .../references/rev_profiles/PasteBoard.sb | 194 ++ .../references/rev_profiles/PasteBoard.sb.xml | 44 + .../references/rev_profiles/Stocks.sb | 519 +++ .../references/rev_profiles/Stocks.sb.xml | 36 + .../rev_profiles/StreamingUnzipService.sb | 236 ++ .../rev_profiles/StreamingUnzipService.sb.xml | 33 + .../references/rev_profiles/WebSheet.sb | 839 +++++ .../references/rev_profiles/WebSheet.sb.xml | 34 + .../references/rev_profiles/accessoryd.sb | 204 ++ .../references/rev_profiles/accessoryd.sb.xml | 36 + .../references/rev_profiles/afcd.sb | 280 ++ .../references/rev_profiles/afcd.sb.xml | 33 + .../references/rev_profiles/apsd.sb | 257 ++ .../references/rev_profiles/apsd.sb.xml | 37 + .../references/rev_profiles/cloudphotod.sb | 14 + .../rev_profiles/cloudphotod.sb.xml | 30 + .../com.apple.AssetCacheLocatorService.sb | 305 ++ .../com.apple.AssetCacheLocatorService.sb.xml | 33 + .../rev_profiles/com.apple.GSSCred.sb | 230 ++ .../rev_profiles/com.apple.GSSCred.sb.xml | 33 + .../com.apple.WebKit.Databases.sb | 212 ++ .../com.apple.WebKit.Databases.sb.xml | 35 + .../com.apple.WebKit.Networking.sb | 263 ++ .../com.apple.WebKit.Networking.sb.xml | 35 + .../com.apple.WebKit.WebContent.sb | 555 ++++ .../com.apple.WebKit.WebContent.sb.xml | 35 + .../com.apple.assistant.assistantd.sb | 468 +++ .../com.apple.assistant.assistantd.sb.xml | 33 + .../references/rev_profiles/com.apple.bird.sb | 427 +++ .../rev_profiles/com.apple.bird.sb.xml | 35 + .../rev_profiles/com.apple.cloudd.sb | 426 +++ .../rev_profiles/com.apple.cloudd.sb.xml | 33 + ...apple.datadetectors.AddToRecentsService.sb | 243 ++ ...e.datadetectors.AddToRecentsService.sb.xml | 33 + .../rev_profiles/com.apple.discoveryd.sb | 270 ++ .../rev_profiles/com.apple.discoveryd.sb.xml | 34 + .../rev_profiles/com.apple.homed.sb | 462 +++ .../rev_profiles/com.apple.homed.sb.xml | 33 + .../rev_profiles/com.apple.nehelper.sb | 332 ++ .../rev_profiles/com.apple.nehelper.sb.xml | 34 + .../com.apple.nesessionmanager.sb | 284 ++ .../com.apple.nesessionmanager.sb.xml | 36 + ...com.apple.quicklook.QLThumbnailsService.sb | 264 ++ ...apple.quicklook.QLThumbnailsService.sb.xml | 33 + .../rev_profiles/com.apple.rtcreportingd.sb | 334 ++ .../com.apple.rtcreportingd.sb.xml | 33 + .../rev_profiles/com.apple.sandboxd.sb | 66 + .../rev_profiles/com.apple.sandboxd.sb.xml | 36 + .../rev_profiles/com.apple.snhelper.sb | 230 ++ .../rev_profiles/com.apple.snhelper.sb.xml | 33 + .../references/rev_profiles/com.apple.tccd.sb | 53 + .../rev_profiles/com.apple.tccd.sb.xml | 37 + .../rev_profiles/com.apple.tzlinkd.sb | 233 ++ .../rev_profiles/com.apple.tzlinkd.sb.xml | 33 + .../references/rev_profiles/com.apple.ubd.sb | 363 +++ .../rev_profiles/com.apple.ubd.sb.xml | 36 + .../references/rev_profiles/com.apple.xpcd.sb | 239 ++ .../rev_profiles/com.apple.xpcd.sb.xml | 34 + .../references/rev_profiles/container.sb | 2831 +++++++++++++++++ .../references/rev_profiles/container.sb.xml | 24 + .../rev_profiles/coresymbolicationd.sb | 63 + .../rev_profiles/coresymbolicationd.sb.xml | 32 + .../references/rev_profiles/cplogd.sb | 217 ++ .../references/rev_profiles/cplogd.sb.xml | 34 + .../references/rev_profiles/dataaccessd.sb | 372 +++ .../rev_profiles/dataaccessd.sb.xml | 38 + .../references/rev_profiles/debugserver.sb | 227 ++ .../rev_profiles/debugserver.sb.xml | 38 + .../references/rev_profiles/deleted.sb | 239 ++ .../references/rev_profiles/deleted.sb.xml | 33 + .../references/rev_profiles/fmfd.sb | 408 +++ .../references/rev_profiles/fmfd.sb.xml | 33 + .../rev_profiles/ftp-proxy-embedded.sb | 268 ++ .../rev_profiles/ftp-proxy-embedded.sb.xml | 33 + .../references/rev_profiles/gamed.sb | 393 +++ .../references/rev_profiles/gamed.sb.xml | 34 + .../references/rev_profiles/geocorrectiond.sb | 14 + .../rev_profiles/geocorrectiond.sb.xml | 30 + .../references/rev_profiles/geod.sb | 332 ++ .../references/rev_profiles/geod.sb.xml | 34 + .../references/rev_profiles/gizmoappd.sb | 293 ++ .../references/rev_profiles/gizmoappd.sb.xml | 33 + .../references/rev_profiles/gputoolsd.sb | 279 ++ .../references/rev_profiles/gputoolsd.sb.xml | 42 + .../references/rev_profiles/healthd.sb | 408 +++ .../references/rev_profiles/healthd.sb.xml | 33 + .../references/rev_profiles/iapd.sb | 343 ++ .../references/rev_profiles/iapd.sb.xml | 37 + .../references/rev_profiles/keyboard.sb | 327 ++ .../references/rev_profiles/keyboard.sb.xml | 25 + .../references/rev_profiles/librariand.sb | 242 ++ .../references/rev_profiles/librariand.sb.xml | 34 + .../rev_profiles/limitadtrackingd.sb | 216 ++ .../rev_profiles/limitadtrackingd.sb.xml | 34 + .../references/rev_profiles/lockdownd.sb | 332 ++ .../references/rev_profiles/lockdownd.sb.xml | 34 + .../references/rev_profiles/mDNSResponder.sb | 129 + .../rev_profiles/mDNSResponder.sb.xml | 42 + .../references/rev_profiles/mediaserverd.sb | 592 ++++ .../rev_profiles/mediaserverd.sb.xml | 36 + .../rev_profiles/mobile-house-arrest.sb | 299 ++ .../rev_profiles/mobile-house-arrest.sb.xml | 33 + .../references/rev_profiles/mobileassetd.sb | 358 +++ .../rev_profiles/mobileassetd.sb.xml | 35 + .../references/rev_profiles/nanomaild.sb | 286 ++ .../references/rev_profiles/nanomaild.sb.xml | 33 + .../references/rev_profiles/nanomapscd.sb | 403 +++ .../references/rev_profiles/nanomapscd.sb.xml | 33 + .../references/rev_profiles/nanomapsgd.sb | 363 +++ .../references/rev_profiles/nanomapsgd.sb.xml | 33 + .../references/rev_profiles/nfcd.sb | 276 ++ .../references/rev_profiles/nfcd.sb.xml | 33 + .../references/rev_profiles/nlcd.sb | 229 ++ .../references/rev_profiles/nlcd.sb.xml | 34 + .../references/rev_profiles/nointernet.sb | 19 + .../references/rev_profiles/nointernet.sb.xml | 20 + .../references/rev_profiles/nsurlsessiond.sb | 375 +++ .../rev_profiles/nsurlsessiond.sb.xml | 33 + .../references/rev_profiles/nsurlstoraged.sb | 254 ++ .../rev_profiles/nsurlstoraged.sb.xml | 34 + .../references/rev_profiles/passd.sb | 501 +++ .../references/rev_profiles/passd.sb.xml | 35 + .../references/rev_profiles/pfd.sb | 232 ++ .../references/rev_profiles/pfd.sb.xml | 33 + .../references/rev_profiles/printd.sb | 301 ++ .../references/rev_profiles/printd.sb.xml | 34 + .../references/rev_profiles/ptpd.sb | 232 ++ .../references/rev_profiles/ptpd.sb.xml | 36 + .../references/rev_profiles/quicklookd.sb | 855 +++++ .../references/rev_profiles/quicklookd.sb.xml | 34 + .../references/rev_profiles/racoon.sb | 142 + .../references/rev_profiles/racoon.sb.xml | 35 + .../rev_profiles/reversetemplated.sb | 238 ++ .../rev_profiles/reversetemplated.sb.xml | 33 + .../references/rev_profiles/revisiond.sb | 245 ++ .../references/rev_profiles/revisiond.sb.xml | 34 + .../references/rev_profiles/routined.sb | 405 +++ .../references/rev_profiles/routined.sb.xml | 35 + .../references/rev_profiles/seld.sb | 368 +++ .../references/rev_profiles/seld.sb.xml | 33 + .../references/rev_profiles/sharingd.sb | 14 + .../references/rev_profiles/sharingd.sb.xml | 30 + .../rev_profiles/softwareupdated.sb | 289 ++ .../rev_profiles/softwareupdated.sb.xml | 33 + .../rev_profiles/streaming_zip_conduit.sb | 276 ++ .../rev_profiles/streaming_zip_conduit.sb.xml | 33 + .../references/rev_profiles/suggestd.sb | 293 ++ .../references/rev_profiles/suggestd.sb.xml | 33 + .../references/rev_profiles/syncdefaultsd.sb | 291 ++ .../rev_profiles/syncdefaultsd.sb.xml | 37 + .../references/rev_profiles/transitd.sb | 224 ++ .../references/rev_profiles/transitd.sb.xml | 33 + .../references/rev_profiles/userfs_helper.sb | 262 ++ .../rev_profiles/userfs_helper.sb.xml | 33 + .../references/rev_profiles/userfsd.sb | 267 ++ .../references/rev_profiles/userfsd.sb.xml | 34 + .../rev_profiles/vibrationmanagerd.sb | 271 ++ .../rev_profiles/vibrationmanagerd.sb.xml | 33 + .../references/rev_profiles/vpn-plugins.sb | 280 ++ .../rev_profiles/vpn-plugins.sb.xml | 43 + .../references/rev_profiles/webinspectord.sb | 243 ++ .../rev_profiles/webinspectord.sb.xml | 33 + .../rev_profiles/wifiFirmwareLoader.sb | 216 ++ .../rev_profiles/wifiFirmwareLoader.sb.xml | 34 + tests/iPad2__1_8.4.1_12H321/references/sb_ops | 114 + .../references/sb_profiles/AdSheet.sb.bin | Bin 0 -> 37573 bytes .../references/sb_profiles/AirTraffic.sb.bin | Bin 0 -> 6069 bytes .../references/sb_profiles/AppleDiags.sb.bin | Bin 0 -> 17677 bytes .../references/sb_profiles/Aquarium.sb.bin | Bin 0 -> 17981 bytes .../references/sb_profiles/BTServer.sb.bin | Bin 0 -> 14053 bytes .../references/sb_profiles/BlueTool.sb.bin | Bin 0 -> 6693 bytes .../sb_profiles/CFNetworkAgent.sb.bin | Bin 0 -> 6205 bytes .../references/sb_profiles/CVMServer.sb.bin | Bin 0 -> 5389 bytes .../references/sb_profiles/CommCenter.sb.bin | Bin 0 -> 8813 bytes .../sb_profiles/DataActivation.sb.bin | Bin 0 -> 22277 bytes .../sb_profiles/EscrowSecurityAlert.sb.bin | Bin 0 -> 5373 bytes .../sb_profiles/IMDPersistenceAgent.sb.bin | Bin 0 -> 6325 bytes .../references/sb_profiles/Lowtide.sb.bin | Bin 0 -> 35453 bytes .../sb_profiles/MTLCompilerService.sb.bin | Bin 0 -> 5213 bytes .../sb_profiles/MailCompositionService.sb.bin | Bin 0 -> 30901 bytes .../sb_profiles/MobileBackup.sb.bin | Bin 0 -> 920 bytes .../references/sb_profiles/MobileCal.sb.bin | Bin 0 -> 21909 bytes .../references/sb_profiles/MobileMaps.sb.bin | Bin 0 -> 25997 bytes .../references/sb_profiles/MobileSMS.sb.bin | Bin 0 -> 19669 bytes .../sb_profiles/MobileSlideShow.sb.bin | Bin 0 -> 28901 bytes .../references/sb_profiles/PasteBoard.sb.bin | Bin 0 -> 3525 bytes .../references/sb_profiles/Stocks.sb.bin | Bin 0 -> 17981 bytes .../sb_profiles/StreamingUnzipService.sb.bin | Bin 0 -> 5533 bytes .../references/sb_profiles/WebSheet.sb.bin | Bin 0 -> 28765 bytes .../references/sb_profiles/accessoryd.sb.bin | Bin 0 -> 4141 bytes .../references/sb_profiles/afcd.sb.bin | Bin 0 -> 6637 bytes .../references/sb_profiles/apsd.sb.bin | Bin 0 -> 7029 bytes .../references/sb_profiles/cloudphotod.sb.bin | Bin 0 -> 264 bytes .../com.apple.AssetCacheLocatorService.sb.bin | Bin 0 -> 7461 bytes .../sb_profiles/com.apple.GSSCred.sb.bin | Bin 0 -> 5197 bytes .../com.apple.WebKit.Databases.sb.bin | Bin 0 -> 4901 bytes .../com.apple.WebKit.Networking.sb.bin | Bin 0 -> 6869 bytes .../com.apple.WebKit.WebContent.sb.bin | Bin 0 -> 19429 bytes .../com.apple.assistant.assistantd.sb.bin | Bin 0 -> 17077 bytes .../sb_profiles/com.apple.bird.sb.bin | Bin 0 -> 12213 bytes .../sb_profiles/com.apple.cloudd.sb.bin | Bin 0 -> 14557 bytes ...e.datadetectors.AddToRecentsService.sb.bin | Bin 0 -> 6357 bytes .../sb_profiles/com.apple.discoveryd.sb.bin | Bin 0 -> 7181 bytes .../sb_profiles/com.apple.homed.sb.bin | Bin 0 -> 13605 bytes .../sb_profiles/com.apple.nehelper.sb.bin | Bin 0 -> 9165 bytes .../com.apple.nesessionmanager.sb.bin | Bin 0 -> 7637 bytes ...apple.quicklook.QLThumbnailsService.sb.bin | Bin 0 -> 6285 bytes .../com.apple.rtcreportingd.sb.bin | Bin 0 -> 8965 bytes .../sb_profiles/com.apple.sandboxd.sb.bin | Bin 0 -> 1666 bytes .../sb_profiles/com.apple.snhelper.sb.bin | Bin 0 -> 5157 bytes .../sb_profiles/com.apple.tccd.sb.bin | Bin 0 -> 1607 bytes .../sb_profiles/com.apple.tzlinkd.sb.bin | Bin 0 -> 5141 bytes .../sb_profiles/com.apple.ubd.sb.bin | Bin 0 -> 11741 bytes .../sb_profiles/com.apple.xpcd.sb.bin | Bin 0 -> 5469 bytes .../references/sb_profiles/container.sb.bin | Bin 0 -> 54225 bytes .../sb_profiles/coresymbolicationd.sb.bin | Bin 0 -> 1439 bytes .../references/sb_profiles/cplogd.sb.bin | Bin 0 -> 5085 bytes .../references/sb_profiles/dataaccessd.sb.bin | Bin 0 -> 11090 bytes .../references/sb_profiles/debugserver.sb.bin | Bin 0 -> 4813 bytes .../references/sb_profiles/deleted.sb.bin | Bin 0 -> 5733 bytes .../references/sb_profiles/fmfd.sb.bin | Bin 0 -> 12749 bytes .../sb_profiles/ftp-proxy-embedded.sb.bin | Bin 0 -> 6725 bytes .../references/sb_profiles/gamed.sb.bin | Bin 0 -> 13597 bytes .../sb_profiles/geocorrectiond.sb.bin | Bin 0 -> 264 bytes .../references/sb_profiles/geod.sb.bin | Bin 0 -> 9733 bytes .../references/sb_profiles/gizmoappd.sb.bin | Bin 0 -> 7725 bytes .../references/sb_profiles/gputoolsd.sb.bin | Bin 0 -> 6341 bytes .../references/sb_profiles/healthd.sb.bin | Bin 0 -> 14597 bytes .../references/sb_profiles/iapd.sb.bin | Bin 0 -> 12045 bytes .../references/sb_profiles/keyboard.sb.bin | Bin 0 -> 10493 bytes .../references/sb_profiles/librariand.sb.bin | Bin 0 -> 6461 bytes .../sb_profiles/limitadtrackingd.sb.bin | Bin 0 -> 5205 bytes .../references/sb_profiles/lockdownd.sb.bin | Bin 0 -> 9381 bytes .../sb_profiles/mDNSResponder.sb.bin | Bin 0 -> 4090 bytes .../sb_profiles/mediaserverd.sb.bin | Bin 0 -> 23021 bytes .../sb_profiles/mobile-house-arrest.sb.bin | Bin 0 -> 8421 bytes .../sb_profiles/mobileassetd.sb.bin | Bin 0 -> 10002 bytes .../references/sb_profiles/nanomaild.sb.bin | Bin 0 -> 7637 bytes .../references/sb_profiles/nanomapscd.sb.bin | Bin 0 -> 13237 bytes .../references/sb_profiles/nanomapsgd.sb.bin | Bin 0 -> 11469 bytes .../references/sb_profiles/nfcd.sb.bin | Bin 0 -> 7341 bytes .../references/sb_profiles/nlcd.sb.bin | Bin 0 -> 5117 bytes .../references/sb_profiles/nointernet.sb.bin | Bin 0 -> 864 bytes .../sb_profiles/nsurlsessiond.sb.bin | Bin 0 -> 10581 bytes .../sb_profiles/nsurlstoraged.sb.bin | Bin 0 -> 6565 bytes .../references/sb_profiles/passd.sb.bin | Bin 0 -> 15309 bytes .../references/sb_profiles/pfd.sb.bin | Bin 0 -> 5133 bytes .../references/sb_profiles/printd.sb.bin | Bin 0 -> 8461 bytes .../references/sb_profiles/ptpd.sb.bin | Bin 0 -> 5237 bytes .../references/sb_profiles/quicklookd.sb.bin | Bin 0 -> 29405 bytes .../references/sb_profiles/racoon.sb.bin | Bin 0 -> 3034 bytes .../sb_profiles/reversetemplated.sb.bin | Bin 0 -> 5653 bytes .../references/sb_profiles/revisiond.sb.bin | Bin 0 -> 5386 bytes .../references/sb_profiles/routined.sb.bin | Bin 0 -> 12629 bytes .../references/sb_profiles/seld.sb.bin | Bin 0 -> 11429 bytes .../references/sb_profiles/sharingd.sb.bin | Bin 0 -> 264 bytes .../sb_profiles/softwareupdated.sb.bin | Bin 0 -> 7477 bytes .../sb_profiles/streaming_zip_conduit.sb.bin | Bin 0 -> 5845 bytes .../references/sb_profiles/suggestd.sb.bin | Bin 0 -> 8349 bytes .../sb_profiles/syncdefaultsd.sb.bin | Bin 0 -> 7501 bytes .../references/sb_profiles/transitd.sb.bin | Bin 0 -> 5333 bytes .../sb_profiles/userfs_helper.sb.bin | Bin 0 -> 5957 bytes .../references/sb_profiles/userfsd.sb.bin | Bin 0 -> 5869 bytes .../sb_profiles/vibrationmanagerd.sb.bin | Bin 0 -> 7005 bytes .../references/sb_profiles/vpn-plugins.sb.bin | Bin 0 -> 7589 bytes .../sb_profiles/webinspectord.sb.bin | Bin 0 -> 5829 bytes .../sb_profiles/wifiFirmwareLoader.sb.bin | Bin 0 -> 5141 bytes tests/test.py | 2 + 312 files changed, 39827 insertions(+) create mode 100644 tests/iPad2__1_8.4.1_12H321/inputs/sandbox.kext create mode 100755 tests/iPad2__1_8.4.1_12H321/inputs/sandboxd create mode 100644 tests/iPad2__1_8.4.1_12H321/logs/.dummy create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb create mode 100644 tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb.xml create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_ops create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AdSheet.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AirTraffic.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AppleDiags.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Aquarium.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BTServer.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BlueTool.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CFNetworkAgent.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CVMServer.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CommCenter.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/DataActivation.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/EscrowSecurityAlert.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/IMDPersistenceAgent.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Lowtide.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MTLCompilerService.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MailCompositionService.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileBackup.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileCal.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileMaps.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileSMS.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileSlideShow.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/PasteBoard.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Stocks.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/StreamingUnzipService.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/WebSheet.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/accessoryd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/afcd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/apsd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cloudphotod.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.AssetCacheLocatorService.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.GSSCred.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Databases.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Networking.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.WebContent.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.assistant.assistantd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.bird.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.cloudd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.datadetectors.AddToRecentsService.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.discoveryd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.homed.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nehelper.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nesessionmanager.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.quicklook.QLThumbnailsService.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.rtcreportingd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.sandboxd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.snhelper.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.tccd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.tzlinkd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.ubd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.xpcd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/container.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/coresymbolicationd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cplogd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/dataaccessd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/debugserver.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/deleted.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/fmfd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/ftp-proxy-embedded.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gamed.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geocorrectiond.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geod.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gizmoappd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gputoolsd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/healthd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/iapd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/keyboard.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/librariand.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/limitadtrackingd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/lockdownd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mDNSResponder.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mediaserverd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mobile-house-arrest.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mobileassetd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomaild.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapscd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapsgd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nfcd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nlcd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nointernet.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlsessiond.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlstoraged.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/passd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/pfd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/printd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/ptpd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/quicklookd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/racoon.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/reversetemplated.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/revisiond.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/routined.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/seld.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/sharingd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/softwareupdated.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/streaming_zip_conduit.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/suggestd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/syncdefaultsd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/transitd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/userfs_helper.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/userfsd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/vibrationmanagerd.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/vpn-plugins.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/webinspectord.sb.bin create mode 100644 tests/iPad2__1_8.4.1_12H321/references/sb_profiles/wifiFirmwareLoader.sb.bin diff --git a/.gitignore b/.gitignore index c952d3c..98efb4c 100644 --- a/.gitignore +++ b/.gitignore @@ -20,5 +20,6 @@ TAGS *.pyc *.log *.bin +!tests/**/*.bin core .DS_STORE diff --git a/tests/iPad2__1_8.4.1_12H321/inputs/sandbox.kext b/tests/iPad2__1_8.4.1_12H321/inputs/sandbox.kext new file mode 100644 index 0000000000000000000000000000000000000000..659ad9544dfd7e9c9b54cb821b2385c1f3dff309 GIT binary patch literal 73728 zcmeFa4R}<=^#?rn?%mCPCD|kp0tUFd`EUavEQpGVx(Um5g9rgpK~ch&F5jrM4OnFp zKq-oDAfy{0G-$N}L=w=J@L|xlmSSmlfwpM1U9bwm-#V*cZa(+@&Am6_BlQ2)qVMy( z&-2goOlI%BbLY&QIdkTmGiT2IW6KvERzipg$%14+TA?F^L(Y;H|E5lzIBL>FTy*}0 z4*N+&yFjkTPnHDj*3_wsXO%40E|6XM{))dI_Iq{%P8=cp#bT@if9K`YsZTEc!Sv3n z?sXhm{l32rjXt#Zf2(80lZ&62z2Gsenk(B;Qt`h3(LRKf{N^GY_UqC%O`SSp;esbG zcIL`DB5%C!?*kk~{!R$ccGW+I#}^bldh#dcUs9y*eLoR#9YI3Q-e-y7lKoAcx?tYa zCzs5hzHr{uMT?)nb@%sAu*OC%Z!>$h^RIjRFR$aoF5nSBPn`PS>Xfb^4P}UUq$X zJ8DqJLG5`bEwal?>tMf!BTbz;rf}@tqdbM3bRE*hf|V98js=P;e{60PX}_;6OJ9C(0`zDV>f-Okdwc$CO(HAtkA zE+Ev@CP+i10g{znN}N(Oqk!-@aD>&U|0{|R$9nesjj_rJ#&%_UEJ za(ou*Xgwj1AjFy0XrZsSoRGc5KtR& zKi1yOlTUo!D`P`}{sW^o+=ncf{>Ne1oZ?oU@KqN}Y5BIBh9P~Mf zkH?s7lmfs^o-9b2`~D)68j_hZ+9@^o4$Ch0QqN&|n9UO9I0OB-{jiMn$7v1aOAi98 z_qKk>u4Rk+usovfu%U}`udh-v>+L!BKuMgx6?p> z)lQsZvCwE00|&;@*pU2UqsxgAD{UsYLmG2_f3b}TlAyFP*7Q;AU_+K~9OcZ`(Jm=p zTI%`j=hp28`j__F8N?}sEHtU@%nTyxBMk4B4kC)hRHNwR_-K=YWvB)3x8Km)?AwsY~$}gTQ z#hPx2F=#>~$rLI`#G0uK8t6~kgkY@67GteTZ)7<6OA8lNxyqK-2ZBR<#y&z=lqS`w zGr>$>i{<_0B2HG+9q_G{blWh>>z)T@h<%`>11_EfhvoBJ;h+q$E|cV37jjGb$nSRz z&M`I$l1=9NC(&5qH(`=%3wcH*W1Mu`#6@m!-hpVtM7%v%6lBhl7~!)=MsmC!sl=m; zIK9RwC*apMwVWH}66#6j(1@dO+A?+YC}=1Gmj7O_oe_R?Hwh(!j8g)_7PZZc;_Ed)MoN#$sKiDUvI35t3=m z)@hjO(V8VOE+J#B5H!q?#-6_=WZCMlJjq!hM+H?U*|XBT3>NJ$rdDWuGmmBHy`(_nv3d1U$#V? zUx(R94v~4rzx4Eg=p%Vt$W=@twZ-g7rYwRUdVojR(wBAYMg4AQT5ETuaovm2+ zpCO3_eWWuagACN@$(bA$X9w$tdP_Vc+C%Te%6TN_@)2i3$fx+Vrh4x*K4LFi;xQJpdg^1W^r5!Ch2m_s#t&&0cVFkt z@|AcDKCCT%H(LI?W)7IQ&|_?M_8tG6Y`4$@xMx0R!TNTvnU~y<0!W619&X0d43{rS z>Vxv@n#I`$Dz>s&{+7b4NW8kbrS5z193dZ_g&p9Rg#6|x8#@8A2FdLgN*eo&#}E~j zUY5n`eXM%tN1%TqD*5$hOR!xp1%CNFS%RCxhwh+Z$P z27UGkC5-v8hvD0WcM4-$eC*v>$o=T$1pIz1#-5CcxfyQtti`dW-|kaKH5v7Gj@$A& zzckjHfLYQxDtzp2jFI45E|JL0*?a}0n2^{^#K9uL>s7X?; zE${dnlct>gFk^cV_WPimR^yc32X8gg)g5kWJYIknVkx5OWv_dFLEXkWvcEq)c%MC3jKg;p#7Q|=f)c5Hitwh8@0|*_?sSApyy^+#F~{C;Y4Eh$fAvN znVl`+USmnttJA?r$TOZHzM-?tG^wLPz7?QlvI6<1GXzMAug+AT={h*^)mguhr_}sL zF0LtlRERDjuRi+eqw3S+?VmoT%x>@!(s;O@kh;@qADHa>a-BiC#k&f$C-_94JwQY= zeI>@Qbbm;{{ot2HL>Db4L!=Q7ck@eTU9^a(xm(L!S}tn2P02ZNBucN5dy+MBD$&&% z=$Ea!;3VKxuoDNyH^xc!`o7)*z%|nu9bBz``w%JLVW59&<$|^KW*TjqD>3Qw31Omo^uW7?kx z*^2(>>>?x^sqQU)=g;a&C5M;w^RKe;Ah3|5_c?w20(>or77HHqf<%k7+^yvF96TNw8nl0N?mN zLSz5Bx&vnV*H+S){6|7|9VW#8)0q4hrJo_o^a^j-90&f{5ZfC6N@pb|8XGJr~O>5-9 z-ndO8p%0 z$Vt5vJhEQ;9E_U!1sLso8@lmHjBa%FCIvSR4L1SwwGg=Z!yi;xmci<+z>1F=O(mY` z8Z?sz&7@JODXLPbDXLPb30#x4#uQblR1gbsl@RbriRNxU+&7z}kcY_>mA&vj@ zzB*5TR;QQxVLf0{YrlXI^v-uMisiRstwW!4P|vr)vN}7JHdN@Szm4RQYNjQd>9ZaE z6seJitkoa7vYDcrKsR$kHr>jS3c;NA~f)4Vyp0kavO8P}TQ(?@%d0pO>Fttq%) z;u$cTpj1Jt%?sXLKAZ7DaGW{K#(EO;)my#pZ{BfOl-WgmOzuppH(?~qlxyQKXG!B) z*r44=d1zZMbS)maj5*u`ztuV1)9bdEcye84`lB`<_@9|R*_Py;gnN)j+7d^b>}2Co z{9e=+uhhK1&8p;k+D!Cc&1v;!<*L3-g}VcA{eXM+Bq8q|A*3EU4$J?AWCPscNDOXD zPV$LybgbzgXEFQ!1j|@xIqfQW|ZI?;uFgcE{HW5TN(Wc+B~pJ5B(SP zw+1pvqG$uhPg-xF8)d%wK*R9aOJ*BKriAuJ`9z^nvHLjnu>S}|=j6g9%McN^`=E_X z!HQKTlWL(>Pw(gurH-aQcZiza1#N}NCs=jOke?PDy13@zSaNUx12URV;n>!+=1^)&1Cu?N+`vnH zyX1z;)>QLx-?bEx)5FqfHDlKFO?G zE^t{@#y8QM(H|@N(}_n#UW1gR>NekA8ofwY>7XkjrUa6(%P`o%)6Zg8j$v~;1H^ZIpa^>4 zi4M!_OhV900(iM00Gp77t*8Pxx)8M)nU10l43X4(Zc^aLkc5DG)ob)2^SA$L?bgf7L;p8R59#!37;ncX#NeFY0@bwo8Vf zK4Yne)vFIGwJZN&ZN(i}`|!WB{y5s!?8Is|vW3fLv;BHV2PWw0rm*vMm!z&~X;{-# z>!XQ|16~#bFGpXw+L+I~#&Hn3jYBWM^SymFSW~YN)*r9XXHE1Z^w~D-YpT5JQd+)N zSix?vwgVP)eMNVwsk;s~+jw7&uYb9TKHJ8)x^6qC=#h^(NVyx_`afNFxmu>J^K@#v zPvSOVeQ)a@#2#iJ9(xWVv?CK;(3;!T$5L&bCj&}6N7GYO zWWX-Filo?8c$$0}`~cu*0e%H^^Gd-C-3%M#m9WY8LksJ>L9cDz09!$K ze)GsR^0wk`ke)<8#jC=)R^B$C8?4&_>&-n^>({lyI^S~T_{9O1_j`f$b~jkC1vGwy z{m9PoQth2gmd*b!$4j;PFBNKZ38|9gQ2 zKex+l3PxHFSetf#A2{@NgY^_(xxN=zL%YEm1z5k?_1*W2qit8{n?{-lSd*>_>!xd> zd5*r<4b}(HH~$BFlig|lT44pc!FmO-{ND?#2fM+V4_G~}3hU-;#9?MPST_S!ZQa#y zc&)Jhb%m~Iq#R(4_+DV`=?3e4=%t~Z-$%d7y1`lxSTnB*%W;k4HKrS^semQF(Pj70 zzf!kKx~X#~q~=3d_#D^?X@{?qAQ`&skE!SV%l}Xh3kkIbSRWG{ z0^QOoRKp&Tbx%Vo^%Dc^lI%$;o>a8*)lcKDn^@rkXQY3OVP6otKL%y@=N^<;-b$(s zwF12pyXtHYwY}+hvm?mb&a9J8DMPb<8|j(W7tmLAet#c($wo!z;pmn6zmYQizh=ip zJMRJ5c^|sW&O1WE^ECJe?D4&`Gzk{oQ6XU~(*(I_F<$`9j*Av)xm(L!S}tn2P088F zaCYpe*=*%WmD^?~uU#YGXA8-%lk|YmnSY|xokTxNObEjdvV~CF`4^Vmtl5Drz~)CS zd^H&~A*@<|d*aTq7E(PrLUPB4#Lo7RywUm$rkkQoWT{8})X`yQ`972+(*L0T!1G}dlM|u5iV;)mu1>1-L6@t zjr43wCh-5403o-QUqJ)cr2lc62g9YdfWEK=a1`_S3W=b$WyAK1H1G~+ApbHNa4R%0 zRq@F6g)+N*e~eoh4KUm=yHF=BsMoM6D&yeRp1ZVbmv${`*P?c9)2?mGH7ByS;~i{l z?26~d8aY5*fi<#7dISu$Ln?c&7wFMuL-kt?Lah;VG9DChxLK(FK?7f#iR&J?ez%#g zzOlim%t&^5c67;84are5CI^ zB+?I8&JeR6F+TlmEts901HMnNA||ghDJ@=lS&Qoq80i}5&PyH@+{uf*?i8ft#kt6H z-Ai$A8Io_Y(Y?H?by>|Xy4LY4=FmrVWzv)0e(>x!h!ZaDP0kiU%BW?t zfbA@DS&UZLzM`6|o(CkVdLEFd>Ult-s^`Xh3Y-#@!&;5K+OOe^XiFogBBao{%CYFQUgogt3Y|TUj)cx0`uWARjO|+wx@;|D`_}DE&EMI+wJnfT*|}ex04iA3arOP` zR6JYS!S<`+!`Ow>_piEN9Y_BG{cG9-aKZ8|*B=t^n;`hV$>7|1%kk&|_CsCv*7X~kpYo5TIX=|E_6B3FnlWn9wW4sN1;7pbgx7sTQNMdDX zWk#h#k!4))CvrlT*(8&^d`RqU6=JfCT}pGP(qWMzlWQKakRBC}Smdf_k>(L=?zBro zHh~Y`5!q9tqbJ%hzrc~IsJgJ=&h@)A+g9toaHvZq~81&Z0;P@5#ZX7)geK)P<`-FX6=lFMn zy%n%G{j3utk-Q9c!9F4%+WKy^UC(pQ0DLZv$ zH{k?GTN6%`Imd+KwwiGI&p;o;nbJ|Pv*@Tzj;pSj%ijDNXN-Rr-UsN}IKdf5Z|hht zv8$UyLJ(&&la9!_{s-a5==2|vhx`3!c+R|4_Qm16wqKfr_iyN6+L$A3*3NAvhoNg( z7#=uLoaqV{&(sG)pA+un%$k|&PV0i4%jArm_wQsS;v#;Wl^jQ{Mv}!TITwthquX3) z`R`<$V4?eC{H7_&`4l0HliFRJ=|oFHH6iJxopZEQJ#RodckF|+`R(AZij@UAqL!=H z81Po@TD8W2w<_111H0npgtd1$63YwWD*$f=?9dbVeO$RdRAFEInT?&WzYlr9tIbqz zH`osWHtB+WsV~gJYqB|#Zu|e>|A4h(gUT05>kcmHA;n{4{@EHg+8|}yGjOt;zzh8E zusFJ;)~0{KdZ5M(7-Hwdxd@)NB<1{^q*Cou)dFRNY=(-MK{<#1?-Yb zU|-yGRy9<%x__IM-KP2FsygNz2hQ_#gZVIEwgoTh#20;mVPC_kj&JX^sY1m*H#9VJ zQRhh;2HnzH4G;cKzvQg5MTDKZilf(|4Xed#d+Li zIL|__1KnW00+_3Qs`ht9-F{zuRIvV4wgyPW3ug>G!3n)s(*@W8N7TpB3oX2)^V*@i z$I+KsggSO+?DnVB@v5%tr}>hlE2~95w0V+yeTYedvzZP~di|G{S^<9bBIaKnPBwz` zi|N`qxxUJH!RFc+sU+mg(u-qut$2&S3~w`lxAWcf&N#p=0$g?`g`J%|ST|6y45~5& z^f?)}KSU;JYub-9pMTh$(IpcPktTgRnOO0xBXn0Y7hKekJX-gLlP(+SN6Z8l)~APB z5=V=Oe6rNj+VoP)hdbMFCcL%jr|o=%UA-dTsrcdP!fwsVX`ox7Gyi=(&IT<})4%J( z(_MXd@H^^5(N+7<+}zoRwx+ve)@rZPha0s%pEeUN;$AMt30u&pV4VLG2X%AcwDDX zj_Z*cm)3_&aHQZw{s*wEE%E#W@=Sk7N;v5$4vO6CFhuTi2$6{nK61Z_SPU9|aa zIJ)i zy|p;QzwKf_FP?w6=%M*-*B+G*zHlZ^@eI8l__cOxYk#zL1z>m1g|fPSl3$7z_mB=P zXl?os@~BUVN^}FHwwGYBXWr1QkQJ)W=*S_+f4nxkR66{Lq-j;mnqci5DdtJZF#MnT zQO0%oQ6{dNA=%cB2JG=yc(oenyX}XtkJNcKj-B<%Q~X-_*GoJJ(v1=~0G3v^gG&0r zFI;T_^9yG!5u$D_SM_lgOF+GEQ*w4jgPnU$z&QvakdX9Y63#zA|L0p zh1vL};N)0JXv8oB-4>%WY=IQSBx#TR7MQ__e2&MC3_B4NYZ?b@gnA+fEy4+=i)Vri z^kL}ZMVItt4bFDnq3x^iIL}407e?ZvRtlZU!&}=%nIwPiQN!<3n%SYu~YZX z9-uBGqGvo1b`?57b3C2itj2XpK^&2M#C0*yh042eVZN4Kw>Eu&xFIA@kDXnfMw@TL zIsaQCd^J~_1Boyme6U|V8}Fiyyhz;kg!ey|1;05+0&eWC89EHo-y1AJYn5?iGIsyW zh%;fJ*T?>hs1+<`g+OobIHW{)vW9SvJM=kJKwyKTz3`?RwZ7A$i?IAaODduZ#B006 zq;WO&2PXP2(&SHY_V;=($yRro_{7XGzs)EaE0bVlF;D|~#A2uDF)htcquQ|GyR0YT;3w0$0f~(2BA?fdt%KdnO~kZ*4j~GSI5V)=x5mZ z43?dQ_v5sFuU0Vl5%ewAmwH_N1$#Oru>Eg-qKh8m|5-Or%A|4dqy_wcVm%zvfDV)78(bAiZ1N}Cgu5~9ep>XSCyTOJmGcQ zM&7C1v$iJ&4q|?vMe7q0nZVk9Q$xLSwt^rM3ZcvWJ%T-}xRE154{c4@-p_Faafb|a zvew$I;a?O!RBJ|W46xrG+O4aIzwpbFSMDL1PkZi@GfBSG594way6emkH|+7;^B=Ij zjiag12Pd8+Svt{PsjCnJT&B|JY+IFBYs4EvU@g{d@=I>Ivvk`@MAWIU<9r>-Ln%Gu z;bH(fsKDO&^z@6n`Jk?X?L2ac8R0v-_QfCCc5z>v&1g=W>Hlt59Feq8>WD0C5$IsV zRpK%c{~=4PU{H3QR@;Er|*vBcgD;VP1-fcQnsq7fjeRhDR)&?}ghgL&;B&O?n{hOse4+TF0ae{q!P_yK4g zk4PI1GBB+X(VDVa8pfX`JfWZYOR;Za9Oo6z}UD>u`yV}e(chvSvk?ea9ZKiu*nzBD-s#7~#7G>#ZY>cR%JcF6jahzB#xK&Q7QL`W zjRDr0Uw}3{&nFpZj75jZ?E9HjJR+~CV{^LKXZ?b|mIhb20yU>^s>11Hx&wRzc0l@0 z2gzjg)34E9!C^M@pCJ~@VnV)pl8|{wY%O0|r`yJ&Z6ryIBc!$HrCIw}jF{amyuz`{ z;d21rBwVxjMnn{r5a&&yU4?1EB_56rYlkh(=|Us`X6X}@nWEbK z&=NDro&;(-)b7In-?kUw|GVv(pn*nBhBQ#VElZ=qBW=G7CMl=j^q{YJ^hiDZ2KfrI zk}c4CL+|ZX>kc&9(NYu)KwasHFlCP7(kgq$Pt@jBm$OlV0Q)eXzP zbp+u=vtxK5D|kyFJ9um0Muo2#=s?(z`-ccPsV$hfHG5mucGmLNrn$1pO_rUXxHEpe zYR%r_w*`A`P2Hxa1GJ~NGJa`(16Z{h?>ub~ZwCY$AQ&S3pmFKN0opYgl-5XchlVz6 zUD36JuddRnT>k&IT0`c-s;i?9wqqoXX_3sTUclkgz+ErUR(Tuz=9HGOr;kNaYIDKa zIeJ6vV|Y8V5s8DGbue=ODnf2qM2H{9v*!} z7VEg-T;);^zwS}2TDl5-)F}v+`gO((LqL?`%Ez5=otChffHIR?NYu$Cm)Bn)3nv_X zq8~qiJ0|31hv%k^9ewaZ>$Eh`iAUtjEr7PgyA>-P ze&uc%jWLSf!1$Ls0BlLK{VW$zENm6a%~nbB;XG&JJXto_T* zzxIX?a;OEA%b8~f&4C3$m3Dvr+4XN+e~Ty$h35N%SnooD_+CS&=+C)z$)?p)^s-GH zI)!ufaPl;fUp?i)MKqkeAy;x#C2tq85_z#UWlM?GsvgUw1Q5Lnx5c!OeaXJOsI^n)YE1qg5?8{ z74&pn%%IG($3d|MoTOhDWAsoEGHr58FO1e#EcMtyDQ7`RWY9yQxS$@C!1SSyu|?=eBB{bJ`F5xdAO&XDheA-ru-@6-THG9U%0FHNTGbo z!`w|1N;sOx2^)Llmk7{=of|8aR*{uwfiFW>`Aa+jUIV<(H~Hxw=VMuEa2kH%LFJw1InA(^1b^K%Fp zGV3C3{v1(k7Qz|~FGRU_3PP zp`mezBucX4u+kXl2w7dp34O}%EsRsv?}>_hLm+qKq&$h+5C@7UK0SR@f$OG^`wd$m z)dHu?udAg=y*~@H3B0C`gM4JD=9Sfh53s1tTmbXCBe7Q93)KY>dlWmN9>o64^o`hE z1HG~Z+;=x(F5g)1nj31Uo125)|14&Xs5^i@q|T4Re^z!Jbpey}{bQ+-H|kwJCdXPEYl;y&k#IphP3dq+h_{G#^KB&C z471?cw1y3}m;)}80a?VN;`?2V0v9)A>ehyK2cV;X^9)zU(eb3?&99Yq_-zhuDZd&2jZ#AH_KqqN$KksK;BnF8pJ~|ARtpX`NFdoriY>@T>wnWg4 ze)Glm7yIM2wV)7@HgjQ^)YHlB=BQs!M1DON5HPlG9~VK41K+CMAw;&+1upJ*e;xWz zb|JFmH;~fY$iE8R0GjpKN(;USGh5JypC@Nbb{D~7@o6|qv*UC0aivc~@$PWK!JdzZ z+eLh}A&3auBz&4v_L$!}M$pU5c9P{#Ja=1~Ha8Pkk2tzkwkqA-Zwcg~F zTPrPCUFNiz6$&TB<^0fVTmo&HwLusuWFnJNqzWI#jemTp= zFtZ=t1VV_rQ8(y9I5j&2y9mkFBOWKC@l>3W&~3ABFOq~xT_suH(lj2eW$jGrD8dT) z9;7c@4U0Ui3-Q^zPFu6MwOa9~K*R|30ej=i?lMa?K<_ zNG04F`9@nRsJ3@`pTKirt~P%AWXbH{=!h0>Gs#lu_zG_uLpQA-+^TKwWgx&=#h=V-=IQ(3hk;~3Murq%2 zWXTd->S<~EQi&pk)gaqaIr{XS*WwEn$ihemPtfxL`%1kcFgFP1Oxq?Ryv^K1j%|AP|PZ#d@ZCz229PX{q zKy%aiSaCzILO0~sX6)7Psqd-%K7+jlTZqf{;f?fG7E!BrE30)u8;R&JV+76a$sv|W zOVg*V!|Ma`t+ss1bAIH_(Emwx;HKyOdO980Woyd6 z{H)F!T2yY61P#Sp%VPx^+QRNX*J=sIZ%sli54Ms)gr4%N)+s$L&}fO!h@Y#B-}z}Jf)9}qv=0T_t(^>5=PGT`R$ zWQ7A7Gz-Ih(!1acDX^b0YQF*UwqYCQBIuu&*6uFy*3V^-KWHh8jE8KUto%1citt-c z|JbtU^f>(DB4hEtelB9*wd_32_DlZqd3;81)N-KZ7pM6FeE3$}``77Pwc2*IY&w05 z_WSjg^a!ITH`d2Ph}_(#ewgya3R#5JII*>UZd$#|s|UvT$YAdiN_)y%Ky&nwc4!BP zUx`@nbW(dr+NRh=<95tHJrMBp^qH1SpRS6@kB{u+hM01eou9Ci=~;UEIAl0IeYTYk zHaCsz0GEQ*PbVf<4MmJsT{xwS3*RTldE>XLqxC=w5x+Ri-Wbqf70;aBTSCZ&hX|SS zFd;LM#v$#SLdYMGP9Z&o>tv+okwziSLV6l0`w_&&MDiltjWiMI1n&PDsdEqQ73{N& z@Cw`1eLIJuO)>hsPvL>Z&{p)cSBtu)6(JtAo}Q6)@PpOU9-5AN7vfrjzGde9VA!tL zBC{5JyM2FUe^ouDhzJchi7>|B(X_LfY<{MJ)xH^0f(|XgN|n8`K#x5hJ@dbHg2!hw z{Jz%8gV((x^WbuZNNP5VShz`Mt&HMSB8!R4ykR@fBnotM%=SZqeOiOIPutvdcRPpO zG-Kl+yAd%u5s&x>T{w#0TSv;vu+x~cW1Zy2w??3QvUrtbK;bR;mI7=D(OiK^^&^{m zzhOrS#;2*O1bl|Ft-B{qUpYl z9LNW5oMw8vgGGHFk9!RrlVH;m@I4e(Vp~UVt;7yoPgc%>)oLXwI&RU;PBvUWFc`iS(SLo;G@(qaN?KN>do4JAcXM2>Cc#@MNE^N=t4lCm`{2=s33(=ULHe8uyG6d@hQ9>*}`QBA&3&h1^W%`dCt z)~%DEkw-I)_j_A?C7uzpc^|)aqBj}8b!&Nt0pAi4#Bt|?$%ka4>kuq9kpGii(jhs` zeMlC?N|^*IW$xgcB^OF;vM~6EOO}^-&g!!cmK2_~W)_?^IB?||d6tL;XUQnH-hSdx`Ym%%hXvm?!gmq4ikhh3Fk-GD`aghC8T&lF zulGIqOp%@H^xJwj%y|>P@0Ibd;ua8U+t(s?<&wc^eOUbNvbToR3YnG?=mZ8zGf`?{0*a{QHJ&2vz9F5>!Z&a zvPYdYAgbRAM9a$mDrGz==L3x2Wfu-}=-{KPFVD3L^igQo8D7!DJFh!Na#O?lpnc3; z&S4>YA!PP27bI2n(b%26KJGUr)0q=CZem}E8TZZcnSc5ww%8u&>0MEvWA-Szp`#D9 zRRQt6QzJdb^oS&nF;sDg<(}(I2%Cb$o-n5VoNb{oOwKPObr)9k=Nk9;;;Oh}f++Ed zZ-VkYrzd~|paO9PiR};g@fTblM}7>6F1(1B>N>K{kJGVhrF%w~c$O+QN}CTSOvUuI z2C0)0R+RjfVQR2@$!=wieWT4WA~H;Iug9$)iTUO}%e#&6VQ~_+9^BDk4k$BB-{33m zT{<0@E8-x7S^WYPJ8}w929{}fz(;dAf&LEGoGh=&*bvMddzZ6cC_}*>{38_X zIX)K0W;#>CCTLCy_8tZHerSoLd7lOL1YoVTU5K#!bUXIV#-?}a*Dk4V7o9Y>CXNNh zfYag5FPJ@RETPNX@I+Yl8FpD=nXJMWB}f9kN%Qy9PhNq?zg~hzd~1aK5h?#0x`=&0 zE$|l3I|{_Uq5yl|c5dfntQG?0v14Hf848KReO4Zx_60>?boKgWgOmHfy4v;S7#4-L z?f}F46EkPu|4YaPN3W0#`XYKcSwHbCN0J~b#+s6pw)cTFz`QwGo3o+e3YZPcB>MovHcc7G6 z5ny*%be8}NM4%v3`AS6ZX5xCj;G3}5qkb1qw{tnihx}zERP^{4lo6 zygt<1+Xp=4(~_kg9loMeJU6W|#m8?8-ldnGZrCyx_P^;h^W>&K!18x{1NOS{jT;?( zSkaR$A=WoNH2K$*-jUd6GY!yK(WYQzCJBnOm~~kP?RqhEidxvSYmhqStz&3gUr+=4 z=E4N<_E7{83*iMJ&>ouR)(g9B*ePC5*3XuN^*GJDo(~ky73j~QA2Z#`*8T&WxYyzQ z8keXG4GcoM%hF@)#78-C1?nSN6S^YB-`geYF#mu4vUadI-l|qIArO=$64creQgrj) zp>!{Ntr2H{tQXd^Hk^PIBG74ymM+jEZJ#!fU{D@qo7P~X{$*%M6>CWnWY|M;v5m8@ z!ZX%J4q86uig-xI*OA0kfW%s;>I_clVhdL^b1*Y6oz3(H&bLq+?c)ZRPY5*9%1K7A zQQ`OkUDBEg&rXxiTvAw4a2A~FIf84_xc)&xel_{xS|LcqKE0E@e-Q8A@4a7pe{yST z*6N7ptm zzGL2ted#I3NEXwwx$w+LvCn*Nlx`%vbIJ<5M^SdlAE!uXdB;(*p}_k=0oCc27mPSs zKsiH_%m-QbxU}Go6Ry$t zURB{zPmOPhC)r2vxEt3Ld~@u;nL2zgWuO;>j#a=?_n{u_BR;=GxE%&iiBSufPd>y>O`ibtd zoXE<P4!)T8;h>T+qN2f@nEBPc7urwOhVL)WYm*{dQvW{ zCoaNQ?1IgLGwC9b!OUzu>;o@|aUnrE0jqsKiF3x|I}gLio_aUhCIs;99azimz&#g% z2WWtInw96nwdWjtvz6WVu~|6?dblW#ObwsGDYukRQ08pdwQsN&-YfANmUza?4ly6T zOmmxqGEZt6%(Me7NQ$5w@ip}FHh@z3s(Ycwv9APSj|_a1`B_eDzd;Jhgoq7pDIKeU zsXaqF0IXoY$Mw7{)I2Zi;qX;0_p?1O#~~SrQIks$dlvTCHf2{s;1ALH<`IWzTPY zM8Ym%xfzil4CUB=L#PCEbQotW@4eNs-Z(_S)d9SzsayYuMjO66gr^}|LvnVR11$~dE%UlgS5&UMl%otx$i?0?YtR0Y>@qs`W z;A?fuyvwv183*41&XTaJ<-F5Q0hnC60OvEc>tq03)>-iJH%1fUUOyQ zR|z^DzL3c|OdBoLzrw8k#~wmIMmoEX(4RICnu|05>CZ?xNY^7BMT#MDdkNJc>5)uG z@kmKXLy>Mk%0oT5NCS|@;(9aE&yZ@6YLT`gH6TTih6COxqzOp(B27fP4{0jW%Sbzr zG62(#)PUay_wDyF$swQm{l%bij{X??b;LIuR`5}v&0o9Z1-(vFFQ{O(?S_XkPEikn_|j$sA3eUA12g;v&ohvFH!?EKj`j?deJ zFUlO1i|X98ysQWwaecx?a|586cbW^NntJxjieDx5x(!oYDO*o~TYQ5(Hio-=dcfb{ z`?Zu3G)qOZ#?LobrYgRw`=6upcFh+kI0P)|Z#~CGgZ+AV4nD`>JI1WN7f0*YD-$-xZ#pIm2T!I?8|9}} zD@3U*JMP|>c^2y@Xa7AZFK~ZVxguM7VU+u;<160w6--$?uV1d4X0EhUCo@k? zdi_d5eT@x1BPhpBXFTUsa5VKf^Jc5G3g7i5W>i*q zWo!qX&|j3{>~lNwO(S$m89d3VlLLf~Xx!^dn#-XtH$OLiF6+q+&&4Tya??COV70Hs z{wwpd)vr`{2n2jzQ{7=GTFK4?lch&wUtMqbAI+?DfbTD^JBY7S?(w;S!TsTRD3^0J%KXBW>Wz{20lOhG}} zS2+D_af#>@8jDx4=aFZBP*@BPqF7Tr_yx&%d={b73b0q4dnodwsmUXkODvmIvm2t>mG3U!F7u-}Yg?)ab-o{1)uQxA5z9_bEK*?6!IA z_s961JU4Ct{G*>WZs?)3X!En?&3&jJ_`GvD^9@O;VzbR0)j>w`Q(qb86EUB&@@q@( zz8e-V$5WnyPvX$a%C5Se?y9S#tFD``Qdhwxb={)Xb;~E#4P*eJ4?U}L&r|6Ps-^6e zbT->rOD>=Bj3F*=MJuREClNgT6F*)em|c2ITu0TZ4ioHXOVLm29D`QQKSIj_u zMZ$*oO_B8RzE!}@KUXICEY)xOj8p8MpOio@&K&nmY|)AWeR$Da9eoa3qMPno=~{q3 z(l^k$Hx9&aQnA|VSFxH<&2Y-*#6?azqm<#g6SIFS{qHdQ3fM6Ds;2C6ygs{JM~~sl zfnRw4rQo&l6waV;T_bydje~P^kR_|NxjC_n(EAUlcYEL@DcWdZyK!Sysw>AGrNd8J zf#pe&c>KRFl7RmcB71yfZUTCJ%gRo^Hx&IIdVtMBJ?;-$`4>bKVZNK!!P3P}?Hl2n z?@&tXXkNRzql4YOGVGVr&F!X5?8~#Ne}%}2+R~5Kv+)C94RJW3iiFtG9 zsBHEp`OH&_(@IPB_#opt{R+2|N_DhfyXRyg+R0j3h8jLwk&b!irpNu*ncV-j&#;Lu zVPp0Of1UEqLBEa)?S@TB@Q%{aFWdIRPuhmL%w{gQEPZdq!ISEUCLa~fSvfX86*>@E zEx%e}4PqY~yh#Apd}9U1f4>g;DklZJ0gbA6U`1A?mZC_7d>0lqH{H9OtyN{3pOl*( z0&iv5XZTRLu1+qgqd6UnOX}$Qc9lym-d-&a;#o^r z6qjf4OXb=PKIoQ@hQVtXz6~8OpR%m)iC^#F8=pS!Y^{|Kwy81`qf17sv8LjEI=T~O zrg^7pWxQ>yALh-f{Do6yD6ttO9`ZhEnR^0@6A+zx}Z+_5sGQGTDfMhw^Q|jaM?;5XA0ke0k0tf!0 z?2A*DwS6ViCptPFP=4wCl>%j9M2GKBa?+dLw=}4yT2y+^mdv2f+wg3sw@!O@yhWX{ zH{k2XI{2HgHap-2;|?=flF+?ndr#>U{r~6QSG9Ncwy1Q$+L^Ec--K4!!qrAh$Abu00nO`)(qaE`r*7Rb7sfvikVsG(EaBs1=xR|x%P|Gu? znD0NKOUjm@1(6m`TJ2q})wV?I5qrN3vRxQYS9n)yPvA7_vfvI^BT#ygD^3$xHul)TUf17RN?`NN5aLnX)uCB7G0j65~*-OwVOH`{I|yeIO`S}s@KOp}V(g#o-+4t9;WC`{(xJCbST(;|kh+$`xy|H&E|R)+yqqa=!``iD)WgyH;cbZ% zM3A-Igq?7HroCErL(UXJ0qn!WgAW{^-M6;m)Ggo!{e136A5;KZzuX?-d}!1&M~!IA zr#jQgQN50m0qj)dy(Rqy&I^@Aj^j*h-w313Cr+}NxzvAo`TLF`h8r~KN#04?jCowP ztXJ2g$tU460?yCyT?_va7i17NHYel}qHcar9tQcvm}m;EgKOL#Umw`zhT9I#WAUB- zpZ4AbJj(LgAN^)BNhTK{gaAPTehCRoVs0SXfS^eTL!y8|p<+doNoHWiOfo}ef{B9t zK++|64_HMKT z?17}ys9+pZlD4UI$Oj|rBu(#KGIoioy;@tEaugCd;X?1(U(uXr4oc|P<-ZXnqz?uz z4$gTl^qv$hZib6}<@O3OCC&@y41a zUY6f`eAKe^*x@psnyQaIWPD!24Y#p&X~Sbi8gEvgQ~UgIKehe}=ycVb{6pj<-t-+2 zV#ga)ez5`QDcXl_R?y=Ueid>#QN$39bKX?edc21aD$lq}%5(RH16^ua9uJr0v52zV zj??~!{V{A4V{u9NAVg$IzL zqPO(H4A|$F=L`GsxKR@=zl|BCaruSb?6(rOS}@Li=YtOD&~(N9UDxN1JF?fl-mKW$ zy7aiGGCZIU>ft}LJd?wJ{zAfLih*wWUFbC;{L>fGAt`z<+-0t`8&A==IP8NYd+`$J zB6Zo-rsZ$-EtKrbxAuKENs9k;`3}VU6-ym!@KUT#Pn+ z8_t`TNYX9%u0=b3ycB!i!0!W(!fXO)8tfkes{0WeAUYwoJ zvZeT{aj!zb?^J$pVJUWusYiCcWolMTYxj?mJKuV_mUi9{5WW*Z4VstnFS|Tjl+v6) z@~N0%GmrcU=SlRZqT}N}*GG+kE^`CUmTc(L2gda23ulSlsG+lFeFm-4g!s>m`nzUB zpE+T~n@^U?N4o8;v&SBZ`#fGZrcWv^#LL3^pl6`1dsLrMs_shcDlo-Ci@&>zX5J(G zCVLWo3#!1RM|;C=0!juqk8s{0vfefh=wwyPe?Ri_{aYoe2PA{qu;;9MEnru=JM87% zdYrd_9?R5Gjj=L)+j1j*b5M`@OrTmPS1%8pho-Yy>rvh<E-sHLFO^4f#d4RV5WCV1pc&S4tw3<)Q`q5b3Jl+4FF(HWT1+J}?lHkm#g`? z|9oM$zTJ?a+oZ?u&Ex!`4{w%yZqyl18H^Puk?)^rc@4kIcRqd>y-}UmzGn8tGgYtQ z^~M19wgd5yIA!N`S<(v$DDhO}ci#D@yQ%bI{X;A0j#U!oIFSGSIQNZKQ;jhOZ?xb9 zxGrmWcsDzlcc1jZhI8AoKD-rkyigx_F?@${#0GZ%EsM54TxPPT;|?a~lDPHobe|%%+Kv0Cm{ZmlL2fPYPs7RY7_{ys{V`~>+prs+ zwqrQTo@h3m`3gT%$f88tk;E;1KBUF8G^7-w!|M{0b`+=6S zvCog(I%>23Q|XDtpT!xj_q{MT<#VH<;?$5B>ujXofOjG?Uns>_48A5B_hZhNpXk#S z8Yjn^{&95F`jO9W5Md5GzsQ{Y!ps1fJW~z{exSMRj%s}{>bySaICtI8aZ`TsP^9m^ zbIC6(GGDi;?k^cyr`R9-#MZyW*)cvhk?O(iYlyA&B9q!djrYzs6cEw))hCVm} zH~RF!wtm_CBJkMRF>UlNB;7W@De&~kV&mxcQJY3?PQi$od@jA6e$g}9A9>qSA6$di zLXe+$)z@`_-yod6vzTM{<4zS;<)7j0Fx-^_uOJSZf5iI6;KaEO^|KPE$1(o)A2E+< zmoop-x42DLn7UDKO8H~z&PsC+?C$QDyT+g;UXSzNW7<;T>ZsY&MK+I~P2G6ZY{0s& zFlp#UXrL5bcCsIoQy8_;vwShx*$8c7K$ci+@u9bLmR#s;FZlOn?16XEMm@D(k>JsQyA z{SNX~JdASYSCTUB3>u8T3;gJI$lw{0v;x$K?+oZ?HqV59xki#61xbtN^mSTb20D1X zG$GC;oqj_ZcG{@df36sQhWTqUb_LTxQ$Tf~?VuMyD?l%R)_^wbrF^x$K{>ZZq;M@# zm@M+u8lbYFv^^$DeL;k)<#07do8g})-k!|L&!cDDklWU%5R=V)6$pr;* z=A55prt+4}RF6B&t^2W0o)K-H7ua?xUWzdpj>_hpX54<6P!^bguW|VL+eysuZo6&d zZCORATT0taK1#nK9A_rtOcQZti#SapfB2n8uGtjWX9)W-!hVOS`4eG#1MDXX`?!EK z0c{|l)~m5AC!^pK2`9k}`>!*%n@4YBO_>r`~B7ab}ukB34UM9UHx!L?nd+qqgAOnWoAf0{? zuiIe#6))#lZ<%YgTJ0d~6Rpng1rF9Fb+=+AKF3$mJRWOoeRiq8xK*bw`79}YcKPhN zW}G5fS@y*1kCY_^XwUFQUkciZKG=A6Csx>1fztBQxljBEcjxX{S@sCt0gyUq9Z%`k zuQTqSU^WY1*?x*+qW>S)V}5f(24nzqU*pD&O9zcBZLK@lU0zq*MIq~O&yzw<3P2+h z*nTQL1~-WFCog#Ois>JjpcX4ug42#j3I~^B*b0X{# zEa}TSKBZ2VGsNGCzH%@6%7nAJ!cHO2gUX+AMnjkWb)XH>{0>!`-+t4~G18y=W{6#$ zDBtEj+(JzMDDdaLq6iaX`mul^XPhr4Cmnlbm6$>F^@T$HEkd2z5tH5%=oB`ehi&%4 zrl=z}{a5gt;(y)zJxFn-Ygqc|Ky*$bhjTdWdYcF*I{jw>U5-(>R;Bj~N>aK(-V*rZ z^)zP2p-21}5;+D+^T*=;z!G^Jq;59oK2R&@2OtZGq_G3EVsB@i31j!xaBL5Xv?Zsz z18%fP$Z|zb_bEh4-FJj?G$y@9*xipZT+KG~h0WOXMX;%cygd#LBKi|-ho@5+x8gk> z>ft0R^`Uz5+h?GnNeFsG2$c>=uK$G^OOp&_z9Lrb{OImscVhN(G zOWAywFwaOI1#?<`Lcbx>8zsyqrpH64B*n)D)RKl=O|SWcOb&mVG=Vgn|LQdCUtq2@ zMKv2oCQ7HnbFtbjL9ssVPk*qo{OnnF=$7+U=eP==z;?SG1S{|Q%Bk#i#GcC zlyEy8@&nv&zojA?ZI#|XIRZJDg7Z1M2L@Z{PY0qS`pVEFQ$)xK7o)Ql2J*!Urm(vB z^rj>_mwQJ*3XU2uyrTcP+J^>uAL=u9jmnx4$SRN8X~1nd?9bCLNJ;wO^gf)<#SACE zFEJ}O0JDy$t(B+;()Z9C;V7>*a!L0w7Nuf5Wb^z!%_Ps7>S+ z_uFwMIGS#yXBAfK>Ar_VJ$0qHL#nRer2Y3!z?@-`Bz2=4e#vXoH7EzV3#HrmF3ukR z!luJ}5K(4&2N9=AH-6pw5%wI)x{bHvJsI2q{<`-|aXT~Gr)&SZ*N=PUdYqw^GS7YT z3c}RM?m3~k{+}TSj+BptB*1N|oyp=wGs(W$Y{VN)i*RoVZ`$K^rn#VUP#NA;SlW*l zf=rV>jNN!AZuTFddz1DVj+U~4-be5|Yd9Ub|3#dXxXzdKN&;Fz%yZEgSBsVS4R~Km zXgkqX67b#?PEpgG^LF2x~iI6yvrFdh?5=x#rpCxDS3*5iee`_z5&e zv~!1Wq<`k&zP%52e)Xj5K(LLpWS9jN2Y-k!1MYP^=_(FBj&GwxYoONx$)D0jCggX-`Zqsc4?nZlI4dgC zTFUx+e}0k7Q&4+SaQd1Nn~n4&oY;p zq47@F1>?@qOB==J4s$N*a?4p={sZPDKYrs8H`1g`Dy@{Z5p6?B)+EeAn;2!JR?_#e zVJnq>QWtLWPfQFXx0`0o@ujpACt>}2eIV*N-9-4V#tsCuC?htDc9byC`!DE)BpLP} zpTaHdm&XgsUowvnHTTXyR^i&xCFY4osl`0-A?-kHSB49X#>M_CyuA_*V^O1gf3EyH{C(W5Tnf75|G{7V0i*}# zRq+Ce@6Wh)Ij_u1>xv|Po6JEe5)5> z<)0t5Zi!Ea8v(}VoA8@!k_n|K(Ya*(b3@JQJnYX3GzoA&r27t#YeDrozyeNxiM_D<*%Vtl%yk!`w}My#2>^hXDDIQ1MQv@|~G zqxyU2U4Y*1`Iqo+(&pJQM|YOrW!_oQj5)C`Xoud7w2dTV3m_%7D5bBzRQ?j%TFys7 z1GVs@{@&aRv0MMrSJ^?eZ-DHfabNF$5oI*#qfr=>ur^Y@?zQk;+M&L!b|jD0Q!<-8bU!hf8b47n8h!q>gG^^e+2H=1$cmUD6s^fO=e?h$V! z(OX6JNgyG~H4zBmxoPIdSFGYejGeR2Hc)V&CvSYEn3mj=d%je z%zohLU4r|;`S|B!%&*Tr5PV3vv*MM{W2DrwDVXiF!;k$O*4U;8{jblq`@U1Yyi|t` z%nxQIi#cGDdFXZRW9V#Lf$3JC?p9rXuYXaX4E?{e0B1o!H{-jwe8^WF&6LXOv%}&g zxm@V!Ds`0mZRl?$=HYmgMekaFoh(dci^0Cx^@!~GXyFVk{?|?>P%^D3-vL$IZ@^Kx=0Ga^$ z81|_kJ?K8Tc^`7~HhgD+9tK|x+6H7`fDBBy#zW8!ks-?_ZrS`25-Gs z)D^Af9`ZbC82TY@RFW>-2RW?3oeM4C23momhbnI!Fo)JqG%I})<@oZsgo+rm7h^2_ zqEFv>x7g>_SQGYmP_fVpP(IQfh786T*&o{lj&7XtU4}^!d|p^zde{ruPZ$(+e;j> zxpj_|H`F)$b_eF7H2VJff*rSvboL5I>l|Z%){4479R7`gZ(Y!Hw$M($qGFhjaRup< zK{G*9PzDviU(KUAd7^nFM(wEAq}&wWMa(B!yC~IP;s&g>s{yZEQD50NKqqBK_+*@Q zZIf}+6Eb6XK!%;KuN{0F?uBJ_nd~};iP8w$Pw+faF7h?}abAr+A~N%V^xPr_?-yv}JbTj*=*ml)%!iTw$++ zy%bb1Pl@&E>`&CS;vO8%Y#^lA0Nt#@tL(^6iK7r{l&LR6Lp{-#*}WLC>_ROV-f-Kc zpmYJHX7~4Pl+%$fitirr=FkWq@>fs!OGfGT_m+w_VX~JvMV>e5vW(Swzyc z4QW(sjcyF8D*+nMbJ2E_Kx^jW`Uv_5wT*eWAGxj*bN1|N|7zSXO3<>v_Rg;&+%UpQB1-H;>{Cit*VFrlZ0-O)r z3f&yZG8waZV$MOAGN!mQDeGSf^u2bT0V^Rt}0h=ENhGakB$4Qh7BXSXoTpSZCmqmW8 zAB~iY61cRAFz)c{@D`;~Tl@QB@s_UfmHu9Ob7;|LF;b~d%Dn~q$e1_71)U+CCfvlr z%`muezIpS!t$iudsxrzK-P^%Ca5(2#iCx~mKp%&E;3hIgXq=~1%y#52c|f*L#@^g4 zmuzmILng!VQjgjqXx3ihD5mzCSs0iPc`=;zEcA}wnE4dbqavn4j>+1Em*Q}G@RNSE zC$x&5Kz09dzp=d^@4ZWzAAXXUdGr%1+hhHSnP@GdhxlMhE*j6p;$PRfgP&Xvxh8|= zL$}y1jF-mRC?0Y{TZUJOMtGpO(N;07) z5bD1n)Ugqv#%%7KL%U!U@?U-90#x#Et0f=Q4d~4`V9i02al}Pq=Fm%QPxnXRUVhBx z1;RcG_UUS_?MJ$>cZ)tU9=tj#n#HJyJDKg!58zd_$ru%}Z+>xf`DC2VnnfYt4%_hy zi~16w>!+xNJvFv%!XBd-iBbjQ# zSiNV=JpF6*F1<0q-8GulV8Qx+Q?=X;lQfd9FI=$O6K}#Bb$;CJIX{g0Xthy>PN!e4 zHgzYK4-vC7%wI2%>9GC|m}2jnP5k&b_xBuO8Fwt;>N3XNxL zI_Jz+Fj_om#_!{{QQK@g--*6I1@+;F>|TI+x-C4`{9W|ZOvrg%J&iWFGX(iYUr`7{ zYSZD(%pAf4&iSIG!tL-u02n&*v?D275>;jcDY(tc^Am^d*>^W z`(C`Z5N+Ne)~|Pn*HLc7ynO*eMtuzA%XlPrk$cQt<`Or>XPEF+@9T)~aQB#Se0IdQ zvAY0kQ1>F;j=O}LGa^mH!*0GS(uDm!q-i={Gwttv6L-=R(XYk(8l;)Z{O2cBhrdTZ z>qH&KqTk^WQ|ZSb4@e!ev3`+9n&Zt9UWb76MQZ90law2avj=p0{3{`^q}*tqgqWhC zm!UD2^fKgs4c?ETQ-->>!sZln0kq*HC0AU4o<}~FN;jVhvJHOSE$B_s*M8juNHQs# z+bK>)fU3y^{as8vi>Z{6DSnPv;Eq3m)Y^#5{`Rk-^9WGcx9K){vKvcq%)*i#GIVwZI~~F?)FRjPu~#k zN0^_yWp6jHH~$d3p!EKr3GRPRbrEbEpfKp=z8jHR{4PkhY%j#CQIsDVg+HZti%?6U z8Gt$$q;gVl%lL=p%}Cj(aLUrp1vq8;07;6~D6uVKM&?Cmv~oeazA(Ey3T?;z zlIc^wj^?8nLPGk+#Sv+z_jxd5LR{++SEvlW5O1+g^<7WvcO%tRjD1{rww=EGeTuBJ zn;;wZcF~OE&u81aq~M!pu~Yc`y=a$ozV%}7@{8&i5(Rl7ne@J-0EILp9L8P_gG#~g z7xjb}hC{F0Nc+#AzXd@50on`-$*e@IH} ze1qQhrc$^bZ?xuMN9Z@M7Oc?P=iu!C^XNeiIruGh#;r7G`=>;I6*3JN2(o zJ${Kb0dymf8l6}bobSc&HRa`+)%)F9D7`ai_cV(S;?6kjbGhdbZxlLRnj0FRQ&`xS zHVkbEXVpsVC9}`@AGhZOCfaW@&+E#!JM2cR`y~236P)VYWgiz9UXh4XTIYL1Z~7L) zHbc~Tg74ivgR-ZZ=0X|f!fK31NL{ZlDnP%zXo4oeWTsa&AjS5N&BA;{oHwG`tUBYS zm6Wo_IQSb=!FPGZL*)=xPo-eQ8!FFXY-+>$BECZRT4*)X)tA|YwFIrZ($n3c^#FW1 zTj#VPJ~#XrFw0A}C)=eQS}nNeBq6K^V6GQqePSWKV{v*W!@D)SRl_gV@N+eMv4)?j;Y}JoO~WT?c!P%T%e}NbztHdj4S!g} zAJp*sG<>Iq->%`?HT+W=UeWMg4R6=*OEi3?hA-3bMH)U=!^;{zMZ+64e1F=dvebGVD{N8;F)}j+ zQaHS-r4Fa9%5Cx5Bh2b8wf3q8OT8_^%;BnYc&loi4kWIs$zy8_eb+iI9#4crx69*b z*7|lg+LqcHZ4I@yDyysB;%JEQpbbFqY5-g!veRa%vsvXVr?W|}Y4O@T@zOk34N_ie zsjX{rOEpanCyMM+PfIOuV3oZtxzV=5RcDjku12p%Hf33}<)yAh+3i4x*7$JQUFN>V zd&i z_gXx4d5AZ!&ellHJcmSt;gS1k2ZEwg!R zTF`LR#)6=&aOP?8)LNX*Do2CIZL9UF-RaVhJ@s(ls%3wd2i-s+Q#Y(yNK-nkiEJO@3TWUfH!&_OvwAQh{8Sf~%Ge2?O$>EwxC2K=x{BEweS) z8XdJNBSgWV-JlQ%nXQVK@c&?Ir&fm+neVaHHZ?lDEurS0S8r*sEVDI6I1M|2p9b%h zEWEaQG)PNhOP;N{*5>v?dgcq6h{o#h=20h=ybqy6g#=)T@wT{a(n2(<*;WUfG<&5+ z?^2@3j*0G>7wVkoM%KKCkl;vx+2poT=em-7ZL~q4dAQ@%y3lp%ZB<@~s0OKU@{}8= z-gNVKil$j=YOS`V653*u4YHPmton^$EfKv)7$S>2K;%8-@Y?g#5kPgX27F6aVUE+; ztOZXXEki<@Elp0ZB*d3(1=?~R8nhLok=O2ObUbXKddO>ZEVFy_Ts2-A3LyF% zwYD6_yjn=EMoWmRchokz+;&%kO|m+unb$NS&O9N(9JOj_XlGuD3OYypn^$XZgy>ek z9j;ohlRv2_2TMvdtcO&B$Rbfz?`lFz5}#C~9GIwFwam$pVC!vOi^izg;zhBrXBuwQ zZ;#E=SZi0mn;Ifw5Y2_75Z^3GRi~=SU=%8^)~bj@H4vkJ1P}R&P7-0@v3XUYO-Wb% zcpddNPo$fs29o%ZCTd=|E9Yq%n6%v6kVg{$@nJ=jPM5_h814^}-C@l`v-UQ+oRSa| zIVxNhl(5WmxzX^|Pox(^4-6W;4x~~wgk-$L&|Qo0+_iZ^yhMCn9(>3Vnqd8)mpqTX zKGGXlQLR@p%M*1Fj*Yx(n!u%YqKvfxsRgf&l$R!h>*NZNsD8L^C=LuVE7XALE3e+O zOavvEQ1(>DUN1f9s!`h$I-5lGLj$y9Sp#}bEzKC69#QBd+jAuPH!nQdQCV%J3pY-e zi)LHm8&xD)LEa^Xkl!30iE<%hQB93r_Csc3)E_i!v@JuoMr#tG3QIBbY_NGBay8cF zNc@5MP7V5}HO$vIA{dNrsx384G?vh8Ge^=Gh|0UnP!zU=hF5FzcydA?5EV8wH8vI; zQh~H0d`fZ10#lf}FhkR_K|jRhIgvq3Ha(ZP$%BcQ!i7Q+PGPw8D#qx+RBD&|L7xeA zwoAgYIvTw#SF~wt@?bQT+#Xw#)s=@?r$lYT;uI4ZuQP{HEi1GsNKhW$z+hMv4uE-< z+FCC;7T;K5gqd1X1RhQjcdvZHS|`h~h(**?pspntO=zU|0(WMG}ZaWZ2SGTW1?|+JqTigB2x1 zV|LihLl$@FTkW@ly=ib>&C(Hm9hiS$#?nBepW2Q{WLF6(kX2aJEV-Q)FFe*)d1|DL z!F37wbBGC_9C8s_M`TEFit49;qr`B(gQjkSexjQ8^gB)CDD_MYR-331wCoNg*y&qFe_us*hKgSbouT8|$_f zi3<9m(3DH2wVDkva;*+l0E*j$QLl;vwN_EjM;Ldj6aR1a$eyZ1=vb3r*{&|IGyx1Q z82-eC(DCxIcK_9kc(=SE5*uqx{Rl#)ofqp zJgX^OB$wM^ad#De6dMkfhB|?@)`iw*Yotl2ho<=8TIy>kc2Of%iN;DuQ_ObJSt1t! zTon0(ec4jK)KOLIa<^1r<|kJARoo&(Tk@Eodk}gFbVgh43SI;7>Tu9T7IJVOZscCZ}9$x1a~0vwEZgUiuZRurwCb3*An^tdNBC6qI4jQ!toO zH9V{VWE3uDBF+|>x;060FVr6ho(tWBghSU7R!xLk1jak8MzCZKwc1PiEsI|n1*0xi zA>Nu$Caf8NM0C~55%L4dHYY6%TF{wgOQ?==p~?tVg$K*BT01HQ?fDzlyA7_;qH-{^ zQ!pG*ef=M+CL%VQSN7U%+RP#DZ~@pcm&?yr8zI_Qox_P$z%o^2Ijz%WldZ9FCaKEQ z-ZG=9L8xzT{q`ZK9$A4?s%q#$^+Kg8o4ETxhOnz}jce@(i!9XTDCJFFDqhi(s_HE$ zUz?|@26IH1Wn_7#%fifQYk&lPxG7t{RWzG0zoa1p@lF?p_l2C^54F;ytlCMrP%82A zc2dD4yk_#v?Xy(GS|Gw3tOj%=(m0_SC{1EWz)G4ldl+I0Dp9Ky_ywxLym1_Z>JK!B za3_p~!sc7{8#s@A&H$K?_R72%Hb1Xheek@J|auRHI)TS!__G(6ldLDenE zpsFElU}W;dngsR2nhq1xd^E~ZiqKdaTu{bEwkgqPcTdh#tbXq?ccE4pu+(yMq>(}}hcQ9H7z9XZ_4(O%GDMXOP5 z&>}M~sbY0LB2@Gt9h7h>iGRf~jA7rl)Il@JkShPO-W`rGtlp$$82V@xRyN0EGP{$4pao11}X*NDLDy8ccnR?auBXzU~dcW2!I9`LwNTUybMYQ zQM?q+V5UQ}^nB>ly^t5SNZoJP(t`;ZRY*Bh;7syebtn4aFR*se=EB-mj%I`okEjp$9Vx}^n%Tk6%Whq^t?1U^O zdYWGO=w`iA584BYI~cEI|F8IP{#U;pudF%{uaqB-R}O;wzlm46h+e-@=>|1DbEA@V z_C{seT?vXKQLl_K>XqX^|FyCSbnh#_R<`Z^wes?t@k-&81Z6Su)dV-oK`o$Fpvj-< zl<2$k%Ic1Z%F{oasND4OM5Sy0M8&dwqGAJY0}kIdQP~691-m`4bHL1xZyoFxf$Bjo ze;TLUZ!#$r#WyHf6*nlyUyf65+BZe%2HJiWr@U2^pful%a{Nw$GVaky$~2T+_M=hC zrd3hO>cdfrRp}5Vd)5$TWZ4kq-tP`knkt4UAH6eF@wX)^lZ%HaalaX=bpLv&vJLdr9Yd7+ zfyZwcqO5(bM`^vgSlLoptgJnRZ;+{Qy5a`5{cDfX0h(s+QNAqe3CFP!ZlzBgO7ZGx zO7N*^O5vJmN?Q>4_%uaoo2I<;^fcwjBDeunBb>eO^(agFCL4J3o8rO$c3N4XPJ z1$r2?2Gj<65p)3bF6aZ$UqGip10ds;9%Te519TH;HfRCpe$a!U6`)p7J7_1U8*~Wt z7tnu#q^&*5a8NdA3g|Y_9iV$a4}iR&?}Ijic7lEZ>IVH0bQ}}}8D2m>Kt-T=AUkL^ zXbb44pf^AVK)(b12k1-C8PGXU+)sLx@t_>gZJ^sh4}cm$3g{V7J7@=J59nRczk|L2 z={tIq1kf1J6wqy;d7xTQGw2!6tDtv4e+8We4S)>WdXz*^Dkuw-2bu;lgYE)Vft;Xb z(Bq)zKs!NuK<|PMgFXWN6C}OZqa=aGgQkLtLD%Z>{~Psq`epR5pY|wYLDWA(fBBx8 zyv6)SW;9l}--rHGj_~RVsjGBa}({N35p$?aTFagp@FA$EOugf5F!2{urex!xm zW#N$sGB**z-6Ux%^T3>uld>gTgcx70%OMp0fiTa73Yg6E*nK`>PRgVLX)?@b=?V#j zdmzlGNVu>G^BdXyRN=n!=9?ru{51Yn-OYr;Jus*9<|1jjFrUWmrwjM)(YHu5VSbBl z2BB~d%vnDAR;d`~H|uUA6z0I3&!S4CSuiiul@bbbV9pm&Wi*2vpQD>iD9nL5pGM8W zQ7379rmmb&m;-Y@kGfr&3-j^1I|zk2FeiD^Jn2rDr|RYt3Ugr2h)I>wT`*79Eg%%; zz?|We?v@t8JW;ohP?!UAk|upuS`71O-93cD9GKIWbFXwC%r8pcBNXPqoRd*Y&;q3K z{nGt}!W^hO2d)a(3#d6S&W}}@8^=~}E z;6h1N0^O}Hgyzu+1}v56kK}xWJBvp(7Hhi*b8N`fRoRz%#Ck8nTpU#(3t9(8m^auS z!Z9eAkG|BL*7amzb3z|WR%w^ot2*5(SB(?LWEw3 za`9rr$nJ7tF)g-G)OBctL+IKNrp;QVp1V=kv=R0VOKYtnd~JTPyCr-MBiq4<;ogbP zrLK7+%-t48BTm3@YG6-m*9iMYOMN2_l&EXyNOMk~ST|q6yo&T%jo5_6m81ykaQ;=z zKps@@*tS~g;7W#Dj3D$EHC8GZE$KaauimAv)z{%C>Ro!LzJ8<>N2`5x{Vx?@*Sx?3 z;i0bQrGh3;V}Z~csW!EZ4mUR-kuPEIAx~DZodkcPT?unCCgnSYrs@^c@M|m-Lo&<; zi_>C#Q0%JWnTboxL;2%ferR_{@kkmUIyFFlH-4jg@(*>^GWb9Omo9bGvQ|mT`9^=V z|A?JlD^6l9!_Fk!Ub);u>4Fl%i*0;IZKxYcx!)MRI47_a+k4@IFxgjhukOs{^S-oe z1r(X6VmQ4@df0ta6OP#M(NS`Yze%9M@(z_NySG1ttm3?|dYnbLzjFDod)7Z0cs zXbLg+P2oRi^Li}xB3!EX74@XC!*Q!dTb>h#z^I8(JH0%8I8&KV+iQ6>Eoj>mfP6)F z4Ypc$zQ{103!=X(r$1C*mWQlPYD_pVMrYLE{?hV?WVJbI>nMMg1xEu{*ygL}O-Lz^ ztug$K16`h8kq)6tCpVFQ2e2lix%blNus-{>ItO1+CA@H=GoKZyef zf9J_VO8TdW7erxqfA&8c=eREqDQ|<`1I_!-L&_o$#S{8F%KU==LOSr`)>hD%Q^zw$w;@$VfGhLh3;~@Jupkx_b5+;&VnNSeVcDvRFC2Zk=wTn&;dpFC~wE~C^KVw zltsoK<-IuQ)8b(UA~*E6DFN{fQTe!`gXaE-?|H*i^Y?(Wli(jTb2z?}@eP_e0=gtn zUdo_%U%Ad2nY>+lVt?~1W1()Z&L z-$T-%&jZaKr`pGj?@?BPPJzhn&g*-WqagZL|0V*muKFL&CyD=57wH&(BL5o??&^N8 zZjLx;afY}S94l51%8(en?mRv}>OSZ9b zDvOU=R5|Lgje^TWgUbgoFAr~f!>>9YyanIK`TO;VZ;CSVk8(^puEFs-yuZrl1tMKv{d;nL z;ngj_g$<=aIP*a!$!a|~p6pS&Kxa=t24S3Xi-ps-2<)1ZYb9{41g@39wG#M$qy(IQ z$J;FUzZnRflwl>~TE0#OU=-XPV?4t6>Iv0+2jh0e z4#q8v?Ti~4+Zdl>Y-L=_s4%W%Y-aQ_x*45}c19~>HRBS-#f%FXD;ei9mNS+y7BkLZ zEMlC>Sjd>mXkyG{lo`_)QyEhjlNb{jjf@6HiLw75YWemto?#3!e!+N>@dRUl@fhO~ z#>0$0#`hTyGQPujfN>w=UdG*wos6$C?qJ-`*ul7kv7K=vV;kdBjIE4o85PErjLnQ* zMmM9A(avaPtY%!oxR`MvVyV=7|`V-jN` zqmj|TC^7bPKkH*W!x&`zg7GAy_hYraxEY;{c19~>HRBS-#f%FXD;ei9mNS+y7BkLZ zEMlC>Sjd>mXkyG{lo`_)QyEhjlNb{jjf@6HiLw79?jMY281ef%LSB8rc#`o1V}S7( z;}OQgj6TNq84ohP!+3ykALCxe-He@#uQKjn+|Jm+xP`HuaU)|J<5P^SjB6Pc#+8iC zj9x}Jqm$9jXl1NsT*A1RaUo+R<6Opa#xllY#uzQeeWaW|00?LOwuFn+;!0!ZWcVIa9PeWJGWOvW_E6d>6f7#FkoLdLm_ zQ`vrduR0ItU~FgH$k@i%%D9$MVe~TE8LJtWFfL@QWSq-b&RE7cgK;WjA)|@$$k%E* z4>S50-)B6?_zvR%#(j)?89N!bGqy9fF+RnpFs@{5X7n<;8J&!FMl0hI#>I@8j51>y zV=AM8QDW@>O3m*{#uJPI#$${}7!Nc0822*nX6$5qm2n5-cE%3IEsX7q8yPDZ%NUCp z3mJ16O^iv5iHt@@1Ea+F#Tm{g;|az9qmS`@#)FLSFz#b~m2n5-cE%3IEsS#+%NUCp zXD}8q9{H!5uJ;)aGVWtEFa}Pm?)Eb7X6#^WXKZC$%eVv>hkm*c7z>=sSPqN=U&dI> zxc#gePY00f+nL|U{8P-gGOsYdl6f!lZszUGTbW%$Uh&V$5YMWSq)a#5jYo zn6ZqpoN+E=CF4TI#f(cBs~N3~c19vx8{|^X_l(-!k7>$gHj7f|sjH!%ij51>;qlqz>v5;{pV>@FJ;}*sljKz#)jOC1T z87mnVGA?FZ!dT5{WwbL&*Z!`Rz_k*%Rsz>b;93b>D}iezaIFNcmB6(UxK;w!O5pz& HCGfuiljdx6 literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/inputs/sandboxd b/tests/iPad2__1_8.4.1_12H321/inputs/sandboxd new file mode 100755 index 0000000000000000000000000000000000000000..487063c639c985f3c027ccb213ab32dcb4257542 GIT binary patch literal 1116096 zcmeEvi(^w&w)Z|KNl70-fT{&6q%TZMTS^5j1vO1i4@G$ts9F(i(l&5X+9sw2TYRO+ zc#%OpDJ_#CFx7FKf~dvU2fkV#e%384g=zeN%0Py{5ilOU1&-HgE?BDM5wYofFH@DrKN(ltHtW3)UKk)hY86+tK!K6 z>nyd_$TEKU1|gG?_?P#Eas~M|H&`kn%Q%8Ea**u^$_URFUZT>D zT5E$qoAHBj{S;+%BJ-y|*$%lcw2X!(#}CWc(M?D-D&6s5c+C^rR9;?budBbPAd!6; zK^aq#eI%lc@DizRE>zPo<_by+!eV+r8^xf08g)bkmV%Z?Kjr0hHRVCQDt9zEFPUGU z30)K09EG4Z8jeqSd5z_#$`E>>+mNH+npg%@jl2NR&ktoVu^&C}5YmH6d$tp(aNVr2)i*?zQS!TB{UtyDK^b(4$seT*Tdif2)mFFB z9$7{y%FrTZ=?}|LN}%!x&XJH}M3!Mj89UJzGs>Xjd8v<5M!mJhY28>)%bX}v?+1iD zjf~#i6Z-<&71%h-Jib`@ppesp3P2#PGDehbXbrOJ32WzaEw`QMje+iIbf z>xX?ghBD$2e(Z;3$mxT5WSLf38Z2^HWM4i&8MH4S{A3y9*)LfJ`H+x~+35OXKdGno z+FE;^Tmb$=wxeTMH!eI(oAD2Zd;C*gUQv%B9sfj@(S7>Oce7=O2LFwQ+xMKOL zn~S*R<7=9m5CjOHzjFZvYHD-;|Y>THve zMXqPVgnG6i&)%OJKPt>i>czx}V4o-U;S1C>u|3qfWfz26L&#jDpt{|GdAJkb=?ZVa zJj4Kzc?w?wp6c>dAzsoE#}#1y@AH2W_&*8!p9KC-0ht3C220ct zpM@2Sf}=t`#*y3#W3ool4@ecN9KEE9{o1A;ij8?qh#51Jj|1`I$pBY!GEnR~8Can= zCckbw94HZY1xj-?Qq;ix)h7cR$SYsD?6c0Qau#n!er*OHGo&RQV=nbBesQ&W>!^mlyas`|QG?He|(V4CNHM2B*lOZp*>rF42EWN3gQb#Y!v8C3<^ZvDFDn;I3Y;EK~Y3}D@jzkFtVUe&b zkhnnuIYqba@J=GCBkHjnGLxs$+U5P1Fh!*O4)$PvzbfarfcC^>@amx$$W7PPF=kY& z#~RT4wdnme8*OdcCT3;{M^fGnG<5CS^qTGDCX@ee=ZqxuEm!3xNv8twt|+&*g^U?l zRVQ&XZq_|5NiBUddRrhdF&F(&qdzURq29bTLb}CQm=_-J;{6YoP9DpQLl4yVajC+Y z01>N%nATH)RB^X=3Muf-Sfg@lM2(c_HTj))M~SF&L1wZRwLa=q5mjeS3hSPMy51XA z^Q-;eJ3jPZaOgSKFy%DKoYbfFEHg~*TkZd#>c9OL8n}L){%uHYhbf^i%0t_?q~GNK z{oS<8ou=u1YLBY@=-7oDb)TggGWufolT3B@YX2EI@7#Wxqjxm9-+q2?!<_!;_D~Fy zuI)A$F7J!;ghEKt(IK6EavwSWAnE#Q=NzW{m=M#>m`SRtKa@t#Pwf)lB;BEL{biRL zqq@yVN3{i1ok<>7R`vWgt~WrsJiJc$BtZ1DTj(5!5u?ToB)Y|ztdR;W zGn*?Qvl5l4X;n+xM@{~EMP{0@Og1F79Db=HHN$AsxYTljQp*mL+D1ri>y3)k9#*7w z*XXs7+Q*laT3TQ1L6R*?P0pJnOYPdxtEkkr&I(FRj-gUpXqX165$Qo=*O=?UNqsRM zGWTQv=PaHR_$$jwPCMI!p6j&Gq8xtC_?*~x&S+cd6PXYF?-yt}l>w(lddD)}KfHzv z842XbG;z#O4{_NX%fjWX;p2FN(1md(|2XDa?e8@ovZ0?2Hr*(_?5Y!LvU{X1m(f4W zJZ2)kXI-{xjG39HAjvNdO|z@Jnez`aM=`EOX}>Fd^QB`IduuQ8?*-_KmnV20D0 zcA027N!_XiNs@|T5W3gYBQ?3I6HeC}=Q++kGsMKvbVtT&7@D%(l+^u)M5I-z5VE_d z^7K<yF_G=H9g<#4x>AN~E@;;CALE-v7MLetzHGRF~5$8aW~`&{?nL zkYx(=zgLze?|*C>9V2~36BjLLh2_FuEFG56=<+ii!W_fov%J4*yriV@lKL%AS_Z!K z3eSG!s<={gRL>NUc3{^9=E9U^ht=KMH)Io`t_&HR~HTT`nFAh$KP$W1yd0 zAztSBJywX{2NHUIA4u%~eL&weV0*UuY+#4^Y+z@JC(!EBiSeFk;tbDpai(Xgc)90P zAg}9GU}68MKu*u8K&BWYMz_q`r)`ND`+~i~Gf9kUxoTg6N7Itap9<()DlyT+?wQ9k zZX#akncdDva|8Mc@ypO$Z|Mr^ATjWt)CtDy!qcyQCEE9Qd#jCx>(4$jW@MV_7}9l( zz@|bEb5CoANX#DtIl7}5^Lb};X2DLgyG(OW%bFA$i&Q&JbNV!6IofB&a#%Wc#$=;B zIvdYLj*gD}*y!*+p93Rgp(6)Pxtoq%QUx77D)Z^e+zXD5_AKu^;RuyPQx1H280}z& zVhL8pO0S?3GpdE^Y2xWXgL(@7HmWC!In`5JP6zIL86(i~iVgDbaaO-n{d>st+Rc3d zN558_?1^rP*;5EfW{PopPa#EA8&;SONEZIX6b~yhSf5S>)cr)%d8W2c+ozJIf3L52 zVO+kCbWP?NfuzTOQXpiePwP|jrGd;j&`aOtccZ;ds&}lccQMerw=LVDm%J}vj_i55 z+;gh8(Mr!P!kl#4?_P6wzX!jJ#~Q9z4eaO*#EDaWXSSVzZk>T{&8v>)ghoMEs7A%ajAfFC zWnD2qR}2$$rDQllSA1WTgnAk|lX>6!C6N-ls4KCG#0q8>Vk4=?)!9n_Q434erF zuq=>}8T1RHTV&sE%g%mPX9k~|v--TNQY{S+@V>cnIk9bxoLW$PguQCXF?6#}XQ6&o z{sNMzb!*11X0YC9RK2QBwNyMDD`Yp~FIB7LpwzSsjKOZFP%ycx3BFl%To^%}OM1ic11hI$QohFL*h zOAZP8TI%kQuNBv)dxE4*-FHklF+ftN*CqQAa@yMh32~4XJc+1213wuOW~i2GsE6G! z5cEkO>EeCgB+W>s8l-Az;xr;j)e1NJrpYajY9$7(JF$E6SR7GHuMMd>nWThdl0sUU zRu&$YYcLvKozcemrD-4fe+$2a3Hc?y6F=pbXddZ`lWo>q*sRp_l+#9Es>yBI-_2Ij zRsPDePmZNxoxbAq)pTXYsy@9h=tIPmv9N15B>lKu)9ZhHmdbVw{b#tFggF^>mioun z+u$sXPyT$z%{I(K%*Dk1$2Tfm*bKmss!L`jYoOtYfIO39V0FX)qh}lJvq;vXy%eR_?Q%iLd`LhGXS$Fo%n(TCS|O$- zdQYr-wKScfyPVZh0f}nUiXr{lHAwX9ouu64iRKOtW03AxvlI4ors52HRWYKkp2-x5)2r z`1kGQC$u;B2ki}bL+yQ}tH}S<-P0rH)v~0CGfF3y5I&>Mdg+WJ-J$lCj<@gD|3&+X zC$#VLfk=6F%I!1SjCtDed0Lfpsr|!6{fm}oXjI=j0#mJnc4x!)5Z^5FAB*rGChA}) zKiyx>`n1``q^r9N1Veg!pNZ}-EY#Z~DK8C8$Nqvn{~(K5KPLutylta(eE%<62i0+! zu1MMaPxOdI=tXFbM7HsBIe(Eq{(sfR@Hxgx?R z;%uUJkcEYYbut;Zajd9n)AJ8`FNa^JlIlkEkRCUpl4jwYi26e-1L{Y2ch&Hz(j@h- z`C>nbQo|$DMLocE2?dEq%_YZ+eS=#Nf>SUCIx_T!;Elund)S_}poXbQ>v`S4YnOEbRxw z`TwE9x2lnA;^1XU(lF=0o0yd}|DmM$+k`ZK8YbOE{uMM0+l!s=Hg1NnUT_zwKiP-B zXS*-_bJuH_337ZW?ifNBy%mbT>x~Ql%zkUREk1|p;BBvyZlg_=q>{>Br{nWz7fJgV zzQD)W)5JZGQ^fxJY}&Tyy)kXEZIjxf+B9wIHWkkFwEft%iKhajMtN%p_|c9 z?vh~N>Ddh}>mi(j75R6_dRgS(CXWN{D@IKqX|Vz{Oj>oW*!SJ7#1Pa0hk15yk^dvv z=Wl{UR-HRD5S0S?C&}_(2h+gjy;lFpi!uhs2 zf;NSHp%Lx*aJbmF{ubI=k?N=Us$R~wT}eUX-x^l)B(uh>?N&*7NJ~$TVdWi|al;Hx z=feBLSLomLcA>3DUQUF4Tfy~rMDu!o;CwvfHP78a}HyPCIZ zV0UsRojetIW8spTj{_X$8{5jjUnAm$f6l%@3`QxdneMSuJE?ASK5YY}q5dq8=(>-i zW1G{F#GClM79Qt&|@?AA@G0B}xTryhi8@dy%XZr)y z$!&M?5AnyUOCf&}Q!ty(x^$e2J?on4i^0{mW|ruG!4qlYF(N$$bN~l|n}A|~hObcg z7JQ4qW58};7r+4~AQ#91T)+dseZV%L5!ebO15RKzkO67OX|$8PV3LFE@@;9SNG|X4E>z%b0zL_(C@6tmnEWyL{w7s&}RXc zYZ}6jDrx@oCFlEp3Y}NY?o8^$j6$j%E+c;MY|v1Qrl1AoFaBl{IhX;b?%h*Y3}6q>F%WV8E$?1L*86+-1cZ- zo9=7d74F5GPX)}bneN55QvsptO83`7qPxlVT%b{RT$t*PYMsm_ptN^v}?Nu$S z_bhW4w=Qp4eE1G`YVIxW68BAeihTRz-rnrKmz#}s!c@3;Z~h*m@5xFkgCz)Ex~IsW zIt?6F_3N=O*E5!{ACEBs>6>|XkNMzHiPS0tNu4NXm>E)-{Br|&R{!o!`C)OpDN#?Xu-!HnB z2<8@*baHTIe|oKUES@b+WDHaP@JgVJB(==itCQHNQ+w5Vy?aiZS%ii5vb?@s+fVd} zGv9h>PFsn2a{rt*lC062#XCDm3N*@lS9{XFJ3a4UKYCkxu`Me35gV-|!OIx*eWBJ} zHr_hj=}B_y8qvBzz4j8V+cr2&zqH*fF7Dj9jQL!zXOfsyl_U(TZP!{>pZ7cR#3}lk z)>?6nr>@nt*)B$-Em$QF6EW{uMy%;nL(h#vx}!utL)7-KZI4Ml>zN@&qg8sWU`GaH zksdQ}aJo3n&HJXvbAOrtn5>UA(>zzT(>%-kbrmR|rFp5p zr3ok?SF2;DgQ~!PLsBqmTZ(xx-x3jDTg-Gx&=WsxSfs9Wxr+CT(wU` zn$;2$%lOhRd+Ez7+plQbU8L`uqMx#7YRjoWDV`pb^_cNoAevE0{s9gD8F<}}3tw3kxPPyh|W6ab$KGE+}4QZz( zJ@G!T&DEx=zGbJAp%aXDaUsuswb%L40C|L2@;3hJ^0kY}JpZS(y|k@4m?=53eVyMw zbsw!^ZD0X?qEw!T@@d&ApXl3<@=5zp@&dFu4l-JRvRQ3@ADA*{4(=f~yDVp(}l2It~oydjGv$LK^-a{>P${v!k zjZ58==APR!XWz8y`EK{-9QT?-^V~Dq7r0*xl6Zl8Ut~6>C}en#xL3M&mssc}_cP+4`l~ zGtEH$@cp0u>?Klk*e50y4D{>5mzMq7qzcb6lzmvK`5C3=r<9rxj$qG{V;14fNuAh} zoh>26hYQbLuc&$U1#>kkof+-G-;YN7@%O_~{bpABVAPDiCq~V-0-@OUh>exDpEDf4 z$hDs9uo(q{@K;CA3`}B{3noEpn`W~eC21vrMFg#p!%)6@%QrTOxC5Z%LD zY?`rnqD^LBVDWtNNpK02la`MB1$3fJUptaijnxx$Fn8b$5$)C{nQaVm<&1RLsMIq@ z`sHuKh`w5z^rlxtJp*rCd~SRx{~_UiHP87!ki8e|{DlPg;G(i~$)$S6MhkQg{R?;v z%iN5h!_K=GXAZ$#4SnvZl1_Lv{GS7*v#)65{4dKTHF0zeyGOjcv(f$MfN^%yFX#$> zDlps!FV4+Me>z997^$ooyBwUbrp7E3uW|45PE{jC$8zBgJX2Un&ud*XZI`>(&>d(l zu|2an8qcJbcFlC>i$(q$!3&Ta7A3D1(! z+lH@02?coe736Y`o(jC@B6D-`eD7>W&F7V!G$*BJz#lkqG`9`9yX_zvq4ji>vy+1`sWQh(-NxlO4wEt&fXUAMHE@GGB|{WscTqz7n&%o}0o{voN z5<^X|xt&Urq|9$Uj5?3yv(M~i%}f+$&%7egBn zx~+ho--M^FL8z&ap`ofGU!3XQ;0aMWElJxw6Z>OrcOtxh(n_)!cS83ybYwAWJ?OoG z>J#d#7&YTLJ*Dm%CHfBD3=d+_LE3{W`^_G-Z-EoDr)1RJO2cl!I(VjI{(jnP=iUqt z?8hkRoLiyg^S~_~{S1<$Ax^OjTECFSE)pI)y#~7 zkuQHOa>(b1p9Q=w1{SbJLoP;rs5;Hs+(Ey&_D@ez^f@}{XF2;@{TFCS)d4iR`ITyvx z_vnwJx3cc!j%0ae>|b<%7@!+2HJyoa_}q~!ng*Ie?c?kbDqoFaFN_Gee1v2ZY3Ys` zX#YEl&}I!%=ikre^6A22_;4qlyw>AFx_8bM`JR%k6P*J{Crge>jizCx7tbxhT@+kH zmwxe3k#9#%jO@!4`SvbATIRYZt`j+5f*CbI1E|f62YY?8QrbggZvNi&ojCn= zZQwr%s7q)b(pJdl9$0Yjvp_FS4L;~f$4NSNh8;LN>|!N$a6O%Axp%ZXTUhC}fiv(; z)A>9xDEqR`T)q%bs!0@;F3s^P$W$6A^W09?56I6sP}Z*DZ{Jsnl`6<%mS(LJr}vh6 zZfSo4SA}NGqA|81h7hsPH@aqBCzWglY#J-=8vF$Ht?69fe#bs~JLSZa^!$vK9v)cZ zS*z5L1J9o5OT@OL7sIj#Xxc*G5&5J?#h2hT2q(c(#bAkNT{|(L)RbU~UU@D*z-ha4 zU_-Rs3-~-d7uR+#;&Tq-3E*C~MYTtb=Y*dH&bp{{Q!A)+^AF-|hrb3TJ~g}!7HP^* z3I4_nt@qr~UgSF|pI&U^;uRgz$*qayv)i%fMV_6*v~D%O#FNa=Z)YVJPLhn$s_p9! z+|i!rmTfB}_cT@jqg1%Px|1YTyIH!@mTYdR5fk)ufBKj^qm?lim>+{&k94UJ>neGC zk0_?<-O!O6Nl-^xM7@W6{rIlgo=S|E$yg;?-A4a1MT0itSx1yEm~xZI=!HGD7N?lk zUU}HSXTcA6+WR;xOz(gurEfr8^wcctkV@4vFe&A6PqPhY+OGF(q}l+>neL|E95+xc z`^?6Hpe~$vGV4IzK?A=4J$?qO-jOb9rRT#+)84aE4Ll2yo+VptMjnl;u~zIGrt4dF zFHMuq$3v=J!%_TWFU@Vuk;k9&pOLK>)ef~>!gb>%X5v(L0rp9A;mNeRQbn9@fKC-D zNAxKo(O(T@ik1Bg!ZSgq0yH*7%sNokAIwK<&O4apq3vET`yn^>(v>CH>X_lhSXn5| z`OD;%eqC5XJ=8*KW0#cBSa_FD z(H`m7@|RJI3VTdbJ5X;ho~Fd=KeXZ{su4lSkd({Xaa$RhmnvIO&Yvsq_vmRUog2;} z+D^`&DTm75Q&I}T?;3Jp?$EeksdIy}LL2lr?>y2)Yhe3n3+7^fU>vuZG)EHV*oT7} zIXCC`=?VO6YEcs~=hL2;+n&DPuL+M9HF7QkpNw43D>jCe%!6}}hBRp3U@F$C z#BQ3Om0AZ=JQ@3mA@g7;WS86$dSV+)v3-!qR?D?rjhS{I&W6sqNLK#ANpf2=V4+g@ zM6@@1aFHi=OdHEwON56_7tVirgyuKOElC}3N#fwF1DAW4ML$D|7mslM>C=tWyJTtF z#qHZT4&xXz$oX%QJrx>C_d`oi^Y=I>SSrsZ&bQVS@=9n5>X%3Z`51*+^4V?i;hxbF zf;E-7mn*=z>`XzILeFROXV)ctmrWLy~St)JyAybBLxBK zwPAOA!cEIRi}hP?Y~u2tU|TA9)n2u@3~LI#`P^+Nt4V-PmdJ(4RQ~Sz6T3}Pog>BN7Io*e!hD>RwSeG z20R(PvCRlCy`aUs*(9QGt@87jg@k2@xey;!S9b%F+_Spj@{5)=~pPfI-1iWGa7h=u;Qa%lO5{vO#1Q!na4VHWZ119b1s$aj*M z$HgW{I*vSual5ckC$P!U0wme;z+w2`*vWJLxpF%=|1mi)J%youG~IPfLCbY=%Q@du zmc4{dMS z#%rT~5_Zw3v-+?TJ5HQdw5;bD{DOq@?Y|qT6}d6e`}hq8YLQDY`Db3-g&}ti_CO3y z$T(k}L!C_PaJFI`5VOR?;Dn4t&h>ImIUMO3{2t`tqnwX-n5exQPY=%xPYW4I9Mwq| zrW*R3tww$^-Tf{}Lg)^;7qjG&=r~u?o%B&gY8*|HS64=Az;8+JO$qMMX&m|w&z*6H zX4v^*&Ue^MYYf*DoKuY&Q2u-8N^yVn25ays0B$iG@;~8y$yA^65vGMDj1A!a$Wq+i zC!{1W&z#dp47y&+X4>Y5M>>zA&L>U&ujFxC3J*FL;qMGb_Xoqf$HO75;iVpWvP3|C}CagFCVpHwm~Dd7r)eLr${CnMz#|H6}? zoV0o_dD4pB4Hx>qSQCp~6-t0j#rO`Z{_e!O89H-i$YbzC>-RI#H$&7XWhDO)S|Fbk zF%prVywaNF3tq6+}1F7UKtl--2 z4|tQWrTzg~BXv0Izn3fK>B&ei_CtQPqNI zO`NC}HRx^Pu*MUGn;2cVLxyuzoS3G{=cGcPdG14A7+Q)Q%WL;dpi)*=07$~%Yj)sy72Rz|w!HG0;{ z`*L^{?plcSZjX)H(cC_#?J)HDa$WFF1xan>#AO=ZdX(x_8E)<{((|x+nY^l(hL}f4 zDxPQ>gS}=1J;E*@;e68z5P}hk6R5t&jdYnAX>gFzQ6rLBdb7}PEQrGCaWEAF|MQ*D zvt!LJUgW92nbgZj0eV{_P5qL|cX%VxqMfvc?}mk=%>CN*Kpz>q3_dmsS(&htlKPlM zw-lW_P1Ece!o9B&7XCB736o}^&%kl_mfkZr`SKii_ArgM+77$JU_XJI#@((rO+HQ@ zFREMYFz=hb0MbD}iY=};IbUlI&4F7af|j3&Iy#Ss?n~|Hx{RN~yZ9VF9pN9q&XdfN zUX$jLpp?-Gh;AMi$D zRn+1WJRoC~YsLqCm~nc4uS7S9d>zbTsYRKtc|CP<7xA;qoCydrJXHUKh}< zzFp`j@^mxFkDBmTukF_1NwK>7UD%U5&FZe;T_{Bl$Itf}Y3*R>e4n1E(Q!99HOSF@?_Ej6Qd??2klG7ry57WrcpNe8R=zG{#wA2p!RdY7B+8AoSB8gziM>VL24DhUy<9pCaK@ zJX(>_1H+6|HLOLCj5bEP{}}1!d^_Znblo?Wb^qgz#~sT!UyU3_IT~&%359RCL|X1g z(k{G2+Qc788+VDc=Na0AAGYBOIecP!Ke%LC>6JqN2M%h3s5aEeX{bar_>CH!NzzcE z|FyemElu1MVF5z^jy>knuu$tsy1e4jkzk}xhiKf{p+evHN%Zbl(Bsycqx($0M=LMh zHdDh=+&WO`uXE5E>DsA>U671KdPlw!NAJajK=rA)tI(e<*I(%Gbs~?V)6wuW7^wrT zOH^8i@sm7gTk1=N{zkcUcv^CfkT+!VrBtE>RW*MvY{B*+mUkX4^sNZ$rGFKE{S|C? z&=;fjy3qf=`C>a6Nf;t}M%MMvowSo(g}zsHJ7q~+1xuzDAOS_|l7uK>xjRQ7hWuXm zr*cV!{usHvRK~s76KRDtklRw!RB8#q3LMqpWa!bragyC>lvq;03(3=3 zr|g~D_6GX8Z?MqklJDUXl8l-)_%$>m^$g_ThJ+?fZ=SZ_{1;8yroSW!S%(e6WhwZT z0%1}*c(#Sd7~ppX@Tjkc-+a)#CTtu7gS77RgN1&gw1>)dcyPPCB48(g90_J#&Qa*U zs{(BvKeaXa-j(->xw3pe8g${=IDM|RpqasK4?LNYw1d<3)8|h3Evl5>T*j-Ds6Nad zperAdzHwzAD&wmW(%=n-jJZrcyD_*Da_D0h+IA4nwhH}Em(X#^rE7;!g3$eg^vwBV zSD_F8WRhVoU5+DwEg!tFRS#EOBFJtDn}bXpZkP#JyiP7Cg-3Vnyy26w-c_Xck$ zrS09u&BZhDtM?e(X@}BVGH{yJ)fLw|ua&OCEncH*ijg z@4r)Uen@Lk75a>FEhMdpo4I!utmBn!5Alh6u5!;jG+Sh_zcBj#M}M(R8FFgcn#-S^ zu{XZuvbKl3Gsp}`nUONkqB`UH2`vf?l;K|D_oLH0qs3#@lg8pyDzUMe74xbYF<`^p z-!|>|4Ob#g{T-1`V5gaBq!O6EFEkdv$Nc_N&RV(TIGoZm!W8WKv7g22ieEdoH+z%F z3xCIYvxMiT?O!0IAEm$Zqw5bNIlNRm60!3pc*3PgEA(?Yv~*gE4!&w9&I^)o8$gX; zG~J~9=8i~l^3$rbxTA4l$?s)9rWL;rEcBmO=JwuPlrgTS@c+@mFOm=jt48(vKG|QW z>lJLcX*oLi5IyH$@SCSehmAPji0Yh#c}Pz@rebWhqE3wNoF?k@(?u^~u zC(clGdK!KWZtCrVzkg$&$?ubO6n1NTjXi7&*%l6G7lr=M<@WjU)SSWT74`A+(6W!@ z&|nxNWe=GA>({W)(bgJ$3t<0fUkZK0*quew-Mormk83PoaEFd0{mi?H*dV(vFfK9U z0Oeeg|A%U-gTwWZZ zw{vG=cE07+deZ3_bVuXYIYe58I}+jkiwgG>h~zsL^j}o6k4&VO<$DM!`5pq1hH)Q4 zCHpT#dJgvvjHuy1@onH9Pr~Q<^=m+uo>F<97PTfz+NGsy_}Sit=skp5P7P zfBkdv*Tk^0uh9Q0LCM&smrcianD%VM%y~w(EkW(M3wIix!>YsTg6WGVq%ZJ4SC4R& z`Y>H}igEXjWaxWM{xh;(7y4g>2ZDI?Afy}DdR<2g{hx-_km)rRMfDvM@LaW>F|+-e z)Mx-_JaP*|nlj6)=jk2$(EWO4jncToWRR%Y$1gbb`exOh*YV5b4E}-5Q*cKgH=c2u zJ+p`2M-1Lr|JOfv1?URV)LiI$-Vy9q35)M>IS@R*FZ3OhS2HRHBK?s*`^_X$Ir8|G zJWD6!DewpHdrpBYu;ODsPcn#f15Se8mvyxezWGFH5b1gOsXLM8HRst#(qy-3c6vts z*(TdD;m_XbQUF8{(s3VF0~o>gio?=A4(prl!g@Lww7>kz(13Fi^MM+sks@H>?7e1!jp621iCXO()h5q_@{ zJ|E$?DCv_CZdbxn5MH5#UykrfCHxA6*C^pJ2)|7Uk45<1O8Df?wRplwBpy=6K5{O0 zUD`t5%OzABgF279^Ee~TXC{v&&}ZbZkIS*Aqgrb6FRcvOM>XuDsX!y!$49)`BXKWVis}u_ieN)Pf17YdlJ{7Z@AaYrf2pQ z_?NB)hiBi5``HZqrms<#u?nGIEPs%$C(#9duk0Is4X;<-BYRxaTZ^>aH}h<|2I)RA z1#{2pXVNEwe_!FJgO3IO2ZfJ;em|qoYS3>gv~ed%62EbMeROE?>X=@JEg0143;e;` z7Oocw&QEFTpB11MSX!o&NVA3*58LI!_^y>(#@b+$GCZg&Z#iwT$@Vq(BL1Bg+Qvt} z6kjRy-LxQhk4Ih^U!WGxEdTa~{?Z1&#=wdOe+XwhbXSgFPaF@eS=Sv8{(gu^dGdM1 z&$~?ix2~1TiXv$baJL51@DC{Aw;ebGQTH;7HfDX*N2J4pCVy@TNkLl(^+y`Hl0cfS z!2j1A8q$dMj@`qwFo%~5YCJEaPi3fwLXu+kMDHO|!yr9lh^4{>sK@VF@C@*(*9rC~YW};U z1^(L>1hu`uZC<{+Jq7-Ca)1yFObQX=gh{Q~>k6^lauYkqs5PzeSI(M=lkNN%WAve@7Whj;uH%zD>ei_J z(eVE@?a3%tlG`^4cNL=XyF|)sJ?K$?w1;{ET8^HqX+6!fUDydOFcbU>VGn=#XUwqg zIPwU}-x0yLM({f$`1>MwM+9FL!IwqwD5j<`;O^~-bf)6B3j318R`y==>5&Ve={*4H}D}sMIg7-x5yCZm41m6(B z3laQ=2)-nO=OXyL2tG4{*GKU25xh2n|4u(qo>Bz=MFf8~g8v|b?}^}Fj^H~Z`27*Q z7{Tv|;2R_Onh4$;!Iwtx#S#3{2tFr*PmSOcBKWuno<#8H=S-BZH-i5(g71ys-;3an zMes)=_>Ks^HG5jNo+-_@^UyPXxa^f_Fvm4H3K$!EcD*OCoqKg3pWKGb4C?1Ro#4Ya{sY zu9_%MDT4nZf--;CDpujS+lJ1aFSuOC$K=2!3ef8l)MMBW?0e;UE}M)2=N@W&$fBN2Q@1m7CL?~LH@i{Kp*d{qQr z7QwHG;EfUd!U*0V^I3n>DL$3DC+lz8F#pOt6L$pwg0S-!E)0T_=`ql7tz>!xv{9jl zK$j@A7xX5D{u}5A75a0~qC)=}beBSZ3i>03{sU;aGSvHf&?*KIpihIItI)lmZ&v72 zpzR8M67(L0{!h?d3jH4FQwsey=x-JJEzno8!SY`RP2UMZ>pBMdeuaJo^sf~9MbIB9 z^b4T1s$lvfpcgCjA<%0T`Weu53jHh4KUe4u(1#TI0O;Q;^ghs^EA%fwf2Yu`ps#|z zOxxxLov+Z3fi6?%pM&12&^tl5DD=-jzo^jLLI0;hKM49`g}x8;utGP1X5eeny0(H& zQ0RKl3l!P``bLGW1-(k4t3lfodK2g-g{}gKq6gm;~9~F8gXu2Pw zbzKfRpwKfwYjEX_hU-AbEA(X028E6ReVsy20=-tD)u3w>ngM;kLVy4Lg+Y%(e+&8* zg${u3Rp_rk|5KrTprfLLZ5Rc8nL-bPPF3gu(1i;9chGk!^j|?YDRe*RM-}=r&`&D# zA3+~g=#N3atI%gapH}ET(0^6v4?&+-=-+`>;~%`B@;L!|jza$ybhbjj1NwS}?gqU= zq2B<#L7|U>-mK8Cg5IXkFM-~r&|RSSDfDxo4=eOx(61@`xJUJ=;sw$0R4M~wu1I5bOmV5 zZwFna(6@sAg+i|beN3TCK!2>zD?yJb^i7~+=}TA8{$-#SD>MhX zTA>R-iwb=M=wB=J643vt(0QOg2VGy6Pn7p?RORb!o9gWJMPvFcb(`z#_tfbv&P`it zt#u9hv`V}(XZ5<}tJakktXNTAwCdL7YgeyYS+uH@RN8B^Ee=PGH9J%gsj%A{@Kz{` zqr6hER&Fl0)#dBc>PeNY-eGB|6w2%ETbz~F@=B)_??BOSwAgB_Rb=Zz zUA?7}zPhE{T33Y^ddPVSEhusRy5O5b@GdgEiv@2YtFhLH!m_Sev^aZVPIm76dS~VQ zP>aTi>{=3DawXmm)1bdWpF?bQ<&BQY@M zSP~NhYGQhlkq7CS7XGj?*;{S)n&1m%GJY}^&71ECzLsV_Uimb?#=fb3{)E@T5Jm1; z8QC^RMCw|51x9iF9Xu<3n0a|!r44;*&@ZQdZ5wS?C$z#CGocFo&DN%Ty`F{#-%+D4 z#Vg)uNbrMjr4jmDL;aG|*T;|rdDoG&+q2SYv(l=v(u&hormcgV#uX#2J}b>AH#~*} zRZibv*WZIz`B?SIY4ypniiW>yW~JPvW!CxzOHG6FikFqk3hj=jg1Y*9tWL7LZmZQ< zZ{@68ZI#yL94Qr`&{g`hE%`Bo4$nM&T20Ls3|(4%e%clcU)D8<&AKM1J{n`6lTlOC zNJlh=m~3@;aglyGeS29wGTRp9Vl<5ljd`SyH{lgVHP&^4-Pv#}s>6g>7knFFC`t*% zh4Q6o#v4dl3N2WlrB?{ZlC}mgVh+o%A6!{bSX^FQRKOLjC0pgX?kz7|M&nz7JcWu2fr7!WzC#Nwn{c(Fx@ked?2!5YmkwbhR68){g+PCv1di<)^c zJgo{-^2Qr)3`#}6950|#nuOG(l$tV3LD;xen21}g<65duE6z__nV+^UJB`<;ZG*Pb z|MD?d1_Bd7N^P09((jEyl71PJSFKxJL8ZKO^}6zLiz-{98k{zV0tayqYUb+!hZrN*|+s)xa?gvrb%%Sm|a46<#b^Tbet zIq0<1$kQ-AJ%)ruIjyyJOwhFYi0~SFB{KXV*ygCra@gx_jal^dl9wuQQ;ogCQuCwH za=AYmyRp8qp(YC}UM*H2eF_YCM6+!6f0Mvz+axsnX!$n#W?MtnmU=7^l{Ge~DZcQ= z&P(+pnAG94V?AkTx>O2zQMPWSrBuO)!N$r6q_I>BmfAO$uj%)`cwwn|b!eJIXm*;G#o?%rZ?+P2gZQ|UUZbF0-!Of_4q zrFMG_)`L~n2KsWlf=y^TDZF*1lA;hwSt$30z>Zl8;5y+Aa~N<^RA1?|-xGRAT|o`> z1)bnZsA0#8^DyecvR2sdX}}6iR+g?nVGfLjla`IOjjY7HreT;_w8-&bd4)7tDmQO& zkl=DzXsJ=Cl@|C2!N7GZ*M+DW)PS|@9#R4a%4)J(oK<99gS~QdJ-%RqYGEmEsoQ3A zgzC7>S`ieLrIM~7c4t!+v23iwA4h!^sjRVMhy{Ct9rU;(T2NnaZIE5X6&S__`*=St zCRw&_U7-^e`CkUdU?*H~dg z=Px!u?n`(8-dt#@vNpih+nx2iXn2Jgcemiz84w#v;lcKhb+H7iPmEwvSO(1J@;?QDP}PxT#w39r4r z?gzCsRAS&RR^G6!##XmEJY-8nI0uiMvULqGNpjQR5rn@Y5s?nKsa1qZDyScztrc4~ z)d#0dm9+-)!vb21wR2;GBMbJju_?=1TVbuLLii>u68LMiSK9HKRC%`{v-o4%R%?d^ z1?AY%fSCtn6RdCqg(_mRAb7L2sY2FXyp<5IowQ*=AT_pH8-|Q7c$;Nmz-(=~&S>32L=L$LQ2Xlst>F1Uu}0mIdvAl?#SJYpe}bq|Q=DtukJ!8KfNb z5KD+e@9XGvsH>rW>^5r8>R?&w>bE#+l(9vG%t4PZ##O|Dg7FtJf!VD?4UPu%Xnee@ z2s&Vg<#1y4fP;&dYdV7d3j%CZS&+iM1>=pf@TyzaB08tE{qav}~zqK!YH+IvAKLLKi^1_f}D#AcqYi6*M(J zimD>SQJ3YY*|N!2S5NM-R^ZDaPnIfj5B3+l%~?y^LfuKooFwNIl6664Cl@ZLo^oLu z%@7usIMhT#qR1rt(?8MpM|NWIR>{d^3a(n~Xu9n*9raZzu}MVZZz<*T6c5}9^};Yh zPEtJQ9PTJ91pb49xUn}f&n<(-LUbTtAMM}CwgxWPI zatKNj4X>%8Ql;j_fl)^im?UdefzxSek~>}~N6_UUABnK>H#HTZLU^9ka?wiHHDD<6 zgB6Vr4>sTvdQ=4~K$U?y=4eHUtty{7=pcDe;T|r6Zll}FpgW!qHM!`IBW~?Q7Q=VZ z<3`lVaW0>1wP5Y1tqYDPT30CViBViFEPhZ5A+Z?qj5+xW$=2YPP2sS`L#QoJ-t2+G zzS2g1dMEK?(V_hUF(?|NUy!a}qQ?~ZUw@v)dy+eW(1*TfeBrwxZsIq6FEjmoX2pBu z75dmSguDmz0-pk2;5>lKs3Zo8L02=@SXaHQmZomUP4Rir-04IPmKtC`H1OVKXBsw4wFaQey zBd`J}1F8TAa38P}XazceBfv4>J)jr(6z~G)0dg4q2NHl(AO~0q6a%Gz8K?mofgOMd z><2o5mw_JO1K=$11t0<60orHLe?Sjp0(k%jlmHt50cZeRz;3_;JPmXKZvZENGeAEu z3Dv$## z1&V=Ezzoy?jld2-1oi`+0R0@r3wa&$7td$_76yalzn>vI{MEdvN}T03yn;F`T`2tR zGW1kR864 z1EDs6{L#-<7UlifN{atYo*ymj5)pU)NcnI7NH|mR!#>esuSYl=R{o{hnSl7Djf7+Y zH$D$W5l%cvnZKC7gp!wSfdIWkLmgc6TVJR>TDR&fU z%u1T@SUdtJkM2S|@GA1@!y`dc`GvPLlBelc?jhuEKyI5dAd%^iO#aaD=aBYzD7`Ws zKbD@3sbwD_wSZhc(r5lZ*aP53;3i-lumP|F4Zs7yBY+1u0`veUfKLD)Z~=%u26+Pb zx7tZIuoy4`_;=VzIZzGQfd;?@{0evl=mmxW?Que`2CfB`0rkL6zymxBybp{3|Ag&` zdX12ofC0z{ihBZI{^{!0HM!`N%&XHyD)Z20Oeia=`{=b zq5KZ;Q-iF`w}Pj(hkj`MSVTMnyAd0VmgAGaCxr2bkY1VQa(q7G!^^(~{H(C_j)-^{ z`0)JeVP``h+Mex*SBK^Q5AZX>_zN#i?B5fJ5AW|UBluI`FAvNA1$b>3e-3nAwLJb=I4Zrf^GqwzMGJLfNlqUJ?L+h@LNEC zuY}t`YY>h7v6-}8U(otjBN1ivja`OQ2z{oHfTZSVV@ zbNIg_yo&F6{NFwBznT9_0{=z)ziZ(CCjajl_(p2AOMruvbk^{L7mLwk&U|;}dm!JV`JT-8GQNxX zzQXr&zW?N#&#`vqTg10F-yQi5<2!|K4c}wpY&#Xt44FgX5Hze9qyN&0n5{%ij|O1_V@_O|aU5qYNn^&l)+jvudEBEH-TEl%+X4!ig$uPeSzSJz_bqSxJ7h~VjPZ=w9x z5Bv)oJmugN)xa${*`shvDF3bSFZZ@qc<}*VuhjgS+u_=V!8Y7`#Mu@O_VWqv3QM_& z^oJ3+6YK-~!tJ2KxkESf(I|C)3IU?(^b zZU}dQ>%v`O9^4H&a1i|7U8E=H@HcP>{1Og@e}Tg|&iCBm&IreuAEupP;T!Jm&K?YS zxncNK;_V4vfV|a&pMkVT{u6L-$2lRNc%xvRGuqne26qheRsH%x+I^88i;J&y_u)VJ ztIyagfb?aQcM+U``#eA2<`ChBae)&j^T6dg`^sIofbh6~YdnZ_o^!CpKPF53a`IcT zVyaU?JoP_xXA!T`(nTF!Tnd#AQtou7B{_wM;f8JU@upL(m0@`?L5knaJwW5nOrZFFV_?bJj&-QdoW+xi>2o*iGab8K*Yu$kvn=L8#H$BR}Tbo;sUodxE9qG67i8sByk!)$R>woTR=bYaLgMcqtLK zwD44uEMF@W*%twRR0cSW7_n3~RdB5O6j*$$k)qWy3ec50rFmnR${~!NTN<5H5jE98 z=``f}vC{IXvAXJ}#%Kw)c{BW$udA)*wBIZ}y>D|z^0>_%!S)%f-$eV!bS$XnDASD1 zjf_i}7sMi^dzk%2idSG+&{gWNV~)@ENS1wEAS`Bjd?f zN-ajGS-ANYUaaN6vV2lHFD0|7P1Pt{t7=Uv8b3B=)vO<0$&PS-!l5m^mIIg2d7a5Otc(j2|UN_-JPl}yRhlHE)B@emz=zQ_>FOSBi^s(zv zvcAFfq%>AOEm|T4QfW-~wS1E0)i>76K?WyJ`mNOZt&+B#C?Y_ z8cj<(C*1{`+VwP9Ui^|?-^eA!K0SSeic|9qGL1!woK5@mFX+ToTk(?lw5&G@`>3qx z)E|68J2{cQPWCauAkgTlWaQL&b0Q^P}qn&xkkKJdioT0-;PaZX7OiJDg*C3Ui9ff9133o%zZr^}MfqZzv zPbojq9`WmXyrIqhfu6;Z$N!Z32p!-=Xriu8WD{%n-MunSx{}T~#(G2ie>hiYs0weU zSHihd$H^E|_;gyX(JL9)r~i=s%MXu?ata1HUP)w<<5j33V+Ca@f?KUVp76P4bkal zWnjU))1`&`_QPgfTv}FD(E{}*qa`woX{zT^ zQ4v@Z#${fi_D&?<`F4edmVH(_Zc_70F;5JVTfe7N$hUr|#Fip?XDQ{0MR$eD(t5iq zSkjE+#Nq_=e(V4%g5%suv62Uh1rhcOQ+X1ooRZoHvBBHT+FnuZyiLZ(ppOTf*1OBs znYD<|wN++Dd~CcV!)5G(4G|_HIvUw}C44y6THiWH>GXV+TJNT4qh>2`^w_qPYRnlA!rKB^XEqN8{C+&XQ z&{P{?*!Z_sd%jE$=l&Y0E^n%>m{A#tVLGJ@kX!l)o!~_JI}!GF%X-_-xWxAfF7c&Y z;zM@5%Y5)?vLbt*B&)sX9=o+P%Q zKFMZoy_@}N2kp>G0>$Z{mS2|Zjai{qV!IZ%(oKCzM_i;#W)9mu<*{r??Ofex(r+LG zRHwJDHeE61nYzL`Z-81b^vq{g{zN z>}2S+_(?t(_gO-o>3=;4OP1ru>z0Tww?d0ke1gL*eiixP>-N5{7OT=)s z*I#d$lsiB)e;A%YI-bhH<#1PcFqC|7KR5`EhlAl5$Xir+PdF3~g~Q-(a5(G-N5Jjj z?yv;z0k?#Ea{R^KNMyjy{C3m_7H;hAExF){azo^lOOOysPPxPx1KUB4Ki`AnkRP(b zG^0cE#PRYk{djVg-;V6_iv3nogtr@YVj9liO6HkQWK}di;5laj%7k!K-1se#jEYr_t)8eB%DI$oCT5vx)y3 zcaG$M);`>5X}81WwswQ=xx}Mg$mb~M=%79j_c6{q+-etSS4#-@+F-CtCakk_R&GP7H=_AN_Ym^G7*2+lzzOhDxDUJx z?hP*|UyZ9Pa1X$JCEOYQ7VZeIf@;63;WqFZtH%<_3El3ve+M^%*TGHU_3&5l2Dk~l z5v~Vs;yBiUH$w;B0@Z)F627y08E)T=ML*$1x-WJjiAx6m}sPpGh{J$amG58gH z9DWX;fPaCD;m7bv_#up+cTXb#de3==l_&kvEuP=2xHV4x0Ck?d26dji-l|-47dPhK?>_Fn;C|u$;BM+&;5qi`rr+d^k>{qI zd^3_F-yE3MJXxN5{zv4K!!=IQo|7}=b}0{bDe^XEoQ#Ycyr+uWR#$$PW|) zO}-b=Q~4yPU^GwV14~LIl88i|f_-sz_6yt+q|5Ds_H0FNzP`oR@tN4Cp*E2Jc2IV4 zIkUvxa`TbADQo_5d3R1;Yp+v3S6;il8oRCY!e)5IBK0!R=bf@Ncy-)rW$9ARCq?bl zO8g!z{PljCewyf2c0=N&kB6L`I437gEQ%4A&nES5E0GiHGM1AAw=P)RSm$NRbJhQf z95|A3+(~&UkCt&+57I~`jHby;w@FVILqbzK-Ph7hWul^#)=V`+suu`B?KV2Dse${U ze={GUIppII_$eb_50TRTIeD}iB{?1|bMoj)lbCl&ZnA0KHC zRtnlAJv{Y&MX38~Kk?N-osX`4&0%O`&h) zM$T>ig;$4+MVCX#voCWH2ZH)Ody6_*Ux4q_$_(R;gN{-#U zA^Ae&nS*4DL4Tx#(yGw3{HZJV7$J_ zvzt56OZ!UR*@7x_yE<5+v)#{Uo`*z%w1l;f}VlG{aJqvKV* z;^jnfUypklXuBG@N zLHO42NYdrwf0P~Pcam$n-SI!h!ke9Wu+(doe46oktZ2spsh`=qT05SAyU3fbaO}Bt zRq*>|0aU-71fPN@!)M?rQ2mKK8@csql4IL=fHoe^z`X(1uE?=%Jiz8K)~@GTJxrc$ z^}y|Z@A~rW(?W51_IHwNyI;BAITyl@;cu+IX7Adp%E?w8xz3%Uon4@hop=^wQ4hvc?!=Bj9NZZ`Py4y#Oa1No@*;BVUReCT zOt{(y;(o<>HE1V@`wx<1TYJGSJ<$WbZvJl|N%z}NEb`uT-on2t`9S*lZD*;)Tk8Cg z@^pUT#{V7XJa8nL;N?zqWJ^33B+yTknoS3kMZy7{#i7Ci2q-l zPx0T-{X}fmbwTc4?q`&&@Xwtu@Ygtmxc@4D8>gbKzhBV~I$yqqx?cVb>b&}u#Rc+1t+B(>oX$Bj_H96u1uym-YFQFBGW8)3MSz6Mq$D@6*;J^By{p#w(yK)Nh zx6FyfZQt9lb05$mpZb*a$s-Sz8`GjRnC4Yg!~&(vcB_~kQytATz>3V4?&KYVPg?!c z$Lp%v>8n4JwM?$Tr0n&%#z*M#pL>3$>wUaQ*o2SaTa7koI#%HzQs0ypNlkx10~O zz4CACI$MP~?)} zs4nvB>1^xz_1)5KYaY_7*dwg;Iv-ioq9v(vYg3v^y*;=`X+HrDrMN1a@F81^ltKy~M&g%xzPI|gE=gRx zpW(J3Xazmv{et}!IYQUH7FE+Eu`J%HH7=Or>=s;~cm4&g&#oJJ-HBZ3MCPexX=lG* z*)%Vrqzt=)qgtd%kASPixXhj?>qR?z)H0+${w&y5?sp{fKSiMBa~d`Q!7|D{6m5vi z-A31G(~h+@-_f3TtQ^*5WsUEKX!?Z5etvaB+i||c=kZSScH}Ok-zl8aF>Z(cOWc&y z*Eqd^^3nSOpVglCspr}B=hWQ%Bh3bGu}(lMdelIy_a8j}=yUGXpS1Y<2wAs$FX8W0 zzJ82j&jA>5PG+pUw4<_bkLF`YMA2P}Q_T@kQrN{MS?$E;b6STIUppo4? z5%L*%rvLRIELo19Z?{BzxfNQR;-i7ir+8YZE56cSD2DVJ-6db|Q4#u7ZuGL|UwA<1 zGc>kN(PW6faZ5N3_f~Ke+#2oyd%?l5Hyi-Bfjh!&k1mm_^qI)KtIwpb z4bO%XVGPn9`L%Ge&0G465v6%c`^mq!%-dgjT01UCzkVkDZSh#|ApVoT#)Q*xZ_-bp z{9*7A+`IYtqEGq6*6$H3c+q#!)*eH=?Fffy;hF9#!b8Z=6o2b1@oUI$#R^|v>ro5d z9Nn(OtG9HAF{{r{2Prp(rq(I^HQ~_h0-IoG?^9;z}Sj`+`k>%+OQ1B};;r+;@H z+($wW9%cF3`b3s*Jl;IQzelgs48MWLQXh@~<8Z%&`*`Z{Iy}ML^QD)yc0JMBdx6~6 z-q3y4J;n63PeA&k@Db8Mj>q)1R_^KMK113gYgcIF{4Dq&@p*c5?}6vQJ0VgGJC5^6 zmruRUhibnI@V|-h3oZUd($|vyBF#5qd|xbDy`Z(zrBLm38SDfvhn?XSQ0;pq`L0-D z`dak1pV|B)^$$;t^sB8;Wc_+AZY{BWy_IvFXyriWZ{6VBWd1jb<`3Nk)bnO|47>$C z%e@fQ3Mz778g8Gm-(E=7O(t@Dobw067@x9Mx` zxZlJ5C0g3|&Hn@EPeD6C;(e%mtli@I{Ta8$4f1ZV@fCSn#M|bKqR}Kqx%&w}BCUa+9=GDu80-KbuLsISB ziH%ikv{uEEUw)N&;#r;g@zOj2)4wR`OywoKKFS7F?4OuAaCafwWWBSz zr?+Ys;afbnCT~AW^+k?y%1@A6W{StM3bK%c#pODw>p`u8_Mx*X)RS-4b|0XT$=2?E{AAPlE9YqGrkPW;1C`S8QF(2oZ&BW_+Km6-uLszK<4-nfT+NeP z=dDoVq7AvH26tQbP)JHr+I7|SY2_-H^EkK8+kfUdZyE17LxyS-Hf=>YoK0ox8k`>L z-Q)?!euvt`ObdMZ{{^d+Awf)w$Kp$Dx7|25KE1E9w5pQ*fg4x}HrNKSlnvZwv{>J* zqGp;djy78>Gpb5(2J0tTpT_ueCL03=&zUTZ#}HDza^U-rxO1jkdT!s7_&5L{&o9m@5{@!G6 zi+s=KubHnOV|JGH{nFD;Cg!pr_EPjF>FfKY$Ms`wmx!GVEyZtZ#>!Hj_ctfMmVZ46 zOP1rO?3R|3LW@&;tl5$4F7dkJE4i>@NZ#8W$*a@jHSZm{(XW|5^IcTB=DjRM*XOv8 zd&{)GpZfqL9_#xVi*A9va9<012maEp{np!7@rp0;O2l}1=+TyHRaN%{Z>i=(y3Kw* z;iF++^hk$8-pbJ{Ez{c)dZlI3ueGa#JK+}l!I|F98b!s^Sl&Za4;MNhrkgKX;XLz90mtMq&ndp;Rv`L+#U9Yd%!Iq`nAH%66^ad zv-SNtCD!*_X8N@ah{xM@xB!lUVMu%AyKtQ8$(BjKhMsJ^wbw_9_5GGfzefKov-SPn zXMI29;vA=X-YI;G9T@gSKlU0VKkKL20nx9a*EvvnsKS>BkNdYqp30l^&=xEHlUd?N z$uGXXUx?DD({B$Gj|Vc+`Rn^B-Jw>lzrNr7xT}eGFRX!gx$oHees@6W*KWhV9^MQO zgEzu>{dikOk7V;9S=Ve?+I&dm8;>`~$~#>8HR9X)e&~mmX+C7(eBvERzQ?&oIrD;c zJeu+Hk!$Pw*?7SpeVVl&?RBj5YK6)l;7#6J|C1}os{=04N*|EPD*ls=8~<1EqY1Fc=ofohj?;T`Zico#e$sy#2D zoE0lBlwJ+}*D}+usXs2V{xJQT_2VVD*+0s;+{&@}kX8;JiR|flkEVK3f z29eKIgzp5ehJE2RK|5Vbxh}IHe`m*O`Za6s>xtKgcsIaOcq7~f-UNHVo2?$pY(C^> zxY4f_c80eF{d7C=I=Od9Z$|&v{vTG)yMlhZ8~^v+dpJ_H)4d}7dY|-Yc7EJ%>3%P_ zrGu<5_@MM?7XFZhKPfhXO8LDYk8V`Sj8b?c8)q9O+UBJ`bg=jrLN5lDR z?_}?J&*9TeKgs+4YU{nWOwVVf^Zhnb{Dge$e|J7w0nL!QZrwoK$?o_ma@GH?eNuL@ zb_wK7ku3YTJ6z=>Cv5x~^8OTa*jA+cO}wzm zO5XN*h}2^;+nGsswG_M|-*mbDnprRJK^+yxbz+T}rd;@3OhZUvj{k7T5MxiIr+Il4-FiGosaO=$4a{r>|?+ zJ-yv>a`K#zojM-v9%97Ld7D{In&A;OQ*#& zVV`AZ8e@_1(O6wm0~Lx)i(zzO5hM|8JD-|ZWnHYTd@RDxo(Hs^>aj-lwRwj)ej;uIe>7@y(~kar^wLGGg%zPuZ`NRM~DKgx}~+x!ccAdkjf z^eWr}dCRj9>4o`kh5wV@)(S6P#D3Q>o*(PIy{-8q?hW4Cw%_%&em>!=Aa}#?#{jQgqy!&|1-|u=6^6vgYxsZKumfC!hxo{xv zS&+Bm@L_OQcqo*-dm0=B4}pW>{%{DK1R34ov2Ym2xrgWPcP(wm2;94R{(jeT??Jr& z#6#X4-T{t;eIV_SzYW|Q`L*-}qu@G7yVXt`dhz|PmufxY0A46U!PBMApWVs8!COq!n8V@90n0=QN|1VkMA3}aBR+MYqzvg^u z0o`|rS7GTYnK9+3gUC5;KO6SZS!(;*NFIp1+kF*x6?};uj*)k>qsAY#{-66C{*re; z4Qt?&Fka6(^7D{(OV0f${*e3|te(n09XH8+>%Ga!Yhb}yxYChoh!Mv zwI^@MwDS>i+jxY?W33&@-=9yS{ExAG=SdiB?Fd=FZK>^Nqxu|Y^)q?5)$at{YM=S$ zztqY2bq6yzvhit`0p+J0l6(4y6q_cA?U$}p~fNdZsgi;I}2eRT!jA$N_!Ok z2p@z0fRcA>^}HwG-{4~SCFFdz^YJO<&YvLdeg?P38SL^AtN%SmJhcnN{k-*nxDzR%?3+qr$fr#6%~{J-x5&J{$T(6vrv zOA`^sw>0kLAknKtk{9!4YWv5Y4!am@-`m!At4?1fCes@Fr%6Yruy#chsbRh3rIFtT z^1v%}8A_28OJ7q{&I2}+8EpIc+&qSV^LY$B*{1Yg7I|*UvVn@)sg?LVDd-dWDeJVY z$q{*EFd`54>#^44_uK*X2|c=I&%CuNzfV7R9}ZfIX9Yez^z&~h&+nyr(axKvT?9AG zxCnN43cA>q>9n zf&a+;;h)6T;qexK3t0<9z6NbuarH#ee!skL$-Q zY2o`gcG!=bJUt$NF?pu{^&m#F96w&Sw44-LoZ_Pk7N6qtkf$RjLf)hpdI9V%c~OtE zS%(BS@^tfO{UBq}32+PKK}W$Yq5OI4D4L5ro%rn6-YYdf?86^7dHR9g<0env*Uu+B z5poy7ZhNuG)5k!`)AxegAy3~ON}eum4~GWw^j#D3^u;Dm-zku%#}e}N#kM|EU(yXA z-8OI_+#2ozH;22zBDfpu0wqu12o8oF;1IYD912}HjN|;L>&w&I(H2mKu zyieW5CQttej>P>wq&@PNLdny^#2aOH;iIjc9(CjL^u>WZeX+^YA9nX4rusuY>J;8X z`ZDC{xBK}aCwtu1F%skQ^m^i5O*l*o&vYM1cnEpA;$NI4{vpT{k&os!LFZns+{Y25qg?7A>r|Wo6 zhV$VmZ~;6Os+~@woE0lhm)$sW(Zyyzu691t+S%;Kt$&cGQqwz?xL%}xZjjvE`UiPB>28wS(m}K=w`e^k z3%}LE>oXzuw)4Zr`@P7UUqq^Ye^7sj+w8~f zI3B?L3{vz5&ENLZv2lbvop_IsliwcD@>_&k{q!hQzdQ!jpO3dHm+sC!I_J8VyVoPX ze%<}fE%zMzbklG0IeE3^(%s3%&D4L7Yp9yV&YLOQo2xln#!HE?rG;m)w{2yg>H>?u z=Jv_hjQo<#5ud-`ay|FK#A{QIks`;6w6X8S24s`jZpzv}uBKQ+#1@)#*0FeUS65Bt z|1RcEZKw40eRgRPp0U19&Tjd?!fv^POGhKO3cHcxeuju}2!eK5^J>|1Ez|EC@OER# z-X;t27x>nSzb&?+j~o*S_>TGs(osv|X(-1GTt-Xc8Xd>dIiwQdf!K8oCy{8Ki!RTb=RQ&-z9SW-$! z+FLqS+=|pTRr8qAG2yOkY$&gY`qq%C@eYqR)Ugd^B3=VF!*w+s67DA7LvB90-uUaY zmq%k$`sC!BEsW+$v?rDq$;mg_0zi7e>1YQVy^?`_`VZN^{P4&qhh4+GlE@^-t58G5 z3V11CNa=^`Q!i4au6Lxh>1$}?3g$x8qqByx91koP0B9_pFhi=joIOR(}<*nAVlgtq;=T5}sQhB>8Zmal>Z--<0>ARbJ{`^;xZ*n|eNxoU!Ei{P#bew7**B_X}6LeXLwtf4=ZX z?<>hS-S6Q9_;>G1t&ib;3z2WSf5U$={1Wa9zku<2?N7ez&}#>fpY{zui10TFhqw=R z4#E90?kVsoh@0azdtoa#o=*kg4-#HUe(k8YFW=Oj3(9A@s7>4|6ff!9rrc3)z8;L^)vEK z_Y(5C&g%7**$bbI`v&~g|2M(~xNm|Q2a<1U9NYpm4sM0&r`upN@otBQL*$z_KJLWb zfcq|31@DGYcn_?A$T!_`cpp3%BHwf;!r#+g;~?_Q!aX7K%|eZ{hX~)@eOPi!#@8dx z!l0j^jk`s5U3iouRsTIE(q4~i9SjS9!qP34+xi!}gWadJFSvz2ZQ;+zZQ;<}h4P<+ z{owOZ=jjWybBOEAi!cwqg#QkNzYMp7ufP)cD(nUS0Jny(!7bqHv`^}FYYBq6Or>C_*PcCq#6yL?ByWfpGh&s+PwXYTj4Pq?)oB)#nyZteIX z?iJ3TosZ1l_6xUm{n-3JasFcdpKwGvmF#@A>*i;auW|l4)OGI*sPo~kt;&t_+#>fH z*7gW{eZ4u}+1@)|D71d4OK6+W&Y?p>j?>NIlYD?^b)RdxB{g2AoH;X}%+G~QdA5RI{qnpep-y8fK~!~J?l!eMf}u5GZh!lTNE>)?Z{ ze;r|mzhFPl$W#Z(e(PI$YH{)gE`OQ~plv?2-K{UdufWSTd9HsP z|8gR2Z~eUnm*%f?3T9|yXJ6sLAtA3^oAVl4ZGg!4!QJE^vbk~>+Qy_f zEN#5y^nluvb`1`mYNsHYIe6&0?N`=+t?cWt)ymSP=#dq*Q!DW|#6SIdxn|Z6x>n_J zow?#CoFS{A+#Bx{jAZP`m3!q*!33P?dye8>>HeNA_OmXbvgz%Rao;Fo`R-_CMyqDq z&!YAFr5Z&2)@C^wC2YR3_`}#-gKcQ`SLTW5x-9pvU>qeMxwBpZs#s&7VOBY-idW1C z_RF!Y9ag>{&uZtdiaT1NP@jMM`6{hnlhfy`j0o;egWSj?Kj9R}cw|qx)pGIpf4SBE z|J>jPy8i1@f4>=5VLzx~{FSa`fXAYZja9YNV>YV&p=|?in10(je@4|!XAO>q^4N^= z(fYauPLs&E#7&fk%Gzj!bniQ^Qa;&IS~Z*=D@*SmrzB(gQ~7CSt9HuADwzfGV1<H%-r5 zd_p@pk-oa4Rq%{0J$Jh9J9ROhbh`pQ6X*6pX8|0ssj&VE~qUo(768O!t3*VR@cQ_x4xS1ALDm2qMX6?hf3@Sk1RFtaq) z$eU!Wv8p1ba6X&qC#~MOeYMx-zS=fUk|%!J`@OnC*M*e+OnqNhi2t0OOrLoFw(*tp z&-Ul=$~A7XI?Tcr&{P!-HS;_c=$qylrwxTIZPJ?^F zDR6Ii07PmLo(M<7v2YCB8;*s;;W#)D?gMv(<6$W*gT3GcxCNXDyTeJa2u_Aw;J&ak z+z)nyyd8ztg9pHM;DIm?9t0hDFzxyeZ;Eq>9@NBOdxx(#@0dr%>r2<@);#EWmvn@#e$h;c=elo&cNSe0U80C&DA)0(dx# z*Y9M@=M<}t@`?MOM!W{xr^7mU2IYIy=SNW9dfTHT_xJEU z_yFwf*?bY&#h)*tc6k_o^}{3Z4dN}dazgGR+|S~E6g~X1>pMmPnXQBG@Id~%B&%-0(3$Ovc2&ci9;6dn`Uo$rFfMBQKu@XSutpcc6EMcae9s_muaV z_pNtzNFm+ylYD?_RUb>UwG}U?r_Aj`o*^eqpQkiT<0tLCC_`SGB1cWp*TtHqPml6` zRaYBq+&yIV^6?8}|HZh{geQ{Ksn0MBZp%{YG`fzx9HT>Gh^gW`iz{PCGjZ2M{(%zeA}#--{!KYTb=r3-yg4ODpPW@Y{E_vJh`s9a&r6IH`NCx;_%gL z*VKLg;-|E7%B>6cKe8?yZ}KVEkN=&0?0MtTCv?)!P*VMr{pz*j%XI#<-%H&5BbI7Y zAwf2uo_yQ9UUMHodq?M%X@1v4wm}(I zU4`k7s-V*?r#EU{Z?v%*DLEj@r%!K)PG@b3_;cmv>EXU^*wn8>oE7VS6W%?|i$WeSz=ROq*5D zFUvkU8OKd|s4}9lSp2xVsGMYl`LCveA;p5a+FcxRNM?8gyJ#pztTdpXQ-&O%Avz1C zdXz<;H7IH241G*PV?~3h-_hY)2A$H&i8owjMmk*yE2GoOo2ncAL+F~GF6FI6FFt$P z9zlwt_llI`^xykfGC10pwf;kf4li#kpIRP^4zH`=Z1eT`$#zQUgGz({`~?OZG;=Do zoT^His;Y4==jyB~+P$*0s`9X=Xv5snXwB4UWhJvT%bOZ!`1i?_`c>3S)1j76CwXR6 zmEa84PqIFZ(duaZjJn#nO^sF6RgD-DmD1JKiDJv6HFdS-RZ(7F&bz6_A&b)Vd~)j~ zrng6Koy6Qc;@moktFTVumg(nBrerBa&J$Bi=T~jUZ=rwpuh(4CGVZ@A`C7JSmzi>1 z%r4IfZXY_8drrS&c3Kd5cf>pvlW{hb)U{`%E%GVZ@T z!KEzfLY!^W^BFR>Y)oBa)wEy*n5;!x&KdW!RJn(R58yX>dx+moOQUltqV*D+vZ_Wo zYXp?kH$;PdvACa?S0?6JWwdjOyw$RI))Ur2dv-kwold=r;KE#6BVJ^C5Yr|Meg& zS&kpCTOz*P3N23Y@!QQQe$DHOuk=%jA-z*~>8E=Vqt@EOlo^aMnzQM3?p zmKELyc}uqNt?|Fh>!ozXw|Ko%^JU)g2ezK&1>Ohjfu(uFAL?%Jp5*5no)7z=|2`IS z7KD$1ec=&sd+Z2iL!M^CB2S^=n70!%=bhqOub*i3hvDg7f6cn0`~jl*!*B)ZWS?*# z+!gKzcY_n)AUGNhh9e=;`|vP06z&R#!TxYK>N3|ju#fL>)Cwo6XhO5ymrJJ3q3dv{tNvd?U(;gI3B%!KJm(69<#mGuJ2%- zFex}LNPm5(`QF8EVV&@y`Kzy;!dFPYKYIV?{ru4XexUUkjR&D8bdgCP3_W-V{ji95 z5Ph`SCzyMx#j8-d!UqYDr*DlsIHG5-viNsqiC;~AD^}FlJa3JwTFSkFcy*S}_J=A| zy2Gqoe}AZJaC42OzOn#PeVecb^6M*JMfhxZh5ILFd^_%Ca4x(A|HI*L;1Tcw7_awH zmfta&?@fNkIP(bC@k7dKw)(5wc>LoCKNstS6NC0X!TMpo+%~>o;i<%@e@K6l*0C&9 zdWhS%Pf+`vNOv3|2#`~f%bnf7H@FCby-7?t1PMvPZD=i!I#j6D%Bmw>{-Q4fEhL zP~+}d+EwS@b1)A+kH3rm3-Di*`Xc-uz68I6FT-!)EAVT`xU%#159ryyV7B+``0Mx~ z?l+tz!SO@fHs9OY;Vs;M3Fdo$;m`NBak>=$C%ku*uZ@p*{_o<}ICu~0ynG*OynKL` zKHt$NQ(r$5dyRYDC)^L+uicHj)4WSOi{^9_k~jREzFvDP<<=Fo%||1ns%)<*4Uq!A zZe;b>72U$pr>;BdKbqUNrsY+&NPQwhnMhk5RcWiBpU$oqE^FjzvdSoT zNvcAxhcdV0U_DeV&l-uvlT0DS6sAK~HdQsU_h?2ux%u#9k|CcDjw5I*9nZ9?=`50{ zr{!@Cb+!X_WSqSUjI5o;9n?O9^_xwepU6iuuwp5KegBnZ53Co;s~Z!CG-74>WN)Xb zECv~6BFxmf@&;a1s!_-*BfG2%p(EPVi~RS`i&Q@+FN;~;gREam%csWbs+$_4CH3Wv zGg9A#HY9yEJx)#!qv7R*)|4Jb@__Vq4$eo@i}~lP%3IxeHFmu){fU46X=~<@$hoIC zAe~K7rSPWH_IRmcnr35(_Mk7RFzpLKj!ZK9bmljwhso(-GS}Qz~c^EJKevkPu1+D@~Lbk9w-qs&^qcTd10$YvtSCFPU-&f3tnZ0o+L3LY6h~f zDYMHPxk)uBX=!@;oIW7EJ#zYh|4@Cv-s(s0A0yg)9%{gHLV?`?AoF@<;A%{)OjC`L_k-ly?v&6El5ZF6PyD`cGTa{j@o)zWs`i0A^|_-V>BD=$esFiV zGaLr{!$FYI)ovghh+E|CBHS;utK`|meM7s6c6>0rO=z&>*~PO$Lqzk3;jKtF40eOV z;bxGxKjynFH~Dr)DEan!a8K9{O1|yFz2I_hx%O)ce+NgwuifRDk6@L@O!J^+z#hwp{^!n@#p@OHRAycr$nk9ZS`K?%C^Y4%=F1PheHzD5f zmhJ?tV`}Lj<=TEtg&hfBz_{E1o&-C1KT5vs7Qj>BI{2Ro^WkYQ1mpEPgM2;Ct~1Fm zF5mu~ot4hE{Lis^D*t%=^GN?O;pdZ1=ivp^=Ox@1;{QDBnO+jK>qXYy7t3w!4Ut7! z|4?s#{+;r@+{(E^>zG>mK|8;G3m+x^Rq#Q0HB`N>v3g!>>zK;@JKXuy<2v(SZtI!e zjsFdn?j~E$RQomEV&~V*qSXglyW9%ZF1Nt~csuL>?|^F0JIQy&in}D&w*G*w`r{t! zk9$q7t$w@@w}W*10V~J$YqD~1Gf(b8NAm1hA)9|^{UBs>s41-rFMJuQKVKod53}!&&$+q8akn8bs$+tOg-rzs^FA?egH<4uf;cr>Gx8=6u zg>G+msq=0S{*Hw&liR|fyCvnm2fM@fp~mS4w10^6?N2Zdeu#fD;UB?G;h$k4{1|qE ze}NmpPv8cS^WM(W&ycIH%j~-^@YnG}+<(?O8_gBu>K|8=MVfP#6zRUj`=i8uN z!~tjm$hV7|lK($c9`*ev)cE)wYFz!$s(k)xcL_5%yLg*>CEi4Ds&}kc8FKh^(@*lj zq}6p&Gvejs_>~a^0lioVkH5MaT5`dz6(8 z!yMS3U!RgstMgnk(pT8(wJpuO?^8>h!_N(9KCPbd8( z^NS0bE4!!r6C*yKs-mgBj%5Vq`g*!9t;X}`UG+>4_g?_gp7l!OTYf60zy5TxKH1`z z4GSK^$46;6e-hB#(v_FPT8L={TX`AdEn9ix#*HIgV?!M#Dh+*BUQSRu8P_z_nAr_! zwpe+(3bWK@QJUJ=kI&E2b9qX?`49Ig^T0CNBd7mNZ?ByG^FLJo*-rh) zr&vE}&&gUpHMicW)V(YpY}cFQWi;Kq4q-ugeM8+WCUrKb8THAy@1!MAIGUrB%T4?? zv2uN6U2XMTrMLUvD$KvKeoa=qmA4-M`7xzJems*~sI-4a{i*J#UDxPew>6rZ>eeme zuPf)-%Ich13u}JUgDNCx{~h=zFu>iw>BlZ+>3`c}moJ|;uui|9uOE7&b18EjPDfvK zGCHIM?3;IdM%trs_fOy17+9=|_%rvGh0Sh5^H z-sXw;ax1huKE;7=aKPx3`@3C({W1Hw+8v|QAiux66(`aO5Gg_7QLq>8xsZ58jgY6AqQl^}um+X{;XDmkx(HN0JjE0p3XxhC zMPXm^I|yzcjT+#~XAzSN0w$A~wCc#Uuu*aUZm^k4q=a5nnt4#b-S*JZYp#z&XD!zG2X_J@q$ z{_c_V%f@*}@t^#4PBgeysXM@Vusv*sdGJ{3@nfjJ)^qLncSyeMQ`t}JlN#qE zK$AWhci|_5$NgL5sibR96%%t=~Vx z9m4%NZuS2cQ2qZ`IEnaQ60ZBtSJcx*i~O~Zr8(q)qzA)8zoSCwsEWUZcOrac}8vh5sJJ6Nj;LYcJBN zeIV}M%<1#n2jbqAybK56nX(@O>~9NfY53Dve~C!4Nk%iQc}82TIEURFA}>^q=D(a}{#4rPm!&Q343 z_qD*mBmntfgRorOS%sW^Qd=+f2(FtS^(ePH7yjnte-08^4;T zTOFU@8r3|ZZun=~14UR5uwv$ny6T#7)lJixQ$(B&nd#-`Ggv=q_3=gE@j1eg>~=Ht zh{&g+<4H_0d*5Sgj?Px$QTqMq?T~GMskHXkg>2L9elpJIG}T>h9{Yc)eb{<=HjF~;@*)R? zB7gNFKe~}AZsc7jGJ8#&3AqOf?(^K=*UW>{T6>^a{imH)*7lCv=S5ERT6vCX%mcW`8zi@%W&TYP&rxzAcfR*jIUYRr&N<))%O%P@pmh))#2&IjChm zmad0>+e+v6=gRH(Tjsx3_J2OYYW+*tP3P>3nRi}ZTRF9EPU*kzzRos&e}VO9x@p{5 zIkM-};^XDj{>+|+lvQp5dq|5{RyHCfWMictUsu;Sysn1jyi!6Gfciy0mM**fvfg%b z>)+(ozsX$x#^hPa2bG+?ak=*LC{36Z+j*C4pPapMa`8P~akSz?>VxiojJ@&t>GkG; z%73ED@UNX#;rn+_k3X(%cC^92e%EL#2yC5YQ0-`Ci`4e0MP62_A7rY5(5$?Q8-Txr zdEApEb{|TPvwG!UT_-^$cIW&vJ=pmpqkiS}!HyxN>E-6^qtn|XXCM7_%h^p!K=hw%H=Qvq;(D&k{en{U5gG|C z*5C8>J;69hjolg0N_W0qEJw7Rs8&7K;tiZ7|CZ(^SzKSlg^Uw1=iqMP}*kGq@sy@yTL zGkpE&G0Pk%Qvwf?qFe zPA0lNnTa-;95erVq?P06+bu08)uK2hR&czz^_h4VB{I`ei;NAhg4R?fZz@6YLupi|=19uMU(I5ZC`2%!Z#S8NX zrXC-5%@fUD`TG2c?rzvKUrjo+rUh5R!5r5m5N&Mxi{Vgs5yW2EJs*-^_#BA#H+%-% z9i9sJfD0g6=61)!k+{XZ;Jp03wcb_n5&5G;YiAg4%parmuBhKw(fnb!o^<=bDmWfa zgJrNBPJsJEq;26za1tB`C&RtqzHoQA9~=acDu#D~2f%*tK-d?`UbzGw412*Tup2xC z{u-9UPH-w*AIe_20P@Ti4#OyP;57Kpyvb&-{5LoQ_h+yQeh3eR%iv7-HsnDt{5q_G zuR>0}@QV<8=cr4>7mUo=iy~2)qGCMptg;jaB{uOrA zlim5mixTfdcnDko4}^@9{K@cSv!kBuo?>>?r`mYjCGRxt>tOv2Io~F`XD|+S&O4L; zb`vC4saX*MVANNBX|5V%$Tf9fK&Xx7ULi%BsJX`!0j8nPYTYYqCy4ub zt$S6d{(^R0c@gTkUb1{%wso)Meg*$R_$urO{{Yo4uUR~^S2p(>l&AJvV*a+jgSp?r zt>b;${3pv^*)1UbQp<0d?3T%Y8TT_?hs<8tjvKe@67PNZPj9mO0sIpF34RJcgzrHt zCTO3JZT+i#;9r9Ffz}V7z&D8Zsod~0xCnj@?}lH%>)>DEmGDdW8~7DG6MhX(gnxs_ z!*Ad`_$^fbeg|jc{yS`h|A4jdpRfvk4=dmgupIsf4}#0#0q|dNU$_Ele8}8&3~t#g zkASjQ9s*^rJP68Oc~>ZV%iV1 z{&^2=ym52oyx&0QJMF%q$Z>VVGT9H`$kKI^+xi7^e4S;NZ0R?#@ItvQT=vS{C|~x< zn?mfBvHzYddu1E1vRBsmD0^j{kFrsPhy4&Ng^9kBG#9o<8GxvYox{hG4j6L>5x1ZT#Pjq+2{}}R<{r8b@0GtB{ z!bZ3YjKN)DJ>)uV*V94RM<41Ac83J@fL*4!L)~G-(|CvU?{Ien{^g_-r@6bcH;q3I zAnrZgkrt2pzq$8ftvi1_z%B=}0^TU|AMK98U)LXq|2WpjQ~GgMpWwP-^%_t9>W?z0 z>+l4qew*mFW}khm`y?y6{W{b;bZF@6(2~#>p^fr3%Nv$AF0VfCmi%9byE%N455`FK zO5)0hwEfgF;2+NlpcBe>BS*KXT3&-&Q`9*an5UYJ^1{0MivHo~ zs%N38)|yk}`A+vON6=%>^&$gHO8WF4vVY`#r{Fa-(%v3KsPoGBZAc`FMI4tJc##4w zm!&jD+xA=j{vmrr>w=X#V%C7WtTbJ2|B^MaF4zX1HFv1J7in}OUpbNE+Z;M;aMU(A z1+{B#)F#YRT3C8DFhHAFol54_Q7kQ1$%K539Vh2SX7MRTMyr38CXcr*W2|8mE<>a7 zX_d%k^SwLmqgCZ%oozfg-R=DI)etGR(^a!rP%vfNDLq!SwAW6FFp%)%?c=A|@AwmT zHcL+*=)tuiQWN`E$9G}+iFV(mdsNqrc@@y zXh#~0G&}3ztCvrzd@pgV%4$8nZbS<2U`tm2@*5oQaJD(Gu0zOYa%49#5Qa2WR@Fsh zjbAd-%<)Z*9Jkw7zFSzntGnBa#zDnaEo_W0ZEcy7_w90O&11iY7jd4GqMSbcMJLj&=bxx5atxh{+-}ku1KE{b= z(hBfvuAE?hgBic{gs3KSMxfOx({>e;cJEe)j9sj(W$%F zv7MeRhn1S)=46-kJda-whS`d2u_3EhF8c#nk%>7qx=*df`MAf3v3{+Gu3maBOu>HH z!NG68vU~!&&V*vSy1c2jVn*dwD@&JhIZ)J2t;9c4{=C1;YV$Gh=gyDKcqocA1lFzf zT5;aWzi-W!zsBuyGmqe|;0TaF+Gl6|wsn0E`Z49bC(<~*sj9McYE>;sb^lC0H#JsN zl+K(mY*_G$Gz7I3%f1ce6i_kxsQ=qMUoz65QE0nYNq4KcC`8zH=h6pD_xOPso{*Ni+H`_eS8Y{Ea}@r8dXc zC`_PJ21@)vr7-Bvj&5ZB&*;onrgvnWq|vf_*T@^!PpQH<-lXdMX#n0hlcmhWry*5F z6TD|_*rHwib**>6KkN0w_KQqu=&Hsh7J+1??24IFVsmRNl#Y*{r?aL{+&@k3^8db0 zbkCL5)5cZOP9II6KB4J9V=%3fgsYOBlpI-p_@DMdB)6XRnp)4=#;3iOjjo%@UZrbm zztTeWo0XHZ=Z;DG6^v-fRh)9)Mt4R{&YnBdp1Z5sC;1>#Z`P)|zE)z>TwB4mraY|h z>60FBmF-j|mq^J!VK=*Rx_?D^HA__UtQUwAoG$6%!-kBH*0Nlu9t>^K&W!Mi@&>l^ zEsgm*tCDup^z_O1px}mW?-9x4Zqxo%S!L*RR1g-nQ>&YzjZCtb;Y8BQ(@Mk*+HqXg ziAkB0S`*XX+GvHsl%yy{vMoVz?09bQ+#mMEF_?X9j~zg>DiW4y>zsm8g%g@E0Zt11s` zin91bv}UTz=s6!*m|km)rjL)BX}a9mn)aDd71NhLCeOddXmwO?hjWpER#!Dv@np&+ ztU6I_c@+Ce^QtJX_m^lV4*A%9I+;)Mx)iIgQaKsd07hwysIpINkJ}27lz%9(Kc@9ne80Jmzu$DA8lN( zSs7Y4qQn(E{d%2oUCGT8_&1#=VCPwyTq<)uzytQi-cB~Ae2VqcB7SaOz<>I@fKAk| z$?H(6eo!Hq&sBjQvcsEICOrSSW{+ahD=4LfjmQJgxt*n{rPwGN6-$I|$ z;<>P;{zRGc*;YTv<6F62MDh7#+=tTi6AI6GKIhFckl!niPbd8(%T3&;q-Ra>M{ghx zCvzS~s(!`7rI$-)mqnhcop7R+B}r|at#(=BOH*6y3lkU1`S&%`OCoQMR8}=M)>(Oy z-||`QeWvU<*XaC;SJ_MKr51nBIS-lN8La=_%-4@G$7y13Eh`An`B_H5Ojr8H>(_TQi_f zhP|NtdvgNK_qI{|;(6Y-B6gM*AN${zWUYlA>`QtIaHD=c;i-_bHGDAa3lD%idW0uK zq?GN-;EuS(o#0rnpLT^{pWU5B%O8e^c>}bX3*`~y?`^!roZE${%`*ZcWmulkZR2YYPsVC=44b{EH8cnRTg|JKMuBX+P+ zi+@g*_&m^Kms_QM#j)#sMRZRl9%>`fRXa#i3zZI1ZmsqeFFXM^WMAi3oO(Eq)vynP zN5ckqB>pit7xEVF&W7>&&9Z!ETYZ#I+ zZG6DyV0=qkW_FHjLI~K_{xkU`-@J3)ym|AE-+S-(R-h4H^nS14L#X4#7-0xECC4Vo| z{Joq#UUvS%g$8@RuG0Is=ZmipGi#l%mh;59zn(9y_s7gy>J`Sd@CWcZxCvYWH-gv0 z4dD&254;gZ;Z1s<6`~)$%*1>P{5$Dd3MId9#ot$Gg}+<#`F3`r+0P5L+}?@(!{%Lt z5c|7@ytjLd`yKatHQaq-)^tMF-n;tXSIGI|d=IWZ_!Xijp0)ccII)9$2=HMj<>e>j zTZHod2$XWqeYE^P#`)AAaJu*t_><>?nC@ z2?_TzIbXd0Tkv`K27Cej7V_P?7j(it)caG-|;#cT28qlM|U_+8Dr*MbP%?n5HQ91&AWDT|k z$7dQCYE)fZ)nRGW?_&m;?CmXc#hR$@}dnH8Os$p&4}-2 z#D~$hpi0YV)fTMo5~|3y2Db(A!Lm?_{eCf{q%=~n!_!O*O~h4CrP)GAIX)+8X)mV1 zC{3~tY_q|!_yVIeBX`Vcr|5gFcV~Ap(W}l1^utyox9u%&p@1CKFn(@`q%QpPB4cB* z6Kyfa@@u=dAhAgz4Lu5((ve6*4>d&o>Hj$hlZ@X2sifyGC=C_KrT;#*zskISF-zQj38`cNSH+{&7P#2*2FQSSOO=m4Y|BUUa?g8_ z^Wk28JKP%H0vWZI-vGCT*TC(N4~QIe5ETF0V}Fq&4_zFRhxQ;gS_5;QBM;5upZKF0 zDDu!ba0sk}j5eZ4xHIz5qoBw`g~Q?Djy&`rD<}`0;>bf6hvcCX2`BQ?FS-5O=j5&mH0o=@BHA%A=oX}!oHUln;M^1Z{wTqbf-*SzpPQ$4@RKp#u_nm_z)F`_KcgQ(&Di7rxwbzh{a*iO(z)P`jf+8;! zdFTbuO31RP5(rf10|VZY)y&r;GfvVzG6GQ11)%dCr3J zJR%Rh9G(NOgo~l%!@0z}YSnqh`A$AU%}3;+z7YSIWQ0Lq!hy z2=*c`eH8u?A`eAp$_gZ+2D(*L9%{Y^pTztQq}=HD^E7hJH<5}icb*qww&kJn+|OeE z1yWFvhrS74z@Ov;#H{jA%{Mo`mxy29|I1Lm8#y5+9ja@UkjGj+>dXQi^KMz$i1YHXDWO=m}hd@o$mKKbeqUq4zLR=<81 ziJ?DyNBwf~xz>8jdrKq*fa|BZ08T{JrQ;_wJLs~eN zanxv}iX)LU21D+J`COmf9)|n`{dgwvSru^IPS?q98L*QWgFlN|^J?38aV^Hfo za48wbHK5fL8(IH)u2Ja_Gjfr|GHNqxSl_o5JQ9BcQRHmaU^o=+gd8{yhhP>Cg*!mx!_jTw zFt`;Q4lCgfA}@#iH`du_&3axq4*2m??CJ&zox>^aIc1+Kt{*N38%~R6dC+I z7yCc(_aOK?hs})|1`4}kAbu5(UIu6QvKt8O` zcLJ36fP9$yoh13H@sY`TzmuWd?-Y1G#9hnDX_zHn7D36E)1lZzTNf!Gp<(>d=)(%z+2%(4ACxO3YvRdPIoe&X{)OC|(+#O(Y%iaLFpZZtDIeh7iOWnnElM;<=T`Z&vP15Q4^9hN>o{JhG^c?NS zCH~t!m$xH>x3BwYg87nVe{?7Gz&Y#Gytcq@(#9hxO4K*!WkdZW5qUYO$eqadbZtwy z+INs2;?7mZZzz476O&D_ahgJI6p%alo-c0ei42I0d~3$iO~@UbluA0i`-nW(zK6Wn)A@yeE*dMR=0 z!}d>pIsR?4E#nX?$rr9jU!B&Lsc_M!iA+d48qR+DeEgE{vY*a=rdU%txtW9xxXXGv z$DMz@^i$qne%8__0sb03x_^X-QV6vTs`|tZLUeH z9{E0f_V{r3y|d#NC(SP}Tw?ZYHVmVcKm+5xX(;?GDgJDuPU?1Dn#1elrKhab$xL!ZPKwj#3w&R}{j6Gk1Mc6CbuYaoR||{_4CBYvrpEnN z_~&kGf!bZoyxlVED${mPmi^jmH}5{;Z)=$Ux%(%NS6-{sZF9{p#kSK>GLP5jX-Ga1`nKw)Zj% zmVecIw9I~~8REXo8ms=7S^K~qn8(3VNdF%H%Pji$<)6a|@K10*_z~P6eh4SR_uwS> z8#ozC{u}^*g_(YS`RnjN_$r(VUxL-}IXDeUK2C?rG0%Wc!h_&X;KA_6kp6x7{qRtD z52SxzekVK}E`>+Hn;`xB^6Me}`|@kxQSb_wfbyQ`0hV8knHs!&F{F|#KONGxm!AUZ z-ED+h1L@zFWntQRzei)=h834uR`j7Qalm0xT> zgWw}@Dtr`9f{(#{;p1=&d;*SuPr^OnQ*c-KG#mn-fibuoZV!J72f}CJ=I}XK2A_u; zz!zW%{27eE7vZX2%dD5+H}GZnH~0$t9KH%ag|ERs!4>fL@aOP-_&R(W{sO)U-+;e> zzl1B`ui%UD*YJ7xCf~y*d;6w0j_yBwd-UELNZ-?)~rSLs?6MP?D2Uo(Y z;Ro$kMJ1yvGZO2iSJCl(?2`k=O?(&!~HLCF8mZW zz`w#e_!&&X&*4$<3wRj(63&2sgHz#Ga5DTFPJn-hW8pV&Z}=_T9sUCjga3qa_%ApJ zu7U#~!|v$j(1e>n3-*N(xE?Hm(O$)JzEH)g(x_0se;EBo=`xG+hN54?68I(LyrJl4 zkW)*dpTPCthmiAzqQ8YSn$cguKJazOxkS-dVPE(X^{$=DZ=+9ahUZLkrg@9T4+$WUGex0{-B_-t@{irwaRn%|o!i2z!Y6 zP}T+-<~f)l=EKb+@V_4MK+H#)GjXrS9r7GUX@1Caxc9HYJ&AiQJOm~Q-;3}m%p)+* zg7SQ`;V@XI@utnA9e3dl*v}zq*w}EwdUaPnpt;n6;cibK{b%IT!YU zIl`3?4sy=b16DKkpY(jdYJng0r2U6)_ngmOVx#QWm>0m;A!hTXp2x6;(eQhp<0^cuPpfiI{(g`6MU&LhO5De=_#RV}A;4?Rmd-s^-%o6Jas=x5zvl ze?9OAc`n+2crgCYgp=V}a6CL4O1U@(?uB`=hCkOl&v6$H#r}M_BScHHxfQ$+mcxsn zl&6bfKg^eC_)FOzZMzFgvA-M^!z-WxuY}+9SZ4i@bVf-h-;I`!tFb>C`yattcnv%V zUJE5(uY(8nSi;&wqiiDf*Ta1wX7c++^JdJF-#0n=g?V$+xW&8`_Ypmo3d{DuznEX@ zd7F7BW_b^{>wCCE%=#XnxfA~Gg4@Bn;TG^7xCy)$t_SafkskM(4-n5kqqP5+KZDEQ zAK{PTyYNBy27Cy<0w0D?!=J#1;3M!(_$XW&eaw8E_-@1u&8y%O;*WGb38g$d1uw<^ zY5d9aKLe$FEyw;G?0*VRfzQGP@HyBBpNA><0z3@<49!B+_>Zq=I>!2_!0Rd-z(I5a|{{n}>PodN+e}z)7dN*hE=TXo@rUmxEE?Y6~TT^X_2&d zThL?*`QD>eiR0cw!}Sz1?zI27|FfvnVlb`Yd#U?+Vpex({=JCyAASKjCCdCG+<%o|_4E z919mlsJbc~Gvxc*!m4!4kneCyYk*^he2-gM106HuyWHB^#xX;_&uy*k95dAVauAg7 zdV9Se?LTJuzITN3eOE#GzGG0n?>MaD`3FNOhdV(jheM#0!=Z2++;@hRyS|sTH|dgg9csHi0`msONNW_&A?-ROpGI3_ zd2h+yV}$zNpxLizAC6@c`*A|Ghh{11+ZUQ}0+jY(KjIO2%KqHfG$vUSp#>*nFYN|2 zKa9}+W0rC=1@kqS55z3(<5bLJFjr%aV4j9~56sh{v@rRaun1F>g>BFT@^xCTT)ZT_(PxP5X8&J*^y~)>4z2l}$9H=4Y~V@=rLbYw_jvFuD=# z(Y1K;=RNJyweSIbl5Scgs$KcD&*4kC=hWqk&^R|2a`CB&WFk8z)6kU3rDFNqA?#F% zWX<2ZXqO(P3g%;@Q+0`X=}h(j)z{#bOOnFvMvEV|laoZ($-y$!bO&seM@c$ZvbG1fl3`ol-)7aBvh0Ghz^tteIT)0n*=Yg;yKHzQk4R8twE*qwz_)0ToQfbRV+g1 zM8?@}k=6puh*Qh;FU)wE8DCgXX~8_6D$BF1v%_FZIOwc&j^Td`C{F17A+TX(QEQpe zq$9^GZ01J}$3+iLd_(8t<_*lwr)nahYse_cERKk#I3(!!%2B(O3{;w&kE9k`xle{W zRpLi<@HFFVt%^zs58&R+7v;u=(ZzOx#YVKGiN<`Bda)K0BXaH@hPfOc>+sm?B_B@3Oi~yI=TL=i|t`e3x_Z8 zan@uKS-0ziNdhrE2Hs!6J66 zJZ5#_3is=@pUe@lndX!o&q6yLkz+e7KkKlDsW(bf;TncC$T-3qMkMCx)*O3eprZ(8 zT;+;f)?qq>`yeOjN1o;jjMH%0b$a}5y|DzEmrXjAGk%^B&`#O2ruDd$cnD@L$_cs8W?kP{>HYZrxC87)Roj%d0-0CC$t@r@O%2!aRK5@UB!u7oWyafL+ z&e)RZ+I+85vgvuOCH2N}_PWP5{(K%pE>f_*_%GA9+o!M{)}+4vw&qS4JH{aq-Zh0ot;bDoBm_tPQ8x?ci=AVN3dLXDm?Pp=@b0V)x~(GPY8IHVx?wpo&-^Sizbmh&|ot-~?Ck!Fs! zOf==+T9^CHlQMFM_$bjgV@I|L_x73@m3DPWpWA`*5Nn>VIxgV5;K0m$yh;42qRNy?JQTXrh{m4+- zQI%5Z41wa)oyg*|S!W>$D%6g4>ihRUlrML?JP*TYp66qYgd3SWUl+bZiATSgbr4UY zh2er5Puu=Rr}8N=Zllk^SB6B&p z;JaD&Fy4xfc9%VjWZA<=mP^NZyD~!{OA+kZa(7Wea4PP*Um5Tl3)wtpJiNIEsS4-c zf5Xav&gW@3_3LgLe^8M|m>3 z?-33ce2$|tEh4|;*2LFgJL1GMQ98-h_Ci%j!fN}u1;WLh@Y7HSGY9#DKR?$|eEEEp z=ju$phM#M-xw6Edo_0a1 zbob1?B-O4|sPpk56TJ!AwzXVp6@SrLxxZl`%=j~`B zPp?J(wA0eY&nev87xupT-o-wuKKp1|v4Sy_o*<91v;67kyWiiDRK&G}=4UzFbw2Fi zmn(APy3db-T_))sC3&O-Kehb0<);Qa>1i}G^)Fc?T`Dox2KykQ`LFQ%ckAai<3?9h zW48oSPkQ}$NA4Q)#)+aHCy{PUWjPr>v!GS=nR)&_fBErbK7eFn2kTYb^x5KrO1IPR zwofAO^X?NKU%0yv!s8upoWbHdnE)xUUZ%bAg&RVXT|f@psd1UCxUt1Gu5`+dZuRBT zc~7*Dsd1TXLn0*qJkO3Na^}COT;`k(qb%o?!?|STNNA<9rf6&adhe;Zwl+3r+L$qp zx~);kBtnVYXsTi-8?^ic>!VP~vDnb9_nxwYM;=*=eEv@lk7TXDP zG1J+8yT5i30)3~h4@@WW#j$vwXCK3tmf*iSJx96;`>cu$WEaC2BsG)y7MoqMjy01P zzFPTLn|_Gb^>SJZ{REuhTV(cHywOgr;!GN)2Z;tj=PD8Y8_$_;cU-o{^_KkryJ`A6 zm^bfm+}a8GdZ)%`_B^duIlBGHTw+$Lsv$Fv#yHiOl%#t3-PGK$z^QNfo@4snla#M{ zEM2WIC}z?HZrWk+Zi!hUIcoBmOE=T=AiVqKQ0ZEeSrBV#cKh=p7vcJUcfQK{^3)R! zkaZvRV-cj+rgX)-(Z^>my%6@sszYC&eRWGsgRW%2rOa>7VvSUCI@4)Lk`T~~Q*WQU zeIKzveY*T{?(f`3Y;?V*YcGpG{P9UbWSu4M_NYMDvDUQAV*OX}u8zLX2?tcSWM!3v zK4vPLK#t-hZ9_XA$Gw_TH#I%GuG!YVDy>dxzbX5SAIpN;VBGq=>drt>gl~1C*8Ov{FJZ{kJu>ESY!MnwGG)lKp zO{^;VFWr(r{;7m@b)LEIvn5@_+D+7szC;Z&N-KSds<8Jz_&WAY?Cwb=?NtWym%(3i zN*-M1r+xlpJwi(Kwrx3$>}N){1sL=s6b{fB4Tor_-6JuWDp(v;AF@KP5)I*!XglsKnK4SRh%e ziEp+p%d{hO!fSe`w6JL^WiNu%bI_;oaJGky1YUwkk3IZ#9>?e>?*8z6TN1jEUI1H~ z(3*^~xZ?-Gct?$P1;+>q_$m!u=jq*-Dc;6rrnB9t{$wnjoZFJ(eWe;|82xeTOQNN@ zPIS9+dEsgsbg7AIR}Om>pZ0nf&wqh+j68CE{H<3JEX3;;LI3tTM(-A?Q9`_E zeecEFl9u($qLjWRs|!h71=Koj_58^~oUAN$;Jtba67(xZ0M%$O&ye^->F|Y1Eoe&9 zV#uU8SC#zn;;%uHZfDE1OiOLu*i^kV6s=P-tbI^r;%>TRzf{3+iN-WS9AdAUC8x|( zC9*XP>$9Qq=iMin&dJ6^I!N|n6^WOtQvMW5S6!OY z;~uIHoOQ3Fx?f{UR!SsZJ|tP4uDL5K3TiX68`I8<43#I|x3dp7A3`E(bB>sQ-I=iB`a1AY)Q3vpX8vBzrYf;Q3sFa`xz~JaorcJ{if*?MpaLn%(CHG&I+P26j1w1 z+Pb6oW+xWJ@?VO0wC5##&pVBNtgda0)w6h%DuB)UQn17M@A=CnwFL{67tbA`Ot!hU z#TCqGJLbK|yg%*dR@Y|JO+1MEu%s{aUcC)N-j2>utd?pHy;mt`Y_gUmOIdx+Q2Sbw zW_xpUW=={gEqsLB^8$Id{nhk&>6Y*s?^yk7ME0gXrAs*iGg_jfVvdLwN*IR8zQXwk z14R5LCMGFLO5%GOrNcNSE0iyJ0lco)^zQ4c7woErT3g~yK z@0rd8>zbWSs^1yK;%>K0vUpvd$_z}zhr)_`uedS$aqv$q_&XVI< zeP1CxN`5^>(u2aIQ}>Ji(0gf+)h)JO1s!JSdP(1N zRF9V7yuXQ(NVrs#Sz5v5~61wMW1MAlt2<{05+va#`u^Q5(PyNBWX+p`7svP}IT zL;2%tZ>#MBWZz!bN&3?1?~h5#I6JG$LA^>f^!_QRG30OQRH$9@*0t&?SsoCLP-&hd z)SvMDIU+VUi$nbh&mWnbpwbLIpWmJT-B!+?$Mrp*=Z|ips?%`tq1|*b-jXqcJD>{n z&%F3te@^a(#xpPizawna;l1X*uUFrDhZBll!OnnpYH{b_l$^V0ruL*?7< z=TS+xN=3YXZU5S@^2()11f&LIY|xaJq=vpLpF2{II(qAw7Hxnl#dD!}92tjOFNW%E zyLwC7RiWEJuu?#@#IS!uw<<`?;qx^43Y`wFQ(=YP1EZnlY`Ug}iO`w;Ly2-Dcbcb7 z&OnLOOK+}~kFlZs*H(_akCmj=(D((k;DyNGY>0id?qZQNy6I+>Z@h@7d`UV_oXem;AA z-^PCfeXgmgToV6vP@EfX!0|6u}LiPS+M9Nbgk+L|;Nv*#7x!pB(Le{2Kk0Ph$$z%zu zu-x77KBY^9)%P)H%sAh2n1bgThti?#k0W=LWQ6N!pB@Qy4$A=x>xXdkHb{uDoL0L& zv03THWJ9YhM0cABsl25tlS;NUwJBfI*m5NztJdkwvW3}}sY?8z_Oc`W2jV^4euwtm z8{u)Jvya{xueIG5AN~%!*Ms0j_o3@u4g1_luRt|4JN7ys=h@TmpFTmHLiQ>T6Z=p( z8|9a~h#a~jr0r(Zs&J%-RcialRAO5|aB+wgnQavrGkZExZ6aBzPgenRO8$jc;( z_2iHD{*nnXbA`qWtKWZQ2Md3HzVV9fA@u$F_sgk=O8$Du39ZLdt!8%3+)sRa9;M%_ zBY;r+{(WW=A}pVfa5`ow5TB+!)P7LDQD{Isp>k*Ub472k-ldJZrw`b155=o#mnYNt zXz#huvug(k-H%x)XY-;HUnu?gesZXvDYH=aHy74(>%e(>>F->{Ca03`tUe4ydOR+A8Y$PIi3B`cj;@6^fux9g!MDq z?~mRDOOPAq#1bqZwZnT?qrs##DXGovf;=Wm?Ui&oPYWSYxuh&Cip@kJYZ# zXyw%IR>%Et&a&Uv7|*I-`~3R7*@qGg`>Y{9uH7!2ye>bxI6tnvOY!OXc5Ro_8ZM`X z9+;2Ej@AEns{$b_^Zq3!iMPUMW9N@iaVDo*E@!}Jst;qpB2H^#bb((u$V1K-`sR2U2%(y*!Kk_AmpHzLg&hsolzIAhTu~o>5`>k(}H~ z_=ws^%@Rx-vi|Q`m#@Phvp}c(S-T2`BOc={v%k8`S;jQ zgCD@@@O|js_aNfod@DV#{@2(ag8K@1sK$Sorc>f~{U3q*bC{2W%i&D;Bs_|AJOpWt zu&NWr9xs$I+F>AiUg%;1XT;rcD=hkcbA1%|N-i)Tdi4*H>^IXRr^XA3eC#UYu>iP92GtK#We*Jl{Rm;x;p{5UNejNiP zzmA0;!Q-9asg(jz6F4Fs)Ce-^t&YVA8 z&a0>Vo*`6wXdX%YXTj<4Y&aR71INI{8lRkWZ*VH^v&MOFFgzb_3on53elEnHl;4Xm z%X_*Q%6qy5mcdKm#_%%O4_*#8fLFjC@JiBe!5_kJi03LO@Aqolzvgty>-D`}V_fT` z8|wSM4*QL)C4`XYxn9WqZ!m6l+;7xyH;GxF7n+}O%H?g2`%-nkRm|!R%}LYa*k&y zHss=9B!>!PGtOqa(EQ4@to5udIL~LCW!qN@yoQKrtiZvJCX5_P!!gZgTYQ z*wY_*^>0)DclA(?4CGG%eb~MpO-Fj{`Vdc8FQ-IZs`g#iXL-0pf_!QQ@~O^l>JD!} z_SSjJV%jF%*CYEAMQiFPi9KI_R`dMcci_p*9lbPrbuFGY`p(98EgpM3k*jAOor(PU z-p-#%U5jsmOazRvrx^0uRlQg{vERX2{~p#4z9;D^R1f68HKsDXxz{P*JN@f4dvg89 z^_CBnRCH9Xo%fSp$m1xN+IDr}eD#5N4c4#T_p`IzyhLJV{E+YH)9reN(9W)t_}>d} z;GLjqtY;(LmYva3hsf^d6m4Wk;YV<{mc7m-Bv1FNpUCMBSCN|ACxFZ^{aDW@@T!>t z<6fC*%Eb~js{1Ha)s$$ivn8YU$ahoTNx|=HlFS6RzYlP1d*PgIdTbw_or~*|UVE)? zDjOf0pVU%EpR~o$b(bBMzqav7aaz4Tgtp;A>Ck9=`z;zdD#4NK>3)}_u0M7cb(DyA zwMTJR#xQ#2%}jD9GY#wI&CK?Rg_yadU9-a_*xxu<`wiZEbI0r5`#|EQI~cM!dtKt5sbfJKTf>#mOtx6?kEw-)x+#<6q(^4&iPc^ zI~g-a%{v_**D@G_t@8fGEUsH(Q{mX!Piyq*%kz-iy(*1LT#VipW>`^P zG(gPA57f-Sc%V^i8Ur>hDi(L-k!oMowvH#N|E}pF{@x@3(M0Ohf1d{4!Ex(hDqIK{(`(rLVwY*uMagKbAZXkw2Qx zz+K@JkoXq%BK+=#P2`U~#UJ+32Oy)I=sj?6cqbeIZ-pay{Wrl;n1!R^lE@g*?o)Af zWUNs014b{6j1#T3q;AEJE2f%uW{4rVw zkv~Qga4I|kR>OlJ^2g{DI34Z>XTUKK`D1iXcrY9e4}nAAp|A=b2DgWdLZjQjBj8pL z`D3&a&V=RgC|CyRU`02CHLy3Vg{3eFi(v{{a2EWh6*XtWuOafs=;tsE{{)YQe}Hp% z-|t%WB6nO=O1Xh$Z&-~YcRXFpFuDSNP4Fd%{4x4Gbl)T8uJ{?u&B&Qc@ZSP^B7Kx{ zv(%bzEO7E4Qck00EAQn->lpr%_abHA=zAUEkD~*1H9Q_(0g*rUy#$^J&xa?Gt~205 z%%?#2{?|F>=v3rnrg55qx$FeoUHkTU7U6mzeH8yK1^gp_ME-f6$Q>6(Ni8(%@rV48 za2JZ)QNuy*d$GtJ%Vy&a%@h>*V~tg8iu~~?csV>0`zzpK@Je_Hbklbg@fPzHUrl@# z^2cj%AB#IA{%bXz62I$ziQ3;Fa!UN)VBARfBGL)XLHN4~4uChq3U~|Y+XOCE_gh8I zsPE%8-p5kwb}{RB0+GvW{%U&f!oQ^VZg>d7s_+q$Ng8Wx?kjunom&k3Hc-W z^kd^eC!Zj4@rRH&%6Iv&Q11uLx6DV7Jc|9JLbZp;!K3Em@Ok(Id;&g6JW{_srO*G2 z$RBzBXGA`!&kxPZ@b^=_UlfU?ogdFZ$&cruv8>u@Ukg_F;3;64RO>~A!Ge`WmIc`m5={wDS}T5s_r^1Qzh z^4{Jy-gVsH(Qv;Nv*rgh_cPx!K5*RMSND}-R(EKQu&2&>uu}7$ZsOHd!@kZ zM|D~L9EvBfKS9UO&Y92)$Ghd{vL!P2pOBwVlkyZ8586YHyu8&X&-3Y%>S$e=Ukq%FY!ml~a>ZPMSV{K=2!+{~axl`Hb85kH~Bs$(6V1(-2P>(<>_fNNH3{mH4dXsPttTmG(j zIYUs!f?hWhiDFNF3(7BDIb`?z0PTjYH!-dXB5loy?HmYP5^v{RQ(AbrB3~HslRGT0 zet~t{vl!cvq!$!@`x?EVpuFpX{531HpE_lh-qTvk*+pI#ETNn^Y%s;n6OorYk zUy7^Gpj+>OubdasUohD|0`uJ6!(Q=os}we<@<>~wVR*NrzArAeean+=Y|7Z{}(c_}#-t=3v| zM2qj%y1M*|&-2>L0 ze-3xwSZ|4Uove#^$>?dk(B@}3b8BL|h@S=g+CH+(=pMyxmcxz1*!yw_yR)W;LRMpb zF>g1CojI~gXOi<1zK{5<%KP?Qx5sWEd)r)_7l||YGXOX5KDNKgyniu^YlY87GK{O@ zIQC;PZ^wL>_>g(DEe+=H2DDl~6Eo``)V^%4r7W+9l;W}^q*SQ=wsb^~vbGcd6^B}b z{P8hg`GV}nGRIgiNN?C2VaF5Q6VmENcZG2{3=W1n!JSx_Pz8rz77m4jtes{5RmDJS zm{8LTqnlg1$gXtmyQ@&`VRTc%QL3UF!aZOgNNpJ{g?qsWMEV(B#Vq9r_;)xGeh!f? zNB;sx!#}_=Jmop{FSVusNb_}dr01Si1fA^B1K4BX%0MCS2} z@jnR`u`5gRYbmQCra0+_g}YWX`JdwCBhKntFT{S5q{1gF4-Z~{D8&8Nz~ zEZpt=Sch8feykU%2khrL9m?~Z0q4LoVFNr1NXXRzuk3^cErS zX{qeH(sF#OhPzG78V)kMeTVG3QujO6{Vp-9J7nG2i@G1{kMLg1QaP_X#TnJ{S>pj-)EtGAJ0L_|L38UhZmSNFE-=~&!6vV9&0XQt;F5t zqvqS@zE-7p@;U}xo-f}};>q{ty7y(xOVwvY%NZ?zFMA90FWOz7Z!a*|JQ&{5-=A8L zLiJ{%ramRvF4su;lh1!|Uq!)r+qQZ-@-u3Eh$cKAFHx7Oeb@J8?Wy7Ec8R` zbG|adTIn13wcUSbyvb^dv02~Y_Lgazv`@$h`A4u=Id^Fq{?hS{*J>YP-E8GR{ z40nZcKjeYsgCV7=d`HM=uzV1tw^hD1+zW02_lEr;@<2`ZNVp;9QLqmj4ST^cuqPY~ zi{L(RRrCfVf=1a_5P6_J@4nc79-SchR`KWPe*XMh*ay=@26=Bpm&pF8($@$#8NLh; z!2WqS#V|^qgUAC*o`qAfe;N{B^a+SOF!~6b4j+Ou-~;d=1Har^ELgazbBVaw80qNOCr@%%y0cPN6*aY{4bK$Nq3x~oS91NS`j<5v| zg7e@ua6TLW7r@P7E9?)Cf&JjIa07T8>2mz5>sIFTllcIXo9W0ndXE!}H-X zcmcc@UI_1m7r~|QVt75g1YQF#g?Etd%ixumFNc@FE8zL?N_ZAT9vD3pUIkBtSHolA zk6;d70~_JBa1Oi<&W1~14ZI%Cgg3y$;f?SRcoUokZ-(-n+ybXyUJCbzx5Dx8HaHUA z4)=g}@VyKzzEkuvEn1&?1C|XczFXvgr;8azx5nSSuoB(}%OT%EaT$C7d3taBEraVJ z4V3TgA4Ly}98k+Mq`tbre3)|nbi)jE>;5QnKK37IdOpG*SWuu#(h%}pXhOtjNrKUApp(CkgRhQT5@9DZxj{%bt6|Cs-Zc{eEUZFl&4%zHp7 zZ+qfT%G+L~&ooA`hfltX5#~tjrMyA&ZTydd@_t7{dB0vFU2jDCHP4>8wV_ zpJ85WO%s+~g?}->8<}Aqf?3MsZ+F-tv_;W;DJw@t7J&c*&0_{+i-Fb7|T&F}@-0-uNT;7=jnr`FR8_z0df zk6~`c=>I4@7JGT$u>X(EE ziZ>`8T>MsaGlR<;(5YTt=R6VJ#<}Hc++Br*l|g^)?g!nbkU!3gK|NZ*{g_mr{`7_C z-;BzR-QDEb=Vj&P2>K1+j8)Cw{26doF3u)!PUMc4(!9sWjNtyC(Ec80US@nMQ|(t+IZbjg z|6U8so2})3%u!v7KZnZ9Idz%(26y6cOxNOR(vx#*T9Qdl4z5S%{>-k$Q}~<(JzmFu zZi1UyLo^F_DPIeo&)}Tr;KgppN}aC6AJB*Hk8iK8#WyO+K1hE&T})Tt90h-TT}+oK zRrPPaJJZs7mAoYJoZ^@j=s_^=9B+? z1UE^N1)S`#9P<=TPYV0vQQh(oFyo2NQnb5%2T8az18R-5S)#&+@j<Asy7P^8u>NlM zHt{s&Pc+N<6s|a%)2j35$vLUnsgvQ^vLFZ0=Q}T5tT$`YnT8Z6QPy%~dp<5n!pJu1 z2-Q#iZ1Eak_x!7T-fl%atEuPYB%t^fHhH0A?F+F<{GOG)}vV?hNkCw zdyKfTAt%DDCf%I%jEbKrbcE%^r&BcfM&$T^Q~I0OnSx&U+ld$ zcRiffZ>PC$PNX>)mJ|6h3tEkBiP!V*`OEk3^8xIP*l~5~n560fD&0;PGjn=LeeK;R z+~3QKOG5omx3|Z!u+0gnC<^G~Xs^HLhOqB{sGy_z$rx%>3_cq9NwIUSna@c~g|`>xi!h&Cr}Kp!>XD*b1#C=^&v)b6_cj@Kzm{n?3h>G-xo ze+Bf`GqQ9BQw)Ec!PKzT-B05w6jA~j|8e~}tiX^fGJ7q`Wv3*yNu%^2*@5g_CBkmK zJ&_8{_axQrJgV7dep(S+mm8Z6-mSDBTKET&P2P9nw)398p=_!)m7bT3Z^)&ZHhkDm#+>{^We$nEc5)hhoQ?G^Bk* zv};L_{=sl#Momr0S>?8*3^y51`R+f42uHOv*CEDqgym=hNO4AJXkId%spF`qd3ejU z=9*ItwthD6IV5QfiKbj^K~rta*XA1Q2k$pK<(yy}vd^XJlj1Y%zj0QrZC@UYr(JzR zp>&J-urZlTHkoeZ;C1B68wTSUSG|uulp*5=U%pIfPw!DY=uZYiS&2BQok}MU^)1qO zaoT7JQV|R%a(byc$xlShO8YrO{tC@&NlZFl;!E$WEaR=3Od>1ANL~py?+0Jcq@bPj!IV7rBclt?bDcwB^nd;toHZ zPVJofOlD4OT3t&+O=BWmpBu%jOmpb{+2=Rg(*shrR1WWZZhyMuaCAA8uQBO+_)xjA z=QKvOB-2c@a>%!P7;gCdU;jD*dBX6y=-xa_BH17v%1wj$;B&Xn+?MgLFWn*cv>czt zKb;LD1DZ0qGpNW?nkA zNzh)tcMgG*z;;Tto%X`jr1?UcGjmch29PV{o)=8mUt^p4NWyElPh~ThZ+`vdRVw_D z^l^pqHL(6h+&7dzUVgdaP5Zn#&%Rrqnlug!AAQ5>v6HI<7Lt?UdbW^$v?)`j5YA~a zLj9FO{vDC^cdJh=R6f0VGv_~hV_?=kZ_XMj|F}W+p9N>yCGITphSi_ddn% za-U+T-!qx<*HmX{sBb>hemnD@ZQ9Ym{G9|0wWIEQTzI^(T0Lw!59yVsLgScNQ=9d9 zhRzfD%3V1oSU)H3edLdq4qXo?R-tgCYB_Hsmqz0>Yt6)61%+NX-#SHc zHNxWsdz@mg2UGV@|1jULEnu%>lF<9~ubXNwKJ6j*7FREwtou>#;eIWWEN4BB?HukG z<@=$b@n@kq5{)60Ub_QP?R4t#5z61d`WlHK6rK@Ve!YywAIhhEJ05zUx{go+?9Q*3 z4F%-+tJ$|3x*u=SUf-(uOKljdPdCnqC6Y;dSYgO`+Pj}C7o}I*n5vIu7}{hRf>hNu zwIEB8^ckG()YEvc&ClD$Yif6{ajvnFU)zVAaM)rr8*_~&H2pQA$L#1($k~`z=Is*f zpp>74^Ao<0_#Bq^?YYLW+m>(JwOL7=!Jn;h^X_B&+bZv0%;LHwzZH(H{j{>5ccqMW zdQ}>gxX5{j;?t;zM+OMlZ=hxd`~!{m8CdKXd0*_;ckIgsM%2B$5^hIBR1V4Y@-oQm zdRZUHsyy|_Y;k$7NR`H49EthkXaCrHB26F?lB?B9bs!?z*# zkG=_q!#ChA@aK@(rsykhHyYNTK}uUx$m+c4v(}!X&#&SsYcHWb7mWVI8X>DeD~cl{ zg=!C@KPKF0csCpa?|@_BEs#|h(d*zicr_dkFN6ES3*ZE}814rb!TsUMkkxt76W}Dc z08WN;A(cUN4x9p$@IZJ3oC*(u)vy{)gOlNOxIdf$$HRl*Sa>k`yr*>tx+aZ9QQjLY z8)E5xUi1*Il>NQY82*lcgW!>HYxtgF6j#EdRR7>gN~h=_tP%T)Vyjm4`f0vE%E3wl zK}CgW&Eh|?m$GH_{inH7^!t^42^m87{S*>@VT8Yn9MJJ3AKVV!54V61aQ`2`WpG3IV<`FlAnqHO59zsv#g=>C;YvC8P~XENJilo@>Xh5Z zgxvRW^f1`&Pe}e)Pl{Rd2eK#gY2&Ak`!njkT+HeY+0(gF_4}FdIm}XCp67i@xqkr` z!JlFOFYfjt{1(0hzk)Br&*3ZZGx#d}3#44=ce8?tf{zW|&#TY>x|)Asyx}}Q#Qm4X zubg~<{YA&buhsrd<1Hs&ApU-%EQ zxt_JDwVU<1RcUZ}4J`eGDo1jt+qUuxdC2~b{QcMMi`tUphV|=ppLdu2kDYh7p1u#! zYl!Gq)GA7O;_4@V0^?bG{bFT1_HlaH?tYUTek$7YCn7Ul7$?5;^Y`6H_U$z!5Ye%y zovEeyNn@mV3Z&!vwXSqboAh^T9jLv!ZIq^>?6x@FM zovi~ak=*EBU-bWOeUZvNq%CM?-H^zYy4MADuL}yV3)23ES8;XEQ~r<7Q%Zlv*HGDw zxU42>wtFW~Y+1fr(poR!A>_eK*=mkPu$fC;n6D9^M#a{}1Mn$wNi`#I8)yte|LTC^VdBnwjoO#}pm?~+ z=&O7ah<*8naFAnWzNWkn<{f072JQ%Z!YWt{Y3<4_Nb6Ak&!XX?f3@sO$b5~)I|Tc` z77dkjRD4{tvp+ox*T*!R!T;+;@@z)*Wy0;s{KK=5`I_jHkkS=>814b@gN(+bcfh^i zQn)v~0giyz!IAK4I0{|~N5jh?(u}A)-&lAdW|^;949CGU;COf%+!vk%C&1&O%-0+P z_lGTTB5Z<_U;~^CkA?@pB%A^hQ08k6hg0Ffuo_N-GG8+ZPA7l%DVibkG>dxk9$?uX zMF(>tm~pz8VRRS#9SVoQ!(a@`e9iVn!%Ug4*%tGWa4R?yR>GrTIZQC$)gRVi7S_Uz zijr~;Q$?R5J&#Gt1?FhaqS-P(!~3Zdsy&Pr5$r7S7d?A)9C#n<#o8| zU#++e*#zYSdo3q@ZzjCV+gt-rU|#7;J6`kx?ksvll?!!V=49hk{4K`)6zofg1vB$L zr^)<8Su^&o|Mqwm;d*i!llY%g!2h|#w`!H1$HaW)aM8bN*5K~~4X5WZX}F8@zB*r1 zb_DL1;O{VaDLgnbO!TjsGvMWL8unMf1L2kM0O+RgDvjrAJ%34_>qpLWU4y;FY|Rq< z?~DC)a0JA>Fv?edy}IjpOy>63->C82q|YVkapPycrfdM_rG(!ia;wbC=zCzkhWB&3 znDzZY^9T65Q}4gC=wBsY?~(Z$(s7T>)1VJ=xaeOs|85Nz{j0<`+?4s6zhZs>eh8Q0 zuLys`2IYAk*ZV$UJn5K)^88Oh$&aVi z{TZ33QS)-g9W&>84L6@v_u;0@*PKYa&%;Ibd3N0IXEHy-_wk}opC6hn_*#A3AcgF*O;5bU&D>yo3Jlr zz6L#r!#S&p`6c)^lze>$O1}OUO1{1eC12lz@_ybYJyOrF)bxCydRL{~e2Be#55L3T zOVqxPHu;vK+&T47pL5Oiu)4tug2fBynJSS z?&KHLa`c6M&tGz9$;ZD5N&i>IH;(()8t(66)_jKO9Q@Y!m*f5qb^oWB)g7XTxmG8fo z=v~$C81lY*i@sIL!}>x^2Smr@2BL2j`@TZ8hv={zZuWx-xDk}^d1KXAxwE;6>Z{z@ zEW`dt-221B;HK~(i2hZx8g2%sLeal^0OWhodJg@o{r58~nFBTYkAqucFXa#RA88H{ zy{l@5ysv?xceVc>gcpuO`|7sDC+`(v-cIzc>U)KlRsX8KU-YkXpDJ@lwYT-JN<9%% zb6nD+`R=Am^sh?34uMi14uz8cJM&_Swc~loDSzz?3G_FY+PY8&G&EK;zY@B<}F$~oVRE|4M7dc2dGs)EGmUMkHFEiOv+e~C!rRskyTL8Py zwTm~W8&b!x!;L)IT{0*Cy>?nZXM;NvC*M~W!jElnCq^Ya*F3u#j5L|?$Jd}J+uAmo zDWYlBxsgQ{5l4?{9X3)-lbA+n@g0vjW3}*qUioRpC`G|X+wY-(o{P{|(8z6Ch_D`} z_!Si(qUa;J@mi;SEGd`giOWIQea+IIrkCJKv$P+^HXra>CD_jYoj}3wX=1u2o5;4t z3)YkNcWT6a>ks0ACdpV&qW8Pow_6)Mle)Ljox>ib@jL5R3!TeYcpg~RGk>T0A@}K8 zx&oQ!KBGi6vQ2#dnROJ4BptLjC#^w254SgKQC#E4@xh8#m}Bg8$cord{Zm-q7^1a+ zzOaRM`2YBPe;3P1K>p}2CqvuhN8$Aq`HhzKi550)CbwN(INx_9Ui-D(oNTSZNDkaM-weq8ht6! z&`5t!{u6ap>#mpBZu>|(>eDjU^~9`A6>_3wS0TqsQJl_ihwYx~9~zTQsje?~Q&f?Z0%df1_V8i#i+as?K}fTuLEQKlDzn)%ndaiN`B2-Fgdx z`O&>D=)ZJbQ2*e2YNMAdBtPeH4O=~vUBI)3^k01C-tJ3kw=!0pZfL1TZJL_&bMwBB zx7$Z%$9G>Zd`Lf&j#It#<@GLw z=0{emf2?ote)XJWAZm%i`|~-wqbVs~wZG`yH$U7C>op2JN4t94LeC-3D|JOOl&-w~ zqtN~H`_E&}e{Q)9h5wK1Nz(ZvFW+3TO?bb5_xj@R`TAn*PXxwO-TGF(OMNRUhxfj# zhGwaxxYn0Hp1sV=h)wu=%gf6*5l7E|XY_oiyk7g&Ubuk#QlbpG2L=-2F7s4g@B;1B zYV>3DmPpp=`pVHpgjo##&j|Dy_S>q>)~ssW%Bak{Zov-Du+OfUCF8hQKQU7DVJJsI6Em$B zYXC<|Yq!wgep@^410A|%THBsu@F(FUo;BrgC*0a{gcHx&aulmJiZxqI{VV4{O%-hr zlnMJ9VD}fYtI#RQ0D<*^P-T#lh^MH?{${+a5ZnBUF z3W68Z7y~F^NmjrDRv>g~5}Fk^yPL3(WaDl^Q&H^o?ESp6x3l-&``ORl%XyyV6bqi6 z|M&Ns*`1P20s-{AeI9$l6Ur^N9RSwEz6~5uasQ-;V2+*hxFf*gQd;-oHM$Irp*rm1g~mSzJq8 zzU&H9vN*6QwjwVjK15Eex9Cmivmo%en2}Rf`=Vq(Sv(igzKW_K?Mv-h#VOt|FhKm5 z%nEGbjt_aR$3)+ZIXv)~oDO2{V#O2M5%N_Y+8#2R4-JOfz%XQWt(V_l< zZAHIKNuR)WLQO9WZ5-G^^viJHAwso>p(4W3dxyF~kzei#sU4xtklD(R33r7*BW*~# z4E+ZVgI_}WiO|2{2>4G(s|tMpNAkRHAiX?V^|?GDEP5X4<*~>OhsY-wdK!P@;Nx&S zd>E21`S-yIs?X&K(KmxWmr0smoE|NDW;ET9{C`69&6He#^fGdg*h|?NMQ0O!8uGTM zS@9tU_ZWJPL>}%jkz+>Qah8~ij>0`--xBxL{%Ak-e{c@}5#n31qRNQkPs$&1cJmX` z)6kEq{Bn_mtJeG0sGgZ5<~jJQg9$hnY0kND4x9(8v9EtzsfHcN%%!-w)D+NejG?VQtuAJKA-0~7zW@H z>??6U1Wts9!qIT4nh#ffGnGg$AF1{02%+8=>hl~0<#~>VbKo&>E<6@WJ{-q=R;)Ol z9S&ALLe0k$H6QdzD{Sd(37Z!kq~>glEAG zpvW)xfak#O@LaeqJP+o>Kk0p*FwW<`oWL!5XNtZfAO2$J;|2Kp*0@mg$dJz$iJlp~ zAJlqz3HBG5ml8tkFB4Kemy2E*b-zNxT`6V_2hC+@o4M9@zgpd|5wp5OWLlq4eKQ}y z>oH5cxPg3=dVM3zgEwLS58Q8t@4;K(Tkux+8oUj@3U7xmLF$9Hi#yS?@;usR?zW#7 zV!lW8(dcu-UQZeK8~3Tb$}ekudO*z&N<5l>nfM;YEamzLl=ko_l=6Sf^o=F9VPvv0>$BnPMBEyddy#T>x|1B=r){h+cO$&Fo>=SF1^QeZT@kKt zs^zuaJ!_8XyzrcOEjlg@!|}H`p5isWPS#%vh4sn0E?G08&SD{Eu0r|I_1Z{0J$oDZ zqH{e*MlYmuUQQZ)`x3;tUqfTvLPO`Ju|{{H2zA)!@q|kZL`>vJo`$Wq85*gU0e*wa zT)467(RAgTrCh(f!BS#Mgqz9Di1+{7IX@fl&>eahidIgX z`g+~}XVzP~dY`MI+J0cZ;N1Dqv99XPkB)WK|I&3;o%i*u19;^{H<5DmxOc1*tj%?T z9X;Jhj&aPdHqZVgW0TLD{e6s1PO-h1zZ3aq`8bl9gnDK(<}%|k$Eaa`BM3eL4o zsk#^?CkIP$k?(TxDc|#bj4${(G5Cd;nFmz+;^TtLbpG!!*pGR?B@lPz04VNTzysly za6V-Iuc#hw4JBL|_H!At5w0W_3=1>&Wnb*)GXG~z41TWqrpMu*QMNe>;x9A;ZU=XT z+rypU4sZuJgn7fkQ0D)H)T&T8xRcEHm24T@S*Z7cp}xUgWxkL5?vi+MR52S117;iqtS_)jS7)-~u=e@Rvt2f?v0lTPOUmc2 zNqpA)pFGD&8vn_nXIk?UYJHdazqgn{I}N@9PluAeGoYlG`9IQmmd^Ky`E1)==Kmz! z=c@a8GViBm$o%Irng1i)GMWD~pCex8|A_xW;{x~=yja^sX8v!Pm^B|Sfs&7x!pZP5 zxCgu(O8ztdM>*>JpO)iQ*h@M7Rm)NJ7ijrkgV|&jkoi8^-*rOGA86iU-XQaR*xx8r zduU!wI&X#-!&~6FkoiC2S*G)UCu6=Hdnu1Q;E9;;gvY_VpwyGQ;Zn@^5Kh_y^MB?p zn3?}GcY^oBq3{8?J$w+B!G|c90q|j13Lmk{`%&CW&|dJAmhv*~7lfcnPitUxrejUm@Rv zw9i*z9()b^F1WuA3*Z|tAHE4q_!g9z*|*`(q$<Ynn;?aD|#PN+ z-|?crb%AFCQ-cOqsr8p4q~*1{L(OU##A6?^j~>s{I?5Ca}g`qq|@t ztoh5fWQ%32fLF6Rj-<8jm8n@XH_5f!zE*Bj!OpP=&ow776-kB$o-(Do%49#;NYM|# zQ`cjg#x}uoI{DCA5@&CqrOwaJ@*mIlpKt!$wJ$O3^hYAc~qXf;|jtp z=;0pRR(VjW$ z{j^(5;xdm8G|3A<)UCKS$gXr4eVG(~Zfbw&bb~qOZ`!#IwOL#3LH7gF>1nk!h=N3pCuXw{Et6_I{0xi#T4=K7OrZJ&g+8nw(!B$v53^H!;cS zh4In+8&}^LuSs!`;dGQMSJWotJm&52)@r@h6CKN%2vHW*Ab{N{61`lT%8%ZsGE+9Z zDdq5A*G=%!Q~XU$CL2d4>p14b>xfg4xNAJS#}^S*D(>|n1DB3fYg*Cm8Nc&kQeI4tE-hA&^Km47pANtx?QzX^s zdOI^sC*|z<&g)oTT$}5QzJ4&f-$>u9PXCh~K*@Ks6w!|Sb2-POO)@}0m1Q*EAetN5 zl^$VBWSOJ=$*sMk*?y*M{9PsTHL@>gTXTJ5py~fBV_sV9MBn;f`DeMG&dSGp)=yHb zu*eCywMb@rL(aiGI2&7)vA_ORu@WSIUcZ*lq0MXuqE~#NxjC{h8UKTc)BD#4H|IW< zztXIKF^g-7%SJMctK{_jO|g~va`7Sa?7a>2oc1{-e~_42r&Rl*WAg`_d_5E&1+gza z4EDo(2<#6Jf&<_pxCLy2TSD=_6+8fL4eMYToC|qd71zKpjKXc;esCZIv>9*^l>71( zUpzH`TS;fhg#7K?>0R0#(+*6gY?nV!^sSo%B|Q4q%OSNbv?bgL_J_>6g!)3hYC3HS zcf~B+4Q`x2Ox7n${*XUhsQCdy>*ZI-EE4w}DO7tHT8D6>VICX2Dr z`xMY;JlKSok7s4lFnA8Wl*p5q$5@3pc|LCYU%yS*MtKHi}5>w2Y{Z^C{>V6b^J{2tx{CI4i-Qu6sW z^{@KY)hz3klFxTS$#>Q(dA_@KT~f^V*zWh*@!Th7;=LbAIXs~LACz@UHA5|rht*!s z$5r#AnDe>+V`@K`ojL5kAf6}S_qM+E6}Gw|fV5HJ3ofv>}7;S2CN_yl|& z-UnZRQqF&ecVT`JN_oEoZ@?_;l~=%5;9uaY@C+#Hm8Zbh;Ym=|D^G-P!sFmua4CG7 z{67f30~_JHc0GCz_f+70S&yXt=z68rpMTi(>O*b!|K!P~-G3w`UH_7GNv(GuYq(Fu ztl?z6vNrIU$iJxjzt#P7F{?W?=WzdJFbcmUza?M4!YuXlYbfpT8z}8?IqVI;g?-_F zptRrbD2Ej*RNuPx13zFd{lJgJ*TwkB_?hRE{sSTh@e8ifudfhlI-r>sFh##Q_5q>V zL-R*^w>H=#>jcr+Ag&}<{^7cHA~Ij#4r6i?6s@eNA#_0eSw%&-@4Y9 z&DE^>*0tVW?7yTeIg%!f!48fW|MB_dq%EOSy%il+!j)%6FjY z?8`M7q(}i-*9i85oo7C7t{d1i5D4xUJS6yHFqk(auOe?^-T`?_^8TE+W4`z-l^mb`?i%FPGWscR@Y?NvmuZUr`SL%+EE);S^xX`lG^Nd&~LA|otiIK zFy9O>X*CPi;EFH$pwSTOnt)%e72lDphtAhE&$zCQ*6@E>1=U52oyy9#89IEg@cTyL zOO#n)44#v0{uUMNnLz2VVOm?F>2P+E+{l*CO6%z!GitK63RzC@*4GWu8x&86$HbGB z@znf8G|t$GYhSw@W}4v_TP=sym4~iWX4Dvkdr4+gkQK5&Uh1}`SG$shAJI!64xeoB zpE@$qQbq4qPw!Q2Dyr*ibyym90T zeq;Pz>-(zrR?F<(>T@1^lsx^a*Kd02hDbf%|LH~bQTKZL&P3OGeec+J=bZH5ZM>_p zPQGD43eE`j2#9>n^8ZQs9P1sM={{=KjI56R$_|XRUkf5QBfXSs^|$@2&@0tD-D(zI zN$(VX*$nu{5zpH%o@Y%C2a&TCtg{p{-LUsPC4xWJi%kT4M9fEyLP!_>OXTFBHFDbSqHG!^s^RU6 z&(YUs%QdY=Jf3qL+W8)-=lNvnSY9I@xh+0BslT$|n>krHEO{|8(vU9ajfwi2v^ztGwJ$%jY08M4wR60fh}o$b(Y|yHg7B3lqu6V6^QY!cr@7E!?lv_L%jBA!T%KL{CF>p?-)0G&YD{FQQ~Oc zQSwbYQgf6U>ek0~ZORpKl8rrPtfaArr?DMA-H=Q*NZ_O*WYrUN8e#P}&9B!;>O2o>m67>Y_ZI6F94usEEInBkZks*#` zV{;+#|ItC{PG(`b3_|yAJ_wy*4??G{&LDJ(+5S;<3$mO!g))8h%sY^$p2+v8Gp)Gh z}K+mtPqo z>zCR#UVrlaUM@dq0kS74G$b1U__WJd5=OrxoqXeaH^rxTW4tL<%eQNNJSxIu9Fkn$ zSRSvdipOHeJw}=u=k)X5ug&uU{^0emIlM;otXXkk&3+iNUg2M^QU1L_ip6{A?GA65%tboASQCeo*EqGxNw&5-pxHpz~@@d&|xj>$t+Pm;Nq0Z!7Wn+&%NG z;@(q!obb+krPy{D+)aW zklA|kmwZis=tnpl`QHD)5%3#W0hd8$6FYqdS#1dkN5g;Rj}d)KB_HIE6>5IL(3|<= zMc)$X+FhvjF!Ugf(yqoC9}<2{;zcg`?m+I0DwfU0@yD5!S}o*#ty^E{PjK3dF6@b^jHERknM z&U}`6D0~l6pYq>?hau114S$ELeD@Jr&mPD-(m2X4Pe{9%WgbmA-;;L?|C4f-wq|s{ zgYd_3zZ>B3bfi~X@h)8#_gj&t6#fzUOA~o!%te2}J!9VzPbXYgv@ePOGjsSqTje>= z5xq;uZ_YBIc_RMK({O)Mz3US0e7*0VRqy&SnE!&mL*NDQV0a;1oHtYDnHR!~G0(^T z5}1aU!UJF?otG0|0PRaxa-Vg$FT{M6aSi@v;P0<+GQ1j&g4pA(^33LLn6Fdw^`dtj zdE{9hdFHKfzX|&SdY_x|XQF*co?p_Px&Lj%+Y9sU*mr|>sQFIOv!vy77v=Ln-rZu> zb_kK{o@FwdZ{8D}Vcw_lK49Fh>3Bf&E+LOP%Y^2+!CB@*P}2V}lze&wo`U_O>i;o0 zuR`60$6)`2_=8WvH2fR!g@})OMf#sMp0U#pF{}P1E&u26Fa6N-P@ek*jbHUIsrg0h zM-tyla98*;l>B^!_$A+8RsXMv-X%3dP1hSx%Hd6Qf6I8+HotAVzXK&6u^&Rb??EY- z_tn43GpqR@#4F|Vq1vndB{hG9IUoCfsr@YTW5N$4o=@Pe!Ov9x(n$C@<tyr<4$T4gC7kOrB|Hw1bZxo9hv-TShdF~Rk zlyvkDZ7S4sKyz52x5zPLuky@lFLKR0kgm;OIYge>><|0FO(F8k<{u#P%w`w31@Q+- zKl04nO68ep?^~nG%xYIq>m~Bc=%eHPk6GH4$TLfOL*7~27yGKTJ&C-$w5M&Mw5RRh zZRGm)Q0m7H#3SR8A(*9K8p?fx^shU@Jh&6~r{aHScoN(N9uIegN5kFVQE(VM9MVp; ze;$Dx_7ZcXSpgTrQP@j=4|_#9sbh?7hPaP4#}QuY7sNc?+@1WE`UNph;EWHeo;lQ%o>q`Y(UF3Ed5@1?xuc^iZbqg1>*18>jyW4e>jKFGLVE`O*2 zV9JQih>h|3H1kJgQ4yvUpXe^sD|paq%>UY>*hv-U~eNv`Ao&Wj$?qv(uZYfW+zQmLLe(sPHSDEhrB02GLil^1}z~<}O zQlcGl-iV2dj;INUFIFM$7*TOd(P6d{Qv9nR=WTaS!5{vI<-BwEM&H`K(KlM(M#*os zA6e=B44!!uM>;H*oXo_C%;U#OUDB0dTUS~ua+fT5{1&U2ukbHMvwf1^+h>;l$5@Shl3%Yv6y=4>Xk*iUOl?IOReN&V@N!>1pvMo9sutk4I`wTb+&%2kW-yu6TT&3dKxxeGj zm(VS|{{HLs4|MmYZ%k!n1sge2$PqqTZ7-yh zXaA?0H_&?Q|@ezy3$sQn5(3epu&f z<@Tq}$gq0iu_m%P5urL!!vXQCQ8{z8y!iC*o5|(Bvcg^zn;J*_A;M`6qM=y=JI|3T z+{j6lo*PRDV=MV-J=~NjQwS$VIMl{d+qCW9PTjcr>SU@e)8IF6JDkXfCu+2mo5@ks z$J16N$kbck^LFf;@#b&GzM0?YzL`!^j$9@3u6R&L~g`!&b+P>30%qZ3A#!&w371L zME$(-NGxVGBSXe{PQ01@?2KOOfW&XV_u%M+si&TeJ{iM^ZK=XZlCq-xDLin&Lha! zEGJIyUmx6@`&j-;v;M^_t|cxT`-w|#32ut5$nS~|5qRuvAZyg;Ms#XoW}lAQ7hM%x zE~B5~%OLi}7eJ&si_eGs;kj@CJQI@p>TgSUDrQC{#V5h7;R&z|9u0Zx7aan_P~vAa z!nx}MCH|78;2>cpUC5(<&Drvt!yEisPPH=k!aweznQ#YK35UQba44Jrsa>7MLRMKr zLZpR4BZIpbyAl6xoSzOgei#}Ow9X@F3TDnDST5%hgtjFdtHz-+I1+9NS(OfL4oAZh zI0kM6$HJa)99$QUhlOx=7=*Ha$AA;z4}s-+e)_j?GUjD)3j7%EL4Ld!(DT!eDkT3a zF~1U+Cg-LfEoK<{JN{;=;lF|SR;)Nc&rQ!KH8f`P0Q{vjTq7rc7)25ea^LxKZhBEIW@yfZ3t>&* z8$CZg4i{sNV$bX~XE86=^V9c(ne;6o9yve#P~7*#9un_TO`pV@@prh|AIS;o;$Qdg zApgEx_VJiI;_qnEF$f-m**QObxtvQtzGu!)U(W76k!#m{2jZwG=A&+bjin4 zh)3%8sdlsAv z`Y&l;x_?LO17^*q3!voFg)j~;f;I4BDEWH{@vc~Lshpe6{(|Lte!7&;B;V!j(D;XSYh-V67I_rX2k{ct9H08WPw z!m02fI1WBcIgf;oz@6cvcDX->`;MGO@U)iq6ULMF^TLe`($D@K+Syb5Px9euA@$@L z<9XZtSq=A`m^D8jdlg07~9FiX9DmHY|PK3{`*@OA75 z;Qj{O9KH#A!?)lj@NHNO-+>##ugOPg-|z7u+=JaaA7GaB!(P7_|B!RjH9sI`>-==d zkB`*+FXLl7Um)kHe`DoRZ_Mgl7>4g7W?4|AQsFlH&21da*Z5V$w+b|4xo70=E9fEi1V+;lQ>nY!KrGy7uQbyG>eWwvo#%1Sx8&SEvA+1veh2*a`we=N zoDO}qweidu@5nql;?b?hRj-#L-=t^@)n3luZr}Ovqa>1S{a9%^a?kgRTdr=$cE%U6 zBN^7d@YeqSL~S-HjJ(?OT$y-wPc&Kwr)DDDseSSN*UH8HB+o;C_U-@hK8ohO=~s4d zy3Cj+PrvH*URMjt$4$1Be~n2+8s?yGbabRHQR~&~%ohgzoc+BS&e5(sQ?^r5Nj+D( zzw(`+bsXJqu2Nkrrg*Fb~D3guf|YfRV0Sosx=dA)7l+@{zlH!sD*JA@n1t) z^V>7N>0*md6x7d?Ru7k)KxkAw9R|SJzi5<3Oi8GxKukNOiodj%m5_blh4O zEYS4JIrI&Ub$r${^CMTVT+1a!1)h&+VTnPFZtRe6$ZkpZAOtI@XKV=6Z1# zU%QEjnM>#Eoc=O1D)p}qd*)vxTu=FN!mai?udn}Y?Ymd*Y-}t)&iym#&d#IAypZFZ zW1RA<>1C9J%C&{r-ROtrA@5%wbU2C4)vQ$v;Ma0Ji%F%(WCM{si$r~<> zc|bO%3}T^lIJ!ldt6B7a{h=&q2PT)GX_}PhsY* zTKqWN5wk5=iX|Er!g}b(#47U&m~{KKU2GTGpG_#a|ulid+QtB}WF624C`;&yadI zK=d<~EDfgkpV&*iHM$>6_(ty61e;iIZm{A-4_QAsZ(YfUAnSmOWWBQ}ihIVsC9-;h z+`u8~f3F<=45*rbj$rR z;m=n4bM5urb7fr@J%j^9Kcm?he}97c@O=17V1S%A&$;LWR6pa_@B+-A!3#B>i)DS6 z^js|Kx~%&R5dDm-&+Gbb(S!KAjOV=*Uas+8Vf@uDzbh%fBZF6oS<4l&9<231pZ^;C z%ky6gN5Sjh77=#J(u>X=gsT= zFq?Y>?v(Xh?C%n)Jv7IX-h1F~@LnkS!ul@j?gPyG^|>E39?<93^X4`G9>QNg{6DPs z8=(3bH^KZU_C4TZunT+~=D{c6kJQ>H;Sca{@EiCP`~*G?KZ4J|58$&<%H=sIP4{cMz8he5_jT;0yr6jv{@%bW{p*`B#Om(b zl$(?vG|$Fe)_2c@@50mJd+-$aK0F3~fd9kcKj4AzL%ZDniTfh+BU!(tymft7^Z8@D z9(;oR(%`4uS@QogAp-68AqvSQ6TF#Hxu z`}q&gAEY1n4(7q{v9H1X2N;7t!u{b-a3AOF5yRQOk|lOD#vy&nV@}dGoz?HoJ=c zMJ-QWs_IYlGfH`jen#l;bLO?&An}%no<{6TOfps5FT}pLS*rHEH9zF}Gx;L=8Kqrr2BjTt4yFC} zGh14BFK6BTR&yJ)1J(u}3%nHQ8r&jS$@%bef+qye3EmO>OP-+@Zv?r5)veB_rdaz< zGLhGOyRCOF)qUP>gcbj^?h}oLtL(YY{r&qzDjQRA7HR5hrq?e{G{~%gePZDTk}79l zD)SSKX-lP_xEQ7K*Z1|gvfp#E?w>gtLvCR2 z)A6`Bq>_!vXtFk~?mgt!>rUP*h^^nuzJ|R(4MuP5JJ$98d)D=rNIB8oT9;R8t-VQ0 zoTp1f>F_vfpS~W%p0#Duc@^%m0wG5)%c<8{x56>j{bgkBszW;T&Wk%tqdhQqTR%u275wU)0Da%v9IiZ-p5 z`ms;!e(YZ|Om^j;wBx!+x-p(AZ_wr_5~eQq9P7+(`4T6Ghf6=FTjeK+CZZ(q)v|xU zFgDcqM4qHJQ59bp=YC0cBE_|1j2Xy8%l%yLV&)nzKiU35(&5(omt)(KOBbMZhnhH> z7;0^`N-DQ)of{kmNaxFV~!a{2IZkK=?Z|oHWA) zX84F!%eu8b)AeQvPhaJCQDr;t`#XAJ%(KNP62F=jn$>zgu8DTNpRG-DAFXN9uASFg zj``&_V$7`cy1)5R#UH|t=1{;^R0x^p{YjUIQprKCe4UZI8B$-Ioraz-xaOi zueG-09&gAPt!}ksP~1=E{_?uS?qx5s(knZ7TJL9PB>4ifKg81E%xhfV``&Sc?>*xQ zXUVs;+MnAom$#K3-mA?96@=;5ESx2e)VGO{R3|M@Jrp##Mq&-YvDgDRD~d(!FozR)4Ae9;!DKanH)b@Tvv`;!j& zrjB!TwF4L(sN}GTvJEgy=EG9|lV-w8I_Y_VGQKyHfto;C+-uOb(-FXZ z=)cNp>7<()%4=$qez~PTNUk~qf~fR%vt#kvxOIH4&Ud-orz97|Q`VPeot%Bk`nxFB zu=`Ob9(^0Rzq>P2k=?!b>(KWi;$aA2bm)6&jMsU-Ny|I*z0g*C^Y*bsq^3S83NWnC ze51d&J;mfu>qJ#kV>~vyKG~S4&PW~(8#sTkc-_qFKdp-CTNdZ^%j4MoxZgBN09rAR)Q+c{hQjT0D^5Y$!cIbOaGsGfyh+zW!~ZGaoCihG?{K-G1etGjk4E zSBWHtz7(;xu0nGIP9*gI1(6XDy9?1Ba1#0fEcc~oVyHn{D2k?th_OFFuAbz&OZZo5A)}??ry?=c?_p#zF&H5L!#9iXDu^+djC~s42 zMgBm1$iho+qqAxB>B)JFm|4PC`=Ty+%Hje@?JdrOtlAd+6f6+=ICUR@{dbJX30Lw} za7%Z*OM7D4n#qwjf}KP@&U}S%_zS%Vd2588gUp^FmsKG0aiJ&RAmrK}fxN0h!foLL z!Rl?qA1!89r$W{EV|6GLfxE+f zAJqg5A-6BKfsTaEj z@`RntrQE+XI7{@NEL{(?Q0(_o`@M~QFt3Xl;%{Hkd%}5^1tK4ZsKjg$wkUcsP$2PS z;>$?}8OV{u)&B!I{39QSTvGyVKqALfAo6kM?f9Fg;cAfzHHsu0Hf^CuxBR2yd1JnXI=`e=bbP5PLSVPDEd#3qv|B*7xR3JMBfSa zBC%@a2WEYqgVgiY(v!)D!?@pxfx|`5iI&F^l*cZ?%=yIy zCiX=~;{RxkSLNf7XX_;Lairro<9Oolj2U7+0nJI0@0~Bu#!o809a`*zg z0!n^diNEK}t5na)F2RiclLF+5t$e&j>-Dw7AosscNIqXLdQLQ-Z_s>J`8Z7<_U4mF z$K7VT-=glfido&E`6&0l9XfcL;V;T^~=-36r{-3_H4iG1AE@LqT=ybntKyPtep zvBEmPSnBVC*h~F=i0AEs_LE0=KB>Qu=YLerEvCQG^NTedn9b{uj{BS1KPgmuXkJEo zo`UDYr-`RD_zWi(iyT&g$j4z;{U^w~6^MKs<`;~=<1YO##H{*Hw7$GVJTc;VS<_J< z@^R*D%&)@f@HIFUz7D0myuot?scmn{ULFc)k|>C%CJ8oIdwA>b~6g4*S7K#eECQA!c=lg#X_75&JEWj)Q6s zvH!{V1^d28$HAr2zlwQhB;R>H+zlk-MBcDKh*{4s*7C_be;)Nz>PbG7dJ%$BpE?mB zUtg$L*i;zZ%vy6XXXU@%CVU8DAJ>oO;i>S+1MxJUttK3hj*qEzE^$+y_@ zFSF;MU^+fKl1d?_f}fq#Un}|@+(~iji`-VlGZ+!b6^yO@`mGD{R_!%{OV-%cU@OkZdsFYt<$t9KQl~Hk?numkn3xQ-l)z*pRE`Czc6dI^hhnn z%oS{GH6Ogs*G@SH`in8-V=^$Feq(ZAlD5ska`)Dr-&)xXH^{;Z)2`*UktPlTi1lwP zoU30JuRU7u&liSVe4G3l;}3T~HIclK1;H5qgf5{|a^@;KU6-u=bcIhewBsffb%BQP ze7g@9jdb1tQ(;o9M(U(q6MikFGHI+0(F`e9@Pf6UUVpMMS0a~eNwdXrx6$yQ?58@{ zN~f{4HEa#`TLnR?cGmmw1I==hB)8O+l+#FLb-0QuQQLwqZ&k^WA1y_mqi5n4(k2^J z1bPbNV_Be%^A2_0r10L=*2~k4eD}V8E%_S0u;mK=`8TOIuJOOtBI)ZJ7(>hLa(2Wu>^a zv@@DL7P8TyM#NNH%9XbBrXwC*#q-N#{NJIMspWC4@K}Tw8I4BBjL@}}F>MK8v z`_#A`{aqo)1D97O>Y8ftswT;2m%llY`kKa6B+B%SI9PhioM>{a*SY19gd&Gy>Q2uL%zv3|0C58iPcmrQE#2>Bl5DY=jk|y$D1D=av8r< zxr|Mu96jHa9eR$|rkel7Q5=0LNr*@u1gvd6xdo%p?MmrVF?jGlp>+1Nf|Wk~)$vHvo@G8CVSvv*&p z|7$WD(IB*bU>8nDSwFCaF~I1raZ0?-Uq9TO`&jYy)$s1Pdt*~VXtC4mH$)#$&%maz z)F{PO^Z|*xQ8HwmK4NCQPR)I`Tc>A$(K|1U&5a%b19K1YhdhM3W3OD=olxYya!d8U zm7MQlZb^8Ncjynr+!qqQcvBcgPNEoY12=>N;RbLJTpuzERNNJA3kx7`z2ZE$Jv8AC z@aMvwfg$iaI23*ZcZ6R;X6cJQhRpI7e+cEi@4{U%zX^APufk#Q1vnf&3rE1e!3y{| z90?zRqu_&ZG?a9*`cQl?=CSZjI1b(l$3sc??(jy;6X11lBD@+R?@)XNoD464Q{V+~ z4|pD&3eSX<@KiVro&cxAW8e%Z&odKBzRZG>UwcBy$GxEB>)ufEc^`N<{`ZBFfBQkn zzu8doZ+|HH7lD$0RqzlLE_bV)nwPN`G(P1 z{4IbI4)@SNxJdOCS?2zj4@BOiFFXjALPqzYVz>l(nqKe_%)&!q&%&j~;jCA$S9q9E z>pu*2E<8e3EqJbsyhG0b=1?Btj)p%M^b8yWe}Kore2fPMOg4e?F@H$uluZO$A8{l^EMmPxG1h;}W!vXLX*c;vod%@e_`tWwx z72W|m!#iOR-UWZ|+%s@D`~ltrzlHb0ui$;~-|&9;5qto?2OorQ!H3{$@L~8Od;~rV zABB&@$KXToad;Y)AN+TE3h8E3g^Ms;2iimjKMeHZ1^VJ3%&)X!?)p7_zs*1--YAhd$i{f zo%Otzqt>Ng{{Zul&U)U<(PI7(f7{~kpD+wRf?Gk_Uw%LMF>+j8@%IVmPi>6(Q&HDH*;7i)s+nv6`r?kJXh52uE()hc-0+%E2^&b@AF52*Wm z*cGNAFVF7v5Pd-1=R))Wb+3l#1L|G{(FfFhKiC8A18zZw~6b;8cW8V@>30G+JR{ukC_}`59R;<`u^#m1AD(DL`!}#m3 z;m`xfeIy*@zFV4GVcrrmGzUOt)y>U2^$3)~zOWqj#y$*7;5M)rX3{r^csn!N7)*Qt zV_S1O+&ke8F>h}U!Mq~G`yYM_F=IcJvzH9>OUw}SPUg;-Kfw$!?_x4LW`2MflFr@q zc_p2h`wmz83Uh?|uRsP!d!gy#JBQe7{p%%=%u0$lYnZ z({h}He<{ZV>P6KZ)L zf;ou!P|Q-UOQDqOVels6Ib74zGjIfEDd!{MmDnF8W_UF2GHyNwa~0-e;S6{joCuGH zqu>c}XLuqU4F3qXgeSp1@MPEvo&wi}r@}mV8vHTH`yYM<&w!u6GvT}NEch}!8$J!s zfe*oR;T`Zicpdx`ycnJj&xL=6C&RzMqu>SbV0a;Hgcrei@M0K&m%y3uQaBM_21mfl zp^WFRfI~1}3CrPCa0~cX*biO}H-p!}KJZ#t3a^9GF0LmZ<$K}=>VdSQ8=5S=Uyo7=RPRy=YA;d z=K(0~=Rqj#=OHNV=VACg-&v2qW$;n>DSQk{yLuc-yLtjjyLu8zyZRe^4}VX=m*La! zDfkS0EbuI{p+?a|n4x(md>-BaUx3mc{|>Lh{35&vz68&KFT+#dEAT}4Dm)&(29JfW z!=vCE@L>2R_gM(vf(`I(DDC_m-1`LIH9yq${hs;0-LBw9@?G}<_HTFk2VcI@-aZtP zPyaMOw%tF{aQ_lB?!5nrZ*Jfd^WV1nr|SNhnAIJc)!hGc7=d3v>Gzk>K7+iszJz)3 zEA02f{cE^4{07d1%V8z_7EXo#fs=B-u2g<`}|$nnr5&a zCn-`<);YpqgfG%zx4fd<**bsPxqqrLn$oFrRPdEIHPj{}d{W9qHFKx4nH*wi>+Tt` zNYUIX*DA@kwX!_b!itW_HpEy97tI&47Cv8pV=no&ev%63x!aTvU0?iX=Ocf6Im_N8 z=eLme+R2k`Io3y7)ZbzW&~D-lZ?D&h0<)&ZNL6hdXT65WZ#KWzyj)cw(OYs=?K_We zTTP!X3^vny=4y1K>gOj?$$Hsqo_2&+2|G-~yX8`UU;58>YnFarf8>(ia&=0PM2b~T z*AZ+L?Tg2?&(6x$KM;@8oMqFlM?I*ndwG)d-e2jLv}7l&?t~@YLKPJOkq!H z-}B8Etvl?5mTk(iC|VVX&Wp!TfsoM|H*yWcn~6)JvicKuee{**Xv9&O<{RF=`$kcC zr|+K31GF>!k@?j=g_DvVE@n*R3cg~5_ge*#6#uJb0sO`t;K_nFqC(;e-ZH?=T zw8}kqzu9`15o0ai+HdTxw|hu3SN1*ObP!q>BT?DlpFnM}MT%MLUL1t97`tg-{;v3Pv z{Ip)0iH2lGyK6i1&8>&PRSJgD&id>*hsYh_j_rHSSmqq)_O?^T1EMb?+uqxm-xb6& z5j`=J!pvQ<{?td9(ADm@o}ZG!(?W#alcl})jQ8Q`w=JS zjI{Q#C0l1w)c1s4=Vep6wMj^}qDC<#_&BSl=I0U{Z}n4+iD9|e!yj&aEAJZIqL?%a z=lE58uU>0&PC!_N31vNEB9{2n-XRn|I6wU7VEFq$_|QOj^FX-X44<-hl;Q`QcWUc`@OZ5)#~$HFYOi{N*+{H2W0!f!p~PD+1XC} zzi#HO{at7aMUk_LWOI=U9@R=F$7PAS6FJ=`K_!t{$Og)(O3hLC2G6z82qxu+H_Z=! zmlu9EFMLT}_`tmIu)LfpkB}x=Y)fj2WK(esHge!l+jYntc0OTbBD9GdkY;YjS~w{8 zZKWN`u|G0gm6g8QmOaWlyc(}kTXmapYhJ}un>Vk*-rHXXv+XMUPX2E(7;1mYUAqulcquq-#=FdWL&zF{To+pHeb1Zm`fK(3 zYJx1QM;65NHEDg1x9wlIqFH;?;;FD6l`zd(>>1G3{oJ1MyR+Q4weeMj>iw6nLCs; ziyxO9@(A)g-gNlZq3q{zrt*DLtAv-U8~?oVSo_tRr^AkaqG)mokE|FsQN#Cb7T)VG zxu9NzBhuxq`%7qc%obfPs2LAWY)U7h8vmeG3OAKG+C~(;q-Cdu@3}nbnlgvO0Y{>b zHC!=eg1w}v_iM3USN=4_Oh%4Pip`y zH2tl(XXRexK90X;;xoGb+Om5#nwIk+qgu;8&txy|w=(^LbI+WgTnRbTZGNOSD!qvH z0Y;OK&NHU3wfH4sW2NISZ{q>73mlSaE9n~lqxx$E?_Z7YmmDvs)jG2$*Ox;}ueiJI zZ|pm*=g{`LGUe^O2dse7f3+G;dwtLQN&}XzOgQ|sxxUpr{_vFS$3Ok1t#f_5mAPNe zkP^_|$M1Px+5J+s-ROH#G_lGRY+8+aksWfiI^L=Xj1EjY;g0if z)|8%-K9Zj*ZZI(^=VPud{S7J~sP`E@W0XrTgvcdX_a8f`B2qW5-sL7vF89H0xNqBr z`}VoqH_YCD{FG5+MyAl+l5!_O1xqyDGiHq(yu)^GHwo%?A2oQ$Hm$jj96Yow_rd<~ zT0Ub3j~%rAwmOg-RUb{FM!s1>AmjlvB}ojzl=| zTSFmDtt%4TRo-^oeIN%yC=K}*8J9bxO;q2rJRrIjnd9nyAh{Qxlz?rjcBvimnH9H*OOZ7 z31y^hSo%4v`co^T@%X|)l4nwTXGfy7R{Q%s>xFTxgS=~mZ#BXv7~zN!9%^j3 z6$fUG)}O$R;XX!TH^XI9#%ob#SZZ~7%{nA&Hgh*JS(;!jr+njZS$L*VIEnR+t)@<$ zIaB@R8bD>Ia+pnt=-gSk%$5yjD$UZFHas)Y6xf6R#r0o#_-57;uc7zz`kby3d!kKI zmPp5;1+hH*Ha=fz=5qvkmde9F;P$olp<183<(rNsXJ?Liu-*gB-9@Fa)}OHc8Xf0{ ztzrE-+U}fhh>r8Tw7*{Y^SpXXy>#-A|J6l#KOwaoZE8p&P`RjlVFMEi@?GxomqY1u z`J8yINU&O$$ThU#zp`Rdym3J?HE(L1v3tZ8<7_+J|J1o$BH!!ECnh4T{zAuXQ<{*r zk6U>?YCgp>1<7;?V2_iWa;q3Vl_5erCCA)p8I+1A$KB5935oi7ywzd}nekD7TYLRE zpKjBqPSD{MnzuN$ehm7z=EdVq`TFWji|6v`xX(#PuSa4I6EZAnqec^Xc)+fkJE#R#r5|=ys11xFK zNPVJCC*;bi5pX?{F{Bz=(?#K`&_Ut*x%!`$_6#tw=tlZ_-_Z-NX zh~Sd#fjIo`PXD0Yf~D8jc@Adh*ya##jAh1;J#bWTrcM^zTAl*$oe_LNy(0FW{;Y^`m}6~Y1i}0{HZs6uK2j2?|p%Mqa{_;l&Wui!P#!K3e4@vO7kDB|JbaIu-kCR^Oy)}ILR29u*9wF1u`ug*lhNilB9d87k z>L3bVyNJ%OOG{XPI&^`>irjuqxj&aLf8G8P=~PpFJ!?1O&)4s|{naNI$Qw--c`~VP zwtrdQB~}j+(*df^Lpjf%Raf6oOXtE;rR>9#e$7ALYOr4fzW&&%@-e!e>O@VGRodlL za@ifr)&SjVB#&XuuQ~T+4YK2WRLPfZv^tlRzFe0o}fr=qj>R^Q_BZgI&Te0iPlReIo|CV%xy7VRB!%$@*a;;e|+sHS}i+T z(!7i0)kGA&_e0j*>J04pB_|<`(Wuq``QDGx)7x_BQFigy#C-LZq*&nwTFDM>#Y{)8 z>62zcUIC_0xP1L&U4p@awzl$w(~o-ATWGvtUaBNU!t48_nY%2~#aLRWKVgkgu1@-k z`a_$!!`1Ok$9!u8pC&pwvey4y^`M^Zz$sbR_VtI@%NJxh^`nt)IT6*)8-F@Z^rWvt z|LEG(KdP0=sn^y#uL>|&1@Eul{{7aza@GDl;@&i4*B{?~T;n9mgYUZ|yL_B;e;h%4 z;}Z9HPb2iDtNH#lJ6$dNv-hRh{&e2m$tSCSll^A4yDvTN{zrZI+O20_n0V+SKTiCy zh?u#2<5KC5b^n$xJr&qn`?0KG{{BqYc$|Gv&H54R3&`G*D^d9R!)C%hIuGxpmvO&! zW8b`qLqC+8j~;oJ^LxdgRg$N#wk`p zeB*E?RGP`jt4Du5aP1>j_Z|6lvMuwOQ666yjW@`Mzr2O>mopRAzWlX6qnot{w;lt% zuWy{?c6aMJ@V6`XzJHA;M}5@1>MO3!gEj95?7^3>9IWwfgSFpRqVTmx%iX;{P&{$@ z(~;SK?5j^Q5VZ90SizcwquuB|eB=fO(F@RA&(C_|OWnoU zc@OKjAZyQeNz@w1>};j8-RCA~JLBzIUdxnWc_bFIKL7MP%_$yR-$Z%KdY?^Bz3pTi z-0W|$Z8O)H#i_V+ZBwN&)tJbhlik^0JdQbtF~(?L$l;imWbKylfA^pNKH_sg)^~sY z*AMN=n<1^`_34g7{(mszMfZIy-zA<`5bg>WLUy@@Qg9fY2YLSPHE;xs!U{MWj)Z%`QEe3JaAY$qp? zuhWQ!mx8$moB}7oJ>UfBk9QjOW3Zpj{qiWU88FDH>ZBvj;FoeRH^6;QxIWwqc7=Px z&Tt?62aJP^eKG%n@BQG9a5nrN?hlti-ol(+yM$BQMgQIs&Tlt3V|R(cTc5LemvF+h z=uun3$?k@EE2K{_uZ7G2aH{bVgQ*LBj=As(%#5u$6M2cj0<%6>9hB#;hw|J>D9_aZ z|AM~*;JJ`SY@Pwr@OaqBedW2Ec-}l?zC1T)NiUJ}tvO?QiJW(B9tju0r7%-I2V$1{ z9BiQIO)I{mM@@~!ea7pkirf&b?XR0?r&D2^vnozHM_Juqa5pndJP#S+I`!C~#oPQqZP~F`%dRVH|8jWaZOX&D7=_y+6fFN8 zYZUIre*s*iF&CR$Gs(N;o+K9y~l+{;o0^*t~LrUmU~oWW4+Ig^`2H^ zm1DN-bVy={hL;VNT3&}vKgy6joy;mE)bAbbM`Joj&Il_w;TOkKyf$@yZ_oU^t=D=AaI8yU#5b>+>5%0)bVksZ?i?>8b`r>By*;29>`iwr|7%qK#5doa>wc50 zxk@<)J!LKNlg1KnIv2#NB?Ygu-cFM_~ zFOB)XUo#U3F|C)5|7PodzH-NBZh0YJy^(}!$@u00o6Yb0(wnZg8>;rdPP(d?a*ria znO59PKFMwm?kYXol53KD zNV;}*qQ0T2@pn6K-O_vkJ%HK8*vRz%{lV;_cDEY0azxIpwvWp>|MN`a4C55zWaA{` zkH+!FalWueaAr(#HnxM=?;(GguX+Dn#OF@F7y#R$xX5`=;?pQODX)*1(a){sJ}2ZAo15vv=H{Fr zVPM`^{4rmk?nOu7j=A_yxCIkh2f{6>xM|2}SKWCF6esh_B;JxlUb#E|rR!j#S2CyO zZDi8>7fvJ`oqFMTNbiWg{9*VcY(yiIRP7)JMdj74gS^Q@ zkHKm1Avhi03;F&J-2rF9o8c^Y4P?|Gx&rP6FNS>ohyDWhf#*WL|3ha%zW+m~L%#n* zC&T^W2`~bWfs85#9*&>oP1d1yRjAQKu1`Th^>0uO-O!xS6{c{PN}U?bcTHc_AY1n0|l|52Su zA1vw>TqxiDM~fMTdg5;}>;|bP`Rl-gIA^94?#v4u8Df4w>ftg@dpguEM@WZP%-n%d z@>$?8{wL)tZO2&ulYqw4{X=*p9qv2uDEJ0E8omOLAsx@cV=+GoGxhUwyMCS^-HUOe zfw|}r+%xtq@l@*X1Nb|Q@cG8+8t(QS;m#u76)Vm*&e8diViTIz;qP1xcb@Sl?kC|O z_dnnGGv=!>L-Pvw7kFu4WAg%dF}x67i2X(I&+uaSCzwg+r5ev=njVQKV}Awy&c=Kt zJdM+y{;K|pO=zBg{nhYjcny?xc`fM+lFQd&mUeqR>6(Z84VdR}+S4s|dE7*KEaS8% z%-Y_d8OI;_tLeNAv!wHOcrm;KUJCDo@_ct`{@iWc!~OEOAJqK07jr&yKlj`D1DPLt zz<5a8_k%*cA2i2v+S8+I|A{S<1h@LARg%#pTztnwdZf}6ZjPNQoo+Y z`~>D_^nS(WvzQ+?UooD8XLEYf^YCuWFTh*j-{B4LMfg|v61*I~3@?JO@_f>7L-Ty% zeGQ%iUx#PHH{j{;O?WbV3rhaI4W+!^fu{xDHQuw!3z|pc?|mrc_5nN`^FPEM^M_E% z@1LY!%I_o0Qhxt}2jTBy*a$y?^Wdkj27U(P@ZT^BKZpCnFW^kLjB=O?zl7uAS9X2) z8u!!9Z;bD?9xOM$weufpd;JggpK;og)n30BQh$Chezx6z)NntES<4M_hR-j|_*vms zs5?gceFr%MsMusTiMbODLaG0GdLG3_X1<m zFw-A&<(!Gl&2`Q7IB!Fq7h>*acE>Ew4SSWEJ($B4`yOUb?4?~m%o}LEmwd~_S48|$ z&wD{>_ZvcK4;%3y`G#Cr*i;xVnBSSx_(;DYaChK8fxO_R!6Sm(<;~116=!E0iCjln z=8$XI8aJ5Yk7V-Tt22YSrw^u&E{rj_I7L* zk8A$VHNR_ryjEuAZ0r~Yu4MSkhiB%-THmwjm-vlUXcU%&(cSUS4C{oAbIyY;r6lf!>dp>8TmO0&vDEo>rcUHo z3o&z9?Z;k^5PQyJv1FYX!*OlGKkGi3JqTfUcGK?Fn^CI%a@2Q8VkRhlHg4w6tJh-l zX72V{M`o&2^~|ufvlfqBR(s8H-;DoBsBol-ZH8a(Jg6_;ibyRxO(H3c)sPj!w)~@c zf?3#Xc_A{vvsTD&DeCfVop3duOW&4 z539vVxHihQL(gnhDWUF04F@{(%xXW}dcAQk2=c1d_iuQLN=VC8r_@)jVe->j`?c$> z(@#uPeGg-7(cjE^)~L4P$=wfl<%Bbl5!X_QkNLdcT2E(p65-8f<|66(x;3-sJ%HWL z{B!bZRmMS<1lSpb=L(+GYCk9)knELi-UqIlYDA|uwGLttU70arUZCBhs~_CJN|v?G z;?0i~$_lb0%?X)T_|^pQ`g4z8a!kY9H|Q($)JK_z&AiiRbC629aW+;PHjCeWA5Iii zQXTqUWW2x?Y)juuFY)EcZw7I4lF4HB?BOKwIQ7{cr{=xGyt>vsbrJP)+8 z`ZG$!zs5JJT7(1TEH&9i#J&Pg%>T#UdBDd}Tn&8pPC8=&0n=na2-(KQ7^E{D12%HU z;36y+Y>Ir+o#exkPTWauK)@6e0)&##LoWdWgwQ)SHPp}?Y677I2w(^VNGS35e{c70 z%iT%x*(T-F>L>j*WoKt+W@l&Ty?N7H;<4~8QCZLPV14)fH`|xs(^Zatn_UF$aGZuW zH-e!)QKGa~=^COT=W3TZ+EEJw*~;cbVji1&iB@rQWh-C5mOPI8>b;ij9c(J4<>Z$& zvZ%DQq@tU7{W~%N;?E)Df7f}WkXvpi<3v}y935!YT9upb*!A^lYHH+T0C6%VbcS{v zKc}2kzc-z7!xW=z9mURmkyakDq+g!i?RD__9&ysOY=Ww}wW`{9O9!jxW9pLcwJyrl zBfr*u)k!y3JvhQolGgs!iO+xO`ju5n*7vFF`gzw)%lpn1&wANap>e|kEK$~z@6xPr zUCL!G)AqMdTd^wY^Ov4q7w&0#JSSqQrI`_ddt@Lhm9(FA?kh_k?aS}TDYbmavS`&> zHE!u0y7C)gal6&s%YATcD1V&vS#>EMS?jd$-$nhmmA_8>h9tY1Sv#&aB-$2P#U)XE z{ffq`lQ)_D;p|H%J@BZSn_%3bi$ATH6_S{9J-a@5QCVgW>eB1ZWE_+ok9v~|hX`XkxJcr2_}Z_xzO_oN=(*#0?b~L;7Rb`IpAbQ6+y|<*VI6&$`d_ zz{kped;3ctoFLb>po@P%sZZTf4^j}zm$H` z`<>*DZ+%Y^rC_}l9WQ&v_maN#SW8y3$N%Z;*UKY+65Y!t0XdS^f=da%gEM6u1RbO=kUD; zUGuS4xX2$0$wzt}o4&tk1!y|1(K;n7H}dx()*d{V^>eTBTlHIPEJmKa*bZ-JWkmz4 zI_iwWSp#w?+TjQL&YXdJdB(5Cn5;iFtW1#~|8*p0RhI9AXtzJe7xI8i$a2#3{`4oz zxsH`?MJB$uCA8e-W8ZQ4Nr7$g6*;cN5P@AkV;K`L#|M^)8+|18FI^l^mMwscX3LV0 zw{7VWaC<1>eD#(!26mA1%I5@zxYJ$I3m2mlb3))jS+8V{B|h;&qaa^_p%IX`M`$02 zR4KG4WX#oTSIAdMNXXY%C>+>b)+dz@3G5-%e8bRyz+SRGiR%s%sy_^E%Xvr*LwzB$ zW}(gDaJVrX0ei#!U@@$QtIXxbNcc}U3VsPk!L{(4Q$LUJWc_wUU(I#b_(l+V=se zm*vJZ{4YRTX}S7Kof@TQasEv7V@|WuLx12wUDqR=t@;Oth`aPy!l5VJ@1CRj6A_I+ zKSzAVOz6eLWS!CyX&2CJAzqW7H&@mvmCAV#y_h3pol@ys+|X=<&9K2-X0*TvY=w3B zGfQk93ftgpn9dj78R?`nKax(`zk_%)&H19Aq~)?e%S-i@wBGSAokD!dQPV%lPXA~a z!T%W80DlZ6U&rcw9cL`D?+faE9k2Iwf^njKUyz`ajFYvUEfwnZpt&2`Ns)B*>dzB4Rjoq8)w7b@aHfDe*wRz z+|MCD|A6Ph&)|9X{hm+wO0{ar_SO8dJW7QtWR{|4bVz*pgo za0R>xJ`aBbpMy8UXCU>a?erD~4o?`j8n@Z^3vu6$&Zu?YuuMoCQM z`)*mYUCvIovO4YF8VPTlRZo_jus8la`w?_4pW2RMa>_ry{7Ie%j)K3F`^(uX=b5DP z?Qs|s6UC&aB&M)jlAhg(=Hw?wd+0)bCEr~=av?EEl9>$lECAX}>cJ`CNK+Gr{g|w` zyHCEgJmGog^`)F$>HNpbkHX&kW+sxE+jA+PW!ujk$O{qk|+ZZS!ce`C`rf_Qd}khpdqu`?CYEgE zXQut*zmCM*B@^2T4db^xGmL4U6{P9?89%ZD*LTM|wyEbRk%>y&K>30KPeqJ-}N*MmcdXTTlp z_&eeMU7%9pmwy$g5~i=aq&Kdie9XKVcv0pT&DR5(Zs--bEAw$L!QJ5VkkMD@8Mp`Y zk59loaSQi?k21f=S8DmPz}`YlABOG@>?`w$Tz9xo{bA^K&f5>(1gqh%;YfH590f0h zGQW5c90SjRGQW5R90yN@mT0cC!1E}Trc%n3}9c}3Rs ztq_*Z2poi!Em_yMLKvD#yjnO3PJR6JY)E(fGfLKO|kX8>Q){;~h)*3xppBpM*=`!|-@` z4?F?h2~Q+Hzkw&Id#Q1XUB1jOQtm$yx0X9(U7gmG=8w0C=I=E4A?Gu{$bGEP`9-;} zGqhaJlzBxh7idbkFuzE7{#@o2wOkV01d<-RY&U)sy%xaIz@fO7v=!U}j5lybNlmceV_R#4^_`$Cyt z+#Fs9H-OA9miB_bhO0>T2D|)Ze(`%|7jM;a`;E*iYJTBXa{b@pKalm1R(riw$aQa% zc|;ArUC+Bi+p}0T@Ts!1AHH5zVcn;5#v$(<^CY<$Bf7A`-8ZDXFOrwC+z#C@s#nT`afknZQnPf zyr1Dp5`Ts9EPNH>*6Th;xU`4oq168iP}=p2dFMZeu)c7<`L!7cY!Db47#=t*@NU51 zpl5c!Z=2)w$w)FDX|3w0j~|JS$D&HcwblX-iD^{GALspC@Vx0jZ#p@yD~3%)vr8gc zTsq1`3y}VcPuNupjw;Z|Q zuF|{PiTN*yAq&ac-P6XRFj;6;oMt;(o2=~5H43J#Rrt4eraY^ZLp09hg_H)cO4SNYc&uUOu2Iwb}=`|xV`o>MuLjOE3LzYhPrg$2Yeg!LHWNNIWNY%Qlu9n8O~-Pt zuaUQ9kNl!Xeu3EnYe9{)7Y^+wod==Y@(UT?yB;7ByNyn;7hfF1weqpBr8nFfl)2VD zZ0HT|sMlUX=CC~J+Cx;?5XKs;rq`F0dE@2X2eHZ<&pN$FAH7E(y@Mr7I##guyXxz0 zCz*YQ((6Hd?Ku;^uJ$3){@gQu@#=r~$V03Zg)&}qy00AL&^+>p)z!P+%-cSk??>_H z*qh%%@{yK{Y$1s_3An${CB#}+l|wJPmjupTP}R{9*B*2SoK7<7aZUdHBp5W9rN#); z|FbvqX5#l8b7A*k_sa^u!MIE&>O1gV5OzSx(vcAFSrRGa+?bFO2>tMJ5^&~lfL6ck7KR>j-mEAxyJLnf;F z8T*+=|I*_9#EslU{a2Tz8x`w$Wxe5!$W20UCm4X0@cW`_lebanmyoxv#vh9R-->pY z{FHxGw2M1mOSZtpDA|0eXoT96e2(*o*XwDEp(miqPasc0XgQ=6_PQVLgImbxHFS5; zaFLgk-&Qn2sP_#+Hx^ZkyoBqH6skWAUB`JMKe+;qftSLu@Ip8a{v3{nXF!pkoB}7n z6W{^xSa={@2q(f0I0+sJC&PJg3T%QkupS-+4}~H>nF(v*R5%SzhSTAJ5cx@H9GnS9 z!Gqy&I1BCxXTzQ0A#eyh6b^)k!E$&w+!EHo&EOokF^o_j>lM|@J`zher~YB-zp%B> zhvdoPhM{kQ)n+675;noVLF%LUV;D!Cvl;P@fSV#=l=^%=*erV4TCR|GR&DZuSpG~f z!GGc}E!gPuJI+56dCns+370`W=K9fKBW5G2p7TY;9__U zJPKX`kA|1PW4NDlA@Y+xXF>9}WD~A`1O6ukmx$bCNgv!o@jpTRPZYVyl8tdg;;DZ2 zl8wmy$tsumiOL7Uq(?gG^m6ia!heMHM6Nd|NBpxi{j)_cd&!1e526?U3nVATk`1^X zG}q(2b2XjwjPvbuAo3xVpOgj(zmRw)ya@g)u%FnIG{1uv!*2rBYESZOcq#5Lp>_Y4 zi@XH6)0HAW(d*;peyHmH{oVowtHz5Hh^S&wpql+XPlH_`GD`H6}2WEpO$H)u+~vRuzo z`3dVvs?CS-pGSTkfid_f=N04sn3hMi+LJsS|KDl&lOjhU{*z)KlK$i=q23oHKhKEV zM9USH&I;qrZ z^sB|5WNB~QZ$K&6KN8+6@F(LPE%!H#x9t4Et>n4s{l0JN!L8 z?=Rxk`+}w!_`vwc4*yWY|0-?`hvxS@-5o2 zpTqCq7w}*3?@-$Fmz4XeRbLrjbDlg8P@ji?;QkR-C%++Gd9EPW`Bv;mQV(f+lGVuW z4D*lJlQi@_vr4G>gyu`+&xB9G0CpTt3I@fFBy!AZA?{*y{zcANEyUeR>_{Rntrp_$ zEp{Zey+Q78ePoFu_pBD`bA~-h`9tO!A;>} zh&@Sj0ZjK-TVP)@WtNH^N!n4h5cig1XHx4M_H9MdiT!8%%h)Z)s(*;P+~lUUy+HC= zVfG`RQV$S!e{(yHH$bTQhuq&lb9?pQ-W-I#JZHG^AIw@5x!w?LXG;1*#I5B33E#;K z<9~!%g{@7aZw%tra7g%2a~J&Qm^%yAAL73&wmOZzvsnQHmq_~*cgoyD%7O4bvFT~m z2gE&0%SY-fT~7OOpJtHvKa_rRIF$A^!pyfWW4w8ad7*i&c{lR!smzTp37i+WDey?3 zB-kf7B)D5}eDKiVDZy8Q?*)sCUM(_YWsMxcpRUHV`DmuYW!Bx=lf>StgK6=I`sq#` zQ;m`dXi)7_Svhpr$l2kDQ8G;ws{C{Ru5CQRONp>K*4$3i3=NXM&H%VI#fIndna6h= zMlIP0Kt!394YsvB!>Gs=-!f$p#Yj#hYJVv7^TyMC^sG$-tY~S&qg!_o&v!k>`TraC zOOKKJradfJI7RLRYF1Slf2X>*zedjEAsIAvGU$NeDrhzF*r1WmTl z8L1+!1)8sUS|*Z}efjNF4$`yEg}$(XniOfbSJIh7f|*yID*aNHp2dHmK1Mb7(W$)7 zt;f)b{oRdnl!qi;qW-$y*4zjJ!u2w4rgHedue$B|lCaoA_1aS#PI$NT=e&QWPdE?@ zIWGH%V+%{ivk$O4y}h#X?bCl4Ew4Jaz1Zm!#OQEGYE*=;O-t{{wO~!Qgio6V7K>;Y zoQbr#E;y~Q{CBnwuq$=9TrfO@&P}wce`J&ti`IuF#1|`~qXTsrqp!UCdsDgFkT0j$ z({e#EEZos9w%;V%a_lO9JoBo#%d0K1AeO|0PP#C*@9I2P`;@4g=869c@#lT#Y;bt=ogeWNS2ip_NZ#CsY3k4l=v1d{W?eD!e?a1yJ7kG*`N{lO+R2 z(PlxtOjHSc&8w5dbG(7cNQ{;!3C8$8PBWOte@VA$OvwZ5OfROlRKx$UUdL5ddkbFj zZ+R|U-;=b8TAmSk*@zmKSnExNFSMVE^M7#tle6t|Iqe52m#n^)(h%$F)-tJ|*rg!f z8b4rtg^!X)H!Ew_6P@Ml&T+{?=4!M6gM0k|{g-Km|6qhKH^Rqd^)

A6K(0IVS5I z?!*-VS5~{seNxUIGk4T3-v^v#9c3W<{pRST%l96~f4rU))4hf^5VeHYcgI-q9k_%SHN$CBfr^=nA*4BOWXV zlRw_;h>x`n)b_9Sr6(ED>*;;v)+>{7H|bhhjjG>Y-_h9Uy?2Qsb0t0cXFd97e*H7~ z?sj!7qeo8Vk%}d2)BDu+_l8g7`IsOZdsa2a7RKp*Dy>OaV_R=L>$@8xyL{-@N0N3V z;)K2Nx~=c#OW$=~Y++lR9>iWDQ|V2=KGHC+J`qVqtEMG78s?6PHA}~^s3yT@fo>|C zwlKJ3zVjljacgti%Enl0L##5AtdG+b$oGb;+??yM12NCpqAIy%XS*t+B47Nu@u)lQ zmfm<`Z&c^Ht0J;>yJ5(Dlk2)pxc$kUE@}P#bzT^lw5h^cZ#<^`uj3z2aD6rlLJ@iq z+ZDA~b}OCm6f-idO;!nd?nwI`CtgQ<9`h`+xdqmFYtxN~toq~uUD{bF_uii?zHY$P z#!EwDSauj|bT=Gpk<(bYiJC;RU4tz>WG8>|Hnr3cS!k6{rFFLpxOXeM)ek%Io7&J0 zZ=q%q9Z9|7CKAsHZ4iA>}xXU#EE2ot~qP_nZrP=A9)U zGQaN1h`wjV%h%6#Hs34J*H~Xt$GJK5A$K5cC;Q#ef85U8$moX#fcJ-8w$+0j-?6tiQ7ME|1>406FaJD)f;oL575ut z1FNq6R0~q#_WwSF`dSGnz@#cs%c+5=2RGwW9{Cg`X8X-iC_{Eg!N z;zl(>-ThuJMi0U;`n>=L!e=1ibTr!={Y|6)lg0hTjY^05qlY576@8R`qW@^#P5hnU z&DMEkH^M6P9j}9o!pg3JL*bQhXLu>(i=*r!$Si%?d2ly6h%?~sxKD*#Pq`=V6LBN` zC_4`Fbd((h_lE6oAJ_`{DlIz#4u?%}1Z;r&!8x!R9tKCkS#T7T>yL(#-!V|~I~GcQ z$3e;OcqsWr|55Wf0Zzw#0IY!r!ijJq+#gPYW8q|24X40;VGSGx4}yEZsoZZBthMhO zX-nCV;^|T^<=Yj{aMus|RQ*K%(cG}OpXfiD>v7&}1YJRRhzPvkq41N)OpJimGhpOSt${uzWf;YN$boCD9| z{1Ev(TjT#i^dL#c(tj+*{~Y2y9vmS0kLE-0Ja`X0AKnHp;C!jS3%Rcwa9@P~b-`a6 zm)hljG39?t(Iw*6dV%I8!OM-y;Q5exD?OX@px)<|_{)7>1y6-n!_(n4P|D|5U5AF-^heP25Z~%M|ZUvWd zUXc7R$NffN02U++^F{bD{sH_S(fW8y>_<=^YCi(~x&f;Hcs=n%|M7D81Uw%;3D1B} z!IR+A@M!o9Ou}bj9R428fzQDi@Od~1z5vI-7vVneCAc$O0S7}%|8aooKW>iu75vwS zufiaF4SvJZ^*a0vz5zdke}wPDKfyo2H{lBS7JLf+8A>~RoBNjj{2koV-rj}M-rj@K z-u?omy}b`F;k*xsFYWF_+~?u`D?9^!1ed~(;qmYjcpO{_e+)l`N5Rji&-w6guoZr8 zx8E-aZ?^Z-zNIL=pY{OrE4w{^t^LVAxU#gHe+p^u>HV|^nBQu9PwPJpQ2oco%zoMf z%vBn0n5O-{gJwO~NB_}03F6H9Qe=H(iW39(NxSxrzv+zf&Tb3}wrx@YmF}iIaMc3yH*}V1NE`ewXDxIi> z2<8&Hh&@f?qVb4F;n~V55~Kgf_3THG`=+?2Ws_z;GJesy>>#d~e5}GP(&2j50}!{z zB;@8&mU0{*e?0A^Eg3^DB6GMY+b$CF9>>(TO9#u+NNV!z)H`ww($h`eY#p@GYmiPd z5{)P9?cjTpj;Z$4Q|u&Why_60Zv8pGUX}Z1({{}bvC!u$C*OH4y()JR$!@XMB20TD za!H3{Kl#&HK60nW6jl=x&5kPC-i4(Tjo3*{DC~UX3RokGV3a96y=K>2c6;hpIXUTx zgdi4WQ%x(u;f3WdOP?{jJ#{Nzu3E4%#Fum-^)|L8aYQ^TF_NlYo%A}tU)C%mUJoE7OqbxZxvitLHJvSn6 z)3%kq$2CaDlIz)-T7z^V9lRFO`6;lRBJ&$DMTbFT#Hi_{w4C@Nlq2}D5$=46#ac97 zmM|FbyY>3e-YI@i#Lx znSy*8`SGo$6uS|;(F~6=!=Lg>)glmuAsHCO7^7vYQ_8I-`H8DyWJO?E#@ z;e$}sK0x%G8axrbn#gNb(w$xYIWGT1cP_tXcey84+lGqOwl+qJO>5kCI=iDQxYR}N zOBFi)X|P&>^XSz{?XUhgD&EkX=!jM|##^H;ixBLifk6M>QIEQV=)U*{AzWhm+Pn^5 z*bCxqc8@Iy=NgB1tDl{QT9}CJ7fo-EH^s_q+HBKe}fJF3&3el5Oa^6XnQkW4tk$o7VYs(I5!j}}!A9;K1d zXp%XxQHjJn%`Jbn=eN^(@tuPts`K*CJ>Ih(8cT_VZKGpR`TTO1-^N+_u=Y!mcH`Vn z4!Ly~b|QDkO4s-Nj%FYA{rP4}Bo~cgkiC0X@x@f4&yHdZI#vxSPUP5@-<;(+NxnG4 zQ{@v_;tlRRUVNJ9U(|_4XEM=D+&knX+SkpUwlD8Gz;4W2_U1)un>Ovu+a|>eH_7WZ z#S7S)#gG-(QQo+sC%u6G#dNN$0g_dRxn@7oGoLruW0C8vd>bzWt^7Y7437+kUkrrz zH^W!1!M${EqUdZRe5wrm?CGJXXQJq6YoZ8vCyI_NN$V(iHFwg^BwnWx+G(R=(K$ua zwG8A&^Q9<@zM@+DvglbJ55}JPBRjjr#Wn4`>CPujF*=IrX;Le^D!MpgDulTMd!eF0ZBCmQC}r53d| z*!@X=VXpJN*JUpVJ%Sx;@KATFuVJmlxWHtZL_7VYw90vbItobUIscc}U2VbbIhB=O zH@oia=}MdHSqG4R9Y8hZR{w z*ZFIwVplr_osV_SCm*i)!_`jB(qH7xg1dJ59LIPsgn0%dJ62V(wboFhWT0%##ZfAM zJpF}NPjr0==jdg@(j(7`-!f)$?bH~vpt8n5W6HSIRo-Y6rjpV}m1X&h{&$tED4^&w z!^J$;k=`zvSkQ|8c7ruk-$v5&|{y6Q}k%!pw6<<9&;pwRgIiEx2rcOE;y;p6Vj=$^c$vST zjmbz$OnTw4J(U(FSLyq;_BSnNFF|7BA6ECetPn`WHjIoxLYCK=R z$#q8`zRB!kL{0zC9CL>HePMjT?p9yeF>YZUxM-`M$&P40L(lc6 z?5O5Fb1Ck|Olrrm)0_MpXa9KPS~17_Qjj=f@Y}%{kO^rdP47>C&vmSHD>CuLEx9On z`Digx;9K|F7GKdLlo+C~+|P)aM*qIOV&X=>UH!{8?bRsy@MRlAX6ec{go9vj$Sho` z37Hit`#xmF7Y@Pw72FYi4(UzGK7p0+FR%)}1;g+SI267L>GjI~0QovAdjTTFDf>O# z4L%Kbhrfe+K*`shQ1Z1Glza_?k}rChvPX!w4_pRm-DUSdo|dw^Akyu!TOnE#rN4&N z_I)4?Ec;bxl$1;P<)P8;^1;q&RP^D^pN68M4{t8zJmQ5;fQ%YL$3nCpLPtZi7D5Z* zfeg&r;Y8d*T4$&&G+FjfET0$B{S>wQafhOzgJl0it~*tz{xCF$^QOUBa5|g;XTXEt zOn3l17>a1*3=e~Y;Nh?WBJBum3FpAgAft!S#;_i42pJKEN+6v? zs0ha3s$yCo{026`ui#wxIgG=V@Cf)<$QUs69&Cnh!WQ@%L~$nc2gtJ@dJeY1XW)_W zF~}G-v<#-;y|5kL0XyJt;Cy&JTtK~DQM{0qDaO)`Xs@vJ{Nly(^?b6pVdxjcI~tw= zkAbH`>aBPwJQn@^9}(|3xS_E`>wRAF@v@JimOtdVXcT?;@}}aG_)q-hnKJq`aQ?|$ z?-2MC>Y+HX`<&{I)U)Ce?FeYdFvZzYy9dQ@y}8HbKOr7ySR<2 z55Fhz&e!uSd%$wug?inKWFN)SU2sEl2Y4~u23`WUhL^&=#WC|TxCOi%ZifFAun)Wv zZUoc$y;}9buaSKeS%=W5`tSjEQ~WjY{$A9m`tYAXW>3v`ApYo&-(cK?`wiST+VODX zulp&oPNC7fS@Wy<@S5NB^=>8pqnvjeycgcib$b#24%~8`JE7dyUGPNQcWb)3pQ47} zi~mvh-v^WMe%J^ffDQ0L(hHH^GTiIqUJgU>A^6W=qw2#K6aEP96}TUTQhtxYCvZQm z*VFwJHT((u@5ld1(kUE=-EZ6B??6dM{F_MkJt+0~7mfeE@uBVh07^QzwLbr<;U5_v+ir**!M^ZoDDC(kq`PXB z+5^_-;v4+sx%igruWzV6e5pJa-{TG%{~}bbvr4Gff#%qtDf;jD2ZZV``tbXb&my=h zEQZHp2UzsskGAXqYdwiRytGr%hu?vCVi!2beTqK(Hn_ze@MaKwc(VlZa>dSZquK-h z8x(uM??bT%EbSV5z^ub)RK0j<-(n9~+CTd6+Rm{DtnC_ocx~6{!)v?V68@HS(1$m# zh1df&FN0<9d`RPAokk-Tfq9PwwlyngXG?KI^B9P}yx9&}=Z0PDMl|vbGXl4RGvGit z5e_1MGCsf_u-O~;U?|TM_JGY|+(V!|PuK(2=Lu_C`g~vym~|w)|8dK6ggsz=&W1vH zo_2=v{9q5*{FYvJSNJ!$8|O(sj6GoUcHDcwTj8GYw-9^4=1p)Iyc+J!eO(5z2V8nS z#2&Cdhr5B>qjsqc}tAf3%SM8e@*P!_gMzym8{z_5sZ^ z&HY*PV4Xif!w(R*hC}l-Qke)(hLfQ5r;~MkMU=G@Vi!7U*5H34;RnGba4I|o*1|<_ z8e9mc!wyKlpzoKNta~`pJlLFN-!H^Hn>}`|`-Xj+S=n)@`X6QW`_4P!%I4ybzO^E z4N0S9-r7^08^ctvNa{pfIhEfg{uk}DB*My!jqvx3l2`J5skad|P7-2a95aouStZ~i z>zs>^xZC+pzUeK?h}Pz^3)V#8uUomk$SnDp$z1pTPAoL0>FEjsJ^*_7S9NsocR!AeBOp}xik#kFW)8^Woc%s(P!Z~pj zr-#GGn&HX0W%KUlE_xKX#QUvooL<@c%qzVuOYCA1f)T* z&Pe{Oe!FO;UAM7-MkL4{g>hyQ3Qey$-iT7!BCKubv{-}Zfmwrmy3*CHr6q@j>SbEb zgX@m>lf+iP{Km!GWxqQ|V{3F_=}b~(ypbuo1S_pANXO}Z5T77G(|r>peUAS8cB)^X zX{8F)heyz+I^&rVlJ|cBbxe$8

^P zhF|G)5YV~mS+_c|CZlAwbYi2mQ)<)BB+mb>Sgy3*uHo>R2F@0GmYjB!U7bcZU)byX zMZK?C5|$Tr-kY-I(*^byJUVS?A0}F*V{@KP!>E&5Tm9#}NB`PA?shsRN3LfV^6bLO zw@3flex()I-v8tEuXpXLU5vK&Q}FK(FtDrhYHFsr?Xhm(Wqd|E_Hto~x@n&Ha$TpH z|M%#N@9W9;>U^hL5^!d+NB?!Pd%F-tb~e_`%y ze_@72BG&o)Wpw(@RLh&mZuCw=OAC@wzE3QwvPP*@`VMPOET~)%X7M`y=*^i>j@xz+b?-5ufMIBKJvdi(kH7j6@CvKp6XlekMrkqC))jw^XJ##VaPpG z5e^Rwg#T`af1i8aU>r@jokni0Qt5i#fv0>*mgi11@BOa!30boj%gv2xY~J>3t#6u@ zHiB$=0g3>|Af%uLsg{BA%Owr9jK;lWd~OHDjRew7{GM4Briv){L$;=-UnrKf_v6AzUnW*ZLa(2a=8)@_TUmz?I>r$OhlobzNoO0*-^9v$S(r)&QWYs(D!L9XEJY=XLy`@XXF6Vd*`xlU%< zuC19Z3YxL{hMf!kGko_g*C3?6nLM!v)Lgcksfx6>YgDuy#A2| zQR{wuH3lOzh`V=b4>!UF$~c+zUrj)jQAM zRTA{wzxB}N@7AsNqLaQI-+Hhlz5M+HcY`U+RHn!9_7A@PO8SO*t%(KPeUr4UhW7Y; znw?>6C>L?A-<-1V+t;5;|B|kRs^*lu=F@4|EyjMdxAvxIJ#T4KoU%ExH{2`Fz$yW< zU=^6}zNMS(*8VQq|9HNqyz6pBpUyiD?pgO*$hud3&#(SE(aA1-FsTXu^Xk#>l5pQR z&6?R4eJly&@V#%`?=x*kzW&G>l#dj(5bJ#3^NQYu) zKL5La{MV6~yV|jL$(;2btCHWtBK<)A4q!wiDQ5q;uVbZK;Yz^@EqD3YcU-<{a9eyu zZ(pu11Jr&7>s`Z&*TB7S3x~lg0(;A>O!>uueS~^_7&9hX=sfklDmgEu07^!%1*|I2n$D zbc&&UVGZ099t3xRQ(+~ng+t&p%C~=Dx-o-wf5ns+EbSYZX&lVDKXJp*X2e5E5!wjO zhU-Jhu}?2}C@g}9K@%Phzh`%kI`|Eo1HXn5_;*+jKZ6Zi=L0AY>^m@BFDKaTqKS1# zrZHF650?Ik@U(wEws2mN(W>!RmfDW zbi5PQf2nbj#$RfjOnw6753;`IeRd0z{ZQVQ+1ApN;ZJd&Xr3zj0r6bDFZ%?QA7kqN zK-%u`Ut&LZT<=WdEc-qn?z3fIAT3X*&%-aE7g^^oRH z@K(E=ZsWQpw)Jk;`_%n`wEXWR-Voy51qZ{s;Xrr~EQ9xIKHfL(BVVPs?}r<~2cXo` zgT&j=TxL9~^|Rb~$j&F!dV3iE-mHdvU;Q5yQm>C0PuSs)>v_5!QttzQ*3vy`JY$Em z9+G;0THG2A*^}md<5~C({5_QR_#F2Y zFRS|%<5m0qAmOhWuiN(t`+j8n(Rf4sbv>lsH|rtsf6I7N{om5(+HQ|}-M7h?)b~43 z>i1nJ?czNn-@2%YW{det^I7v%bKAiEffoYn1r0qaCePev{MP2U8(vQpf z*V}|^{PrfanzG~R{?@t=tnLTnl?Pj&is6GB64BVGj(BrBn;b+t8rbtij?MY)Y<{?e z@PEfXDb-xp`+a8LN7@dXTc7gZu#Rb8EtgK^G_FlFC~{rj)nj)yhR7|4zFO~a9=o%< zcGV8@=sj-V)p@S=BT+Za6MwPzGymS+sXQ`?YLu9O%x!vHc4!felAL$W;;}ZYqsm?` zvcM(9?oMs!XUXnPtz5W@U#B}te;;Jz2WdfAG*;iygybz6liYG_%&)f}SUYxacg{*T z$vkv8{ZwWNBw75}+Ju6}c3J27p6Bs3)2Ag8%~r2u$Qw|O;2mqP+}FBI+U%OU#jd%V zjS9)Vcm656oQTp};~_o?w{|pBPJJ@&sLGG##+qgMs4L#$STeyjshN1_^M95BMcFm4Zb78IVXmc! zQ{j!5ksdGu-qxn^qKPKrlzHRn{QshsdM1tR1!EG<;Tu18DR10SPIBd+H$`hxeIk;K zR*A*Hrlf9T;s`0FKh6_B&SWOD_DCW`U@GxA%H>b)^waVSiP4E%g>p#WWDdD&Upd)H zzljO2SW6T;l^w|jd8cjS4R4s=lBz`(+9RK8rM6u1Yx$0Fm1B>53aQ+GqkO8DDHUnR zjGP?7v0aRVI?%@q>k5trEJQ~cONv!}8F9+kQ~X$p&BxwANzFSh>1Yk}xS>vfkkT4% zIObuEZL;F`$jR2FoNRB(+vx_=uc5B((5B@Z6R)<$@H_c>D!T>ZU-lcw=%DNd$X9OJwGerRhVKBc#ytdH z0T~sPT?}_(AbAd~gpwX#m1SoI!;)V4sllN_=KC~#>~Vb~*7wbJ_O0gY+iW8~;h`3| zJB-6UU?bcU*2BG!Ya9-T;TG-E(M!F`3AJ`7C`jxehAy88*$ABGO#ypeD; z90jZ4Xt)m?19yXC;ZP{@j3ID5+zyI7qXJHVTfzh27LeXEv@x6rH-MAidT=rfLXl?} zum*k?_)g^+U%{!kzks!HC7cF7gwx@B5P3%EEjW|%d?j$O$T60dP=2uV*}!b$5ab-< zhM^~kcPM-m9tM{~%Cq=BSchH1-o%>&*F&0tfBEHsdXZyjxxlRq!lU?K9EkCs_)D9j zJ~^KeWuG&x^pID5V=QGJR(OQYKhG0)=?R3V{qwPn^Fqdv8h>$)`0b>(YL&_}mK1Y! z8+m1o4@k8wBPe=M8>kAsK9bpDPf zod8mg6Y-ygKV&}rB+Z|sn~ry~`kx~54C0?6at!1y->E!fIPp&9{N3Pbl*3N&blk%O zKNI-YU<~^2Q%Ij@A#?`#Cmb4ZRPD`yAt3yF8&j7w6gev*a0S-%;~>A^yF% z-bK)azl7hK--$c}`Nwz0C7R#wj7#zVJN}nxyeo{$VXwdyBER6dyi%z7f?8fzLn*Io zU=02WHbLYWTF%#z?y6PSi@is!C#dywgVxiHV&_ro2_ld9jmR&!&dox-4rE6B7UMSc zzg4LI(0q=3-VPs!cfbeWouniE2J#Hb=N^$~P!DR~QS0Ge;+;dh`}BI>i9EwR9rpw9 zMED?F0++$Xa5#7kHRQ?49v<4c zcCQ+5*x|2f`0L`^y3Ff0ObG^1QwUi{PK}4-@`2+zGw|2g7&a zcJMto0R9D5z;7s5dEP(Z!+tBQJN^~7^cS#iv8nbQwLCsn_b0|myF4J_pNd^aEf?6= zFh4i`rv7T*QOoHI_5afNyZV2r*OTd5aA8wDg#1FGCp7zmgyK9;K6w)?a)*v0v ze!5$eAIr{~E^Cox*I}75Tgtl>H2V=@^Ti8H&D3R_#dx=*w8q`daqvoiQqsS5b>VJ6u;Ot)VbGw)PtWdjSw!UP#HCx}YUOAUfu0(rdRfw&s z-Xn)~cB0EEja=(;*n!f@Gw-!r{nom%KNB+L!bXrz>L+V36v$&mAeRVRt$=z41-e{c zY!+fgV@>RV6*3` z_n8tHY5gNMeIhCns8oSLQy?YbP1HhrpmLv~!$!`IEDldJO7=4XmEjo}agp`dsS+l` zXxj3J>+HZ8nJs?l=u*fTWIv(?>_dp{DX|lQE{mA_(PJC=%Rr3viWu6+zi?|aiRV=K z{~P&pnfJc)u9w}y8&A8{x+tsr?3FOv`oj_YrdUcKLg40j)7*9uhH+HniPzK|X=VAF zwUm`OeZ27y5m^h;26_FvluvKzjc*Oos^YDPf}5M8w*Hk<@97s*RG&-7KkqtO`5tk# z8wPqT%o77icqc?moZZ^`r9qy7JMpUea40J@V-PQhBuY-=1+z zj~sYi%7HiaJ~uLtqw_C0{IxIhy*E(`S+n(szUyS>QTFz9Z|QEj`|{}x<-XR6+;|6b z17i?7-FSccvnP-EJcJBkFn_JktC6&v!RnS%kqn8n=p-ac-t&&bJvfurVpizL&tm(> z8`p|i?Mp%8?1kSD=6=)h2a~4vXQ1agR=fe3_~Mpa^uwpz_LTzTSicYV!`prR3f|p= zOk=|UZdiVAQGanGXHfT6qHDXoY4pFVXnP4qj;#J=w-*gIw@2=KGaSsk|Fw{}UfI=< zcx9Kv9c}kccDza`=kZo6yBIS1E4u&=g+GVP@|B$lcY&wDT}k&uxSO5+?)V>9w1?!c zd~wm9?tCI=9whq#vVYGYlU7x7IOpvH4}pBGnls>V6kn&q5x8sMesCfrz0m$}B=XeJ za1Al3aO`Nq58wn$(+{;kAn$#3~Yl7;gRr2h|~l9fWf*S zU=wV|9f2M2FgPF1fD7PMNc|O0f{RrCJ=k2V^6#Uxo$L}kTI9rfeMoyAY$DYuuL>T^ zf8sCCh|y;V=PzM^IuIUDd2Itvz}**;K60@^=G7`68)Pm;zGkxe4R`7Kgs1)U@ifj0 zAuX2pfgJJAB)wIu&O#$a5-k!}EK@fBRJi0cc3JoQ)V^{&!<%k|Rn zui^aP;Qkf77G4W4f!A@K^dr~fJ`uObizRfseA_3$c`a(|6*sfX8bOZmS6rGEYhr5^qSrQF|yQl4)?Depf+sfV|rl>0kS%K2UR zd#?K)d>sA-J_z53cR=LD<_+*eDE0AIDE06WlzR9WN;}ktVi)vrzPHO2ZY9tE zzx4TE#eY)XA`_Qo(X7=y^eLYkffWVksX4%y3Xu;tIf0da3F`v7XWz`i@N3m}~b{^cf_*5?7@-_NX2|9;x; z?e?$z-2l>;cD@~yc0CZv^DxNFw+`}O=FWjrk-KDl0RvQinD`s$J6I7$tu)&v!04V9sJ=M!wdz_hhBEPhshdpESwJ zPNCfK7#cr-|lv7wyJ6&$$}$to0Yc~3+nUXP3@!Y>zf)0}?7d2X`X+5fzq0eQc36uf?}znuL8=$mXK*O@TI8tIH1;ttZ#pUH0GG-?mO;utwI? zzI*mb=;l5NeZ1v1zP5HWI}X@-q)va4*PguZ{026Vi03%Jq0yc|s>=LlS?2cDTPCz> zBxdqQB@qzVQ~BdM&sLO-_VfA^qosk{U{EVA_2`sR&iDavi<4bQdj zMA}4?#FQ1&?)>D6Upv~K44fLH;4EYNi+t~gT<49MTs9> zPN&9FZR|@DOKL=!e{huxPi-pMfS3RIv!0tOv7}?oC+pdWH-(;j_2_98qNlZml%vy* z+;Rj7$WBB@8&-}1N*iimB`C%Sh zJPfhW;PTEfKiP#Hb#0H`u>0@7e%h|S`qR3rn&YkWsv^;-)%9{@E7GAYJ9zp9`ry4n)!t;>dL^Z|CnEb0gz0tSNhcW|;@5&%3NC zuR~A33Vq6WM6DIyf+c{P(e}6j3j*HruEkxKN$Uzj?8{$<{)zSDjcdi6?n|K-s~QL3 zHx%n6$o`G(HN`qob^i=fUvGK?@N<477ya-lw|(t9MnA4DqaSye>c>e;qx_Oke`1Q< zU)}vL3e}ms)p5#Wk*(s3Ov$CbI z5*`nEdzUVTVchef#7{z`du1(f7u%oFL0Kd2-C#Z39UcbvfHUBpum&Q^6z6gH-pM~eZC*Zm85qKV44$p@Vzzb-XcNASHc2t&b!1D=9Zz%eu*ikuI+%R-4 z@h*W^!b{<$koH!5A-o*D!u5%F1uVfjytM0Mi&Q^O+sD<~57e30&~A<@`V}#y-AMms z^jX09*KxfByq*{S5mvg|j-RsI@r?|)OsuNlE{zeM_Rq&#Ij=WXRV4nQIpW_*daG95 zC3aM>YhI`Naka#|N6)+0xX(Tha^3sYF8pM|AK*Eg2p@zKiVioI!SQf89E<-$a1?wP zR>O4u9wpsg^n#C(UI1$_^a^|*OU5yrqsvBxO*FxJr$|PmAC`Or(!>a{^v8HUI&`t;OAmL z1^+LE>JQC9>O?=zTo3m*;?H%y#b3(%JKR#<-$N%0oS2vPUa@`hU8=*OA=3e;iipMDvNe%yz!7`_S7k27C{SRFJUgQ6dIKkN-}g`yvK zJw!iliM%J#k29NbZwMQp=*P{5q91n<6#cmUq3Fl$2Sq<_54b7Z38Ei|o?#sta)#L# zq912&1WTd3Z$(dTJ=|NuVu*g6`3+Cy*6?eHejHs}o#@A5!@mvi`kq4awHLO8tngua z-rnLSyiSPyqB~v+vXq1X5JAeOO`iNU=xu`%>wzV#9=17MC~U6W)4gRd|+BQiHn0K9!ZS zdObXsRYW*ZGn%F`W%Gqesu~dCtca%PQW-+kVoPFoPkE`EIr_*bdE1qvZ;X;pa7tc_ z%@T}r*a}GDO-)PDgEyrf8}c`o{iBHzn(05J{kru`b4(YzbWhX516JuVSD4m3)yrXX zRnisxUfW8n<*obFcCP1!rHqbyd-Gd|~O#VBvN`Cdur*|1v75 zeDM~NFV8-wnZ!tHY+>nn_O*2DZ;mW1y>({aYrn$slcl#ks<3pL*!$d;*I1=Kyzq1~ zI@6Lwf%y^HhNnsGN?M&i9}%{0j3p~9BWJ1b6f~lnBa3de`@tK{@F+9h8lPLc9^cce5PRq@%w{%UPWt|p0bq(5Mp7P6C05#lEf)S8>`qnTYl$~9q2t7qd zp1Q36(W)ty+D-DG>%BiI7L7+-ACcCVP?c!7)TL1Uv+f%is=HrkZ)m8RH*NH2du7r{ z#QLcHjN(#ubfmsrl&|lcNpfPY{H68UbHC56ho)^V#*?d3ZLwICn`w5xH@bWuXFZ=e zUu|)j>zE&DZV(kXD}5~@*(sv)d>5R)By1SBSP0&*2JJ4>4~FXvmQTontlUd0q|qe_ zQ%k1&FAtVA4JXt~0HQIm*JnZQV<6&416nlI8k* zL}{k;`93b(zG#0bPo3VJl&EKc-#Xn_Qm@mq4r5)c!;tr)YashSqo>}-dtVtna-V;X zet1JiGTy!@+Rs~Fylryphs$@1tG(oyXs_zg|5hb&-q@?5|NSFxx$@y>efjCfR!v8e z7r#~3W9KuOP?Jc?M-@j{{y1X;?>?)U-6znBjyV$$a>^j@d0pD8?dy&2Y9H3RfK9#O zjgdH6jx369lgGb`>0dE=BWp9{knc&?eaPnogAZFtze>IZ$-nKCQ$+6Qir*4RHYCJr z3!lG?+EXsOwp;qb_2uQVyX$)ntZ{QoB;H&lsfcv}Yn{Z7-gMmZnw)z0JLHewmQ0Xr zD&EStIUcna7?kIapU#NHu-1FH+XwGTX&v(2<|?1~v<{XW)Ut3nRuzrJS`w|5Oh;zs z(Ng~M&yHUejmhr5YQ>(U%eqQm!a02U0wYI_iL^)Rsgf~?26AKBhj+E#2A$Hys|(OD?L4wbb)2v? zSs(cyx;}D!sV9z7`Q!Os>{%}q9%@^$s6s#(%sElf&J=4KA7;(W5r|HQY*!o&RI>X+ zxWy=mq9-9L6AO)!gvb|D%rY?Hh3L;W?^NHx+BW6`tPRh3r$l(k%%{^#O0~$L_2cwU zo)aW|7{5+%j`{68>tSp)G3))%jrB0T_i@(bt?zyA)<2MJ`tQS|PaxsGaY;r$Acw!& zlh*N;>&97eWA7U;sb!5XbVkO0RcW{{-HcpO=J{L&np;k2%kLzr|9#icoal&FHO5<` zEsL1NU?761GE4ZC^&NJ{dLG@;UM6*h&7l!n>5aNqi39xFy$ImB#b6 zKaV_1BKYdvEtk{t_vWvYz3#Wq^uEx(`_}=cu7}msv&NSat}kZac{0Yg^dRi>eBYPN z>2+|HzN1U8C~PGuawLv|?PiF6)Y`Eh{waI#e4O?3f$@g=U5yRh^Z2!5oP}MWW7)O# zDC~hR!Y+7+(e69*NZczke)HIoT7Kr)KmO}T%sn!(t8t|GfRRW%hy{; zG3O110mxHtejivV(z5lwgS+DX2P7TVC44OVO)FQjuHzH@_k{qr$kWm5 zPjDaHLRwkqwZL%E+9+QU7$MaAgP~^w)uIJNK1T}GAF@yLO5JbzVK@f&GKiK}=w3Ju z-UiW13*8L&hu6ai@G5u!ybK-)FMt!_FCfy3&{=RYJRMGfC&LA#fr*6pn|7!BOyVI2_i&z2O|VJB+|xU_JFX zB+wxHOfL;l->|eI5HlKCXCrPHDkEMKEQNe%gf@lLQ}K`B5v;E%CLUs*lZx1nUE0AH ztd456%NNqFRha2u1|rccKG5aG~V z27dzY$2#&U@Lu>+csKs1!aLw;@HUvv-_J|tE9vj#xk#^%S}AV5uWO*(*RSBc@LG63ybelvT+ek@t@<_VMy>LMTAnv* zd8++zt%u*>HdtYLi(coqLcKp|wqiZ}cJ;qasQ%E5k^UX!V7!{tLw01ilER z-MmD32C3~8un7JE|Bdi}8Eybyf$PCnVG(={2I1?_fV30sH~+}K&9d9{oA^sPK-_N` zf41)*;(lB9nbvZEeZOXx>37xtJ=tek+nsPnR!5O;-_N=0bow8XuGIfup*%kyL1`x+ zlZ|3S4*$B0h2~Y}6Xr{-=IIsKKJZy!qo77JDg@2|C+~U;Up&U6h1sRvM6Q?lUh7$p z(X$@IyWeuPr+tXN{eRbbjD5*}=XxwXdU0#R9xx+TS3iJFPPdukyRZwrynK3gN6Gd0PWyM+?d&aA{{ii1_TzF+Ii~H7q%!-A zreduOiZO2>e>7ih?JWxpzS;B$R=M>I!sUjoYS6ah&|#5AS>n@%&!T|kF4XN`H~&%2wutEIB0YvbPZ~ zHojcdyTmU4-94AOM149z`}{saCqo(ih5lau%>1HXUgkT$N6%q3^&I+o%bA); z>qGR|!CRMh@HX_8dt0NvW%zvb`ddn8*2>ygd+pqaOw&u0DsQ|Vxv952dgP}6p>k6h zw{jFL2Pl=ZGvDtr?)J)C?P&!|K9d!%$L`{PyBu|Is^1wdVcPGmRr`ap z%|6CVESPwIYO%c{KJPKB_7uNX=v~H*%*9@UU8@V3%RQg{B7fmK_blAAGHIR4Otbu) zYX5kzVZ|KhOF`o7hu;t+O6mBsNYnc>$a5Vl-hfPeaZ4`x;Ztt=%7e#&JZV0)!l#R(5#HTy@O2yx7v9@uB72*m4pvwesLh&0Xb4X$oXYua7Wv{ z6WknkCF}!v>y>Q)!>|}4PbyngJWK8EeFt~J{ZGi(dD&Nxue7qyA*0l?PvIU=uDd7v z824WA12_!618H5Qufu)pe9>E#y<9w8?yLOy;t}rqTe2~(Y9?FmDV}MLM6Pu^=Z%85 zz|r{M2*>c@cmo`Z`&vjkp{wC|8cW##2+uIg4;@%Q6gu(9IEVZ|{ z5sc$rA07cia2}L;YKE(dW~sfsZ(%F$FJS_%gl+HxcqIHYOv2Y-3cdu};d8J9J_YB) z-~AtZ=K&v8mHzL0r;<c4Re4_k}$j+)w7aPYs>I z|McBeSDh}C2!ATi8x2omJ#B;+@B9w9-_5#!cqZ!#F6-Nva|hy{uy2j$6Rth0N%9}d z;QwM<|G7l#Nb|Ev4Rkle-(?og){`vU753aKwT_hA3wMZ~xjpPY+WgS&?lqWu!fRn3 z_SeDg@Os!4Cen8!@dVIQdNc87@jS7ev%7nX+288ihW{^vd+0t|{M~NrN1tH61N(R2 zotBQf?0uAuM7;Nqu2*rt7k|rw_i5e8^7(%9dC!pP+q3$GJ?krbn7+NcgS)v8TYO8j zp2YK(IFH~S!5zA%5#OV5A$$xT1RsaB!6(tUC%t5LA8l?q_D^Bn8$M0=FyZ;`d?#B^ zvixE_3A5ctYv1j8{Hr~A0qT8UwC9_?Ju@%Eem(48hCSdbQ1AaLRDQf>{$IECBbndu z-Twl+Vt$i!D1YBFe{ZvraYxp+tmdm{m`tZ%_3^`u1vrMW%0We^`uOIMowq^#px; z?knUj`t~e8q;Kyj%v(T}r~dFE%;?**a)Z7-D>nn+-PmspRo(^?UgME%Fsq%}mUISb zC(*aZ`s;42C6iA4Zx2s_JHQj*j_?>b7%qfE;8BozYwaxh_VNy8g?a>LwbzjHG*Wu@ z@@C>sEJxd(^z5nJLCm9F^z2!=lfJ!jwC#<>tnvr*(6TFid)S-4J!`L|Z%u zd%m8RNC*1%?E6oFYM0TsXXRu!3T)WX4-20Lr;7ame|3Lw2M2lwFA6>!{5BX0Z5-+! z+CEegst%nLddLgr6v}&YAim1$vCZOXb^Vu~RlnfD8Ml+pW*h19?;Dgl9c?s~TCmJV zR&}mg$HN=hj9Sbg^(y|Bvkf&6>+WolJ(~nwhWhcqymp zTkcc!52x?BYVrNY^u#=<^im)1ZnF@zegEg5bPhdZrS9&fUk#wW$4}0GYkgSNR_!~# zRb!0AkC|plJGH{)In%!9RCNn0px0#0euUp+KSD1)UvvGWu?ck*vsp&9>;H6%c)d+) zTKY@zp#Cjmd$@ZUi>^Z(D=Hf%)YX(XmNgI=zijhAJicZhQTjfj;mVw*et(7QQ|f&) zY4vDui}?P#_9b<&^rxH)keOc>{gbMPG&a3TYhmf*Cgoq8o5AL3C-bW0Yvyw(EzXrB zvwX_$`J4>;>b70A_{&TDBo14(@QHjNkG+V7tXe$U8KCU~O?m_ety(-gjTrBxW9X`d zPoC%T^JNv&QBm%z$6dvAB+tkA>DY1A-p4;j<3~aq{g)R{EBnkgSYEgZ6LzK5=6sbr zI;<7&Tfz29Uc0v9{~3Qg^_UwQ<;E7R#^~^O*N(O7iq4V))o+|XP+?Ll1JzYe_o@yJ z7rWks_aWEY=a#8ltkDx@^TMPkAmdQ@Kc**ax&4>lZmg=lEhO9e1s`0E8lIteW+8E? zH9lF4=iV5Kb-%~;s27>NV)sUNp$Y@=RSAqL|NPIo}W)U z#cL+}iZNmhGa4((i%To23Cc>0e!*i`BOg|#rOVhxq{>$OiEU>Rl|GL5^k{B}eX`7E zSU+FRzTxGLJN_g+YrU20ncAgJ7hD-nV4smCo@jJW39X zjd8MfbOJ@OspxyvKKlCX$@%~>{lj|v<;D6}_YK=jpXOyG@7(79$>*-wzrAMvcDxFWXxu2? zSm)`N`#*V)xwS*da=XI%=R;~sa`jI#{-nI6zP3V6&FX84JGFIY zT}^dOqX}pW8zhiK2PmKRY|QWlPgXc zLpz<)!_SDpuF<1b$vF&3g}A3dCo-Dl8(Hh+o7OQ?zVn*%0O|R$<~+dv z(enV-&ZW)c()aU6^&R;Y=${t;*6iokI9jtl$$OK{Zkn1i6k-0~)r+>azH2h!sq0^I z@$RWhx|f%jZ3}&8P5oatxhMT6Gj_K~m{XK_f32ET@iJ@LFShve9D93ZtCJXq@YnOv;2hwT zp+#vLnwIuK`_dk0Xi5(|74xzty9sE7(w_<&V^fYKB56`g;^W`YXe(LA6UVxz(CR714haN+iLd-&mAP1J&f!} zxb5K{a0fUQvRW6J2nWN_kX6yhNH`P@hDbfppS8^NgAITqFvs9X*ca}^e*bpl59c{@ zvjd}~7i>WkGt6}YyJ&aKLYZOYXKq6u3%`ftOZaO@qjGcv_X#kJb};4FYwjfJ1+#QR zzRNP{2P;^{X^v%PuW#z)K12B3SV(`|i;w-VFQTPR`(j^|elWJ~?j>{XJ-8?ATjPF& z3!)uN{%_9UpRp$Uh)q8j`*xQ}KbU(J{$^OXnP|TA!a<(9zx0CTUWz+(FNT%y0{11S z3Z4g%pu6W_UjxsCweWP9NMD`BQ*Y@}JPG?o{4K)Fj!gGBIEUvP0q2_iJm+9PzYer~ zJV<8CN63C(%XiXuD7yW;^g+yrYqPH96SVSp1gs?9BjI#-6#l}5KN{-&7htd3?H8K+ zv8Era($#q_mAm6adoHy1JOS!GPlV^eli&sLWT^Z(g?NAaZIN>-=~VpC^7k~$-_toS z=H)LWiDx=z+jGtm?KzNL$LDaqOwTv{U}lfm9Yp-+!!6(iaASC(#k0)xgZ06DG4{&W zOQ7=gQdkHtg9Y$%m=CXjJ>ZqFGrWp)wTD;3AiM_Zdt8gV>t3hx8kFbjIsN9P6Iyw` z5&LECO}we>Zx(s}Eu7r&+;6pTx5;ep0oj{>ht6+U_&d$r&U2VM_U!FnX8OUthWBDt zdAg5$4N@QOhpHD3VE-lV>|*4M!7}Lw<1E55=VACETns;eOW?bZ`e^m(QS@NF<(Pgj zd*8>+{DkwQ|K2d~HRoyR5yRipoc#0h0b+hu@mRhk;#-PY-~D;0dh`NR`FN3SiD5^- z=KHh9xi#)J=n8w#eaHO_U0Q1eP7cUlq5etskE^^Ndo9J&G|v9d?^o_ca@Oo?tBl7I z>sqP%ivI)mm9LZOd)Qjra8$@Q#D}MqpB3KsR;FFn)5*a}Mh%Zf6 z$ks$#zg%KBms5q-n&8{LO zK`MXAW_9J)%Qqu@`Z~OK)kaf&_SVZ){JjcvI*=d*Ls zOoMdN6w$jUuDnrk(65-k$#UAH$83%MEXy75Ud)sXYW4oFEz|NbLw)~~^Js|n0qbI*!4R8@E<5xo3s zexF9_yuy5J%fHEHC`0@Hr|S<|f^N}=TKu^eX^3na`7?vRo{tjb%oC6nj^W0E(cD5X z5=mrw*u}^$7B|`Lh@?}0cJ%+G`+dlKCVX$_huVfcv77V%zRsrnt6M2HusFS#lmB|5 z6EP~5_5Bz;JK6N&Z-H;?e<1V+EpEDx0=WzNgXGgG*fr2wM2=%-{)ohH z_Q;dMpJPVejC^;o~=y%l%p z-VFDEH@FW=-t1ln_k!18zc;)R?gKA}iS$jgc=ogOD4v9UDgG`&d(d=0AIiyxm(U)B z*}fA*FTLd}>G0&u3SVLIdGcoE2aT$IALPx*YZpu2jJ$TS$(zr_UGnBrU@bfr9$@Br z-A94^t)BX(^3fpLbD_P@Y^e7^-pqS0HhJ?6a2{sm!+|{Kx8F?OZ25RF_R7aYEFV32 zv-1Bi%#t@BVb7T_+H)ZHAsi|BGS9dBD9j!+_aQ7cdGp?IA?B&@7~)aAI2Lms%*Vle zNN<7;ki~W%MGia>b4Pd*Y!4-GZU;|+zY(6V z_ejW_7fbGJ<@Frwm%8T?Lho^&$ag$na%FSBz`|W9v%L=_{TEBFZ0?ts`=v6QyX4LP zAePJFCs6Wcm7gog-yrqjDj0%SWB(!U*TDCn);#kdiXlL0lorngf9~ACb%@E zUfqIx_GxaVxXpimh}rI=uza`!^JCmXai`gP`h!#skvHS-9%AzH6Iy-053|a{{ZQZk z0jP5G5c1r1))2NP-|g$pb?b>DD5cE5MK21W(EcC%1Oc3i70-|b2?>2d{69?_!} z`O2Kie?=Bf}`Eo6HaW}N}RqJ z#?ZRjwy0OYID5%;wrHqbQ&?{E-I(qs+}mM8x=oK`w&A>ji{?vAgc!5`wNyv5f)U^0 zWM9wlKlZ3IsHjMr;j{1hL!Ps)o866bezDEm#B) z4aw9@?MJK?{Q#1mX7ry}&sZbBr<9dZ&Q!`$r79UGfLXChCp+F;nGSi}pTFt#wV9mx z50>BSJ14uR4D+hxoGV)+@8)Pw(=`Ww+hPReEcfasJw-55C zy&+~JqpAEUm^XqGA@Z#JF%WrH{s_1!+!6ML+d|}7`CG#x*dI!s6@xLjDeTAmwKrtc zY|lfUm0u9BG+cB}9I}AK^CGe+wzSS>Hh9S?(8* zUf%sXB%bg`Q1YxC;@c5+at7OTo(?7CSp%gHn|v53eb@z$hlcY%Jzx3g%D_D#BbV}?!gEImIF&;GdYig^~?86wYO-|Rr?!*+8qSHt#D@~j9% zo`w8jp!8uApUJa$j_sdBzBy3(u-zAe1Emk!eF{pR^$3(a>pnOa-VW!%8{vWQ8h8-A z93BiWgvhhpv*4j{5j+eY4-bb&!1?eXcm%A2N0P1x&p!(DWXwmyQE&kq0vE#V;4x77 zek|My^Kq6>$D15W?k8Yh3{Qj`!js_o5P4SaI#BYg^@EEfx3Y4FJgea8&}lMTxrc7& z;F;P-$-Ts9s=Vfg2nWe8?|xO~|2dX_-uTL~<-MU+TNdtnYlexnE)XCS^vR<^GF!uEIV{{#s@!l@CsxGs9eOdRaT0Ma7rucgms@}W?3o*YA*MV<9)sw$K)sr`& z>d9MB_2g}+dh!lbJ^3qCJ$VBCm+DIi1$ODum0g9%rDalehgKAKEYn? z^4~D49(@W`KK>3>pFV@CPyc{wCqIX(S6>iL_3BH^s#pJns#jk@)t9fK>eDw+_3T@y zdi5`;dh{JsJ^CKrMS6aKs!u<{n=$_cuZBOvi{LNtJos;T4*V6K1%HF5L&Tfz@zAAS zEr965&OHT5gf9}i_IChW6C($ijgugx8O*o5mS zvxS51Y_wsc_uAaihmCs|nay4LusT#w~PvVXyWV=Iw+QZ1iF04TF6Mr*a0# zmkrzvvEPAs#9?T~Mh~{-AH=+g^k7^5LCk%n2ix)y5^u3vWcI}_dax~DA@-X~A2$9s zS9@mZ5Y^90AGX>7>BCmNmp*K@7X$cEVMjkKd>Wid?)~nY?v}`a-VW>&d^PxWaQ#qS z=)%x7p$9`RhTaK9ykJhDye9{^t?F;)^Q8J~F28ObPjmO8#QiNBrpL2f{mVn--*JM2 z+MK7Q%U#AWCo4tnC!NysqzQ}PTKcDHe)hj3|5koxoL{se&&xLdYvkqsYx445_Fc7~ zBJSNbS5n!uMKwh|tWH$u7rcGd>k}IERI}=+WswpMNJ&Q_F`bSiB~_z%cB5qG=Q|Q!pQf;tCY7%V>>s-s7o0cAzJY}I=WoXH-XxDM zsjI7q*A)(JtS+xa@%Q-I@w&>AdAGTGZ6|nx8yo7zzN9Iz446yy5O3E}0{#?Bt&NoTu@GO-=O; zipbH4!&ON?{byy|zce-Z5=6y_N55d_|62Y3YCYP%#i1M@QZXfe-pWcnr7x3hd8~uK zy2Xgpena$cQ$N4Lo8P383}wlk^c{L|W*?MQFi z{cNg^r#0uclDp~uoONF$%FFpa>Eob{R-*jLYu8r%Z-9NWn{6m7E1tFMuwlMx)gk5O zb@BT8q1-;M;QHygZI+{EVa6)Z%D3O%VtMV%nraqdYvb|q@`{qm)B>&YoJ{xcx4u1S zdFh>8GM!7GQ+CQIcTl%At6tZ$&(e6d&G+@gCqtE&7R@QCT%~aJGpl;9*z>eQcIDHx ze@$aubxEayE_WQ|?`KGU6P9%2^~EKP4K)?jWp(i?7IiI$6q_SW4Q;2VmH28(_m7t~ z5T7?PQgT3dkNVw#8l(r&7cA)kBXnJl-|IPNpq>RJme{=q}oz6`CmG-DFFI-7woN;}f9>T8|f7^Tx-F2M2 zD_owxu_YC%D6PtG67$(+AEbDB@!EM*1sYp1qe(lUqaE;Vr`y8$-z05M7XkTg%-=TO z+Y8TEXOkg*S1g^w>PqTodT06KUJfs}Uu$|luay2piK8CByju0R#f;>4*JGZk9cXP% z^8#~v-B-uzh<0e}7d-X%eLvU#(Ymar5&x_ z22|~7EyLvL(x;%Tx;SQK6xS<3H6&68MknxaZGDpXFGbj;K5L3{X$AVLRlT=h%huvw z!TT(hJO1&?;qv=kYlqU>uh;}O^C0+P;6ejh&9H+DcGT{+nI9HUrjQEg{Kxg*XDJbX zqP~KdJ+BRYAsNQQ3Zi~FIRg9`)yM)9hoO3KWXNy_S$LBt1qc8FRhtd{KxJ4)V!$ecGkP+GMNY7 zc&Xl-eoTs&lvh;G7(?+KQdc&!Vz$O8`e|OoZtj549kp zyQV4SHFK(qn+_O9<&R%x|7-S{sz0KdO0!`~JMiD5N7c$nvht>_C+NGYy-9ho)b#*RsL!Dux(m4WRMdrXTNVp#gbtku0?MD zJi-aWhgae$lkUaIT-j8d@||?u6uUm`uT9u2AUxE$MaX%jF7NpqtZ(J}N{iF}uJ~a8zKA&FN zU)H-muvlic0GWO6tbj3pI;0lo?h7}BvZr+B?-|%w{yAs9iO7~6^Ur>;hdJx+xZ4LF z)_HMv8!w*70LUyfvIS&RfxgcrPCwWeA}xq+1h>E}B29~|A7Fni@fQTxZS2PnBe}kQ z(p{VMlP-~-(nwdrQCcD$AX30c7Nj?ggy8n@-|iCAPx>Qd6*KY;91K5)L*S>7)rH9W z5GhaYUpOz0)NDb7_ky`ExFe;PbfL^J@+|&#hEKpz@DWHpgdc>v*tzs2S{>qC`dG`S z%iM9&OKSN9$@eAFPg-!1JCXm%Uf+!UvV@`BmeFB2SGjmU^oLF0xRI5Q0YF*-urNEI zdmkyir1strr=xW~oN~TEwC6#$54&rRGy7vjvxn?$TVm(M*MiK+EnO!`>dBtKCE8z0I+k!^+{yhBo&~>xNFywN&cWZ8&bc}dPQIKc zy`+{NXyxnz>@Q+>E#(XQi$wA>abA3h^pg@UabA3h?YI4u)8be8;jb|FD`mELA$u;D z*m?1H;We1`ov$TdRbH=yA$UFZZ{vOg{0qDhz6x)GFTtDPi|`h>6!QJ7oZpsmUR>{c zhneqWXRY_%kn`jBG@Tc}*UtyY`SJU#94P-1@jXEN`tA=xmG6h3%E!a((hEEKHQ%pS z>^8cGqqFr|_Hn-E4hhbOAdse&Mo}?KKDMhl;2nKz}VQD(h9D$i?duhvZRdFqIrHg zHfWI!^S>L{im|J%-d~;YJ>$2f95^NZ6yHhtOLb!<-E|kjdh(@mE;A~N&x}_xM@f~_ z92l>w;doY)zdB?sHB}v&%v>`i3z_+4>mQR>mBj0(_4}Wf3#tC{TV?r8Z-r*J${&5N zAye};a-yo%N%>HT-YtnfRh$OpXqjXQ_y78gh3gY+??rx|*_+GAoU4Brw|230S8aXMozI*e zvH^^v9B%f$bu~2&O-Gtq>=r3wqg(yFs?wT7yWnRGU!Hipd|8>$t2$3v-SPNl%9WG> zntjmX;Y_=1cII!iE#{+ER8Oy&HhXjV=hsL7vwSy!IY-2XfDB0J9W(H)&v}GY!uEyq7|%wf_eAkK1(iKFkQuqFXRheEk@WNSp5Aj~v0&exo8Y1X zvZ?c2RQAs)Tu$N4rBO<6&Uz4Yry#2@w8sT|^o)rXAEcjH8l}|YzJ;DcdislnQ%H}( z`OjTZ=1(LX?Q{NENbSoX1!+CQnf!#z#EiRB~V^4*?$O7AZI_L6>H z3%|D?9y9j)>Qs+~hlJlx{w+M@`K1nxWWg^z%0#n=`9JiCYrUo5n;y3QV)mGGKkKnH zIurMgA>S$ggC12{f60Fr&Vp}21UmU|z-s)zj6cY8y!98EYt7%%=mGFW%rrIm&p{+# z`A@+H_!w-2Z@}5`T{s7R0NJoZd`qMA;1bLS!UrMiFZuVvgW(0u2XTsBA89W2-4OxH5p9;@{lOgLb`4izea2z}r zj)v#Kfy8${9Ete?I22w8*TeoIxC7>k;kNJ+xHY^K_J^0j7`z36eE1YR2R;qYgwMd!;Ir@)_#8X|E``U!=i$hn zFE}q*y?jx$_6X)L$Xh18Ce&BcZ&G*!{xMS@UUgnK``5(6L$HU$^M>=L+5bhf_6gFi zz3aRMcZ6@lLGT?o5dIZz3E#JH?}-);@|+KxkIeo<(b_FYd-r$eW7rpd0ylzxgX_aj z;d<~N7Vb0A!a?fkKb_CvyYLJ67W@*v0lzl?Uy0@)QlGzZ{$=*xie?Wfr{6h0oBj7< z;XK~|2dIAHN2qr6C)j{J?zFSNIKP_ze~ac0iT^hzf?kovo{sdHSUc%LwX>M954s`D ziVxCGhF$zyy9X&(QRyqeUpwhNvG7@bc+A+hXD!tWFa0Lro(cUXOQVF#ug%Mmo)Y|Z zmR=JJ-^CA)8T+o%Yhurbgzql@_I#LMnU{<1HTlbvJ`)R%eiKVSX6)CIUK0xs3BRuV zTX>jXk++`P$NUvapNWO<<%h?Nf75Sb{_#hCZGc7-^$Qz{W)JhH=WQZAC;6qYueon3 znmeT5*i3p#NKcXUn%HxS{pVmV*e9nyD-&1Z7Z5Tm_I3RJ9h`{$K`D=nmx=PowuVq#Ow!)W)Jg6P;Q2ze`R|( z461({j{P>6N5HM}MlvdM3Swwxfff$Bo92yjcd__J`}VttS)1fN8y(|1SsTN#a3eU5 zW!~O!JbGMqV3dPa5OvyKryPLH{onzKuJKz79!GWSE?{Qd)SuBG~ za?9Q6#P>^&xM=SSBlqRbU@wF6VWw#IFme~+_J=paS?~r}39p7#@Df-JFMu`hELaN{ z!2{rlunsPO_3&`m01wVRoV9T73x=~{1Dpe^;ape&=fQG#Ae;sdf_uV);Z%4CoCptv zW8h(M6r4{!Y8(P1!*Y*wkAOSCqkMZvJ}hvLhTFo0zCDceCw<4j7(5pCg~!2-;PG&M zcmiA(o(S{cNw6zC8FqxHz-+jP@4GGE^;FEiu1)_Be}bpO@8B8mYj`Fch5xhQ7!K>j%@EZ6&ycWI*34r2DlX72%m;G!AIfE@F92$ybsUR>4Q%bodx7fseyI;S+EQd=gH8Pr=b^KkYtCy%@IkGosZC7#WQFb8tJj6mA2b zhg-oHU<|$pH-<04-f$UQ2fhru!B=1>_$thXufZ^U9R}bV@Yn83qkn-v!#Cj%@GbZ) zd>eiR-+}*te}$jGcj0^RJ@_VkAHE7dfX~AZDer1$KEnJs=8xgS@Dq3s{2RO-ehP1f ze}~t>&)}8tAMjH6IqaMJrTYbp!LO{H`lo2)7#O*r``7NbX8(;?cn0BMWKs7Y-G9Lo z;dk&D_&q!V{s0e!KU=t;L>tGz$lUJ#c7K6&@Hcb+RkVHsk{&nU1e6{(5Dci@42b3q zBkS}G1tMl27R??;YPv@QS!Ul(GfSf7 zh1qY$LWS4w7eS4$Fq1E_KtDeoNWZ_i{I92ZJ|sQ;1KXOvEdvAm@LT!eF%y34z(7Ad zB>Xn=Z{Z>DH7GFD{B0N5!4JQ^A09K|cMJ^n!$ZOkk$(#hBfE7U78rs3gzm#dvxku} z-A4v?#(re?okX*Tks;kj1;(2F=)f+%JuDd1eT?kQAB+s>K8}M@PQm8g$BSkUBb#=g z$aycPpbz;6BfYv$4otzk4(45bd(4r%?t2EN!tQW4xE95Aok^GWpWC>=oS~v9!5UvHiP3{ zPQj<$W{PGHBOiC8|A+6vS@7*{l^kVu3SRG4CE9Z#UOYb_Aqi; zw?hMmV}DV%!$h-(k@HCJe0VlI0-gbngp1%&@I-htJO(a+N5X~hAb1R%3y+0$@Hkin zkB2ki39t;F2=|32!FOp-x#K&sJLXg1Czuz($(T=tHp#P z@JjeKybAsUUJWG&xCVZV`C9lMybitvuZOR}8{o_EM)(4}2|fdFhL6Hq;Dhj1crUyS z-U)Aqx57K%P4G^5J-iEE1@DHJ!h7KP@LqT(ybqoN?}sPA2jD{ZAe;{$f(OHg;cU1V z9srlXO85wz4j+Xj@G-b2d>l@JPrwQANhmqTQ*boqr{PHW3>*xfh1!;8upfL8ZU$e1o4{poL-;aW7rp}5hOfe|@HN;Oz79LUH((b03k<+F;csiv|HGf* z+wd#+4*VSc75)vr3qOGG!FS;MQ1X`#;9oF*2w#C8!RO(}@JaXyTmt_F_oAKp6h46Y z@9-}88N3bt1KtEbhu6U`;Fa)8cp>~JJR5!m7s0RL3Gf@Z0DcP(h5v%{;CHYQeh=&5 z53(n{Kf)T!Kfy})Gn@&3fu-=@aBui4{DJTA8=Q)nrP;_t=)zrK0FHn`xFZa~ZD1Jo zhY=WqQMegw2m8P*xGv0wJz#s-9d>{@up`Wd2)QFsm;-~bGyJW~(r6d>Gh7RP54*x| zVK?|s*d2Zb*M=X%T=*W$gYUo|@J-k==;SWzvQ98R=qyk>4s)OFvTm>-=q!{OMxMmq zdhiig2=9lz;9amcl-!T`;?V=0KEVxxPQguGHW017ghy{pJVkJT$M6M&+XVAKXVc(j z=D)9K{^8ME`Tnr$EQMdgGWam7Aa<3!Ai%Npcv$=VfL8WUj>4b@NX5=Em6*;Gx|E)9l zKf~fbGk6yMHsd`Y=Vs0ho`bnB&x39c!kugJoEJPF|B45ajthbpV(x|+&fgUO7vbOO zd~xtnd%sJ>!k=^K|FQon=d$3nW`B9`O8>pD@ZTFV-|?#8)tDt8h2+CE@^AS7-A{6^ z3*Kt}t`FYmhrhuOkD2f{1#kAlL&D!8{}vwd{M&+eVE;>x+eNd7?nk8WPWXP#bJ4rt zyYO!K4)*uJH{reT4d|7J`-2bi{sHH~-~)cXVdgtM6kKffi-QkiukwP~zRMDGed_hvQL-uu}oX5MqD z{P8}|MxlFk&I{;aR{CBP$(NUcFIzbJe+x(dZ{c2%yX6CP&(C>1_!?XU-?Z>=2H&vo ze~}rv-?LFjIe$C&7A%E-HTQQ!E9cNXHs`(IyYO)Mp~dsQNIE_c%^!3R%K0exskwhF z;{J(f?tg(1b;U7A4S}M60ICV`h{PDznc56!GH6;HX`3W^KU`6 zpSZ&)Cvg6Td`CB=dJ+h!+^C);>MNUe+#WgMP&@3q;y)5{3OeRQWwvxeHJ?fa`(JwW7R?^c@8$FfZD{rzh!!uTes3Jw2u|&^aVUm+W6w=OeM8>& z-4yEkV#a>6P!VQ*U&!|@mVb*Mx??)^5A`G81J355EiAtN#-Z46YvH#H4e;aL%8wT_ z@opU&=*J6*cN_V)c%eI>({`ajurJ)f{BJK>xqLE4^6l5&qN{NXUIR{pNT@s zNkypE{OupA^uy2c!(%3VRjAqz4+&o*{}vvSPX~nNn!mbGgN3L6xA4gS&Au@-+rrcT zTlhKhZ|R5R=YgSlFx=_D(0ucMQ0Ndpo`d~(Fq4i$Lx=hCK+ccC9IX5u|IbetbAB;MoY-{OVta~)3%onrn@674&j44>}E z{Ga?=&sh{Y&D>8FaepQX=NCAqht4$nGem1|p?hY>b3$jqMeuC65T0-T&K1qyc~I># zX7`AW7lbZ1_X|aHzX)ob^kS&_({^9(d&fTGV&Hf(I(4*%5h-mS_`MJ(xp(o7#ana<`aQ@oPlcA^0{wb05`)8tXes}7{GsHWs z1LIS;Ylo$w=ioT_Jni<**o$A}zQD~3&irn){}A&_p=Fr6(!Psp(J#GBxb_{MjlKed z9iEH6ihUR2e+~0{?V0}*PW{arnBTzs7u-AJ{wC%~&Rg8;;Pp#y`~EP~pZzuTK4$f2 z?~?wGIq%7AaQ!>J`0F@C>(@WLT<&tJuKQf z1!UY24QH8sJJHG!#6CORF|7Wqy-2tYqPauj%?Wq1cyq#C%)PT{3oIS^BI#IHG=Grs+ z3vXfJHW$qw#C^+fe{LemF?GyRH0NIfjf!w-0Xz zXTjm-e~0j3Kb{@^crX*sknm7H9!NaH4HzX_s^OCa`>!c#2%$s+OWDw;baUv>*mg;&D8&3*Uq zp13Pt_JGP4%sg)|x!dy~@$M5YHUImD_w)Tv^ZjGSe~H}9Kg54oxWdv=E|QLTc!nQt zx*rZR;bzL+!a>qEE4;s@Z&tVp_g{KcislY+uL)P1drf$@#akP$^W#0hj~6rhLh8c} zemKZ;8s*>Ofy6U6Jjddh8$KBK-Sg&!5A@w3={-pHR$d|g4-Fq;{tpcwj{7$~4ihat zi2D)Y`R0B^_$b`R%upf{q>@?n~;0TZVcaS_BV-U z59wcT3EyV+w~E%kLgW*7gl~ssId_EbGWR=0YfmBl`Q71r&Hf(I?4kQ)_Wj}e;C=8x zbALcIcSwK#aQGpfo98?nUSjTxMQev4>3<~rnAtxnnmuH^@p$-2vwuP~dx-z1!q1rf z)1u`&WZd#>c&XVxCz?HEe6%e5JgkE+z)JWc{?~PugejNS~ zE`lGyh454J_lao!{swLSkNXiF{~rFz+&>e|{U1>6{^wBR%rBt&g)gD{g?~bY$3NrD zufyM4_-{n>|E=%;U%vnEpyI=weE%W*Z}b17X#Ril{r~Ly|Hb!@yL)o>uVGfTXdiwP z?fH;++(^*u1ESeO_r&Z_Bx3eq(d?mnOm;MqZT9U%v(JJW&tqo1-#*gG+&hTo-qCl* z%zUMDBnO5&b&lkkzb=ukxT_ss3#uK*Ogg(oy8GcF?cmz-Z|wzS-jo+v&;0d>tmB98 z>4(Qm`25Jaet1au0{OS_koiupNTJdLH#YyhBYpgM*7xJVOgtMzHuU3x#Iuq7TRf2b z+a%J@{B0W9%n#q!509DfMUi4ZJS2Qf{w+L2p0Gt^b2zor7LjetfB(o>hlOy8xlfEt z_MbD!e-38i-Bs=uFGP;BTVyKS9qw)6c8~1ohugyshnaAD$=$+1zRy09QuDuWWIx~k zG~YjF{Flhx{6pj%Ws#ZYzdSPC_aFEDW5)jsxto7TdEP%#0mGg4k5uCROOIKixkJin zRiwu3t3|Vil)nQawF(dG&Am=EcSyP$BD2lDQ8asqylPHlp4rb8%^u?az{q^;>Hi~# z_~|~_Pd8@96^BL+^Zi5K<8b-6@R0jmkBA&=;g5_Q?T0_g509Df3nD1rGXIe9$H>2# zA@a5pBFDjfI-d|Z9v*`EB>c_kbfRefAn80gavJu#=baK+ z@65;<7T=kXb1mFik+c19kZ|Y7-oioRKQD3t_TTh4U$o~!cem^dBNt;oF7G1I>>>Uy ziCkv(mx^W&-SO)G;YfG|915?5gW*+h2Y59c1h0Wxz-uEKx3K;XH^qECl$`Pg+)vED zF>)KvIjGA`k(>SJKwIa##h!m_#9QaPO++4gd*m+P{SFIvr_7c<==RCJJ93}zevi4| zE3>&nw~*)G57&VYkdE6sKNxw4_swFQ12I1wS&X?IW{7!7;Peq==Ecx%#Q1fxj%$J{yEXDn$tmnksrTCY*N6zz+moRJo z{Q~LknDe5{mTu@imbEPMGVTxIA0j_^HS!7^2VcWp@&oaU+}9&-kUq%|AoYUzzuCVT zc?4x}wJMs=@$rYe`74iNRO0MuOyg2Kl$b0ZC_&z)ZegKb!9}+I?d=&YZcr>3E zYqLIye2RNz*55?4hm@ngM?Uk-(8iblfE7INbKFBb{|n6hF@Fg+hX1s1^#7PY%=$X= zE#Z~F-$3OrX7cx6k?%1pf4_suU(Dq150Rg6e<|xn(ehX39yvcpe#NZ({l)V4-!fbN zLh|>w2*+bBf1%rp=eV#t3_!_Ig0OQ|C>q9J2kfEATOu%mIf}i~*A6N@S=hUnvssS} z@}BK6Khuu&f4CTSgm=MC@CKLzFN2-od9VvS4Xy=MkGjI+Fn5C*hj%AloyS`nv+89o zRK3iDbMV sqm7Amw8nxIgB6!fBm+UCcu;7r;U7o{g>t2f{*Fne}Y67t}ghZ>V*& z_2Ij)4}2eP0JZ+MA#$PLe%mOzG4X2M5!$-rCYXzyO{0Cu53M^w%EM;SV%slYBwGGM zH%2;Qa6{M+YQ1iA;tf)cw}2toAN%!j-x3zWtzbSJ0Q2D1Fc%Jl-C$xJcw5Xpat1{Q zN1eQ!cH2j{gY6+^D-S!6o{l*?%53TJ?1x2%nElY`NV6X%63=ikFG~C)ES{xiZr^Tn zbSKOKxU;#Bj*fykn0N8ZgLr%AG0|}rZd`OM`Jr_l%#3r#N2i+qiO~t>K2c`c@kyeM zV<$t6lXrz0Cr^PI_u|g@bGPVT7H)TuaC?a6Z%?RkC}zeX`$YGKePM|`Z(4L;3pY(> z!tE#8xCG+AELv**%c9fq_e-=~#9v%Ae~|G*`gXM1FApO#z(ZdM$J*O+g_U#Uj&L=+gUl8*V(Id?t`~S>*RP<=f>c=48 zcVTpa*)NP9gT4ASNVsF8Ct_y(KYBdhS^Wvbe1hz)zwz8piY~HvPKlmu;ZBj+`WJ}* zQ=?~KA8mJf^fVZNn9UvHerEJ+?7xqmC7M0N{+#G}*#8neSL7%o`~NJS3!>-4_U$f+ zUd(&eb-Yj{zb+DOya4GRE{R@BIQ1hC|5rvYg8_KC#dBr!3YdfWD*UUxgVc|!qc@oS zwb5%}`*zpLZ1wCqp3^bsdYLW%J^P!ZH=6xT(c8@aW|4Sq5v`uxYVolDk9ay{-5$LQ z_s&^&h~|E$?=JIS`Hpv6`tOO}XZH7s*6%^y>;C9N*ypr+F#3SGKPa>HgAn(Jqf4;= zKDt;mdzqu{9*sU?{vTDlLi_lbNWb^EQT-rh+b{4W?rImG(tFVEJq^`>9|hENgXfhcvr_|9rx*UVyCM+E$;MMr^1{uIrru~oztQ7I-PrW z9@Ke6=h>Z)@9cJ2ze`=0Bf6a2<&DmprWFF+YH$=R^nvuiZSDbtNz`Pu?2Y0EhtA>f(rF- zGX1UIQ@vp(f9SR2R+{4YT<&J5=Te5EGAYZKPp4P9|0-$1tB=>A*rnXECZT9^o#psr zSeu%@=K4CF!nWNLkNH2RuX8)novwGJ**#2YcLn|N_W*WPK6-jgN-L^k(@QGqxPD+> zd7tH_b0j_|;8WrG_18aX`YW2hmv^7Su$l3)S+!hA=3nI4-c>*+82+!le|0!DbT&0r zH>>L28SU=Z4t%>SJyAj5cd}nm1>Fe`HG#?eTh|n*KIXW(5hIq(@!DcCqwVtH<>OBA zn#okFiZcJ=iH(;RZg_>=pTgaF7NWcP_Z3OTnmOWD&tHDQs+DNBn%}p)6D?L1ueu94 z($KsG+uO;Wtb3_vka6W+)290dhUuwk<)}8Psmj+olU7AiZUU_1PL7&-@0P-WM6)9K zm}~;4jGEj~($H8x)O74@z0%=FmDN<&4@)$J!&l=y8s=0qG{oytuUm9RtVVp((F0nl zzA5E`+SQ4#vZ8tx?Rs@;d?QyQef1U9C3E5xr8OxLj#-WP5|=g5L2*BeUmz48zlnZ( zv&;Vk9jrqFBVAn8;;*9!f4>3K}RtyRwZ_&*i~kZMYY!J_uH&* zBWtRqI@-n)DRp*kZCP<;Nn>@{%<^K&XhS_(Yim==f%IY}>u5=ReVh-fF_s?6uQz|& zeC`kn!aWZwd8XBw77_6Hp%VUjol|?A(s;O+$<9 zFg)8SULD6AFK@D+P@*QNx~cN)=GU8vZtT_7=n___vz*~%@2So*Q7Bin@Jb6>6-7Ap zX1-mq)0jG~uc8RIb?Mt!t3)MqRdKqi!pzlx^rnyEGdw*jHq^}?_?mv)X*a^puaa_pIQp zb#LBGa;$;BP4kZwyZS6zi399in9#(Ia$@sPQs)GUIB7_O!OLaW%cMK`s=WX1PgISJ zeyZgGEC08JnAY$6^}s8y6K2*l)aVw@SpB@}vQemN^UHdxs!BeMkxoNh zO=WCIUBjH3IS|`n)q#1J$^1!S8J?oN+YCxpq`SibJKGu_jTTt zXO@y){M$m$<%GJ5+4Pbl>q@HPs*f}!l2f$sm*PS7Bx8Bpy{x7@KD4o-vVlo{d1IM> zuf`z!C(B(1y}Q%7Uw~`9ORdk37uA+D%uH$Soxz09*p4RZS;{@nvErR7Yf4KhQ>>as z5IIEC{Jj))w%I53p0;Z;(+2Q=L}Sg~H~oH$!MLZVZ){05!ld%TlvKq0w!e+^ZQCNA z)Olhu2gk*&<WB9C5mp^ z@WU#GCmO6~kTH~^sD_zlId+P}NTr4$`Yf!aXJ8f{yf(TT54+NaH!|)hweGZnj<`6m zKkfJo>NZLiH2jIve77~YN$>hsG+kdYb&vIN+e}xb754j(pZtaddc)G&a=iRx&G|C}T>}=KRf=Pl;Dc zE365*p@TN;<%RR)Ng7*uH-PJDj z#p5EB;sM3=2UJ!t$tW$VpIN2&`TeoanNw2fJw_V*^b5YW8kJ#%CNJeq_HKXFya+Pg2hg3Q?g8B=}t~|SS8dGD`-$V48=gB_`=hv zolKLm=&aJ`2Z^iZ;&bC=jSVHGmCR(kU(5MH3;9o4xkRI_e!-JgqI_hY|1EcZK>17^ zCrc`zHA!Ds->izNex+iiVgv zF1+Tp@Gt%9)c5KJ6BTaI!o6AgCQR6s(FI~YdGzM>Z9ac&jc)oXOibqd=F+is%{KbY zu8KT^`$nzUH;IH&%B#Gt-7vFnqjKs%H3vP+^Q#2s!7kuRR&#%}CPR1rU2l+~;H#z)rFRh2Ybr_uUd#`4!}{F$;2 z8f%!*Siveng=9`AD?Ism?C+nS88fAxvZa1p6Sz{c$D6>VWu_%)w*Bh_ylo=FFc#(MpN$FIb9Se^E90xe<O!S){9iTORPunrd^6mGN%co8j zY`i(u$sWtlGqIHORI&(+06Z%8PrhlnSjZo7%qh_%h zEtqUNdrmUadcPw>@KMd5ICV8KOvyZ?NnPRbn}+VriGKPQu15MZH^G?` zF^}Xnl2FaRbpdNRub9@7dFiqH+EXS3bK<3}z2mmrc3`)7>9ER*T5mS){ORwPn#mRR z`C5(<^@^>|N4$AMvwa_)(UaBq6*IYrk{o0aZ>#&g67|`ypDA;k)Qx1tTO{MP#hKqR zK3jxoRbJIBeXZtCGk+`a9%=bAfjnxneemnOSI=8C0^Wz1tUV~j<0em;G{$@oXRG6F z?|W+MYDKcu{n?qmJMoTRz4T7fR_J2;cT^S2>xtwpe;;Jq`H&Ltr1$}i@%o08ydcS~ zm%~i&8EdnAw_OfbK0YglF(oq7yr+%$6y(pIuWPiH*rB3E-@DJXWt*b+$ylzJ^FHZv zmnt38DMncC?K<=}l+3APu~zS{U#sgWZ9FH|w2d*jo}ztzE1uq_2>#E?^S0xCQs&4k z?~rTr*m+(SueA|MtNV4l?7dc*%XszjmFS1Pu79P^hs92GY{M0$sVY#bZJM^FuR+3u zG|^IajjXg4yo@p^$-2!$uy(9}PXB)19mH4KYdFD+|M>T4o?Og{p|#ckGLA}O=lgGa zu9r?{Gk<=!;Y!T!RyE%jx5#0VoH3c$ufUG`)Pa*t#?wDv8;~4Ow1X-%!E^n;9AQ%eJ;3G7-Z2V4HztyuN%(*Eak6 zPC0zjP*TAz_M+Olnz{2#PMq|g^w+dMwJAU{{`7L)Y+f+7CgXZvSHB!}blI!*yNkGN z9^U+edGqtu7Pz#yMTfCE`v+Ppnwd(^6c)a{^Ihqq`BwXjrg2>J^|a)YSYnfvzRYdj z=Lz1h5}BL1p03P#MeK+cRdyvRTJ~X%Zo1Dr&S>@h)8wnp4$BLlEZiw$Q*Uum!&Jt6 zmUG%SmT|n3NJqwaymK{ehV#aW8P4l9t2ZW}7*;0K(lGB zn&~_{uD4oVIxU_|A?-D7yu1SGjkPkqPZ`&?954Sq@n#+`w>ln8e4h;CalNtTGpmuV zlrob(pE*eJG9GDMiTai{c%b)bl54an)EE{RiR4VOO@HroU>btgD*yR2R^$0AE>EUX z`@bwPRvw=nt8T1BK-Q(nT+WHKviQt+rM8_qNq-ywV?flt$zNSbb$LxyhbD8QXCX5` z?O*lcFX3EAzYOO&{d&{Zc-q|jg3&ZzSHw>1@imnrPd>N&d9xRv=CvsuuFlok?3XP! z9F+BTdCJS~`X|$Ts_D7S+xfJ1uI+uIM7@pTr#$v=vpi@GF-BP`>04afZ<|;@Cwl|Q zVEOgpZ?cI?j2r4prpJq_YG$*zi||wy^eFaA|t&Qwwc~kX;I7<<*oF1-fEh5xJYnlr_G5;yI-`Hs>7R;8MoV_ zjV)cVk`O!B9|fQ7q@SxyjOA(@68ljkZ_|4e*n9Zz@4tL~EZUGoKfV+GlzeG1cOf^lK~Fm~=Ejckb728#YE@qC)x!xjS5+U8He4Oy)JjYOEB-350dpWQO}c;AC-Sc+rH!81ZO0h8nwZChQt^;8jMh#ftsW7 zSxP)DuTa9YadIw$GD@{X^H~oUn@5O-m>j z88u%0O)?dZ(@pVA;-L8O8cthOr@6^V`^0&Ujxtnw`#B|Xa-1CfqyuQBjnk)dWH2>z@Y2)sH@UG+S|2PMbh5i9@g3JnbDvD_H>qOA%!b7K z`r(wp=`r_EI7{E?2_tqIZl5XD#|XL8U+n0_205`p9s1Q;QyJ8j;c_}Co3YYkX0#6! zWf$1SX)hkf#!6eoUV<%{%@?`e0csqhO#eed->~n31R~65QHx%(L%jZx&iYm&f zC$!*9Zt(jrFa97W1}=AEM>;I=#RfaE?VMQ5iS=>F5G|n>@o%{rM0MIM8!>=L?jFRD zmEFOK?d$X%Hmt0SeAL|D>+by(KkYRiOpiK*VTiZ4YdBtXQe8?PBsXRkQ+FqJu@gJZ z;Z|JD)`#=BBIJ6FxRqxwA_h|TnG<`*iE$`EyA8Ayt%ns6i+8#VJ3@I2*Ph!rxnw`# z9qu-77_zec;g6rM45!&pT~tvOudwn{T7r@+6}O_QlDb*(1_VMy{%-iF@@v%iVG}q5 ztN(V^KXnwtA`b20m3*$BiItUKDT*M9>Wb+sKzJ@1&v@mNV_G$}e4z2W?vzq7{qi)D zHfg4H+49fN!i^el_7h6#8Y(myoy=DCDsTR*^NbG1sTyj^YAOqd@wH3Jn8SK!330OV zznW8yX;<>;E!}C;-6DG-dybc$46!(lwI{?gy<$dDH7C_I*U-;zPrQ(0<5e7_GW)Lj zmjYQ!8;km_%7i`#YbU6Oxs-~;i9z*7lHxK>Y?|*_J27KkT}=@?|~~teUqjwg+g0O(-vealbJ~}G|5b7l9raWECob1 zK@db)6a)lWR9pZ>5X1tafT)NIVi9>=02NR4NbMM@HpP8hkfPeMP%_sTg+4t?7 z^PER!h=p{t9=a>6aB=TqZ1l%k4-my>>1C-IPQ$_UvebMAiHwvoYJ>Q?{+rm(zC-=o#*sP{@a~if&xeVn)H*8Cwu*{7x-i6SX;SxttC#z1z0{j-Q z#D#g8Hq{B!4^)#`rfI;apaz_SeHx*z=fv9-iMNfuFoPSLTQNjs*KYWhp$RRx z#0aStDOHHChW9f;VhuV%U%Ic5ls~0h7h`~1eI}$C>AodFl;0bKGqfKa7s>W~??4aH zt4XUj@YkJ&1tsV0QdSZ+=di%J#(n5s&X=vCd2gU7f*I+a);<=;)$dor;kxu1v0&-<_J!(f=WB6U6_;e47I6;JUCgS=%-hFKC)bzB zB{Q^bN#>XxhWD3V90U@dsz)Uhucu;*&aS!%y>%c+7g?cxuQ;Z}yG7IM&-LU)I(#X5 zcevAv;1fL4UPO$z{*q1eU!SJx(GkM&R)wR>_DC*7m758gTwKT(z3{p}4Z^do5jR=V z{bJa@FO$u6rU!cZ%bMZw(fpQ~!TY-OzDjaQx*u&zh>dwg*OYc1+P^7Sc*bLcGmL*2 zFmmwB_bp~wVymS}K!(Xro~EM9%QjWLYJPScIzJsE^d)!b{8|&Q)_4h*7XiVNr(MC( z`v#$Y5cW53I){y9Z$45nRzEX!mh9*m$n~=c=}xj96!XPg5t-j6MV)n8=WkoDMSx}lJLb*Ns9d%jOs zmtuOU=qnK)&OY)d$WORem}M}zB%ftpOq+UJBL4Ge{1R05(c$oBKB8|jv|*SprXT3V zmPqXWmy>f)WDbUGKAo>#5qm@o2TL znM1Sm0XDW!#ASphd$YY+ul1B49FEs01F80394L1SYgaozN$o1hh1y}*aO_TW{}%E; zbyoYFT)D_xnkyaV(e@=uyI#Zo#JxrS1o23NlvJBf*;`6v0>R6+mcL$9bIH1%%(1u6 zW^>tOngzdVAC?zkt!iJ6xmOxWm%##mfdZ8JvoZn>v(k&WAA+J@>4QQJD3?VS1HGlc zl!UlCtI>+%+4jZz5bjV!ztNh)>Tsk@A_A)^k(DUh2)HRXZQ* z?)c}Uq}j8RzljmGVR zy41T^7p$uNL52fNd1-G)!B=ZBqUCClztQ?I`R&w8yCVFfN8g=>@|Vp?lyZ%esoztthToQ<{AY?erulyV zBx23SL4NTkQ4Cq0nyC)sUysn0t!r0*+U&r`50y{#Z;riaq4RDbRG$M2y}jPP$SmQl z9wWJ`y(<2)y}lnw+L~vL!n=;FEhlg6@o&wS9HjdP@^nF8Q@1sraQN`Yl-a>r<2`Vf z%@9cc{>>UsLILznA)-I6$VuPy^yn_JYP^QR zd8ZeX9eZ62{6WIYEX?;=>q>e_){H~zyr8X_Y*(@_MBhH|R)5v{Z2Ywexn*8ozQ0}f zl9CmRUmo%&9F@SI)t^HC*fPTUpzZ?C#B2LkZMHf?SLja>|JJ@kPu1-7dl`Q!faiN2 z!r#JNt~gcCuWda#!>T@uVEp^>q1cHtTlYYR)sMv;A}ZUe;B^3PDQlkARhiKy(y>LE zgqNCTG5noSdYs6@WCQ!0=c%h_J(P`HaIC6ok4%PEn)t2OE+;t%18{-r3^6Mt5^VSk6CsyW^3rEAU8VSiIu z`GoGYRQjf`fW@KqmR2<^S zs0mx+e5Oi;nloOmUl@C&Egr4@Zu~`mZW)3x?3Q`on#I)t`OUaqZj zwPoA8bGd%h{fgp+%IsQo{_*{#{jIR}7c|a6pf|I)mSeV%5cJdib=bWP1$DUUe%#oj z0Z4kFnHQ{mhpMOd(~=0K-v`y>^G7;*7bZEM7na!Pr;a=udfAb~B-f!Y^x`0V2Qp{E z4l_$*g{Fuf>zq4;N7~e*vB>;0RJ;%m;aVEfzP&C-G7$0@#7x9|GOmVsIxwGZTPE?(TaWX50`s;w@XT&lLeGq=nXool9|1v15 z$Mh5a5K3ZU5p}~b@H}H@?}s`Jx!BH^A2gdHOwisn$vNIKo{cczE&A=S0VTuMyqYd@ z+!DGik;@6Dvb0<6;4_3O1Oba)KG4@$LVJrR{}B|Vr@YW?1g-Xv^FVHyAd6`<`i?*-VKbLa3HwXVo;@22kGcv? zEWenbQhz~y{eIlZ;ksvOCSS_<8t1I_I_x2-q$iUNJy!+s<@J1#?9BINdzYF+j~v2< zn&kPn_JOqms88Xe1o5T|6@2UI+H~&u;k>7e$ya6zue}mrIMyum@&y*pYRLh zUoX2h-Q5b1wa*oL=2a$pX{q)#Yu#j@rwfNY43_--ENRy)F zs=-I~7v2y*RIFeRrFGpl?^oIR)%OxqZqD0SMnp8w`aRIWDYHs0A$$+QW4;=n);^=! zAMBAp1f*>ARR--UOFi*f?H3tuA>DWOy55!ZI3?D(v8xEP zqL(Sa7i_cUF`=KzCfME&Kr1cw7kbM!y?CJFV6s~k&J!5QTIVrp%BPEE1`Gkf9Coez zhWr`&l-1vAt&jdy4b9OW@;7LgTK?OoaF!Ki$a8YYl9*1m)Z!D=3I}T_vM_6U)_%QK zxXAi#$=B5K@8wP&JrO;LOrfN-{p!n=(OrW~etgzE!Q&#V-J#jo;!8lV$mm*WwTH(W zgaB1G?P2vF-`$cQ3$xkf{4r4ONSDg}OM7zM!9c%l)+lKvpVq#yc0fZX(0S6DPYn-0 zNTPC{v-al$c@AR9Ls^;zN+IeTqV`f*L4OI+vxH>jk^J=tMfHaG+EzY7;c}-G^MPoC zeeSBzLzUn&H78WJ($d*V5(`eF)#t!UIHVv=r)cdI37OV(se^0#C2O1nbWxALpql`h zVx_!%E%GNQci_JphKFnzJik^y$`^2Fa}3Eq50^H*GH+BUrcW_@j#lFf5dp)EsN$PM z+B-FE!b9^GaEMfe zE@-}H{8{~p_J*UHhO$%%ArV#0-xc-8#U92F!a`l%(Z7&JkI)W{FibwZ^ z2-MYAFz;HJ8n)>FW}hOx(U2W%zBH0Xh5|3Zb|zOuW=A+{Ry{@i_4k)sq;Nq!h3MEv z39qSA-xj|sdH`=bW-|R)H*kIct%rHj+uG-biI-F8VCEoh&3n=Ky3(g4D?L{-SXKXX zk^7(CR~+a^aOV^eJYrL>Bp<8(1AnEgQjo0n4&2M#?AlT4?G2<&CDEW>D*p7`-JU7s zi%|-HOVqztkMriJFxm7Y{c5r027~v81HH}4^R(JuD2~uZ^$0B~+4S{}Jm-Oaqz+|G zk#95k6Xf3KU!Zs&2i<^ z2%38jr;Z+tWPHP3NDW%`S5Y8f(T_vp-%KgY&eD>V8O_>X%@lg6sniI$)ZUMW{pHK3 z5bxuJA?35u5Boz-MmV;3^!k$cx8_MbKbkX!IW5@Z%a`Bw_TyQr9cAAK6ID0Y61^S2 zv@;r>O1#Qxb_kZdVsLR9eLZtUas&z7LMeGD;zly+Jt|jKyhcZq;V$Y1&8pYXxNkQb z3e8>BdKI46WrTKd(Cf>F8qI2V$RbJZXXbO(ych6)J;_kRtuBjb$b5;o8+#9bBW~^UgLHj=UhP`@qrjie z@hU##$x<3YUW4`SW11r#!&_ zDl0=A-pu0h6s>V!+D%9`$QLOwCt5!~9m#CDL=?v-%tni2&r1;SgYS`p{UN+V$*LZrJhAhv&$V)J%I7U@gnTp~b6U8%p z+Q@xv^kb#G7micqilERaS9hGwC^sLMB8+l%rq%b*qW8V!9TO2S$`+RNLAUWFjbtAj z^n;;?r>UMQx@07P__5~sS?o9FcvpNhiv9Q-r026;LVC{R!3UHB>Q_K0-@a zT`w0-nKrxPUT*7K+7_ItHI=G-3due~HmX%XanA1Z%v{}Zi(J;iio17)pKGgUr7>5?Xg z7QKWDFpk#zB61>{MJqm$3-xF$CO)g(v;ZETLOodL7NdPP*jA?53^kbU7NtVhkJ=A(c>4#dUHtn& z_IWufsPC_|#9{3RgJDo^Ws4WclUeN%^5?S_C4*J;j<7#gUt|Tm`>7V+jeh8Huh4gk_4!dcQNktI@#U?T(qivq45W4-Y0CeNMv^Uy}4v(Z)dVXw82Zwe8P9I z=z1o8?BPx$U7YJfsU6gkA@YkrVPA%IT*aHkSJgb*+go1XlR(wo+NVGz*J`x;p^@jy zK}KbtNK<><;Hqn3}c!OhUCM0WK*LjqJ z2=h)uT6CIp7vgVS-rXVbV7sdpE97C7n1Q?1?#E1-OL?%j=wNU|r|C)EBYWEMsvM$R zOE*{ByELM9} z_@~x6v6h@d5&?MTeD@J`6lq&1+`FAqKBNE4rRURSLxNnfwXp`~=On>UiDso01Hu;u~y>PJA7 zMy$xY)Mkw%IS^|n(|Mr!{pMlTN#RKb>*RWpdQk7Z(l_O^+MoWZ?0MT>>H6Z|>d$5` z=m~&{yVW0R@S`C$h$0)v`{LhfuPIDjGhqZ*?)zHx(e6uxTI;mZpl6~sVRo<|mgw#M zk^jh?J%0xCiFeGk)>CiX3Ef|#wd-9+ikTQgm4R1le6|;J>4oidUjHhQRi6>QfTU!# zTQ+Tyx9K;bk!n0x@rLQ0Iw4y9(5%B{?iaHiX8UN*XO(;6Ekqx5BkO%J#7z6Wnai3l zgpQ(nMr%GwFYb&?hgItW;glv?BR(y&MbE5m2X9F4AIbNcpSOIa-O+M;o0n$QFkl9-nk-~_19&~-GrBeg_mI~{v+qM$zHGBSDRt)pS-0z z*t=Ti8okj>{Z#H=S^Z=tDKmG;^52RqHY^=>@S=90c0QC9q&c+aA@phKjsSqhvjvJe;SM%KRs%t zFV~awPY$ga#CpsUWSt*G4o(w@(u@3fulqy59wIjI?uvL{!Hvyv2XljOhP(M zSApX(UjkCQYR~Sf=_9cn#l895*iPYimXE@ORGHfwdq$-C-Mon>(FwLXPND-$f(t-S z+lk}A2@nR42HAxs1Sf*+u|1?0HqVOfDX94b6Nkq37AZ&4-A7RE!Ne58LA^^H2(qdq z_5%+9_XMHBCR)LRz@5Plf!l!xgIj}>z%9Wxa1(Gcp)If?ltbSPB(Zpi0G&LaqLe9 zKL#!YF9ZGj^=dqQnjeYBw`VnSFLoC>OuAYxCF<= zKE+vzS?UAS{=>b{)uE&b|jK}{Fb@|+7w zdCmi`23LUBfail!4;PTm;NXSMN4$CjwH~3`Q~w{8SDLgQ!R3x~iF28zbE%-F1G>k$ zmpfOe{l^5=9(0c){wu-5z>kB6fLDQ2z^lQ7z)yhtg4ci(!E3<@;3vV|!0W(Wz)yiY zf}aMr1Fr|S0dD}Cz#BoSr<=er;Ag-sz|Vr4fj5I2gSUX|fS=RyJm=g>`Qn&w1OHBa z-wsN9eI9?ixOX`BXnWr2e8DRhsO@|g_D{Qa6GF;+k0AZvUgyi6`xiCbm&B~~0aD)k zoUeKAUs3n3ido%3_pikAb?{B_eo*?~1GJBfp9jG@@Eh3w5%+I`zXKlvUj@Gf{u+E3 zd>MQM{3S@g)A9Ex2ZtA($DHqY%e*>b|M`jk>c}T9VzQ%HHtx zw#D8}wJZOj^0xSF?tno1ndVc)iCW54sd2vOM52T{I349e4_ZQ6i|o@v z>=5O1g~B5s)KNHv%@Xpyo<>J0fG6)=Dc|CBDP^|Op}hMHqjIX6UQl^BXhY(%%OmkO zsQo~>WHkG;R}p_=h6}>~W7O>JcT$pmwj(8U=4Ivtr2ElG{zU1dslRBu^oo#R34M3c zJmx$e2}iuhc%u$+fiRcX*K{H0RAff6;4}H1>fa|)`h;7lj5fJgo|=vDU+eTf?I5EF z^iYU;N>CIgjX@&LCa z*w1DMGM=DYoyJQ&gYs>_ubYzcs`}uH#-jt(zD9oi^bLj2Qw>BC+V4`cm82#j&k{M` zB>5AmZ>t}9?<53$GP)-NY3vJdLL06D)0>G|>; zADkY3X(zt;+R9zXeDbf*7cQN8I6i+8_n_V??euS>pO&qGeDR%`7s7Hk@0Xt0%_R1q z0;>2w+eO_&`V;;&`d4MW=Bv7wycd>1wrk82tI^9U?H-DtCV!J1maHP#5&1!1_OD9r z;onw%aGOZ;hRM1~Z;(p|@b+gxM~Zm-ca$@1luSp~XOZiIE)T~{oVKoVuPrym$yvVm zzl*$^>_>xUh;EaFtTohQn39Z@zt0g-X}S;{ns)bpT8ped#45+cjrjF z{<<_Yy_TJuyOA>iszmf>H|Psu^B8p2iTpLL_d_@p&w<#bpuA3ScR|yy__Kd@B3JSg#JB?#*}!Dt-WHo?&sHjo zZ{3Xv$tYj9#c9FCSwDsuY`(94oS30ksCnF%>L=iMKJM`72OTdXjzXjP% zH=PIW37!qIYBik!?hP&l_aVMTAoNv@mtNb{Tfe{LzqzaafN(jMZ-D6_@-w@Bf(w1M z;RwPV3?2qf!hQ;;#Dec%}&r^>{s zU=ch8Tm&uxIn5@dAC$p9%n$++3&8=f6I={-fJ?vy;3>5K(RE9mWzfUdr{98&GwV(j zy6X921{2fqcRDx~JOi8r(ysLffM-DmUk`uF!F8Rpwg0r#o#UMAwGX(JgZp{3TT|T% z{*!i-vE^($hVU1V-bUbs(8bp^@oN9S*Bb{PWnpolvSMyb;O^TGg&!ka15{S=|4zKx z|5d~{IC!CjI| z_faUTCclDGU*7?xz8(i(1-}cv2Cf99o}VDUgM&{(SvBnhYCC-obA$7=&{egaz~%K& zSD)2+;Tb_qA9Ozlzvp?i|DmATgYKte6Wt$y9|wO7UJU+3r1kqN=Vk1renG9@Ut^AAUM1m)=M_-u`8QyScwPm! z2Y(B03%&+Q{r?Xr_5VA<%lh(r%+d~j0Hq!N2)@WDdL4WQd;@#}d=q>G{1fWr;Syrjb^zUT;54l3xsO)&1~IEU=$=U|>w(L_^+6d| zESAvwC%7Aeb>K$WFTs6dupit6EP}jh?Dl}0fl|+#gL%yKN1b09U1v>QTj)iAp%%D5j-P&!&{y@SDX5AKeD-y27-4=K0A0YKM4&IA1W*__sp5%^q zx5r)T7sR{+JQ`EKAm*LioiR&2gT%WlJQcCuRr0Ch%+GHt@yNJHf-+yFKp8(1sQ7wE zJ}f*`aE@|sbyv9)Vu!}=i9H;A-I2Oic3@~OFMqy9_yJ9%ke z&cm7a&~JnHiqqUw%R;X=D6gc^Um>>Z^HkcE#*kRFU84M?Ns^mNKNR}-O!G8BONfx} z^T3ATckN#lPce`b4KXG>{ba0kmdLn?_LIY_+{69Z@WUgl#LyTqG5MF9O^4F%1d*N-fqd~>-$RR5 zYKcc4dHQweikhtzR;D`S?K{)6q|N&H$#H|!Z?oFhVRbUnNr()ybCoatnv*(X*sQ;g ztjB`Wz|tLMJ+A#Yh`y0K^lsr5Z@0i%fNzHU8K$44YR^x#?z{O@i^RD4_tR^~8@V47 zj_^Q<^xfxE^|AQ8YKdYk?0LAhmcL#?W_Z%}TXC6RgYERYIj;>b zKeI3K4m)oTM^7N^wAF>5!9$X%$b-kJsTHks>gZD^h>0ap|9E^cmB+KzksA4tAjhsQ zT$TJ+%_U#&zwj<)22G#5+$d)rc{O&SNRSV|Uaxih60x(!@$)i;uj8j?0sI?8nroAF zjUP(2eDN>5hb5xMfQo2w<1oQ4zC@oE@qzcyA1VvMu&cn7*tFOz`a?hMFQ>wVu>~Ab#!Kp}tuLNq z5`TQ7<CziK?rkFP&q(27n)mV4*hIp$e67#O50f<0LbII2ze>5F#xwVTX zhfw4=(G^DI_;KuA!xtK`$-!|jt*IYkPe9dT)}^@{Y*&M(g80UO(tI zlqcvO5wYF>YWdz~X~)QZxVB!$QR0uUw*OxHIdWU?3GBRbDMR=si6p3KkIk1vL4n67 z6nDO@$NTwIbP)tY~~p&6iU(Pf4fR zQoj5Pu_~X0^X}T-Yg%9O!zi)!a_D&MUXmObFc0wUjJKdTYa-wM1b0#&ulo5mcd^BG z1wW_oYkZWPKIbH70h$SpQym)f(4Y|wI|uX1irow}D#*_a?d%-OdmIUM$DL&2NgM>SdqBU% zN})0)_6FHKB_@JMLySs-6EO?!0q%nSjJ=6}``BKBnqM%{jQ))MG~Im#)gDZ2ML0%7 zVp9<5n#4vRy)LmX2z4q^2Yv{2z=OfJk;a?^{uyioUk4|HzXhQtHNNCd6|N(CG*${W z{s`&rLsgH)O4Xn7EdCC||M$S@;7XACsDBh>^q@y$rEo*hqcKzK>2`OP=*`glg4Fv; zmG`~{>2Bmgv6nUz{SYhB%HnK%jfoHW%Euj~zZB~L6_mP`AC=$Tk4`ZEY;^k+yoB*Ku#?Gn8ijYZ6$+Xv>sg-E%c z4CcXwU>Ej1U>58JJ3v2w18qQPLVB^vF zr@qOL%6DsimZ@3gyR}|UBOd90r(-YeaRwLz&%}N%;m-nRfy==|!L!wTuISOg{anVq z^zZWoHC<54bv`KNx&X|B7lI4HkAPAi7m?23pz6=i`n(u>sn1KaK2?8)w!>wZ9d3(U zq3QVgGggWj{TEk?z6{d;xS*yFB73<~^=E7aegg9r;5Fc8;I-f;;3vTi!Rx>T_$f_i zrRdLSbTMBK{*8LL!K=p`@%LA>XM9fU`7@$7L(>DbpWcl9E$%IZ5c|&w(muC}o(y%r zO~c(TW(@}-vwMegm*;+`x_?2;>JB3FyHe%6Uj^^MEdAqN>P`Cl7r{CZsyVX7D@DHB z{S|m0_;c_p;0xea!JmL%1D^-!4?0fnN3p;&XwP`iD=&!o8=^Nu%MFfs3auFrsr|P^ zZ-(|K5Py$IJX(K#e2-$5c6|(#cKi+~?f*DZsr8P0wtVW|$nBo(UhdxGe#8B_J3ZDS zo`QvmeZ`2ri&RM8#ST)3k$tYmcN&qWq+ZrsUxw_nYS!b3K8I@duq6gigC91e9LOFr zo@@2jN<9k)vz)3BSVr_YNR6p}6~jkL=gJEvu=fm4i~fH7zek_LI4N|bpM>O*<=qGr z5{j;P8Ml0EeLm83l+W|Q@{>mRMagpa2*0S%k?v{jL)p9OwjSR;*x!uMg{5MG`WT@L zqwZrw?*n2t;U|+mz;}+ek95Bgy$?G_>cih>45#-&2C#gSIpIyJ@$(_IYlC(qKgP!a zP@wihyX!tstoCyDgpM`Q3b{LG-}fZwUn%{Wz<=^%rz1YMt+Jg2T`%g>&xMaBjUb(< zZ)37uO=;!c?-T-a~UI&f`KLOI)5+4IO#U(BQcLXm2 zcLL7`sr|%qa2N12a98jY5c*)E1hzu|lX!(b*b9>0c`*?BV13${H$L7V^pr_L-+Nz> zU6*?#@g4*o9*X~9M@TD@kKlZ7>Srnx-%jqeLxIpw#u;CH8{~p&oF9-6%J5^}W)qLp z?C|Haxl^Xp_9uLwU_tR8*85lO8@HBBDK}*J{ZC5#Q6KMCuU3!5FDK*M1qw!VVd-UIP95aNw_neT-2;uxxUUyEK znyy^t)lN;nIH;z)qyL;=5*fvu-swyuUpEh_)pqle-~LX+?(!($e=I*#s>yuA^PA2? zSMw5n4M%5@#c!IAoU(E8|F&ZmI;8oT3Fkq6W_mxqy^rEES@9iko_4|RgW@-xIRwAy zG>hNV51k%*Yf}MaR&DG8>FteT&wA37@%T+A48d=j=JA^*n|Kljdw3wotd!Un6n@iQ zApEAp?%+h$omLQP4tmyCvSN##^}SfXo#yfAYX_BH4We&-U*Rt`pAg$mQ0+nVuN!{T zCLptMVndMiB+&p0zbOu~o+JjL7f%BJ2DX8J0w;ri1Q{KPSHY>2_m^lBn&$DHz{cm% zCUls`cLEd7;BPwk6nHrJU66XK|28Q6CgF3;RKC+Jv2VVO6>hedUr_1wM`3@nI|rXq z4#Ri)6yfK>clv~hPwD83JbL=k3_Oh<_d!haEdQ#aTPc7lGs3K~yQ^CR*2_ACKz z25mx%y?W`_`Wg_kwlCOt9R8_C%5U_wOZcT~UM5o9S|6Y*{q8jErT$L`h0g@P$vp=D zXM%IUv%n+3*5f7UAT#w3lH_I1$26VG1vMQI9UE7Oes|*|&&ajOE~BfZi`$d^vDO17?ALZ|dRc0Q({Qj8Yfa7P1~CUz zE(^Cy1*hcCTF^n(l+I$&3I5OAOM*fe-q(!qnWFVE!e{z7rkhyEzgn$c1sGg5(?bJF<1yb3LLXdShy4y7`sST5$4z{RtH52Lmt6)5|LG!dH}HJ06+8!I zbs2Rg$m*RC6nfz)AnC)8I*b}}>U)fN<1T}m?j$eWcZ=-C(4Bpl@}D|D=!Nb{pdC*e z_9tLJnRKLHpcg{VnJW3JbNG9hm;N;TNj!&E@vV+P_IwfY!8f5%?Ewd}5Wjr!jdlAY zoGVeBf>sD{Zqjvf{s_#XdhDlhwHxQxHFJy%+s&*Zq((vjyetp$sB z7yo>#aO>xm-coP{OJ%%tbUBJa6Ips-v;MazW83l z_A8$s6cLwDF6w(dzX-jedc94TdluyTiUa*JvgG?e%cojjN?&9B5^M8~b=P;spjkTl zvzhCv&Hdb)x`p>Ejq4}5$#5Rp@|QbjK?6SnJ^V|pu!}KoRf($zze|3K-cK|Q<8yy2 z29dVd3%gxd1$_To5oh#ghe$fc-*y%MVwPNNi%qj<>lK&xFt)0^hk-tA-op@|+{>sN zhfkrGt9jfpbz8ZN7CPAW&X%r&S@mzTj;VXoT-;fY8fSp)2AZaWgl{?oWIa+dvxWL& zJ!+baJ?l}^hd^eZru{(HqsHAqW(kdl^{A<}ZV$;vGrF(C`B}amroEX|H>#7eIm_3@ zyf5p7AiJq`MiCF;5_KS>GU0%XuEaa>t>it7#NR;HqfvhWg?}YD349~oCZnYJck#)B zT7EFGDn3>CR^&tZS89(r@e<)!rxGuKtW${}fz!cfz{9~Oz$3u#fHS~vfiuDT!CBx} zz$3xCLHJjRJHeyC+rc^D%^*ka#El^QtHdY4dEk}ceDD$w{#D|9@EGtc@WbFT@K|s$ zcpSJ0JRa-=PXJE_PXxQb1z;9D2|Ni*gU5j#;CwIx9tARMCT4*-a5~rtP6NAWuMfq$ zg>SW@f&KtC?ioK>?n#|5W-u`Ue?8!?U@y2MNc+@}0}JdwM&qvtuERPm?L8`9a>`!) zgY>(txH084$I&T7dsF|~?i&xrwvzWS8vhEO0)OvKknq|MKI!#`Q*r-2_NT!Qap7KJ z-}owK-+d@NoA9H!EhYYcQN#ZV3bM5KYbbdo$+^{hWo1Cm)bk_Rpw>+Pdrb8|6sOy3j8bhJ>rr1^J&s`c?aYBTJ9h4&ai10klR&T@q)Lc zw-qlCJMMFse+WJaJ`X+u{s{aU_+wDo@h9MYm|q~AjGLcgz7+F|;4i^4_!77X{1sRLUj}=?UxOKN74e)1z5>n%e*;Rtc@_7$yoT`y?Juu6|KpV( z)baZ}?Bns@lOw5@KM0cFKRR!E?yqaOH^i*<26BJ#PtIGO`=8bQFJe}A&^?^={|X)g z{x2xwZ&Tc(-4o&-k)WaxV!f?inC!FBU?r66Gcd0KB^Sbg5hSnE|d3|{YL+cG3vkk9c z@E!*C8_7EuT8|+1o636_*l()&@zz91RW(m#0*L;Lj@H<0IZ9r?^($GO6N z)g2Q%D0XS=i?JWaUXE=L9~(a)zE0idb?VJ&5eW9vL-JECe?z`IL30lmpPXdF?yG$t zViWOSp(6$FD`@#rM$cE&y&{?=A)PJcPb54q!~Gk)gDv$CJr|DL3rv@C@0w3LDbl|G zdG8+Rc=7K+$}{GvQh%nDD;7%q`M$2K!%H~w#W!$M%Z5E#uBql<`>6?0r=L+GiLYEg zk2+0Z234M)SbO!gYo^IjH2aGRdZE;aPS2sUv|w~)P|C=_uWvUc%B^tyy2EJ=Ly)A#QkpCNlewNVMiWTDh-k^tc|ldVhU^%Cr$Z z@@uO{eh=vd!;L>9Kl6dzA8xElKgxI7JtiKU_^z?kH{H}`ZtAR&S(RCJ6SrYqX4SQy z>4#EOev`}UQmv?bsKFh2dJ={32p%;5jt{?tDRzeELYxwYZ#HTu(8xn(2*;8mUUhW>??W{ZGE*?_>AsS>HJpsOsB6wv+|$0p(gv@ zQ2G_uWZOW0_vBK68^CS6%Guu(^%thMgkIr+WoN(lB=;#)oV)G)?($gU46~F^3JsKF@gxfDM*SY-5T;OJ4e!8 zbNNiid4;!eUatE2h4VwT`#5(h&*j(nC?nUBc206m@H7Y??aa4A&c(c{VmHgv8$8P~ zKXy9eGgtNaqqUE!(mqk7kexAmYcoKx6m3SPS06q%t4t@)qh`h>!Ak?*l;GW>uy!+f=s@&&Z zCHJ}$cY61^U#r~bUZwhjZzCL3=)_GRvsL1H5bAc~TJS^Q72v_(rQjs+La+@y2b>I^ z2~Gh|0jGikAXMbW-k9nSUNMS#f%@K6k%u`JJOZ2#QZMyKfisc& zNZ@Z4SdS#9)Ysmz+0Id3JAkyqDrXM%6JzcCC;VS&L#J^U!p}qQV|x=H@(eGF+=wFb zF!0qsEat{Bxcl});faKcqyJj`Z&<^B2k{LKX1sgcs|4Ky{&E_w6V1UU97wt<57X%4 zp2y!?aLrE!{|qh!-+-Im1O5^01%HoyANU$r0AB_Dd@j=XR31j-^X>cb_agoVz~{il zpro?|{4R(*400Z-KUm$DVgC*6p{BU^gQt<-FM_A5`3w~nka|8->;EhkGl_@c$9;3h*N8OXB?~{_DYuHJ_`T zOK?9E_e;U0;ALP5yj;y!$h~gd&3*3ID)+fp$-Qo^zpFs0zpKGNf}a520Fj5$dcT%* z1_wVWdV`UtSY`AFlfO@C`>8yPw)^#%9p?t;CLOmo3Ti!o?$O-mzFF;kd6-pVMowWB zl7S+JuuAj{BWG}{%E9c9`8MinZ&2i6?m!ymPOl#C@ahq>w$B$pX}`NbY1g|!X~%m& zX}5bpX}2$e6G5nk+;3l{`h%0;eVBIzzXFZ}zpCX}CHjLKx5oT+aC7i}P}=jjYAtv6GRtP-mw_AXvADl&_%LhV$oa zBJP#_;fNf>;#^NbF37T?g{rs4zG_IiytzTMbu>IzXgdn0@caf3arCD!oLa~X^g>FS<9RK&&fk5)gcNT@&YM1!orLAzlVb_^uOoa_SYUbwt{SVT(X31fMkbt<=J-enr{(6+k%COiZ0>RXHdPRo>@!a$a8Tuzk@Nz;)X`0)MKs2gta zJ3l)w{kG-r(BrIfT+@4bfj@tgW#u8HE(CjOq(9U+^Fx^QWxNIPzMJ`Ocs}G&68&)V zTdjIMY9OCk*fIm!bt)rO+}}OW+tHWK_mq>_j@BjV9!GZa?{~cLBOE!=yq9=a|1R>o zFYn2Pfl{B8S-#Qo=U>P-oT=$~=lfcEOWt*PBtkg@hx?mPKlty_V=m)~Z>{Ne<0Q1y z?Fanc?dBv?>`C``7D~OX>0pkNYcv~j+XtNe0%X5wA*UptHFodR3Zr?2o{>C{RlrLS|20)lz&rxN~5$>WFHch-;;Ap z)P00c@-aT3E{CEhH*-&e z;wg7?7egtHhFyetuwu6mO0E1X^nRj#jn926zQxsOLQnFaXpVRXp2T*)(&ejl6%J_*hT zzXKi(ej7XndPlhkJt(G1^C+myb#3et^}k1H|1$!)@qV~%0I ziu}KX`D*p|3AsnC^$9-$eYAQ%SL+#jw3=$YQBR-JcMK(+Piwl@J2!as2I}~_5qtsv zH-XQApTS=}>3tTIbZ^G~DeP}i_gj@8@q*z;FkbY2uBLlC?o#g0gHrB0z-_@h!R^2= zfKp#~5%1vO-NJ{^`UbVW@74PLqVOTKoj~|HUl#rY>D(u%>45IN?pKBXfc@75)gE+j zBcJz!H-Ha-SAh>|JcGPwXzJyg;K#6k2)q>h7I+c(F#e?8AHjSs=5J$`{`x599OlQs zCs*PS=K@`9M(bpGU(8ypjdBlBmq*Za9z4{xdYuM&^e zn;+lbFiXFB8`G15kq{ib?V(a_*U#?nBf!+Y;g;r99rsF#M(ctKtbH ziprr2kF#?9OA4ih?foc;EBEI!WsgI3w}gjIar>}z{-WO1>{Ob*Q0RUBMy;zpLiz8H zEm2Ke3;F*POcJKdjZgRkTx(5z(n($5aNktCX3(7#y#KqLzGN|*z;){iwHJHD=?B!1B&-Dp|&d;XG7e@JVR(uiJ;gS1`|H=0kqwO5@ zE9p`~uMWCPjq~`B{BFblnIe%ezH7f%`P|mSI<9&}QYm znlTbfWW4eAkj#k?JvntaF;_e|oJCWouhmr29$U&3AyY+f%rFu=NxO@Tm6U;~lLuLx zADbPU6>Ak{V!>(XG@0zdD}jf<&^Xj2wx%i94j-Aj94ESN$UO1h^#83ZwW@rj5&hqV z#W~~`GP(TX926G5e*qt6Gf8Joq0m3I(93czuX#=B$s-*h_I!=}TeCsnznQM6gkia)*$n|00I4(y0&6_o)_Jeg*`PJ=Y*61S+(jW4@yN#pi z^yR#V*EWsXkK8BwFTYQgjJEd(pE6n>BYevLP(Edgv}0s{Ec^Jy#XfJQO_mFpg?MSM z>93bNqjPfQBA0KGag|T@k)e5=b7Hxa!K$gsUXJx5X6Bvi#hp**^+s5X&aISHVTMb`z18LL>-AN8!W(OeWL%y|^XWB+WliTFN+|p!Uy1#$H!d$MH z?qQFOCTR#Gi;aZa`o6!OeBZ)kI-51!R5*;GZtBY+t;u`TP40$hIJJK^=RSbgJphm3 z^ZXk3>$%x+5nP<};q>@=n4=*%bVBj=?Uum*m7gWvk8kgz_?%Qp{b2qxuMOMl~zXTqF zS#TQov-qLH&u#v3T<@E~4;kxXPW&K#xbSl+{}F;}4+)VH>a2EIocqI4@a5nfA z@F?($;2iKyupRsyI2Zg3I1juI6#lN{`)KegQ24u-fgc7h29E{L2af~K0gney2TuSO zgC~MTZ~>SHPXar@G$p=J+dv8-bi|;g@TB z)sF%f!#8fg-x6>%{9Wm9zl-U8Gp+As%C8#ho=Q8s8aoZ2(hf2PoQ;1S8|$7ydM|=! z!Z-dANO}p4QKef67F(M_hZ7>ZM+{d=za~n61)$6s~-oy1YQN+i~ZH$UEn9cJ3&8x*AlPj zh5jV*#hmNpo|*dz+(F7^?wd*czW*E4{w8@p6#q8~Ul%_3SZ zZ&CB-kav-JW31?3rv82Y?pV>k48Kpt~2mN!d;k31F*ueg6*?wjHN>%z}v{M|38{Q=badJvTQ z`UdzV@SEU$;6tF)^S6k1aPVQ_>uNiJuC&v)F|Px6_c5=1LHNJl5q>V|JT9o|fNouE zrSNmHe?n00LHF1 zumt`JEP^kCz2L9GEC_$MaRK-Wcr^GMuRpws`#jg^U;bUp*S|d0g}z`tWZ1^0h|lfZYt1HpfS`+|euJ|JvgcTdot2cRC0NqYL1rG4sDA94Z> z%+8qY(ZW0m|I&US^|20j3!O17gcsZ%?aS-pF7*atUXQzprrtoz8;IUztv{oGd1H9s zV!yHIUDoks^e=D59Z9j@O!FoA@bf47m!-do{$=T(=#AEXy`?)8|N1iCuU+MC0Kxj~ z*r#F-$DWG)Ddxmm;_t+Fuj{O<;$yG1e&rU2FW6WP$q(Nl>MyJph}&--_bH?yXcO^Y zIX{ftKODJ#nC(c3R*YqZz8qa+Qlx(fpX2`z|9bbTe5@HCc!Xai>@sIae)nkHJoyQg zbC7zD@+m!jbhVs=a6>AO(XrEz?>|nyV0|*}rb0z2YdK_jwdTdB`~WAGkb6iT#J?X~ zTMi(iSEeEaKvY?YkNP`tSf;87N)%w8reZVTgmx&)v;;#{-ZS&$CiE_*2wWgT!85Q$ z{+3e5a`|#|XXl1vM&u2svsCQA|9$I?Vx~Ve#8P)4T<50F8Mb59=6R=hW%yll>j#{M zo_{ZH{ctLUhbs8mNIae9ratASKH{#i#M5cwHIR5ZZCK^UYdiK6p1R{Y?GXpkErM-i z4f^D2?&f>aX!`!ZROZel_>fm1)7Z$Zb$h0~&YLN(HTiT}1S|Vvl?RKIi(7#? zSu&uA$TyCnl$O8Ne! zA<>V$@D|FKe=j$8N+ws7XL^$(dWxkc<2%#dm0`-PS7v|GtFvDxO)W2kbYjQjB(hoM z+gko`${o>D%zfh;_k%Z<`UyJTh@N7vuPp5?_7{4~+0CN$Gf)vY5qmyauR`@lP4;FG zm_a}|Gfl!Wmx~o;y?#IOM*E%%?0_&=F?q$1rgZy4uV!bvIz5+@*M;Hx$J_zLVv!~ zJ9w8T?Y>yMlvU2M>YYx8y)H2QTT_R;EEuHk`A5dL%LpcD;*eqD(|NWP*Q94k#p8AvY_TmCxu(F2xK>t8r#eJ;g zGa5c$_^=v_DKw7@gYMY1o2p5x5y8Y~m}=R$7j|nOJgk z>JX>lL#F#kltSlxfAlq+&wJ|UayvKra~AK&ip@VA(eL?B&&Lzo==~DfP4DK$@fYA$ z-;U=;Q${B7@SSMe`q z$;GzVG<&vEVSK!&zM}G;`nmd^y7+XOuTPA_r|@0X%tSEWInQ;*U6(jd+&66LULo>4 z=$BS^Z(0aW z1iL`C08LqNPcRK~Ds4Ie+#5U=+y|Tw?hCeq`+>7TdTY}R@BmQq#Vp=*D0mS0I~e?s zm(PQ-KOiwl%GMjCvcKg<0@O@U8mUsxSJD`lAH3-oeCc_3fgcfqcys zRC_S-3gPC1zW|R0Uj&ZY zuLnE8YeDvOiK{?1Z;30w9C!)X34R3Z0?!A#!R25cJRLk4Tmp(bPZ8_^PX>Fz49J!$ zaXeT6=YvIX4!8)M39>>Y4hNw?C8mKa3W+J;05}O;3?2wB0rvqRz$7MuP)!o8;4*L* z5b9N8NANUoJa{^|EqDgFHFzetC3qINIk+6$1UwsDA3O(K2Rs+71J45o>llIH+u-@& zU%(5%*TDr|dc``c$!9%F^b^E4OgZYDB<^AJ2lo(FT|QMmi|L*YGy8-@00@qbti|6eA)!9ms6fV|QQmFGDa ze_z#bs;@!AeO=R4d7j4oaesjExi9!2xL4hID$lbA_)W~aWB(AC1iuCD2KxDXgm_|T zYj_m<9k2(HvpLUwOzl;k$K3$?$8oO*zpLr$d+M65AJ3DxzY|}f@;q;V-y@zn^8YmU z4`BX2csKY1@V59fs-NLz%+E@Dg3n=pP5g(dFZv41&(j_k$9;VbD^#9m1@=E7-Z=5T zfd3NapMt&Mi`d7o{~7Vk$NY13|Apv@-U^XA_m{+1u6s$$+U}rxgn386Jp`n`G#*Si zkoJ5<^fYMsK+La-o(64SQ0KwdzytCBKj7Zr??9=a--A+Lf6)5-qv&Z+^Xs0wm?z-> zO>j5xPvG|8pFyerzi7C(oWFWz5c#eZBF{rRtq^%0w;BI$gL`wA^Y7q+;6EwfUWs=E zwS1tq`yeRoF7iBkfQZA;KUTPK*R{XIDevH5oyhTMe*<0VZwbt!9DPq+`y216FL#~M zBELgAD$k?oh+I!RzMj0Jj=jF8uJ)MSw___ruE%`?M4pHG-bCJ2r@l84IUcQVQ2Pz9 zD!aeIAMdG?&I)}`{im2kp63}*pF#PcD{ zyMp_JnCaK8ZVI#X>m(@s8Z%j%fR1?DBeuI>V=Ml}d`)~0-nw@hrN8e<{aqa2OUzn- zAbMX||G}-meZh^v{lIm={lR}SOC13I1qrT$i06-(LH8B#L!gY8gFzW5lRz0KZQ!qP zpG-YTf0}~%mzbx5KL-y1e+o_mp8*dg-lxFBz(>L9pp37>aeoAfv)SakTsOm=>E#>L z@iq(lLfw&skn+qHBp*k)b3OMt8m?W;T3!%&tamJfqp0*?h{ z9y^ZujWc?W2kXESu)hcQ6TvTl3&7jKlfYZRGAnkUtTTuHRcOm#`w@1v{j=kjj;&`8!HQ&a*gzTW$FLDRez9dLI zWkJ$m{nvO{{}mUzOK_KV0Ezz;-e5580AgO|o{Cx810;W^yQiuB>FycWOZx~u#S0CT zZ_GuZax%Dd+@B4~I6nuJ`Qco5C^@-{W9!FHj1R;gk8e@eRyU(=e%-RV^XooWw_U=~ zuSNa_2d5$BG8Gk8|Bkm zdPUj->8*-B^?6=oDPEW?%N=(|H1UP{_ZsIv4-E_=vBUwzxCiRB#KR}~3dYMC$0t{! z7w5CNf*;v?h)3sw_aUD2KsH~=&sx?~dU0m~twCJs3+aTBDr(|4m=0A7dzMSzNhUDS zA0sa|z5Dj9(wCnq$vhdPQ#HLQA2x9JJDJR(@9lkwNu(R?2me`er3X~y-x^=F<^S?o zPa)IfwF?h@xHDJE^<{Ei2R?Z1;t@uVFw-hSQ~Fc1J=Ul^MmVAk?ohvpYYU(yR8B-B1oB9V$O{uWq;`CLHoZvlbl`&M54N^U`ej7yU=E&(ILUM9@_0oGO*7^Z3so+||Du!1=%z86tNKYop1epwS*?Ea zzFX~bvFzq#c!uP&%ht%=cw`mu4BW8JUlj z4JpjQj&x>WE{lXgr60_DKhuGsxg=loyQ;)28d}$;e&*(Sa>edK-_m*g!Vb^pe7$CC zIgVKUyhlX5q940<`D#0|eO8DaJ9O2q<@zu?S3m@2HqUX0>ax%}dLa27b{tJ%rpR{< zlyqqs(HjV6ayvA_jd5TH^ru>JHlRfEyzD##^x7GD0GjmqG zL!;-GVba@vb@9%gJ$I^(bMfdnJIbG7;!B0rDe=1L5dJ0IU|#RfWReT#PMPAVtZCz# zIJ>>c2zg3y`6S(8`==EKivJqtGoh{O<0Qy;4Sw8e9F;uCxoH(kewrukniD@v<<(0 z&Sr5Gxjb1MWlwhcCxroOB{{mF8RDQ3~44*EbNHdsrro+D%^8 zEu6Ac`&-~Y@K-q>RRRR@4_m)Oj8AEoART+Z>{AWw{ky+ge(&!@t#+OA=A$5wHMbVN z%7={1US_<=t0oJDgEss)T=a1+;Ytr@s&AmD2X#S^ z7KhdY^YFJkcnoWi`^%RaSczI=Z?YMFt)Z`DJPf9`J; z3v3f59=;*{p{Tb|^0nEa3q?HF${+QThKMm_zPy(VO^0)k%^M;fp-5k9OqDZex1Zf>e%tL|T{={+2)zWf7vwyK|u+|McW^yEqtqU}@b{*ZTj zXnLQ#DXQc@!dUZqt#B+53?Hw9Tk|c!njH|wW*pUA8noZ_9b12KZ@QFW*IGTl>Sar18<>n(7u7O*(yid*eD(Wu?|};4o2N&6D%G6M^};w5E9P}`RSeoVQ6!`BjND6#*2l=bBu1v(U>p;z zmrSRq)sgNmn=ah!{fqCO)t=`#*0_T(Y{sp%4}b#U-PB8FiVWMV6^^W!aJv3P=nm0$ zLPtq{`I_ZVmB07@{?FD`>5Sa3`5^DtSo^lH9Er4qz0auZSFL@7*z2C&iZ3j0F;slI z!?gB)vNjsNyN2@a(**N0e0}3!?dLo`d(}NILtR$Bxe2HJIf$cea8|p8`Jn1!fBpv1`rAfS-1&MJ zR&&p4Ly0Abz~iR8pZBCRn~uwydZV4!tA2im47u3e#Lt!d8XuRS{rGfVw_S?v)g`=c zTSjwhG;A;CH!F5sPELQico9^7qJE9fy&|@Iasz!L+?Cha5st68yh)tVpY3o9(lPP2 zRQ!usT$@9_OnIH=(|F$&Id$Y##fLL)Y5Yy$X0Z_)CvxnV-w=C5yVbpM5$>3qdO@Vz znz})HdE-goPN2B&jQ#QPUBqAW{P?bde*DPYzAjuQ_u%;Jvg>KsAOBEA8ukGvU_TLL z6u3!nPvrYY;eQVgee;{#_t*~iy}@n3eZVGgUvLb#ANP?q1L<`M!2`gJ;s?rmw$1DE z<`Ss+0TXp`^S2EPm*1>OVB0q+Fc!P~*P;4L8B zgv1TteDE6ZXz&W~81SRuhr#o}W5MO%ao`!?@!&G>1aJv>BJEX(EpSdkcs@b)XLj?$^}guM4c>bzAJ4_l@P{U0bb3kbd;0yl>mQ zXRL?+#9sQMv+)GN_kp{C94$892`rL+3%CgLSdjR%{V(ybpZgFl`ol3dZh^aRKNKz_ zTpV3L;(z@b{?8!3!ND_~v+x%qSD;&mzvUWE-?!Cp=V-d;qT}3Y9OM=U=)ME40N-}s zK>xYp{x5g|_!jmTf`0-(0=@zI`TMBGqxz3E9^d{_{QZI3QdfBOb-C7~>Oa;1aPU@ci<)`_wH|NRdi*>$rA+;U z%U$l3-lgfN{$ouCvwJ_~ zz)Qfdg6D%@1DAteCq3zZ_hUX0^8?^K@Imk>@EhP^;5Rj2Z#oZQo`U&X;KAU-;6dOc z-~r&b{~vqj0T@MQuh_fdDd*`~@4Vyx`@WgkDcOV&@YMTfLh|F)dGp?znK$o!@B83(@NpP} zPjFqEz$f8A_!N|Onn!q<`Lx)r<$iGVAAciykoA6e7XPh7&rveD&gX@+{|m;;cKC~$ zPW2yaJ>bvYmsgC}?eJGM{55fFIArh4H?oh4y*A$%Z$RmHZ_+Mddd*v~0KSd?%J{zn zSAg%rUhq8_hVR1=`~WVdRL=ePkzw@z7uIb*v9A~6w)RWOb$^EYdv;4LRR7P#uC3Ms zB;FU2kJg)$-y+=7Z~g}5e)|ea|N1-c-$FwUHYnIs7&FYr%}A(UXjh~L>q8raM}#f^ zGJ!iT=x~9bYVRyw&%S_`jMR{ApB0IuWPO@Jt-Lus)thJB)}cI3y0N~EZs$*L>j4u3 zo>}H~>XUL#Iflv~-}j*T$`(}AX1InLP= zC9J=OJ9cG74%ELdpoDP4$uOTzT?ywHCV#qm9d5rxUrY_lpv`TL^nJ1BBjsf(TdFJO zMv?W85tWIR7#IUCS`BqEgMIby z$X#aQ(`~(;|82Xhh)@}ZOzTdZj_#v)!lQaqLag=qne`n;SY0A@V%JsjZ>o>C$XZ#s z$jRk2noB}!9mVaBx%#l5$5DILI+{pUXKT@Xns5dnaVvRvUn91SsPc)esTDs8jmqOg zDo!&oRAK$6N3Mpt+L~Xtp7Y%I4M?h%i)0A9RghGT*OxcO88dtZKe-s>H#(^<1U_Bv$U z@KK&G=8DEPmKg&BH67=<<#3;eQV5P6_;rK3UJmQ4VtK9$zQKCnYwdnsVy;(wPv+-P zeytc;*8dW$mK@0b-vd}>*@u-Ff7-opFUa}r!OD;P>|y`-<61E{&&75_%kdkG%%$VA zfIR&_0||4_W5p}W#TU1PmU?`&+L>2ggZ04IbY59v$cuV_%rg&M6}?=zSqD`A;-av! zqyW+jOANRH{5iBh)&om^fE&@_zJeP=iN6W{UxYT5d`dqFZRR}>>w>SzdZ77S=rvgn zG@m9N@gh&cE#RYYOZX6E^c9&48HM(`2M)n4+y>qe+E#jT=`Eq{gv^gG5Js*I?I2oj zIq!}_^@owGNVhY*1Tw1@xe)FO&xJ$b>97Kx44K`F91DlTBj5;l2pkDBa1>0#(eNP1 z>{@YkXpF1_9^Z>{z~X5kwTF6wxW^H13h`t;a3Y)l$3m{Va1@-xx>|&Id+0jbWbrTE zG*l_;fLeY?`z(<4z|svvd-6Z=m$o&E*CYKj*3s6s@|#_Nf0lI);l51Fnyd!mW_@cx z&ff_SlCLAy(W*6mL7w=0MX~-fUDg3vM_VAo&f@}B1SOrW2Np}ZgY>+0Mm^{Ko^WV> z3mf3qSaEEGU%@n7gntwKD?Au3gig6Knoot&YKmtzlgf%q4{ zLwxFy>pzUOd#fA}_YuaCc6~tYe@DUBi9Z{@0*{8z!DEPD$aNkI<$909|4ICh*YFc{ zJ@6H@C!VbR?IfYL7u4%I13RMj)bl{|M)Q1G|D(TOAXI;7UP(R|!3*KV@Jx6K`A9#y6n7==%itvV zN4Pt@9FBljzzTRJ+zwu)=U<@ffic`y<39*q1J{Gs!gZmn2a0vh>tTO*1MCZLwX%3zlP5hw}wM(V=mD3z#rg)xTU{6L_37(Ee}JvZyv$_Tf!fOU&F`XBKSD` z96kXT!YAP;kbb838|#7nKQJu)iE_R3)%}d|tbN_E|J$qsKBxZA8!y=P07>_vj=uswr-4|`o`dPfWEjFr| zsfwBD=DJMJdRQx4kz(!F!=_5V@r}znoZJoH#et}&1KffGqH)RF4o7}ZZ|b~_$D(p z%#3|S6Y4yt*KS<<^|awE!8Pj&ne1&YW1%jKdVvJXa$>S87TW_W^t)q-i;og-M9(H@ zK2^HEA$v)ue}U7_>&oeu?JBo5`xI?17T}t=_}X9eimu>P7kN)5Bhv2N4>eXVaPKTe zyi4de-bLe{b-CZ`x}2 zOvfb0>((vVX!%Rn$yNdCCtmd*`TzY(oW zHDp-!WAACv%XQX2yPA+Le@7* zK7g!ml)MG`x-WSRZVg|6L!g{*8~7~lZK0fZJ1FO6eM8Sn?<$!`I8xgsPe4YCC6B_L z;RBHMjpDl?Uz1wCq4?hxsgUa~y)iP(d;PQ5#5IDCh;t*YVjs#plXRmHq&^jnh9^PR zH_T(<80Q1Q8Cf_U9tK5KyKt7;hx!Q~g!?;K2fu>M)kGG;2KXUt zgm1w#d<8ba=OF7Fk*8rZd>m%rBd`TN0JHFZ*b47~GvOU@7W^}8gEzoK;5G12csV=_ zUJMV1=ffl5x$sDM7CZ``24};Q;nDC|cnmxW9t#hJ$H7_fc$k4F(0}R*Pn3O5$FITt z0E^>=C$k&UI6>SnvOn=oh11|^a1ThoC>#gRVSQ^fJOhfG^^N0JC*4`Nx5s@p?$vM; z@3>W2-;n-UTIj5A%o6)hYa4{0Py4T3cme;D_LqC!=(i^6FJj%RAH0}y^?{e*E`a1S zyC3l`GmN8GA=QJ-&x`wV=J!ojH*gn!T;TdU;Xz(Qy1uM#Nc^|*#J@q;Z*G)zjoB-6 z9%#Nqyqh)ME!fwy(m~Fv>l?+-5`G);=EK|JQw1~4JKz)WPWTx9cfp6@-S9!^l#BHZ z)}ijx{Y`h{e?Q?j!?~PqCC>jBJ^ z4qt>9!Ix;4Uc`GD_Z-}>z!TuB)Yp-a^$+tf)}i0D+kXM=Ut0Kvxb^;r=E32&WxtbI z2j3xGl5~)DoK~?9#X3%_`5xto81M5xqrl)V{l=^!-iM^yAASV)h9ASq@Taox$(#fi z>htC^p`H)Ye%5{`sn@@%`wQbs&MW;0>T`3Erk^GDp~!ER`4yD*`8$;M`kHjIFYjC1 z{SP}_+~bM=9hCa`9*%)Oz)|o=uA`9p`U&@Txc>=_SQZ6-s|y5lVku z2|fXNdD5?EseLGkhkYp4Is2Kba$m}Q0`)$@J{0%Y>S7m4?=Q$Y+L~eyisyZ?Q0pI> zi$ZIOJt+Lw7OFoqKMu`O`%rH|8i{_fp4x}1gJt9^{Q_$L9{^t@-atLiEVU2yIPSst z&xPy5+u#Q9YPcc10E&I6)8WQY?w?IaALcr+52g2y*oTt)rySN1FAA$+4DJm#hjL$S zK{}~Vu@5Ep)mBjMtF7^u`)UYoxv#dtE%%k!hm!W%4!7J_VjoKGE3pqH_tlP2?yH@k z+*doB#?dlv5&KXv&buqz5DtZ;6DPc21mjb;3!xKN5lVc*I*yY z{0WYM-$1bsCH-zJ{5$S(@NW?NQ05nK0{jq8r2gN5*pVuJ748A${>DC(`7$fe)AV^i zg}s_qd&0HldA}$AYZvZC3h|#N_hQ9*jL=z51{!h)}aox!?6!Vc$K&{ z9GdgUB@Q2h)liGAFF23BC#GXp=^?B`%^;p!55%1^53;WZ;;zFolyzOO z|NUm8iG3*i)jpJ7C-$Lu zvYs?n_h7}=**qGnGm0<*q5o|)iW=DIuvYBUWjUkRgAjd~mi66cS+|n&ylfObE!mDB zNP_b(esx$_Db^sf%N1c6smN1|eaxag$VN((G>i7L|J!61)k@~U{cWAr-x}H>%KYuy z?REVDsKIAI}p(`di-hhz{00i!}cKzkR6XT(`TA&?80ZSwzpx z8aSISNitB=dDo%Yzd9n>BKpD;m8sgsxN4ge4I6>^C*n0EGO-5q#i2wh6U!v4D(&qu z<842ZY|>G>OdDoU8YGJmDQ0ld(bg7CREtDj;5;(V#ae%DBie3KHHlcFtv*p@&306& zTJx$|+ig>|&DN68nkUI$4|zoGnNJJuZCzC|$<4F5cHV~i{6((e_qDH*k+~e@vI5^08pG2}{4%j}L)7}liZ-?5jv!VIk6W>0Adf^buhYt7 zF~hGsBr~WB-ZQjCX!FqKv6P+G+R7W{DcR+;NAs^no ze44V&EU8sz6Nxq}rzzdbCxtrEmgty?*5cgg=6KVLR83}7ydhO@XDs=0++iVn^D@X) z{Fm%4)#Tpqi8ZWtU;1`J6+w@^B}@pmdF{V=UJ32>ec2s)nDmpSukUv9Py2K;pB{Tl zmMz7R-K#(Uh7QmBezxStd*IMc@Bi^UfgAa)<$0Pwa4WwSg&6OG?#j6^eM0}@{VL?x zO8#`#-)ws%ImNKH{iT&PoeCz1I6_X&t+)Ey#v}OuW?py98K^8-&%(x<&O1J`*WDPr z)Fs<$X2esNflAiYMHAR2vi7_C$E%E!QZ?Dt$fun@gCDD$cK*a!F?c?4bM%!zzWQOX z#L=JMcKM=DJb8!~Cy<}DM_$scB7c1OSz!~!pZ+n%h;70*N^xhOPAxKa5P7!PE*(ZA zSdW$DZ%)sJ7zMHX*HM3O{rcsNtnrxLjx@Mh|C}Wr}_#Ovh9h7K>sPD3gd5Z6}qtR%}{_PXN;TUlYMW zdu}+nv}Si0=(pF);~6!Es$w4@;`_Ft14+x~nodW>4C_0S>yJ_P)jKP@UO&%5>tkpm ztJ-uKA@Ka9H9Z~Ucs-F3KFW-(Y{oi&+xn{~?_7^N&m>bl(~P2tlzGSUaxun&!la^o z96fyoRO!MD2Pj z2G7;eur1$x)5NEJGrdJ*^Q(1MHNl6oM-<4O@_vzV>n(A9Nyi!fal)kBmK2l4u9{pO&OTX4RQlIp@(+xBk z%9DPnCQD;G*yEDzmOib2qV*V~=nx}zlAYZNveRA5g;J|6`7#9R4;&k*+0Z2Bq?Mlx?~Qb!yY&+4>gygUD-Xn&x#8%yX=zSXXPG*vYD~AF&8$W(ePxDDZQV*v-B13w@pE?N0_X8hqL4)A z)!cMB{c3^w$}Fosyg+~AjLv=>zrM9VdwAkmdh-JHoM$mN>eHL1mE&GtzW6*fxt>oY(S0ETfwpK%gHe<)LQ$E|on;iI<%}6V zq<-i6`2yp(sbiQEm5L3FH&{AVU4zJHa=7mok3DAzXlDm5CwCK&L+wodMe_-KPvo0q z)OdmMSC8E_+43LFv(C4K{f4?O@3t$WzKqtd&I`Ey&a`=SSaL?ZHI;6j*wn&TO2%5B zcH>!-@#GNbFCO_R&EC*;W=6Ao@io>(nDM+V&asnY-Ljf}ncypC?eD*jrbceAhYJmU}8VLHn=(>MdYY^VCt z?$1uA{Y@(eNpTEf-12jb{o|a&p~T!Jkb{KngkQ|qG#64up8lUreCLrg8=w=w$yX?O z55T9?_O-57_BU4L_BZaY`x_;uQTlb^Kw^sAySfK{g&aI@6iPyJu zMwQ9k(|0|{GFjg;NUitn4+&=rhq7cL>G^6e`2-@hTKo=-;(iknujF-zw5i79YrW)U z+*`uuAftMXw>6xHdkB<#wtO}UrRmuLw$T@H*JQG&H)8H`n7oG%}g^dVDz~c%>ioV9uqY6g}wSHivt#CKd*U0%) zf1~>2j$}zU7B<3hunvxg)8PbI1t-FN;UqW}?g1yl$#5*Jgd^Y-xGS6rcY=GuZQ)*U zD>x07!@c1KkX4vS8Qd4H1^0ui!u{cj@Br8wR>3el5E?KJe=exf{f$3Cq;(?S!vy>W z^6?#61gFD=uoivFY%6nE2F(p`qO>|$BEuXZC}X!P$l~tOQ#i_ z$p6G&`&GXwq(7PSjf0Fb`i-{oWq;lNvL8=*Is+Ax9nZLncOcyH?}+D+ZbkMtO8hPI z#6O?>7B5!)jqJOtGB2c`Z$vy+IY@W0=xx+=kn>(DdK-%e5f04(@Q<*x-~jV-SOTwr zYvX?_I;aj zE?)eO*m2YT0kwa;hkHfied7bpEBy+xFYQAtxXJVEBcYxTvVZLpvEPQj+H+HX+~#qV zV<9{YehxG6ubNMl`33G2?k}N~cM+_De}hxtS5VsR@5GmO`x>{j+c!|!?H~Au@c&lp z`+MU%t?%!RAMlsz#1+21%@-fI!|dznUWdw*kZ+1IG;FZ&z6Hlrm;H@*K-u4T zE0q0>H$wI|nm0h%-*_#gf9vy-{f+&vWLM)5co}40qxK8f{{nM6+1IFUNcaxAuTlCN z`x~jBoy?u_KZpDv^}LI@EAG>A3$J8%V+HBuc@7C5Ci@!6hxb2j+1<###{SK?g;%nx zag>ISmVJ%dA0XuzBl{ZF4XNs}vY)YkBfA?RdNO$bYq|-tuTk3(a-K=LuTk2O{f)RM zv$N4^PssVEnp4z&s_bjj_J#OQGxt*eY5E+np9flB>~GZjeqSi>0omUu&xifZj`ju4 z#;)SX(D|W4Cv#FLgmJ(W1 zl9xn8RT;laT`otgFILMwMp+}INSd1w-aqf>eJh{!&3w4~CAfm(6yy1Y)RLo>lp)btR{ba>6@6zoSA5U z-rDALw#gVk^q&2Q^~szFws(u*uV5E*3vG{1t{r?dKMC*L|gU5)P4(aB6pyxzUGZr1y6exKJMs%HuH%+}RpM%u&ePI=~=m$0v7 zm3HT`_N#2x&Ogwft>!3m9#Yom;=eQQ!wRwPkMFd8EV)kEHX;LNu}IT-eRewDHe{x< z^YnS-Nd5aw+|fH(sebWJ%WwC8=S9{|z+NtjV+Ve_nUB27mdn28JmZ2s4Dg#QsrWv+ z$6bWv>s7u@q};5X?+LyDWQY4qVu(r-*}X11&pRGjTyH(qJLlC0h9jp~emjOkk0t|VU>=xpNHj$eQO z3%sxLJ>NZd!akD8QjJIQErmyawf#1?O8I#nUcU@I(A{i} zIFV@^*}EbdokWR=_(|6r&I7!WpCsL}#eTr&f0WxjhLAob+%aDwXc+PG~{PpI@GMV}E_>{3BB=){4e>^v#Ln`N&yfgM@{bcKaIY znYq!80D*Oq>CNO}SuM6iRVjsUAtBI?EEUz%)u+>S(J3>s4b_eDRDGs`)t(mle(+p> zhx=Y+p1~8(TBpKG*CX6|$?Y?d?+tH!*%H#$P@Q(FDk0$QYh$?MXx}A&aEFg`3K6E`|#-}CwI#|y0UUOJ7n6`e{NrizJJ~LHPh{# zBhlRd&}`Az60}2;3yoG}TV@PvP9u4z^&Y4nuRc+a7EzYv{pIwncS%s7U-#^1i8IT{ zvS`#_Zxia|Iay3pk6KSgjLk6 zqZ+U|Ewh%)IqR&k)~mjz-12!8TWYXa!1msc9q<3z!rK2e*dO0|2zLD13*JX|{Q8`H zf5*@Fp8X;!5rlxdrOSGnm)=aGI&zGWD>2!SL`+n-#53w}z?Y3BjHD0P4KFYHk zR?*m2;f{fn=->^Iu6aaWi1OTRd#}4cA`=ht7JQhHJV!a{9d_bjHkRHk;C%WZdXx(-paW&7MDJ znEj2@%;3*S=u8*CLVmt73hnUMv7!C2@ep>s=Nk88594m;bNwm*jC)Qlw;Pacm7g2z zAAejc=F~tA5~mWsEqTT}@#m1I|7Qc=d8~MYbMeJ3r5K1$sqJfDFY^0yRDOR$SY{Y2 zlp*tSn#%D@3Zrz7-h;%Ae4e^_aIJ5gZW;q8^gdm}5kXY{lCiz#sC}Z*klHU90XKoW zLS`pQc7&{|m23;k;Z~5hVM!G7_9)o|G8!lz2$AwADTU-;vNqhxc5e+=!#xD{h1OH00mNMV$G4f#qhSp=D_(ev#BKgYc*`~(h#AHWLuE*u8m zg3O|oybeb|xlUGHOXNCPjnM04bxf~wHz?OR2Fi8r4&^$>Lb=Xy@MZED51)e*xZWq= zMEklY;r~dlJ*2)%=k}WHt@qi*xTY}4`=?&gmPX_X((Q@7`K53#coCci&x3oj@8E2> z4{qVUa89rNj02FnJ-OHZLTyhNIi^>Y5yyXSuLFhZ4@NDG8krH8Ek=T z!z^3_w!&55Ot=!91^YlG*dk$g2>dxRN9_}R4-dor6+9d+gh#*+;gRrNcocjC&W5kS zqv1>N82CIq7Cr-ygHOTZ;iK>b_y9Z+-V0BHcfph4?eG-#3#`d~aw_gCai0b+gQvrb z;2ih|cm_NZo(WHbXTcNU+3;9+4m=W`3)|oyU<*7Crs4Up4qgCfzzbmlUIeS)#c&^Z z37iTqg_GfBa3cI8+znn1hr=uAmpewT#P*ulU792E`^8&C{$yOOc9-UuFj7vuYv4xk zS~wWee+$=x*R$_ob<*7cS2J$Zeq9i`$++3>XK-zU@LTAA?8xAM(*Lx7_xrhUj>zx# z`vKk#{{ipd{9nL3aeoRq&+Ju+|2lHq!h2M{`(E}~8O3i9?)Z1a2T0cs>3xa+LZ0}K zkl*6PkBS`s>{TcoG@m5i=%r|rw?|BCS{@y{SWwDh>3LLsU)?|8-%9w8unGPI4}$-M3HUG0 zBlY>Sru(jj!qh==^XITrSU zQcu01)W68@kHTN%_lH4|-`^FA{QeNQ65JGu{Qdyg7xsrDzuy;%{C)(A{Ql43IV!*Z z4HWtP&!NcgzXwHr|5b?mzBwNvzi&Pak>5A(f+D|v6BPSI(ho}D)wro#^HPZXzIiU> zqRdkua{k!knPU!s$3f)x&12vocoY=*{h4rmi9#KH)>et>Mr- zfb%22kNqs(|2z+R(T>RPYk%DV%KawxiR6CU3EmHPhJS&(K)FwMrT;BnY{~D-eO`gT z+~>o{ub(ko>=NmH4%xReQtT1YA4Una91wd|yNTRB{wlw({Y&yjwrmV@^{?#ByMexLhmnz=XS zl=};sa({{Z{$s=!`TcvK$nW0*_lJLi?8C&a)EssU80M+)KzIy{lYar_tHwPNcMaSg zCh!mApTu2+dpZokTKwhynSooLXDP}Z=6QS&EP!?Rze8)+!#80Ad<{0jmtY#c2%F$@ zkmrFu&zsqo@RXSmyF{~PoC*8iidCX4yb;dCU)~>(c-SSh-H`A@%tOgf>KoEu4>J$P z{}1FZywNna8UCapv*(OMi#>pJ<+-{wHd= z?eVad|77x){&fnJ{&Xsoet4SM(f)~x%sb8Z&3>pyT@YF)yjl40f)}u*w07Ypg+~;g zTllBKd4;bOzFW9Lq<>_)$hDE{dzBd+?uU+Ve$y+@f0V>yed>^9SbtrzY=SJ9JImst z3BE<-6l{qR#%>(k#@_Pseb>Ex0;fwpT+fNW==D^zyPis2`fp`{zlQ&1V#nH7ceGWW zrQSEOs-(-!tNi-=9ab>)Lc)b+?1)aQb~&p0Pa8#u%zISEie_lUESgxoPhl%YEM+Be zcWu|q2;w^JBerI0Z7~h8Qj=4C{Gn0wDlHcpO@uV2UPPY5NtB6Uv`|ghFg)1N*FIgA z-yc14q9x57C4HxIIrh5z=w#Z_|D_GUn@o=ImcQF}kf%knwxCpQS!kFlGD+xerc5Xn zdl%&=uS>Iw*5F2#V%g>-w%)$8l%rr#s1b$XXroIr5nT}|)Vtko*PG1P zFf;ZQMbxhDF*Zc63~mHlQdRCjRqig`xyD!L%j=F>(&=B|^z*uM`enPyZOuMKn@giN z(KBk7=^3%4E4qSHUF1EL$}4xHKh?yw7r0%gs+;{%7mTCRQDfN9hSUy9#GK_JS+uE+ z*VLh(u*p5o)a7{|EU3*)H6`8L4bfE5o%^fDZcwt>TaCuZ?$x7j{@$CR=ly;7GQ33P z262s0<`YQIH`Ht6As`~DGk?)DFL_XA+M=<1)(@h7JAeNo)M4)M{iYek!{-yY-8 zcKQ9j_P_4huKa=h3Z4aW&)%<@$#}~Q?<;g-_wvc4np4r-s43Z4)7;jCu4MO3I=XxL zBG*V;p`<$6f~Z=fn;$EJ-D!U}KSxZ%w#m25`HAQb@_|kXyE&e7%a^N6tAG{DdcDhb zofS?yI3Lx{b$0VUY)v!bMx(Z;W$FWQhq8q6uwGUOA_ zCQ@l9pYHar*6Hqc?s#i!jgwzD>pkwx&+Zah@7)|Xiz$HdK^wf1;mZ7)v23Qf9|_J$dvx1fKK5tuJI}o@B!%=I@%`mZ+d;-1npB>qz(5 zpZ|Ap0Z1~)5q|nNejQ8hmQUDM^_X7JcJjBgc5gqQA8V;aC^3p58InrB?7W{jBNsW5 zp?Z4Uew;_natZn^W?I>V4_=0L=;r6Ho_Vj3BD_ba`wy26c813`3&s9z#_lm=$C$C* z%~(G(_L>p9$;dY!5n5t9dnX52{K+$?(f;GU=&~+GB=c&LqobXbrUdI9O-qxso>h=q zUB_bHdubA8N!UUXDQaU!iE`5o!Rz8mWj}NcXKdrlvT&E^D3eysVy&aL z=-h=|BWpz+MW0EaECtT6BWcHy`?1seX`Gl>_1m}0eH@UsL31&}waajSEdA_^Wk=gz zZcFdXKq=3XpD)ItcDaA8{nX2&-nz6>n=p#@k`+Pw=p*d0BN+bwwr_cLY4^$Lbjyfz z1KKS8M)(L?SHgSj`C0l47~vQ7$`t zSw*d_Pglq5%Nyej_E#+8u+qQWfmjpv@sbJo-arKqf0^@Z(YTxY<25pW8sUNVDS=jp6Y9LczWNZG{+1e{9gU=anyi|s%PMM*Wc!B4jH(q0UrkHq@scgskYCHK{eJ)w^ z&z2&MzLKeXA2!6BYtrHscwWgXuOZ%)k%vOmE87^j?%HJ9dfo-(f-8o}Onr4clSF%^ zDE0{C@4oK>`|G#xmk;Ai7>sRca~^exXex1VHpyaY;EgfZpRT51y1dpqc)1XFs6T#7 zvOX!ZdTrSjQJ;W7i5hpzoig?Mf&1x3^z^uIQja%|R=@ zjoZO%4pZ+__jd7Z^Y76IU~5Qa2;esf-(w%Koj!oT_{=L8B0V!`-_A1*)ZpMaAveAb zj32~b*MZlOWNydxt;5Q?ZlFBga6MsQoa|e7l?Xbahk{2jR#Ep5B; zb}n8Z{|YDnO53P=;QPgvW3u~m9(@)Y`|7>x`YYIdYp!N|inS;I&xhtc>az`dCl_M> z$O>JLous|k#VR{p*^-7`tA7R3eu;ZwF0W6FkM!pg;}iA>e-emm#jMWx9+3OrUi@z} zW22mVA$j_LHYChBkHz(o-Su9B_zu9Q)b_O-1pO5YbM_}cRlOAw(`X4i#--Su)Nr=qDodLBEL8m!^>7m=CTiiP>_e`Cq$}AEmg7GS zGAbyU3S)3GWcH_I0%R0gG8S$LN5ie)aLB55$u4jRlzg{=JHTz>Hjvefk}cu(Fb28% zN;ZKzLMhiyP|CG4+z{>p2SKDlO4fx#;aac)t_g?1)gaO*C9A*@a0NIL_J*TiAsh`& zxEuUe?}e(r;zx*7Sjo3=Ec_aZ{)$DA)$fwe;RN^z$7ufWN6y;b7> z0`4jBnch>ST}q$my{ET**f061=&vwu>HVqbuPC~n`1` zXV?n2hcn@pa2DJQw!w|zA!>JWq3W+#7x!WKuLTc>YrrF5KX@cu86E}uz}c_>9t{n6 z4E$HGg{r^edw3k~ui^3VOLzkO6rKn_geSpw;mPn#cnW+KivEh{;c0L_JRN4pe-3;C z_ZjeEcqV)Ro(1oRXT!VTIq)`kF1!i;0bT>ogIB`y;U(|_cs{%ko&zs}bKu2xJ6~eA z^QHKog8yakc=$(nG`t)h4zGZ1@Jg74SHULuCs+rshPCh-SOc$x2f*v#-tc-@32%TC z;f-*2coQ4}Z-%?TTi~|vR=6enGu#y31~-7W!vXLPxK6J-#qMP3>b=zdr1m4+k$!~V z16P9g!XkJdjKKS$0q4S>A`8X-WaJ<40r(|+5Pkw5g73kH;al(#_!@i^z6>9O&%?*z zGw=yG4?YPWhfl$W;5>Lgd>Y;j=fm3}`YR$g!Dr#M@Hu!Td>&o~Uw{|F7vZ_^C3qHm z8J-SbfhWON;j!>FcqDus9tIb{Huwh5je{d^8gJ3weYu}uac$&n;~m;v+%Qr@ym#RN z@IAN}d>>ARAHWHa=L2?E7n+|KMqvf+kI_T2lI1>bMf6vEK|8D$`AqayXgk2Q4Z=Ui zf1Su*`JecIAtb)$*RPm-7NLJ+HTXBU3j7ML2>%Xy!LMN$eghX5E)@M0=rdU;`YZbV z1iypd!SCTW@CW!6{1JW$f8u&ShX2I<9^^XE+wrOBuQ;X%QYdx*hlMZGSS*Dso<}^# zzatiqt`FL)B>qEr;`e61{^G@bL~jLpITot^io1!&t|HQ{D0(Y29pt<#n|*QLMmRKY zg`&UWrozuuf5i=ORovI%FZL&|hO5J?pi{mz$tPqKi{1+KHY`*|cuTK^e<9b2{tCj^ zQN0z1kq-S8=uP-c^jGk&RIfwM@8pO63iK8%6#W&&JK`_;E4C{fBzh{eT?dnBy~z6F zCJFC<;%!B|4M`U!-;IdhpK^=+$$o{Kh@Hve6$ocfX=!2MX5!X#(EN7+?|=JzG2Gwb zMt_Cohy6+PA@Kgk|CNHRr2UFtAbe{(9JjWk=&z9a5&acXKkWK7Z-Cpwo1o~gka|Ub z1?{5tC$(L6#$Vb6{S~y!u2`P5+6B%wjS8_h$$LuePilE_n|BtB5POsOj})puG;gF_ zqv4fsH+V_G7|~Zzd_HdUR}`NEadRExL|=to$9O39hMRVnDE21JQwl8mlP3^g-2DnC zi=GOtKkQFZe^bP*=Y{6s#6y1ttQRbhUl*_r@>ip0&IgL;304)D0(cmhKIpT;o)!~JOcKIN5a1FC>ViMs`;M~?|=9$ zJO(a=$HMpEaqu;GJbVV803U@X!nyDycn1{y6*s_B;5AV6S6mKHgZ*j$)8V3$) z!-lMt{(23+LEIV+%`G_pO>i@KGaLwSf%06tmHQ#gbL-Er0N#fGdW7E&OW+-_KfDvJ z4)21i!Mouq@KgGcJm>Gl-LLRIY~dRHR|w5D?}xo0ZoQxWLb(bH9}u^e%kqE3d`SHt zHXm32M}*|_sIY&S{2$YNc>j~n*Wo9y?JM`elR^!D$_^Lzf2gge)ji*QhWOI|A?0`$ z9WB;<04d+|<_osl;*02XG5Y^VdPuvyY`%i~AGn3RLa(Cx#cEfG`*my(TkQ*Rzk!Yz ztDPbFziqyy{%@m0#%gy+ybsKG;oq=;`yLGAejly?sYks}o%;NU^T~7cV<^wfPoO++ zKQ%kj!*W&l!GgC6$_j@U?p=5snpf^Ee5~-f!q*Eoh-?)Z6={r=^*+7#9lhJFi|Ra< zwVWbL$MJ+?L8#2&a3@ka)YGy-zIZHvuoA(fOAGd8(c10Na9!e$@9HV{*m9L9>-gif zD<`*$w|w2!%d)EElapWj_4S#I@Rg^_dLX>>t6uSJV*vU68v81DXVCSDr~74er%Zo!+w)X0 zspmv>tR>ZuJOokqTzYnfBw~Hk|pK3}wTlGeEFCX7LsJDSfbuYhh z@hsvU&Sak_!{Ob_&oduxWmeI>d|dexd-Ig^qi)oDPM=LT+YJTBwh?c;Zl-jv9G%VU zdurWau2K4@w?78<9gRrUhyetQfhRM>T|?tLn>PZ1gbn4_UvIy!{kHA70+rOBrg zyVX;dCLi~KoM-)CcJ^4y18yn1tvAKfSka8^u(X>)^>F+9WtZBc!LcB_bN8;7=jYTh z-s|dSK2yg?xA1K2?B?^lqK0mqN!hk5Jo$C=c{QAM(D7+`K-h)rWut z_52*6C5Bxn32^RU$v5;`l+){>lCbgJ$I>GV;Y;XE#uRPWV-@N`8b%Fk|R9!cdJ*gOS@(q{e~0R z1ki{$ZT>BEqK{4XYQ->^XvGtA#0~sEg+EIAkjxparirWZtIwZ{wKr#|)augr%erKn zWrfRm1hl{ZyVUL?Z`dRjQdA<}$&4cD_q1m$BcfdOI#_2%Cfi9+tP=OAP3x{chw*Bh zomKy&{We>ZbGx@6-8{(+FW=-+PaFgJ?eu=vyfVff5_#$CRlgs2-gsY%YD~zvzjj}K z`PTC=Gh{s9h3k=)s8XXIRh}xV+EdhPIA2eDB70w-IwaYwzEVz(&H3##e_s|cyY`Ik z>Q_@a6`9AOT)qc&H@^=no09RmN`yr9qr+(gu4xCkxTSC3gro3d!jjUr8xMG85M$Zq z`f|3yr|Xeh&5d;=OSx~{{);w@W(G3x#%Q)W#T-*h8>w1TG8ZM0Ipq7a)Ar#D(6L=t zW`7FCrrMdsF#V>skMfOAx^(}0FUnK9R=K)Szaj@G;+(lxe>cCsb8>c0p_U;ZmCJMT zX+MtZQayR)^qj1;{bU}|ZEwpwVY((0WkZU#vWyd!x_#AZ5dz$qm~Cw>)-3ao?s?ix zGwMD*H{9uDGMDP>ZpNnV%F~g(b*vdr9W!F5cJTxC#YUFtsao3v8)g)BKCMT;-_q*$ z^Yp`&(lQjmZHi3B;qk1oSL?fiqFSnSmNyZG}*_vjGpKuy3% zMo?%ZW(<`#hoU3oLbjGaojvz4&#NP&*f@C|<|d@tBpt^#{C0XjwtMb7LoJ!@GPE7s z`^=Fqbf5ElG+H)R%Mom!)u#GU-1u(1-1{JxK(o)&&Vl=FypEX4csgVo)RL@~Zi)3` zUl#(!$x&(#()W5c=2+Q;Pg?%{B=3HjJ<{VDH8geofRv$>;x2T ziuQSX|Dk+iFl{Saw?^?hrm-bi%hRvTqb*_xC-Kw|%bya#v!6j%n98$!`<2(!r+6~~ zKHs%;{8?H4GiIX9H`iNw?zYq*SvPh38A`UWR<8m5JpPs0>IR)bC8XHv&m?g&;VC3x zD|y1b`t-c#x6dOnEqk$cxn$DWo1YX!&!_dnz@id?f~5a^vOe4u{TV7JFlJ(9wpnIx zwHlI`ElxKN*UGZ&Y3IT#>D`l4wKH0r>$TH~A`k!h*OK#V`F5W)a`XsHUYwkXC+Bak02#I8Mww60DkJ2vvn;_#u<)X8BVyMFU4=;0lnbn2Ld1Z-8ri_Hw(j!|!PHkjVRf$Sfy)9=aaPeK(}TLT%tM$mqIycYBGwT#W2d9L;3x;+iE zy!B=b^5<{ay;pTl(aKaqmL8K-mkz_+a?FS~*6Q=#R=1$zaW^>6_{ysvL{`;p^&ooR zQ-6JoSfTOVVtEwlvBc+$H@`gkM)bMi7U+LY-+|13disU4G=c(;ni|$OTO8dJGH&+7 zo0OiJY_?Y3<*OkoUmX~dZ?}(aW)gLKC|K0JG{J@G-cLG}G45)RJzA<%zBD2(ZyM6@x(3JXmg=s!+) z;63fxrYti=ta4Y!n=>tK^-0FYSk6hPY>srD4dstpj{FJj`Fe>Oc<)$p2JR_{X>D-T zagUpCHdTi_!f5vWXPaH+NaPojOx<|0pwlc<<~*?6!HDFK#%HerfIvAs>5{XWQjDDJ zDfDuG{<7=TS{R#>&eqHrk*t>iQQM?6{++ ztC zg=9U`Q$N;Zp7iDxYor%=j{Dco>XOMOmh@U_iaa3VHjQeL;I^LXc8d&RL>X?ekDH9OunVz!Ldkv?9T6fa=o#j^>pQXkkv@1wN`+L*v zPgD5bQ`v)PJ;EJ40?Mswv%Y)s#cNKqNIrr7;^vc?k#255IM@F247@*c@$`GJvZgtO z`3ko;x4UocdYozvdH6na9wCADcjd>Y%*ZxWH^x)-nF?0tS_1viT5q$KiB$2ItjBoz zhxdM!XH0FgngwWTl4_AP)xdbn)6RZut7PxsJo7@3wod zc+yL_s+Z&PtxsIJ#K3*$#;=Jt$veYd=+b!~PkpqHXAiUj_29+}=)LPOo@HXdc^w4r zFE>AwIK@%w5V%j>aQh3{?zU<-D{uLARg?;EN@r4h_6PbUOK4H%wNlAIyUFv5MK#rs zBh?uEZmdo}^DN)jbutsxM-|K^ zvEC#TR5{z9efq?9GKz*U+Yq>}+(MShlep*gyl<>m7^4BFi)%?_Ucyt4)@MzE2ZX!W z7-fY;RvR6Iewr@uz3M)Y?FtBthj@EqouoR;hj$hB0CNwx%+M`bw~`D8%OAJgR$;|- zU@mG^P3~bx)WCbgjxS=jR#)qIJjB(A*hy}r;~x(N`d=cOY^g&L8CPE`+8Ys%Xk|XG zot~F^TkWOFfq1S%`ma;p(fUl5|2uiuUyzns!r*;jy}x?&I|cQNGI+N-Sl~IwSGh-& zNZyCm z(zU7X-;qA7z;oZbk4mq6d;YrB>`ViA=HKN@F_~c1+1Z_7ZKJbxG1=`=H++;wzO$mS zO(u@*A)Qsf!RME6zmG%-e82kl?+_lC&#;~svhT>wKk$6^?ANg(=={BVp*cNOfqW^r zEevJn8+h;J=5GS;ozC{bXikCqC$RqlwE_~$EniN*mVURl-yadY58USA13~vA*yY!C zF*n}^9pn-gm`Bk41Ck`*uistbA9(-BLPJizU%~_LzfSjGNc=#(56{W>OCU#}K4b|+ z#8radq50&CHGN>d!x6R!zIWX3L0d0X;5xnEf!fsq{mfe2s<6hca^k@AslD8%mabiY z_sb&^Cr}RGcbQ}nXxBvC&Npzsd*$#nMxa0E#+!Nk^&23NpI2V3qx^J4x&xtZx9j?I z#gdLNg5%xx^%!kZ`Po2wcpgJmg#^Bnf^zrPy54ft_w_f{oWE%I^O^C6`kil_Z!F^1 zigBiKs&RyIxN(TlX3R2X8ZAa9kTQ*XQO+;Lx|RH-?4RIyB<9w+*luV!ej6e~>i8@o zPyf&QggNJNI4Boi(uwZ?eoJj%t9}jieJzsNy%oxgGD3`%LK@R3of;k}ZuY}VO4+|Z z*!YqUw#nfy#l5oaU%Y!*!%Id&b_o{m44F+(|4q1|whwPA@k_S~Z|2PpJsV%h?4?-} z{z7I0i;78yRC3Yka0~qV!YvUTSQ&1Gy9km`q!%0l!*CmDz-{5rp+&MAsMn8>w_-#{ zFOGa0+R@mV^M4iENvPKYBMU>j7(=yOy9(7GMm{E81$+k%gKxs&@KrbhJ_kp_ryp#`livZkn~N^ga>oppU?`_jQd+iKIp0W!Z_1rR`v9>io5tT!X5vP zcqr)#jKehkyLsXtNq&nLA7#uYUYOEA^Ht&+f8x*FT6``zq_$76Zchc0{jz{a$QZlacKLxQOk3!ah+WrsO@~cw(||rzLfJu zA=hz}ajPAEv!=U6+Mrd#(D3AJHxy5dha&wq5kB#1<}WN zuW_IHe<3utLfh9|+YPl{{sN_49)R=UgK$242ugcCOn!?OKVm$}^-F(%+8-XnU0^(J zJVAcaA0YMfq)5~9e0xf$<%H-wdfIqK{pSnSADU&PdlnYM=g3Fe?RhQVBC+zO{p3Z? zAEq^5f(7tp{8uO5E3hAY6|MwdgMHxZus2))3!!tryh*-$qV4N#8L;3l{28rZ?-Ebi z8RCA=cwgf!65{>$XA9?(h^!hyCr5R}e zLq-buuY0&7aGi+_V}Cc6%RPym{h^h*m=+sno1>kCn3TvtH)E(qm%H>aME-$zo(R%U z^Va*c8ib;TWmEMnRCXd;V=p`uX?$02$Bww&Zk}hHt?d-WPL1p-N|rZauiN_tzpg*M zEtb_@4+)PcIl_lBj~hc+$}2M%WAawytYe5yi9}!=87z@DF3T@)PdpLGwV zDMjwSS%RLD_TSC9JvM#GCfF{LwN<~}*Q+vAGVztql8#A~c|J{I*7QZJlk)A*E+5Y) zzGwgB1Zx7UQdU2$^+9X1rSxlmIr68sC(s=AE!K0Bb}lnwB{CT{hW4CJYk4H-k)q3q zRq6M%+yB}<4t3q7+9`#4R!a(H)rT#h*lP@#`?}+ zs>$sqIeF2XTsF&UNm;O#_Y}u(UM{&U-4k9Vr-(N2^(`DG4K@viQ zt_TaP-X#U{TV3R3r^9RCKmfTT=&=KpznL4XI-7ol6pQevwWJ= zutU&nFPR2bq z=QoZO5BV8q|M=rtG0StY-Ox?&8_XEQ@tI4W{-1$_Ip=X$mWwax#JAMrqnFG4YgK4H zd}aPsV#oyG0ONiJM*D^C7dPuz>R&u1q%4^T>21ZMA+tN`zai^b!$TWM{L-C68+-Gc z-3!;IOh#-Fx=(iLqrY17iL3{CYem+9jHV;~A#dHt>X5JdUaP<@aSOMCD~7g~^{mof zp&>#oFN_$WZKbzz-tC0y4H`+vi#40ktow)?M(!k@tZ&^4$G{sQ^-*{Y9Lsu7A@Rn+ z0#>)Ao=(M@%|yGraBYL|N%)_LHJiEWFKuQNA4U2~2Ed0}`7z&qpR5BZ_hkOtWOWO7 zaU1`S=Z8Zkn>KLU53Sb5f0I{ zKUdbb%*m`Lq~IiY5S)O29UKdpATY;3r+kf?Pg=_(`8fUulWzrXZf0x_WQtlV3dO1oKEA;vx z|BjaREc%tMZ|V7Po26K@IYIr87pgzRvejH&-&zr#WS8q?{Cnd*1xDbhumGM0O?W!| zk#fw@^UXERAl*N3p9#N!XF;ilvx)b)agK3;UjMnqAMEo&?KkJ)e3_1mCH?hYDE;le4%byS!j?k{I|*l-e?*J@rlB%<9J()} z;6z_;B9H3qES~k+(cHir>n0p>8URf@_xFxjI<0BoN zqx4wj%jW5Kvc$0F%bsSwY5z}Wl0NMpYPgwDD!3FzajHwGng+UerYxH zWuE+)FPo?HWn)A0biQn~l}}^@l=-ruFa~#qo5Stl7R;9ofihnvl=-qP?D?|Ia`R>L zRUUkOd%mnXH(xei<-rG#ZU@q>4Q0Np7&7XLtO|FAD?phq>jh=L%!EVXzxcwhfImQ) zFZ(+j&UK3Q=aD*JHect<-p$RI&DZ&|H;E_nWv{|9@I^>H6g~s3`Lg-B`7)`eKj-Gl z=F7YpAL8?MzU(IE%jRo)NShh`t|LA3WyP1nDY!4T@@3v(p2$rr_tJT%X(~rOhj7Qg zBkoVS5c9l*7ayM|eq863s&$@B+P{X6io=PQ&~!k>R|&s2s-6UYd%d{9?8e?XTGes8h3{HRb~tG)K)!ZwfVlu=F6CGnQt5gCqlmZ%-!J8 z>OR&uM#GO4`EUBS%7g29aqD%-e3@L=iSS@}63jrEFO&K>h4U<4e5%ZoF;6#N=gXu% znJ=Rq=IA_`v;*^Hocc_eALBe{3H3Y>+o|WsJQ@DZeA#?)n}bPr9$W{W52YTMS3}-- zzRH8I0huquhU|RfVz>&t1oncL>iOo2Ja};k_aEUuDc|K#>Rsl`eq^@nTCMM^WS&gR z1GT?ijsH!^gIoReS|ROpoydo4IP+!n^Bcsi>7eE@|C_@{*5MfgYXZulOQ`Leg5%$L0h?}M*H?l-+p<}%;* zGAkkv*w+hjKWIE;UpMUkobiargX6FA;93uls{1j?N9)hY?+M(}zE47F&!?dDgLxg! z(`}2b(UY;`c@H)uKQSkT$_x(o`=Do@F5cW0`yI;L4wZKFjT-~=U|w<3PUJ}Yl1*@a zQ?f2n|L)7V?xg8^=IMTEdFQR9u{!GqwtnH9!XbN$J0qyh(|P)jL|v_e_~q^Vu_HMn znQADnVOuyd5m;3#S6dO$cyrAR)hQ%NR^hj2-tf1tFIetlj^F&eVX>656M5R6dBvW2 z#b_SAtv&OKh*LINW{%_*8X$k%@nO%rV$Zx{lFdCC-ME#oRk{C;^xORZn^!C}S1>|m z@aI45q7}be`R2WhUn~3^W(1C6HsUbmEJVjdtC0<)ZN^=Y%dMUn7Wt{Se}ZR`nA-<( z*p^wdD1M?}!iir%p8lWpedn>_4a&tAx8ywlA8aaUdE`OGfqsbsb3I$XM938V5)#uW zy$t;lka+-gGe0oc2%E;hi^E|FXP#00i_ZxwOXk3hm{&X*Zp`=j(Qp$e;hW-rL>SHL zV&qvk6+Qv?gb%^J;9NKj-VOJLx5Itlt#Ds>6WkA82boVq z&qaZG0K5!V!3*Jm@H`lYXTfSX2Qr^nd_qX&@6bC@U?y=N9#Z)`^iC9*wZv;9-VE3R zQ?LorK81C#PW4U{nDwf6qCwifbQ1a{m`Bw5g!Hchvx#~h7dn{#iNEw&qu*|%&v3q> zu!Z^59j$z|-On+scAv>SlgT_k?&56-cl=ZQaC=l_nDdBoWTlm?oE ziFd4~v-C?yy5se{C&)Zv@p`zSxh^~jt{n=SC&T{m6u2h-r^3}B^NMCa=#*~``G&c> z&LF=K^ND8>{xeq(xvsOdoRYs2|6KJyPv#Sef1b=EGA~(x1fF5OO*-Zii(i2ks{10D zH`MyQnEIU*xb?$lA^Bdf{sqh^8s@FUlljEE&6}A~lzeWM`9tn2XFjojr>j*@GM^~*bQ|ms zZ-;BcJD}9>o#eZC@m(^HsO9@BAAz&rqnb~F`511g-^X!Fy*)uWOlA?E)az9J650;)h<7mYo`xwn zA07ywf&0N{;Xd#=I1N4zr@|NDIQSyv9}QoEyTX_4_I!o#oy}K`H?>X*=P{L#-*z?`jNM&ZX$ z`t2uNZe~Do9~%sXoJuep}p85acpQ* zczW0{$|Tqw|95+SIFL_=dM-BbpU=DB4<&;w*cla-=r!@08A*xRBOm%J>vx`scWz(4-ea~6edx^!;YkJmEczR9e9>y~88d4#ACdeN~!}XW|?UB!}Pggqz^`u@n`pF-6Jkq0I z#O^CywYN6FUw_nOk6pFjk{*%O{O#iiC?|T>4|~=RrE4%f<$eBn^{W3S^@gk<<>ip? zLXK|Bcj$P*Hy+Kee`E#Gsm)O;f7-?GvG4JF*F&P?Q}_Mf(R_qR$a{tf&SP}R_C$Uu zeI=H}!+L0_Uw%Jj%P}vjRAtP|dVkjAK3Y%pePDnKsbt=5)Q=!H_4JLB-yyT;Zjjl#2fEh6cn_GT8|#uYQ5`yAJuBD+Im*2 zw$=XCmj8L*nc1D4Yz{V2t7Ra0@}2X|cc1U)>bhUd`td8ohjTx{OL{+n*fdI_tRF+x z5mZeD-(Tcm_nQ-XS@elV)nD2R)h^8c3wLF5VtPpRizYfO9tU@4{dhFo0}h7+nb+SB z(tA*QHu`&q28q8VWuZNV-g}pBhH5bW7KP*+ocHYGatQ3{grjRO{M(Q9$sVZL^{}iv zWlj8(`w6J!)j!C0yrTCNd}X`N zJB$7C__txh1i6=h^@>-7=BwD7r0yomITUpVdGDceFG10Zm_zezXJ8isLz8-;Q4Sdya00x z^9xZ&QC|e-z>8reyaY=6TndjseHokqFNag%6>tK)5=#1A1ttBihLV0O@n6dEHK>PR z?^?JwTm|=ntDz0AgFD0PN$FcCdH*eP?nKRRRd*`CMctu~9RAzo+=-gsq2_mrTFs&6_n#BLA#&9(U>EpH^fx11 zcfs!PZkP{$1w-)H(1Nmlyn#@>#P>_R^&8d|zcTKVb10hbu+JC9gPcea{RfSQuqX8f z?DLj$KY^+rQS;yGITVSfM^*ip@wgjL5chgNfyNi>$N2lS@s#R6t@jd0`FTd|KP%zs z^SUow%zA2hcmYa%@gkIR^OCRqG7Wj0--hv?F^m&2%gr0j@z#;n<<@Q1@2z*OudHsN ztwP12qeG=)Io(g`v~@{JraYmB&Ygc|>s=UW>W$1R%Qigun^`G)t~)DSYm~}c)8E6a zLvHsHY$^Vv`sLrf+?|~XPUbwnd%oqrOz!>gjClL+lb1tHEKlf^&drw@>mrT1){|fr zDZ%PbgjJ9v!x>o_X+TwlDk`e2B_O--lbNn9ug{A8t>l;Q0tN4uL0Uw8c9h>K^OpUx zv6lJXzcU5gT+Teu1DL0<*p|n|#40n_#@r=jW#bAVHYkE|$-sZ$v zJ!?qK*WqL(Et0vGhJ72Iw7VIp*e8zdBayv7-4KbE&eI2EezyoLjl|`SdHDjG7tC9} zf1+7Uzqj`bDMINEP8(t#uz?Z6Cw89d1w!R;CT?^9_4}d@r$* z?Jj~sHniIIRmhPqE4)zL*6HOGF>9{PCRiKe0fn^MMi+ieoAYk+6+DCa$&9x^ekl*f zr&e~L{dO5{y2+>I!ojDCG}kTHDS51 zGNJdti2pqO_-VB~s9y=$X`D-VGVXg#f1PvBW2^5iS4s4V;mzKgr9%HNzE|Y{!r#Vs z`edzdl53ai{XqYcd_p_*cf&rdgSAVb$miB2>R1IA2!cC82#yv$rQ(*|H=pp~lF!oR zJj?uR8*=$J$9-l#b>#h(Hq#HZmlI+&(%;ylEql86U`kV>*4@E|eR-Pq8w39P_8p3S zM#l1le)+)VZW=LTpwDp*zO(&1Qs1}QKDqmh3e;Y8WWK%W{vwXl1e$szGC*`i#d-DFw+f*uRrOS7YWkl8T~sk8kS+){&0Hh zfFs0{;JCHfxK!_CjQCoUvN_(}i*~p%QQh(N@17ElPP{+CFh1e#cJChUG~Z)ZR8(?5 z_$mB2CJR|1h_EUlD;M593TZd;*J1p~{ix2rsjRffzp3s&Pv4{1v{SY{-H%wm`iRx9 z^nKr%cY}*c?($B*$8lMj;ggtpcY}+$`;_b#+CfyzYl{t;km$>e#YVqujoD zG%%zr-VN?VM%@WAOIY+HNbf++S$`|uHZ(xomGlnn=J$7LcU1H~%&)DFWc`ixs*h#; z&HThte>uOX_k(kOQSS%O`xD%YbAW$@%m(DY4);ba+z0;78Y1g$B`;X}3N`#N?@4Q@ z$baMg!-T32^B%<=y|29c;ek-@^F9dP1sM(I-42ICxzC&2op&P~30Ff#d3h`0C@A-N zGs?=l2#$erulHDZ7W^?h9gZVDPO=UWIdG>H@SU(|zNPDL%SAmAdvWYdf^x6-WGMG~ z6K`GRUhhL$Ka~5pr^0+z-y}ZAS<__QO}__{PI^Ch$!KdPe~G@{vt4u`?hj`};C_yO ztb2XL$wpcK`Y5&jhPr5X%su^{Qk$8*tiR~`TTdwKZ{5*97IuTo2AO%#3m>!mtY_)^n<@8* z&sTpJX!yim&mL7N?~^mtVqe$aSm*j!*5mX(@e|;i+*>T`Z?Bst$~v3I=SdpROGT~m z3|arubiuzE zfh*uIpsc_B44#ksuDtgG^~bp%{1)^t!u%og5?z0L9A2jRT+eT6cu||{v3EI?dz`O; zH^3|5N_Z9DBjx#OzT)iOc9{thQ8hnuW zSt}&|ZjkjhjlUb!owxq>vEHAskkgyDxaRBC{AN+BztBwb{##)T{uIuGx4{}t``r#D zKimN&Kimm>!k@ujkWq%_BUyjju;G`o?xy(=YCgPM^PzJ;xa8ko>-XOy>uuBz_X;%} z&^*e#PuAPezh9{O(40ni9)#oJL$Dk^j6YKT9^t*g^P7^-9wT1m-g?&G%OXKZxRVbc>OXQbxRW0s_kO=4=Q`1UhnvBj z@&eI+SMCQ#|6P5rTR!yt@8iFe>kpvR10O<3x0de*?{A)CK4pGrZqG@`LEJ}tly!pj zxn+h*4W4xWCFgauoiqLU-kopULc%Ze;&xrMQm%cr!*k@yvK~QwQS%hYFMGt8@=>El zPN!MoKWcA%#Mi5I`)(Q6HTdo=<}GF1VjZpGl*61@dPeY5@sIxhhlahR)uDYSUNs#v z3TtKQK;~6+jjO{G({0V$%(1HMcikBQ@;nbc2;#Ao^LzfN_2pZlQ7?R^=Mk8<3Cy2l zB*gb`esOF4K7T&tgE&6y9+%a7`!eUPkW-h8)<+h{8X~yutL_8qV9mx8+Kdp70ejy= z`H?gq@_gs_j0~4hv^QVpAjh&B-s`%a)L;Bvm{O}iab4$Y_5IE~mmQR!DE_A0@#n6p zZf8A*-K|=(FZw)A{pu_4j<(K&rrw+F{u^ICAWnMAuPpIP&sLsLU8|L7+lz+nsmZ83 zb^e*&`Zp%`QNA;?+Kb0xNke*U@`P^b-0#eo?C+d;V5#%hxiNJk<7u8O>6U6rH_g9F z3^6OAPpCxGx8w7#(oXW^d>%s6P1i7-DY0+roTjvQo92mIo+sA&)mI_Z)Wjn-;bera zt3Er*@3i?3=AIm_@6+GqO{`Y$komoJv8s91u>}ofwXsBU_JVK{`6}8ZFpT!ci)3F` z*yGjF250s+;6GO)*GB3ZBk{6KclF^0ZbYu;Y?$wY@WyydRu`+w8k;JaP8JuzdF1M7 zxTb+1Mcr$Wo%SyMJ=M`fG9ImLA|Yot#FEiD?yPiT_@46zi+@@lr0pjbC6bX=u2Tx$ z+aCDV)?We4Ps#J7z1ZCa=LCfBKYN__ju z?;NMv>G1lK`r9e%KDTrK&#le=-NYFL(VfS?qxf-b%wR5FPFjsH%nA$(xV(+I z%iB_Va&k)k?d|>xzDI1PZKq9b^mjFO=C`c+h@IfSepy_WqL=W?{xg@dMl(US=Nm)i6ee<-Yl zQ{f!wg>RbrGhM?Y{&@N`3E$DE55xWuNb5Y(jgMIxPe+Ja;~6sFujxj3j%JP0(C|Ri z$FOec#0%8;uY_aqmqKcefb`Z_hqz64O|zbHo1C{YhoN7i=25->XRH~Ob5^9Uci!qY zQR{crLHVwFSPvUu491|uM;hTu!Jpgoyp@6aB=rA-8cp+ScryGycnbU!p33__ zg3I7L@H8m#z8v$nSnWAS!|w+)%+q+t2yL!&ux0%>Unr6YRM;;5q}}_J?lNJ8{DevJx@9~wJ)y(VP#c8YS-S38|*XTJb`Tn)2@8ou%8&qHAb!vS4 zMAhr?$%#Lx^~QSClFm0nDJQo;$q%=-cz$Srd5C$Od7618Cy4Gb|6!IIJihiL*Yh>K z@g{Tr(V2hUQv6T#2fq7rH+?mnf%(lJ@I2`7jQDS3A9fD&kHPsynK$&$NA^**Z=TQ2 zoR>aeW5Sotr_pdDBa}KuOX8kK{K=O8((_6Fq1yLv{+}9Dp6`4rUZ-iO9c-C>t2Pv@8iQs%H|Bla*c_+gd(lbAB@Oo3l??@?kog zdealW{b_CNKX%p^H|;m=tocq!tWEQXEzcts5kKknS;}+f{J^I1e7stsXed9emg`Qs zzjrfvS^7oN&WTQk$MZU0tos}imC*(}TqSdRvG^j#_y4ASqBmPVGS*qae`~E{Rqt~1 za&x_Pndz8UnHB688fhME9%LS99$*eN_j64=_XAL`Px-c^*;oJVXzpm1^5fa^C^nBv zy?sIIuLl0wi&6JFYXI{G;$!gNE~@MKBixCZ1;1MS?u$-|tErPr`lRV~}}* zqKB{ti|^~XpOg|+L+q`$hQWK_{_rkH>sb6Vcp$tT9t3ZJ2g4iTa47E`0oOq03yN34 za<~$Xf)f7GP`+mjyb_LumqO+XiZ6uB7Zjfd4}p(C<_ie_dUlA)_pG-j!u#MPcs862 zmqF$Wicf}z!X=RTg5t%n0yaVB3pC!Q!(&l1Ur<~RXTrJgFc^V{Ly6Z}uo4~tkA_FW z!{AYH8ax^v3Yjk`o&=A9<6#(%fy@^amqX?Yiibl=Yw-b)`GVpha1NAotATsMTH=2I zjJoMK7yX@3Gha~Lw`ZN?r;_b^*8B6-((O^j$R}NTuCtggDBRFvJvV$9gNZAU&_WEjhZi`iHFl4G9tJUpI#xKG0q;1iJf zg1q0t6S4OoJPEasUS8gBdYmlt10{F&I7O)C0OsA%W0}kk@Ey88RP|Bk-HN-@;f?SN zxCWjHuZ7GPG!XUW?Ou5tBY-tL5NE!+j(0C$8p!X4mG;C65w+#22lw}9(m56FB0?_ZCE775RK z>sB}p{uEAvx526Kb~qE>0gr@t!Z7?9oCALj>)F z?}6Rmz0iWcf&cEl-ntL|6W$O11|NW*zz5-n@FDmfd>Fn1AAxVc-@;enqwpp87<>jk z4j+Y2zz5)y@K^9Dcqe=s-U6S2>)^9+4SWu+g3rU1@CA4!d=Xv>UxF9Fm*F|^6?i)Q z9b5)qg(tz+;0f^eZ~=TBCgB^DlWi#%#Tc|G_Wezu;%^EBG<|8om$z4c~_Ufv>|2@FmE! zRo=7EgpWb)0m*v^hTv~t7kF1;S7iPeCASym3AOygyjwBv25*7|@J3h&*TC*@73=|5 z!k+LlNTZo|0qh0Oft$nA;TG^@xFuWyd&7lrE7%0LhR4EfU_C4{jiN|lA9Gtat@j~a zVbKwV+i{1uv0T(JZzlGN;Z(@vaNc-W0>?l;B2U^c>d|FI*xwQHbwknbXBx}4an#GU zHu}?FF-nRGcS2T^^WAVe1M^*okKTp5(lZi$>7N)|^uqma+|Se2n|>U zzbc^phhM@$@b7R>_!-;_ehdf058>YMJ-8426CA>Kz7F?A{R$*}+V801{ub$n3^QdO ze18*l(es#l`Ymxd?zS>UsQt&X*dK*|8#atK$6&8F-wnIn8q3g#d)%t`+m(!Z#%R@9_F?LX$*U~ew$#dpo)J-rB59o!7_ zde{?n1LjY6yUB{Ff9tJA^m|}_tiC_N+_Ho#!5IRB^F_4(*t@nH?LX>5)bmkKK)nEt zh6|y@^CGxE>c#5*IP-YdT(~FtC&1m{64)1>2)BbLK}nyba0}EYtNT;TQ(bdmH}sdm z5Il`=6cCQ(sNcw^{fDo>GvEvGO!yc)3qFv4ws|h`cQ5L5;9U^4d3*i}^8(cCQJ+UV zuFXGR)EbY_T#5dLyr&!Qxd`=1s4sTiUxI!<`j?`AH2UO!P4CN5&q93#JPck5XTYmq z1-u#_0$1Wb5BJyL-`=RNg?qqNP||rd_IAs^j=6eC-|NjaZn&V9`?Xr`Z*a@~jY9Ip zPdKCEn6FcJH;G!m2b%r!Z|1Hq$NUyGzg5&~4$V^De;eE$-VV2bcffA&PAK{6XN0>e z`RC`T|CC4j58r^lgwMgdpv3##@QJ)%vC?1^J%awP;R6sg>2WW2G&$+<8z||4`bVa5 zzxg2McjY}GEczMtMSXkzL*{Q$OFBJFxYy=CB5DmcG;hM*qi{8R3|`QAUEpNINQ`0uW?|L}A87JMJR4c~A1!5!eg;5P6pxF!4=_JIF}Pg8#X0}a$0;Fn#< zz2x7&LKD6VE%*iu(XMo%oOD4wzsowSD?AqF!MR1p-Cd`Oqggxb%Bl*7%fEnGDuKW%CCcGZx4wUxECtA^ySZLA_!4asMHtZiL2 zB)@HEZSSg~)(^!{@+p<7mirRad+>cbz#U;Jl>E>amZI*5J(&;K5%s@9>#hEpq15jOK&jskgi`Mx z1f`xo7)rf997=v40Y?&!k#Hz1hlAiKxC5&zO}f!c358ueDjZ0i{EiS%0_`9f|dlJRY&Q0q5n ze#Ne13!SZQ2HxT-WQ_(H5Yb)^U!}6^E&trtcP#H2KajzgRj9x z_zGM{IHdm;w~Ri|BkLgnpN387OTL4B9z_zw0#^;mmkX`MYLE6`-O>IlkGGCf{o^@% z=HxTj=OODvYl-TgXq}AykS-?)DW6M~GOr~1FXW$MEmQmJxy4VyLHm!rz4K4AmZSa+ zYT?t?S=QWK2%ZU_hi7A7>RU)Va*lO@>aVcQg-=^6MD4Wy#4qi?s5Ral{fn&& zRsSOEGS$CWh(DJIc@OQs`op{={_K!WiBb5H|PoU(-byivqwrR-Y z{5Fhe=vSdGT@LDUe3y^&hUU-7KRy5L{2ATWbi23P%iTWc_Eon*1yc*oDR`jZse+Qi z-3t#YtSp?@{k0wiJ-_Oy-Z*j;((}~EHbtxE)gh`%WomiC7O>h^tf%eON7w<&7E^@D zRjbv3uE2xROnWWLE!{rTUNir8&NOfHJR;pFfB1suAdS-2&As6N*WKHA0O8JDpRA8n zvN`#OvL4=B(j~o~F((|2v&^@sx_?{WJqDXouqp0&%H>yTe@d41Y~Q-H@A#(XyLhBN zmW(*t5C*s9kGn2jUK^>J*BFa7Bpr7LwdF4R`{zfiBe8^U2SkqkAh%?E)D4P+#2A@d zc$~}?ZH#%lGII1MoI1zge%p_83(ulhQ?jWtl9Gm!imB1L`IjNzCFL1@?Z=Plh+&cI z%Hj>-x>ONMADgtNhO5Kz@>qRiED=e|Xu<8&+`=;|oD7f9HN3Ksk=pS5Xe>UtQTFY7 zd4isoJfXcUd$nojoA#-#Zt(8J)5J|iVMFJgCf=C68Z+6)QAuA-cBISQjTw73au-A= zB0rr?BGq&d+rM=r5FGm=(;8U7@4|B&v7B|zVe5_x0ZpG!tRR?DFA4D5ZfEyrqVxpq z8PUqP9=uA})9DtDjWk41N2*i$Q^HB9Ra1G1l@)nHFLWRxM-e^qNgCPrHI<(lryx?a z7g_fH0|yQoI%1YxZ4}O=Krlpypl_Br7EpM%YF6|W-AX) zKAut=OU9&8wiAmQs(d0n%5avoA0Bi!t+uJYvLPI;b6(kE|2^ogg7?{D!c~zGb(Kx^ z0bg2?M;i2JVkAi)B^h?VcLxo3V4rk(rc7|Ly1UxTlKx)447f2v;>rkpW!dLh_JNjt zuW8RT?K4|V{!Z+j9A^|Jb8iqb3M{#=T{X!kM&VnXQInK0%_Rr$DkW!Tua8{8Egch5 zehretFEh0P@k=xJ^`<&3AEq@?>?Kw~VG(k~sh(SZeaF6X8LwGlX&>>M7RCN4ulm6M zDhj}GDFxZ;6R+H4ANMg1si=)mgL-@4b8M$MAFa)HX`)A9Qym%aJ?M`QZ_j5cIg#lzK6ZxSNMe#OLaqs%`r9il_$ zbW%-k7O!rl{T3uYBz#kT)5ldL!^x(^$Z(u6?8{H9^@uy) zm+t$HLx4g;b>$OA$*+w1-0JPsF_zSj<;K{H`C+xL`HL*C7#PWKy zI?(w-4ET|e@bdIZ3f)rFfHs%opt zC?iS4vxFN{Z_j!CV50U@M(AKzKV=)1z3X4EU~ijR7kjd2czq$+O} zV&i>kj_qYOfA!R+^z&LRXBszJ|ITJnt}Zg$7iF_Ne6UZ9bfL0`5mx;PS7UHN{V zLHxApe})&f^ETY%n4jiLfMi`$;KiAQqj|m8uJovAjD+V^(3#QBsL#V3`x({V9MB{Q zRBQR8S-a&Iabq{d>juUniC7)|t5lmTUP`%1=ifS+){95O4P{N0QPzf&i*PkRn!t@% z=8TrfYMgYCC-iu$6K}0ANNmJnn0>2ZpKCBNp1#-0nIy0CuhKEE#GFqR|6~qUuGtK% zqZFQKuvcpu%OBpv`v_+5b#VqGd2);&5r~#CKFG1WOrl>gHBuu|+%kqgx(}wAT-_=0 z=zLZ?((A-3o`iA}n0NJAka{+2x%w}=H+HF}#&<8TV7P>%z2*2jkbkjvOW||o=hIc2 z(_)p0V8hwcYZZ4qoOF^W^kCw{jaU0uc^ zvQ)@f-rrKY?YYokXPIAVSAR!Vz?@-_H|le|Go&Aq84n`YPz$N1P@DVCn5iqTi#B@k zQ`*cwH+)XHuL#ef|BM|@%E=S@vh(w^{fJ?&$X-;l7SPO`o3%77(uQ0130G1s=CF(! zrqD-NZIzpz=M^r^{yJwv${4rRuf~zPqX7r*(+_6Ge;_@HU#2kS=AqW>d&izFYqgc^ zL`|gsDyyy>xFB5Tys(4*Bx>s&f291h+WrK?<2Y-3|3%PU=6B4EHOW>qUX6e4h&QJ; ztzb-rSX&7~o8w^j{aOpV?rfLS;?mcRXT)bG`Im}U`L6cFt3Q0=q|N!U_I+0>emQX< zPiUlNUuD`QCXHt9JI%5eyLN5j$}F6@2ccX$;Ie~GHm~Hmqij3V-kRNRx}&VOIiRpN zx7FBmAmsk<`C7bXgOdCehyGE4tf|MSTRLOY)upBkDD1+EH{$IRwC$F9OLqei1K$3q z(rX#(+=%oiTXpBek8zeM7LCv{)85>)FYG|9Y)mO1 zK?~?eCCoOKlyPLjN_J%9_{IcgI>#x;^U6-!P(Oisi%rqA{N>bMVg9PseYlP2$7Q1? zzr}0}n{Q{c?ow?JNQ ze|z#BhwA%Ush?UMN3>%-q+R{x;Cz5LPmu`Ei43fd%@+yz4b-Oo_-RbmFLdXFD1T*| zPSxZG?jN@ivhG|#-njdqq2W2w&1*zwk>#ihw>L7^QxoBa>dM%{vc{x0PbA}Yo=&@0 zN9z-*W!SDFThP9#dvP|CP>-7|`)ul*`vY}nveC<@UoJPpEljGx7C!xorpkKVIf6-% zU!Tn}k!sn0&kO|%B4VV+JTu-Sx`?lrU#`CU9?{YJ=RAGcY~%M&0`eoVmtii!11 zzx8|7oC!o3r$#d0?8b-d?^IU$GtH%~`98}LtzlRNbKZ=rfek8(~k%`prqxdPc zZG&pQ!7AN;&`^61qi{z(v?5C}$-=%k^7p89$2|S0DrR|PTqmG>bs6Bjv8ekNb`T|vgSU7Q?uIw8*-5IHNc6G>aCIyo^pCS7JeD-Aj zN16QM)+BeaMqN@dvx4tw;zY({K6gKudz3VprZjPAHsUNcjh;`*pTb65`CvoqPv3VF zC&{KLtE%3~+1_F)9q$ow-Ply$DD%rc{Z{Wu602JU>}%y&PhVT~d2~Nc`aRC1pO}}` z%jHBhk*27(?LzJMmET$Id)CU>($g&8IR4TcG3%N-zb0PomgyfiqAZBT=gCrGRhR>p ze72+GZksX&WZF;A(lyk$Tb7&)m7)#v*{ZUurav{rZKR%Qapv`^ zBtvUGnEuYH`Spnkwx2ldKw7^(9IuLrR{{S-S}g&qE^A0=bOinL%;g4oUv&CEM~YTc zqB0y$Bp201Xv5=iIUOV~;|b)0><-=iGGaeaj-CCe=~t-40I{d-Nc#JlqO$LMY$TCv zitC0T=Tb{f8 z(_&3kwWA_+(f}=*65~~iBw@U8$$1%HxYF*z4N)c+*z+)OPNbnKGB6ykjIzm7`zh(~ zNZaS8Fgfr}$I01rB>wW0%CBtpYop|zwB3N*gJ=wMEyM}EQA}>8@%s~%P1TXI@Ivu| z#U#hp0^Eo_9;#x${fzWZzqOgYIdS?bPQ*#MN;J~wi%-G)T0UYbO?@Puipqc-2zUQ- znA_0Qx9U>yBpnac?CN(9Jj6-yng;fU>t3Wlej>fy^NT4L;*nu!|1Rxc>blg%I?9i8 zotjoG+K=$rt7~EzOY&&rJni2G+7nM~LF!t#geFoXF8xICO>I|bgWXW6~2hc)4aWvQGl7MsQYH2Sx?$F!`DO}rFgDs3%ff%s3` zi&tyQ7D(^3Ig=pqWL1+l5fW(MQueg}TTvB{Hu53f#}d9kx~Ao!q)+6HVAonQkghUJ z;4%u?Iu_UO477)pQTDnfWAh>nYTB&5OfBF#xx($Ar}LkOwX4hAznl(59PyPrY4=rZUyo*SUp2>VpUYBz(PvIM8T{0f4tBb?~{rqg-B@Y* z(+&jcqipV|Wr!80IEnZ~e>`wR+u5<`<2@(eX5GUVZ83tzRr1XUwY|o2FFrabr{QDJr?L^`Rzp$TtU$wn?HC0^@`tKLu`Tc zfUxM+{bE0mF7>jn-I3E%tpy@bo-0PmFyG%qi6=aP^31j?xBHN2jEZ?6{62F=owf98 zVoh4nm5Swbc}d%I$CzIJ3%1jqTm&~i1=G=genH+4{BCJiGVZn2^?-CZ*yJi59cql} zQzx)q-;k)2NtUv)bcm(*;B{An{yMwRobA5Z;?viEsBj8|hOSvT_V*8^rLT$WHsf?7 z5y;OJyfWqqqmf{}o!T$0yRZ2`Bq6}BnUcB zmd*zO`>mN**GDP5f%-(tmlKyxO%y1vPQR5(&l7r;{?oBvCV@(ar`7p_P4_B?ISw+P z(-iLfY&zcR5^h5fX#XUAC3*B%N?oFfzdb+Pn#JiR1jh+Zy45hQ4%a2cN+6von`mqi z^5YEMWY-+q3$+(ZE9o0fYdx6`X6CUAXZN#YfM)eqhDGVA1lrT8IeL1FZlU((n&(^3 z+-r0;lb56elB}w7A}mn;rJL#=fU9a`SXUizM^GGhf%2I-9+L4(l{1xosJxeX*YRGz zJFqiBR=;G8kM%s}S7pn)%&Cfa7+D8f$ZwfljcG?*RzKqI3~Qhq2gc`a`<1aSnt892 zwr|bMWwy#0U~0dhnK{jubFF%UKlH=$^|w2&Z)U%qKHbzvqLKT=-4;dGyM5_EKR6Mu zLMu?uy8UC>2AZUu;w-=W9v#1Byyt)Oe(69x>_2y)F*P(Jn!WCz?;bjt;fqwWD>%X` zjLbOsgz|XlF|T}#@0iPohDA(HdUI!PdIakG*5oj#i$J~&oc}k1<2v_ThC6<0zCS;h zZ_=N`M2d7NynNF`-kvW1^*R}Vmadzn_34LCA177=`Z~WP`hkAo2>-l=mWmmeYX zPwH(j-nAc)Q3*QMg7tRhxkl^+;xl7@O1uc9TXop=H_)GL``nf5F7REx@quF@P(P6$ zWLI&sbaL89k$36(8%W2r981?c;IH;pC2#6FYdW5hr{XvW_(#EW4?(*A1^UOSaYcVI zPx~j^oSi%xloRRt6Nvu|`F&y~@SapY3Apo*M>I+T<=ly{l>9Jf-;*z#j+`>y7pT|# z{QwPdDZkU7M>AeFZ(4bIh111RDO^s84}@F#K^o@)|NZA1)&DH+bWD>)U-M2N9>_0a zQU@l*!(kcWZGS!NibW328{xmo{|S!Ef^r3d^IOf!r`wqhlm}mRuh9{FPf)I^^B$Fd z>aD5RUKq>hOr;bDINpVZ81`Nw3`^%A1AQTpMcBX^vg~VIXb*HnChl$&6uRYvUI9m2 z8s?RStE-*q3tewZ=Lc_J2?Mu=NL`t?C^fK()5nYw$rA2peOeQdOFYH zXXd|tn5Ez2*egxh7qys{_;j2IH%e~dcEM+uurSqzBxqmbSteR<;cuu7M zmOO7(@R#UI8X859<9<2~|HF=d+$Sd?4=fOhvr)BF{_QcIYtfd5qFUH)*4aNt58Gp8aNkTWj<>#7BH`Xb?`Fu z>*2+)0bU5b@HMJG$7*=QA5TAlzvrT+r8UojO{hRazVTEy?8^2KF_k4}t3*=rwjbBKRE|U8M zdC$c{eGlY*(@W((LG&*Zsy;M_;r|tIPk1HV8D6FSJSX=HYJ9FlU*hu`*biO{OW-P4 z3|GVL;B~MFUJo~eYj9rx*FqEC03|(c#C(JC6XO<5hjqqHZg}8!lAqV3|GarKe@QrR z5%T_9joV%GpQ^jtM6KTe&Hpp*Fn;cu->K$56SbN{^B?%~3-~GgC6xSh7x5aRT-*(% zeEbUik1_u>{1Dy)--Y+Wx8ZN#Tkt;k2S_>9^7H@;&94~`8V|YO3sFC8JmP*g?DLZG zsPS9Xe^gG}YCJ&fJud!eym|gTiCWVADJbRWX(;*Q8M)@hkVh`Oai}mRnho6UbO$#i zyg zAWP&dcX3#AiV7u?r8@~1&v5yb3V)XHHQNvF3}t1@kW6i=@Flz$-IhPTp0Q8fN9H`J z=NW!coy!wCj(NY9Prh}cVB0#QFcK7OO8^E-DB2M}sSPczu&Z6#a_5T=v6@*Aq|rt;R#<3BU==ho;106MGwTSV5$i%WhOTckBpXpU#+KF@HC5me04Pfw6}pKwVE# zXnss*-z?)a&3|R#N|k*S8Q2(3);cq0&PZ)@J~A^uJLh;x(NFuEwOC-ozwf<)sdabW zN6!gVBXO)M;w{1#h-KAB;1z|SdrHkBUUjU#M@rq~Xo#9e>IuhPIFgt>NbBKrxV&-G z4`)BV)Gs_ak2m{?Ynkr+hWGQ!`1||3ubeJ~JfQ)U?{8v%cwio^*}U40^7eE_{=w|e zF3bF`P3xkW@lo9rNzP*f2xl;BBCok{{sZ5t^8HcY;`BuejuKcUw-!c4T+Pz+FrfnaYGM~j?1DXBw z>^r{tfA4}>+NIc&`CQMwP)z%xQ{w7Mgz!Z0v-iNLivtzDBm#(&Vr2Aif6zv za0(m?CqSe!7mtJE;23xaEQjOaL2v@xA2O;f-VaWKd&9}F3{HW&!$aXNa4PH%E8q@r z8u3^JnV;48oPmCC)H7kPZih*Fl@xS4+@Eesw?lOVgM-iWB@Y<+pX9GKk78bVThfd9 z+2z97%zys@ecUhWgSv`&eIcQ0&8{o1=e*>Yu6evb&&vma5N|dD*4Ca1ZhCTw?|93NeSM z&oj$NU=fdl0T`UHhw0cSpTi-+#T#&l0}tWnOk^A^Ol< zg1fb-3sB#Hdb_+Ejdg@;8}xqyw}7b4!n~VgzP6|f>h*;0KV5GYwT2IxUvyo|46S3I z`B~O))|$7W{|fr#H@^Q4<4(-w`ypzbpVfRM^Rq8t?-%eX_)GXWWPa9s2;L1PKAE2- z{J++DSyA7EzNE{&s{b3~K35GjeePHN2bh_4)KJrj`C0tY`B_yzg8qHH=eO`K_$a&s zJ_aQ}Jg)YiFrIYPkoo?#=2NP_)_fZM_1J%g_ej2aR`s7Vo_E!d?|9L80X`02CjJV# zy(HB5gXS9CzXGp@zk?USSK)c^HFz%kJveUtc|i~5hS621i` zf4z;pW4gX$ys!D{PsX3!_rmR@+`o(dP5JNfmxSkiA^GhC<1eoHhwAPlQEPaiIjif( z#;30NCu;szQL8yLXYl^d;GytyI2Qg59t8gmB|raza7%vv0=1OeFQJs%f5MaC|G|^t zzo3-&uZY(T8@?84c3NLRtuOwAdMjfCDyN=-#D{5yv>vsD8ZKz=-L;FEr}|xmst?WG z30FSs2fM*-VFCW+5gUc5f8S-T*&RxL?t#9fe^1nRp--c!@!t#ePf>4eN;yZ3m%Ey~Vg6ib zfUxK(?2EcEZ+Ei{wUqxoh`;}I9VlvzKWILPJsaK)2f^Fmp72Jv7hDMk!;3?EoBQC; z3e?a%6%K*N!+l{K?gwk(P#A{8;B>e@91jnG!{LE&|Ik6^!T7f?YG{_h;ZW+e5m4%- zk#JY^%dsclKMKnCjz+%(^%%G{97{Y(|L4c3-?V7|;Y;uk_#_+;AAl3!J#Zqt9ZrHb z!pU$YoB}U`hr%=ARCqG1fQ#WYcr2U_YvBxdG@J>i!^7YNcsLvdXTf3c2v`P>gi`L0 zf>NH2hW*i>4Y!BKz#ABHvpDyP~d!U(<_-z`w&e@FQ3QrM;{rAA~5EQP>5} zMgM)w=fOY2I`|f>hi||J_&SWiS79UZXy9%wlzv0pH2OSgCd?$}Qhp%yRFgR${oi6s z_<*_4T%h(Anu~BJPcxUnC(YADt@(Pn=Ihf%y@TWfNB?Z|Ow~WjT%r1B3-RY1A@5mh zo~!=Q{^QTSq4QWkD<*m%SCGYjTzvgX`UzR^Be{TM{`IqNkm;dwp2lHRfe<%OT ze7da$PkJDlKDQ{VjJ|u^x6ibv`-xE48oCTPWK<V_sXVZ zF=kAB^-jCXXL{ec>)FA%`Qz?SPlsqf{K;Gw4X*RcA!`4pZMtX8JCV^=y|C$?wfG`C zd%G3f51q=8&FkSne$4KlPuKB^8OB`7S!(}$nRm?0-7_*FH~+Go`$&DOc*#gcp3r#H zUeaoprW3cK#Ein);8v8@cEPm1`=eb_7T-1sUy^O*9lfo+eRnJqp~EFsH@-jRoxe$? z(dgX#$vAJ3@(jPUf9>nQ$HfOR z{-6I`lrMJKvXoo=rp`xso^`+e$34hzm*e{xzzg! zjszjOEPVhX$MTwSe%j}qob-|>bY}-Lt<+9&{zdg1K&ds7(^hicxDGY95!lCY()e&G zot0?=`+UP*;KU9hvKx?c9rIU~0}7iMcG_1N+Yc%$yinZMxdL0}+CRkv;{k;?6L5A= zwKWfh{M<;qbRyd$KMg%L#E z$`wW!>$B9scYa=NxP+s<*9Hw;q^Iu}O|7 z)ryoHEVohIvspZ4ckc?)s`lDaX@^>kU-!IZ@I2s7ZMmB=WtwvziCA>*jcxTk&N0kp z_r~fzgI3ai7xBCmbN_mPSnb_{{oT=TV_hnvJuYhIPv*IX9ozIzB@`#vnJCYu`! zR=e!7tGTW@C)RNr2wZ~mS8{^t$*?!AhRfA7~LN%X`s*M{LU=jopZlwKk>cobkP1qJM7uPdr;SE=#9{|8xbGD zX_#-L9(AL+Z8;w;+=JTNonPu{+UIrPQ#Ypke;+P4ZF~NvS-p|{p3&pneALu|$nD5| zsrByrf9Us|_T@X9k0Un8GqDRD`I%Bre4piv)VTThhjxFZwqxmxn;}BE?7u*cyv!eF zwx9o-@*1|0cu1$ycP4MWXJ$A$EH6569%qyM_RRSG-pX&+`O0*D&Dbw0pQ!!Dw7D}I zJL11bzI&j&`S-g?@Pl&6W&fJ)JJb2z^mmEA?jsBM=ie9Bl7A{MyuX;H{cCxDllsE3 z?M(X_`%lCu5Wdttg+TcH`wrCSfWH~*+xvGIzu}6?Uys-$#n_j6W=0- zyikvk`(F^;caIDdo^$}R?Wa|dj#{sEiu{=CjIPGD&Hi0wT%dZDMx`;0AIHW7BsuR- z9PP_I)ILa`-V+JcnQm7jBX@O5&rzj+XWG41ZKiFfO$Xw`F6_;|78x!(@;mK=_g6pF zO}mi4O8H6u6Msv5YKd5$k~@$dbFH4=7aJlMps%qC`QAS@SBZKvQ$r=^+U4yIcVbX} z4bmkrFS^uW@da>K)Mvs0uKsRplspaTG1x0P3F$GA^R?=ZbL`iueDA1vt=zWDnPf*_ z-ot4IecxW3`!^YzqAofHb5Fk|vTKp^@I%%9%q;d<4M&c^fwD`5Bf_hNoZ((Aqcz+O zm)$}|;tulOks{Z-XdG(D8S&L3-M&Z#1GVX zJRJS5eBUf+!6VQw!Td^ea1@*a zC0^)V6R#@YTjMo~zQpTXjn{c1*IVNiE;W#|6w~)K2=zS>SrCmP&ztwFd~el9ja=r{ zNN6(5KfxrFcxZwWfAirV(O&@n02jj7;Uf4dTnwLujG}q(YLz4N1U!N8JP4OSiT@L^ zcfWCx$cG``ml`L#;ewQh)gs@! z9k98f;?wwms%Uo7HYUyk&e{G~EQ2K!ZO>2J!F?9HwB;_) z1MA&_{h{b*&btTlVYB&5_X>5r(a(^U-B&$$>+-2`<836Wj#M_)46Ki(?tz#5m9AD& z_9F}1+^^KS9OVN2POhl8H_1n~S!axJBcRRNOHww1+QsZY9a`9%QC6gESu(ioU4_k9JQLCJ4sIGupHmxjnn7}Q{On(R;Suw-$5Uz zbf-@E*zRp&He&vh5iRrd4SA&e^5iTxyYt3zPCyLfM5~{1ycPVn&>E_G+ahagiPgt+ z%pXBEsEm59<|dRYk-~QgJ*`ZaODy^4>8+rLC;wLP?`(cNeUD-@ZTs|;`Dy&M52K~D zJ;&el?_DrUyA*pO57e_S6w|)wl(@R?_aYB;2{$%5@<5NbL>{QvG)js#lX#H+wyNov z^*2tijDA~fc7m8A4|IveY##DJ)tqskvUu~&mRJKA$Mt}_!Fx8e}o1OB_`5^Es* zC#2Rd{yVhcXK)bw3uL!p@%xbRT=AbEty|ISaBtMVgS@}^MK}btxZ4+sKl{OFA*HDJ zDM&6aehktZD}E4?+tmGm@IKV!;^JS!gW+9pIFxXYfbtz9;m^@$JXd@>90hNIqv1`E z@m%qZJr9xbT=5#nc#d!#BKI{FuZH6Z_tn^g#h3S-Ah%nn8e+c0VmybtCDvqkBb=i4 zmROAEiZ4bz6`l(#;8}1QTn?whQy}BH;w5k)E&@K{&^8P64O2NSReGM+2$4V&QRknx=6rv*^* z6XQ9}KZ~H`pT$t}597Jw?(lfn1)c!^(}U6jzk(;iFX2g~&tDvd>J`Xa z{R!%Gk+)jnsF(eS(VY0dyvO;>9XaI=Qtp;m7cw3^rN>45CHnfFrN!_O#%IDydH+KE zV?4+B{&KxfD1q8DZ;2~$zdfTl%!}q`vCnvtar$*~PZM%wmsrpYV{eVRTdVgpiMt#0 zy*F}GlTmaeYG_u#b#Oeq366m4;lc1`ctDR6tXtqPcq`lw{hz{p;B9a)^um1y>Vc^5 zidlcu)hudL*A$NHJMjq{t#-@kq4^Z>4opNgzsX^ABE?^$8f(j?jJ{; zMEwMe!6#ugdQ_ilc9mHe{2$7`b2`Wu?B7rtS<4qt|Uz}>UBgUFpd!Fm(@+fn}! z-UQ!*l3s7aRjA+5cu;wuYW`>RFGc@d+;2`e-a|bB_4}xM;ok?S_bfc#`VbB%Ji+=1 z_Q(7$a0mD?+zx&MCEorD-$VT=?l;4~&orL@W_+&i{hRT3^n0QYHGcnrx(DhnP%kT3 zVtomhz<)x?cmD^IsQ;zzzcRjd&4qK(|2M3H|ADjM23P@^&d~g7!b4D7DpxaPc0n!X z!V$15JOJjYyul?_KI&~yi#*WHVFBy`3!w!?9_UxydWihbqA$BGv5*H^^f^Rre$=g( z$o(w(Giv04mb}?*3sGyjLGu;#*)@Y)&n4DYsP96JJWzGN4f+M>BM;QP0)6TaQ}Xq; zs4qml9h7w09-e_(KABkKu>>}t&&$jjSPEyuzHkQY2PeWEq2!DHQ1Zo2Q1Z*p zQ1ZtvQ1ZjBupIjX;4ruw90YfVyF%oFnmfROaBElwdq5kSP~?GrnNRxHk$$9699MGcU@fVuMLgay(QFtDl4bO+u;RSFKybz9r7s37D#c&|J z1n!#W$OG+<8hN1R_V98j^#<}lwZ6C#ZjJs`yjQ;eYWI6rqTe0$HPC|B!Y{inu~xy4 z;cECNcpZEVUJqY_YvAK>ExZrj0Dlf|gzMo?;A*%IUIA}{7r^!K40tm<3El$d!&_lJ z{3)!4x4|Rf?Qkl*1CD`rLMi7zgHkX293FuFFW_MKODOf&T~O+=yP?!$zk)XAzlHa5P};Re zp|o?4L21_>hf>cyfqzo(K8afDr>CIQPftUM|7YOo`1>sO^04PpnlLunUZKwsL$ z7d3yrY`&!J(#z&6=u5i@&BL+(JJelKzlwSb)UToLg8KKUZx1c8UWe=88&LWwe}Gc| zzX>HD{t-(3^%j(PcpFMR{0@}%^-oaR*FQsPci)B5&b|kwU40))yZQl?_VPn0{lAZ( zw6lMK(yo3Cr5*hQO8)vQyq0i%3NMA9L8+fVhv%aH8(aqe4yE1w2bA{q3n=aFmv9N@ z|AY%d|2F>*Ho$+u8u%4F27XO^gp7Zi{~`a&xJ)=Uw81o~ugXJ)1yvuCUX~Sd)sS@T zVs&-ZkaC`9<-2M~dGBTwxN1nbFSNS5YDoF-VKKN?|DpB|HiJ@M^ny}fY!0Q}*#b&^ zu_cuDw>Ol0y%m&vy)~44y$w7tbi7prhrvFu9BvDxKfN84{`B@@4vXOdkWQ`k!%Hmb z-|t|R^1af(huXjIi+X#bpS2_5mHs^>KKffb>-c9Uq1JoQ92DBc8ld{S3RNGPyO18c z!4kMTlzMs({E_*EfvBavMmozW=nbc?c)><$Z@(eC7DJXO~rJiv($NH`kU&+qg*AnHczSp81M|EiY# z{Z2mw@?A~LK8w93=AxZ`2}Hd>`@K>x)Bn|UUxdFh&Rh&-ym}mza&WxW(t71O>ly1k zYkcUQ(Dq&Gx?I&|VYh3#-QR8df)xcH6yy~SEu2w!PvPf<-Mb&q{eFgv!(n_tw((K^0M!Cg7v+XH$o3hp3o+_Asa0ng4LkLIy4nxVXQO2# z>0H>Wf-$aEUyRVD8&P*nWYx8rvuh>FZjL+-e-^DX5tZbl}+^lUkp8W*RJUSllU;9lW7 z{;(f+d^CNVxRI+I_VoR>ZaT7p)p~qn|E@)`resrPB(>h_iT^P6!#mUd?~@C8g(V+q zgf6n|w@rJO{{^{_b{~@tcnoP{QECb~ST6O2Z0(S0L5`LC1afhxUxoo9njvn53kx?w zut1>8#o%QTwM>;(W*c#C(|)0i;MxzXK*@*A!g~V(B{PD4R|kTgdD6X|@+IwMR_pO> zFSYFBJ)x6}5jwfp$_R0syg6EOXKVFR_Hvl9|36g-@roH3c|w0S?Hx?}hb4c~-n@;R zLdFgXrR;7xaw`hVjHv(HMl{dO^SLKdvXlvgM*d0pl2Vj}a&*0vvXBxsiAjunQii!> zH)569FSqd}Eefv8_zI>sM@VXKeEvzD5ApKOxR(5J+UFV4N{U>tggu?%>)1#`1a+i3 zr9UN{Oh)1jsV0w=NqIsqbReSJC859CD4dDpi4IHX&yq^kG)>J&W>4RdKp^8vGqoXV zYP6vy8Ec3njNMe<-5+OX?^ijOB`2hNW$d8#1N*DW!x=K7uwv}qlE3NxONN`XLgLB@ zEeqM(h3wy2_Kz+5Ez{o0w9jcZMLO}ih9ySf0>j_dbYwtJcUZP2N;!)#T^6xw_*+Ee z#A$Wx{Ra*lG<3u)`!l2PPm&qNVj)H$lt#^Sl(2ibbwSS#v=r?M#zM1jp4ka`vVFHk z$RtU}Bw7xz3JUvKcq5fqT9T=+o6w=8lh!ruYjgRiH}d*b?RkC2zOq-Sps-s=Gvqfd zw{tPCO88%;=LB-7r&ITvwK(odmw%OKG&T|wslrjj`fCL+O@42D`_S5XU9ZVd|99ng z*72AZu9WzSsD?-;=F;_Mz!0-?@iim7jXwE>PCe-yVr+66B;TNG(|u-}?laqTpBddU zf4{>khwl7FdhTi*!l)9eD@ATp2g+S?K~y?_8TCT*aZUTn@f>D7~U-Z2hKJ59Qv9ZPiSDuujcu*UH)XqQAl}4m~=hQ_rgv0 zZs|2y#v!?-SG~;QX9~k{r0_{Usnvdr%COM;BxkcoS{Io;F;>ZaRjNIEMvM-Z*YBDU zs|wde7f0f%E8*lB#80dKXLw;dZ^KQF`DwlcNYnN?}i6ov}=V=|U5-B8PCEneT}u7$P)A(!S?>Z|1Z}U8J!#*05-LGFlf+GN<5rIx@HLlJVTi-1TQx zj{Z!pm=sG!=eR9I%Tb$SzM2w=(dU>FC7CkESvlsbAL_k~etBO0?3U}gxzk8Q8)IGp z%rT!y|GtV_5aVGtR5{MeHCunrT6oFBIrfir-$GMkT`XMPSl3h&O)co;xPKwzo26)t z&8>Vn>5!<4R!0)Gu?6X*9lkOCwIUZ~|Bdk{J&7`Q;zTDbIhMnTI*6#4SmAw9j`_=p zpL(|2xE{%Vn;hDS`uZxbMimc?w&fLPZ={>uqm*O()KO|=+0iS0S>~ynPfsnyWe-oZ zK9Wet9@xrojThDWeG}#P#A>hY{R+?Z^NM^e%d{2u4p-{s0w)@IW_<=9^Ml3pPH^Ne9bw+n0%eq0k@D_KT-H($?aSGaVZ0@0JPr2Cn}o8{B**ZojA&SPZAqx47YQi%`Nw~za_Rx-JA`#*2BWQ8o!6=cZB=$J5F3+ZWqMUdzkXRs3Xicm6 z$iJPg`L&oEvDr;G+BtiD!>qQ;W`+d+qV8rr+19&ASE!rNakdrtR^eGZ9YSEUj&ECB z=kcbfo%P^7aG&nJcygSankyP^_@BKOE5~vyJB*#_{^eLljrDun~1v!G;k+*R(Ff=OHO-9ZWs4#LDdqn0R6Z%uW)Jh*UiLor8Pz!%XLYq zop(5JpMEei{+q`yJFATY#eQr3KW7KFEt|C}!wD|XP5o6?T{&<;xXyWD2mMLZ);s=4 z`P``RIL_LhUuyk3=Ej=h4e~85wm)9|;`%c|7C9=MgJlwgHrw|s?rhinw75(^#WUiw zll)7?t9(~`;x+hPE$)kKB|frzS1NuVwIm=$=mE?A+O&^0?e(2sP_q>^`)Z^0&C33b zdVx*hD>@Lw+;&z^Zex3_J>Im(co*W0;)wsK%}-U7*J*h~+m`}9)7>py zKzq{Rd-Ax6zV+;HKkQy#_h9CMhGiW^F87@f9K zj%^&@R{ucHb4g!fM}D%li%vfxb?&RAb$g@A$LY)ovh8_VYd_t6N3@z*@2!(_L+x?z z+t+9(Ynr0fWgPRv=?ZaAeR@U*(j|NErKS588!3rV@?;HN5V@N%P6s5jk1hdfvp@O& z?41c<6xI2_XD0V@D53^6#ejGqWCum@pehgqkwYZlt+>f9$wIOlcQ-)1FTAbws`q{0 zw^pmwszp4iShb$CwpRaMtyis8TlxRKH#0l4vqzF8YPA_ietB=+d-LYayN~b7+K*LO zKcH^68(-_@Dc{kn%85Zax-Xl8?ejsIFIx2J>^%KN)4W+X57Et8y19Xz^qI;CNRBaa za50aMjC9Y{>=iEbfqqgkXLn~kZ=BDG>?)TdRnmWz10a@`PWh`tZB3`n%ICFozB2M467sFG1t-SrL0`Zgb zl6M}qfIn+EmGxffzLtc0y8NPkIPp6wG~StlC^;jZvv$z5O^K8{4o@{T1sBb&ueY}l zO$>(<%vVoh52T7czc%M5XT9z8Lw$borl;dR_dK~ZNRk!SNHEzRiG*cZ(>p=6c2+!k zNAIRuui`sR?!kA;JU4AsR`U^9Eqly&;HO}_G9%ucG($_m@>9>OJ8v9Ijaj*U&$O1$WLdC5mIe6$mUnGisVw;prfy!e2A`sVBJ4ExlSnqJ zxi`^is?u7j=Sf%!n{gKY_=Px^E|-FjoJdQTT4qMTz@-~7d;yvta5pF-o5JbH{}9p95yU-lBGH^I(tVnl_CG00h~Ef3)HI5VnvF{NYxIz89MU_PoF+( z>B+Z~-DRLBLy#t#%CJ!EiX<7Ijw$)xHxJR+(b^hGMPpVk zUKY386LHxSYJWx43CP!Uze9!xxwU@geed}RxueGAuJ;^zyt>ePg%*S#m+M_p3{|T)ueP1KF7k>&i_x{?>eq?CTVJ zu7UE)bD#a1V&hMD?|w&hU&dV?e>wLrijzT^?s$^yN6fOf_XBF$fK2!7?-PqGd-lm% z_P+1u-Or~SsA|Q1KhOTW-2OfL?vw*x_}+b1>b_4tY9ToX%Du<~^rYL&P`k)uLp&V9 zZe+dOmtIUjuxXk}2$2t?W$!ok%Z+V!g&PEu92yB*UsKciXFj*hPF8KLOnZ6*^VAfs z&t9qJ5~sfMIoqx7A?~?+_g#5~)@{EYa!bA<_k8sa z@=`1hzVO_0K6ZG%_^0=otMQ7PV6xfADl@@Jk(SWnXgsk;yOM)thvUl+8FJagiSIeo zrO{+66ifO1Wt{&Of4=YP-Onwz{rQk|o+8zU+AJ^kcjU)?jqbOzj^01t^S$SfBzXV# za?iJ@yIJKe`&^0b&X-@(Q^3A@*J=mT=RfT57u8SkEMrWJb$TWR?eKl|eWCL+%7;%L zcF}t0edX2@O)Fx)=lJ7gY!~NgC!#BR zDf+Zi=-5u6k2~h`yF!l%1v2Wb znFN_Fs@WOt40nLcf~j~oflz^JeFi(ZUA<|-N zY9L*Wnjw(Yx|;Ribhr+j0oQ_b@@fKb7Oa3&#x44}dEw50vjZ^wG+Lyx$jn7t8g7SxmU8 zQu2ycaUJd((c8BH-=A6X6NR)w73X1(|7Alkx1hK06wGwwmQ`EkW$SBE6@E+QLXBlv zm46`lXNBI19=3308-IztdJcNwmh0!Czf9P!^qd`{^s?_wxQ=~3F2>)wXs_pf^{gE3 z4<)?Ss}B>s_2`dVp+kLF+#R9(9VvS2l|T3sT{~KoWmHe#KGb)H$HMWIPw20sW~IMgf0p~_V%BZ_^%7s_`RC(*IrlHX-&**)koUO>^F`QS zUvaVMsaN0O623!A<)va)-v{cKR9vB54$p&E;_poSLG*nr*RO&Di1*dpUsUmgehpl} z{cB+eUI!0=*F$;!4e)w+BmVjmkDF9{Z_#d6?{SNEEB5`chx(SdyA5*y^X-@)E5Ad# zi|0RFzCynfJ^(T6ca`6*-G})W%=Zxg>&ovHvx+~|FT?(qw)^`DuZr*rheI@n}VUA!=J|-QNzC-ohA5roAjrJ(vNdAL*2zQUc{o&(qANX51NBqNC@Chj2 zafN!nC$*<+vrxY0)5`uC?RT~rs_*)&vVTrnX`7+?zRxTB-)k?}X5sEU=S5f#UxGWq zKS0S>FDv)2Xs_C4_>(f;^EG9^LVq3makzhj=SaR>rR@Kx{mC{%-sjKSn{Xfa7U}zF z^tiOCkC1 zE7|3*?tiWP{aeiHeW3n8**7TJv+l1}_c7Y-9YlZE3f+Krz!G>JEQOcCGI&WvgSy3?E&NG(u8sKw%!A-Da2RuLl>v_2GfA8aBWoa5mh4@X85qL(E%Z-Uv#0tifK&BblE68|y=r-mH!F zTI{7fLVXzShhdidGaU1qr7QGJFqdK;f%!Ddo5JJaX7I?;&GnJIe<$WGUc-LZP8lnFJRvYpMp*BF&Kuwf)RKpTmWx{&G35I0vC}!QFt-t zh45Us2%dp{Gyly*2tzFECGrFW2?(vCybjxWYc z`>!u0-KG79l%r1lFx9^~RH*U~)Q?5m;gQPz2%)lvdMEKa3bwb^ z*3RdUa(kVAv$DTIzaIWozd_8Z9N(zQ@l9e@>22BHrr)CMZ`JQq_O}TM=XN2_S)t#d z!lC^qoHt7D((mQ|n+`}>snm-_vj|cQ$;a}Pli1|VNA{ z<8mh?^6JalDAS#qQxZ95kwjQ&SsB*FeMceHW|{83Gd)-n<+-eLjW2!&$a)gMI`S*M zU*-GPTczGB9UqTeb7#MjXNJSGr7yj%;p`!$=PK6^R{zylB42P{S|0glcj?x9_vy{b zl%}sX@Dvsg{=MqW+C@HF&+~nj+`6B3nQ!{^Z%I;1`6`&+_P#B@o+f6H3j51lKNVX4 zbE+%}nK{ZX%6)qKSoh?dPmn+}^3@MZo=1IF{M+57OtVi;yH5_eCvog`UORW~n3ay! zQb!l^jM^NXU^^A(U#%N^GkB5VsC8yDYs zo9$NCR#2?$_|m0Y;iT8IgUOC|IUeLhEIXaM72dS2djJHRpWV%zd9QCTz4YOK+g2YPRbp0pQZ|(5KOXjQGK0~XLBq;K@I&2a1_*xuI(w~v%bIE*6 z;qTu)dG(Veu%4HD?@Oi2z62%lDk8k}elsVqH3&zQnO+D-?Q?U&k@-va`~3Li`dj^4 z**_JTW^Zmy4?)rbPLt*wbSfw6<+yY*5=?6WCT->v_ucdFud@?=f*}EGB|94CwYpjL zzo5UDGZC)x-Udt!nWsmK?|L}>1(7JxlVgTi5i-wLDtXV>184eF@)jStq9jFSr7)?wTmwHB}BOa$K6RpVO%eBtzb2_d{=BjrYfP$>DxM4G z=h<`79)|uWacG}QE98Er60uY}Io{OK#(8e0u+^pZ=@js{fw;JLrVt+mBJ56;7ffW+pq6q@mo}xU2AN`9!CRWAfdyHR%4X(GVk12QZc7=kzLmr~15B`Ecib961{9{2WS@Q=w=qlBnaP{L)TsbNspP zU3ckuytD`F0i*MMHz)t*DSy(BaGw)uZ?8*+V&TU4QngFY*#&3qyK~(+lZfFUhY;04 zR)5j`guN_x@@9E1>2Ylj@||CP?swN3tk?B8Z4Kp0 z4%V&o7@#9_w)h6JCq0)Rf>6m`lkeE3l2`lA+UZ32*cKR!E!_n)2#AelFQS(@y*3Rl8gqB)o(l~A| zxh|uf6g_XYE;uuZG-h$2AuB;$%omwEXy&%Ex36o_lw<5Q)*xM|lAN{w|BT!}b$+lL z@_wYh=;>g7?{fau&5VybKd!Pv@p8d@=Nk*1V^L4?<>Nj%cA4MBJuhH?mqD5L?Q;N# zQ^>T>wO?69k;%*X8+V)P8F>G9BtcoEyr&C%=hx{ z15^=I^Ym`~WnZ6)V-EX#a^#e(uo0Qh$-hs`N*2F7w2XZ_;>7p-bh@kc05`rF`wGOL zuiRMU#Ps^U=9f#CmS5&eC+|AG1nZaU=UMMoxBc<8@&RiPvVYZ$Ztu%=^W{I!IRPtP z8w%VA_|GLM{bHW`+4AF59eg7!_8mEm+n@8a) z^WPTSbA3vSOXQrX`-p5&thuKDD1+S=HJ3wH*J>_?tP<3m z59{DLFbIDRO?WyS15bfl!4n|6Q)-TbW8smI*@WuFa9hj?$n$IB{dbhpP&KWP-KRAz za0eKH<8gm5?jY`eDq3Zf8RBk~!7iVg1K}=kUpN8IgA<`VcM{waviqcFI%F4zdM>+- z)cZ|=Q?Z{4>mjFdc_(#kw@KqRvzlRIqGjI`n61KwM zLPpCqzk%#RuXzZ@;r*~3-U|C7*Oa$tR1U(^2btmBknu- z&R4=i?fh~W_LpKl9A4P(2+7Yw&*^uhH(wvKF{Y!LBs`*@lq9X96Zgj=-)$)Q`8ede z36DpNPwb>Vq%ZFoK$055<6cpr4YX^O`@iOJe*@vI zUVWozML%W;ZwvL;ad)%wr{tSei@#gdb8pjb=ed8t4E1N=9q>_jC+@59e;4LoV!j*R z6WG$Y2i^tmg?C_oAG{U*65b4*ct1e+hW0D%LBd&|aD?kodp)G=f2}=&`(?O)7#PJ15n+L%|u3W%BSq2!yXbaCG2MecuHHOhDiegyvj--0j0SE^ps zUV*=duaTb5U=Q`j;p^~W_y&9cu7Y>NKf>GKpKyO2d=vB4Re#q0YUkI#kY9J~_m-Gd zK8DCg8)du=2azuC;C^`3NaO$DhE-b{?<)VJjQ6;|Htyb6@A0AbfqKsmwZCD%7WPoZ z>+hHcV*Uv8m6fB6kKrZo6DaxMQ+PJ!&y@dvXrJ5ng(qYGPk1E!f^Y^9&c84>VEz(H z{`m?{!~C`KujHGl`~Sgy7wo@*+rZWM?~i{Cxi#xm>LSmqdJy&o><=;PWtF9R1?JTi zql_}-^L$xRE@qW3Q2zw`O61}6Bb+MCFJKPX{`+Acz+TFoXg*#&&2DgR7q2!lMpyZbkQ1Z*Ba5VQfgPXw3;YM%^I0%k} zm2gY=O*!p9{2Y#ke}i@KEf|EaK@+ZoW8iYQ6?_%e)quhjMuxn`=rm2eR}AGX4CVH@tsdEXf3IOaIKn(xw%z0@0rC^>jZk#9!* znAB6)OT7VAenGw&^7m-}F>i(cC74SwBi~H_b1CgVd=(xFr9L?fN_}!TlzQd}DD}#b zQ0kGR;5~$MG+c?lW1!R{$3m$`j)PLq91o>FSq7#4H~}ul{fY1)coLNQ-RtcclG?E8qq2VR#`tzf{RLt3HcxF2;N!yaXNvFNGcOGAQNrau~yW z1#E;@!hPUXa3;JO?pA8aH=B(4TFm3&bx`WR>!H+pH^6PNzmfRL``%=~-_6*M#(WFu zQ$qUOius=4@AD1eiOV8UIBjzFM#*M zGvNd9B#3-7{V4b#?0^r!R`_e!1RsX`!$;tr@HcQ*_$ZWm;I``^N?;c_VT z)DuwZsTEM_sV8BO`%l3w;L~tJ^7k{a2J`RWdhl5&_5X9Ehm5;cV*Zfc=kxF#T8rPq zx8Mu#^Rkh~i%|MIFG1<=`~lttUxxRI^jzH3#$It8<;oHR_TA_ zdr1EaQa}7j|1-PYM0Z4`C_%8}0;Rjj7nu+WiW`wJ|HBVenOrz%IL4cq5UVE z$)y90LEPW1bSzT~&fq4e*!fRZmq8u{e@wHPNFpBZ}Tho$4oI?MiA_Mfsb<@Z;-UQtuIU*#>8 zpH=p&+Ole=Dl;%UaC+d9zypC*fp-I+1}65K)i2a9*6-MUwHlW@Z)C~i6ICSfm?hXR z9&2Uv=bzvF(aH&2N75s`ZuI@j_j^F%!}{snIhUChv!_RNEfzk`C;QP7{EMZ<~0i{DnI zhAeI@G;ik)w?_tUA>w2CDY#F_w-4Oh1Cf%gp-x&Txk~!v^7YB(im;qDQ1o@pV&$+@8J;+KPN08mxt&yNLr9U;ozUtPr*c@%w zuEO!m$b0s$W$0n^9wZs8!c*s?8ly3DfvvbJJOcZI2B{Eo*IdJ)zE5lyGsAu`J&Le zus56Zx_m=s-hKI{-E&~9Pd;Fue85mDXMLMHANR=zboM)Eoh#^*51835b-$kJlMk5a zG;^0XkFC{AOv|dzt*sDgAweD=o_ zs{Ud(-bae+d^H}K?@6-xd&M~*?({$RiZ_K?qlZQk%2wjZHHM#p;b#P4+Nq~$Q^a%6 z(=SsGtCMI1wPSJN{b=R+)sP-;KL7E_sVlNR@aU1YGSB4V@{KCT)~W7JPcGE7NkxXI zq$`LXTsySw2}d{CCj4I}hi|wcFQ}E&80J~Jxmq)iFE~-yi_&*Hv_P!)r0@3RAe6jB zJ2RI-ez!81Pa3K93chvW>Cxh)@2O~*$19n8$LoP3zIT~>R)mHa=3qzC-XJ9HvHDT$ z{8h$&U2nm<$euqsS2w@V%wq~Be=labgcev-e5ULE@pvbL`K9Z9YM=c0xZn$SmES^i zIYm@LZTdWr%t(beq8n95b!(ZalH{wx6yZQpOi4m%v;JI2P#w(n$HW0v_O-PzSH86BMJ10y4z(b9 zD%K?HNcPvtyFTFeH@BsutuYpgwpx$;DUZvau9o}@^}Gh2XHE$*ZY5OvEX(h+u@Rvfsw>Lh zB5cEYhZv?NOjf&Iuq|IteW+dJcdq>D%rob%hx_DXHbvT%=zg^h91JxoS^kl__E4(D zQ%$LJ!EQa~$mWVHjWl(nLXE8v^%3|rLH_9OclaLUV-6&GzVWEUI7hsHSo+KI_FD_* z|EMh+Ke$)C6}fMTh||axIe$m<#%x_EmI^k8nifUE9nRcmk^LGsJX=n6kM|QK7j?G8 zZEj!^R>0<2EBJv;vF$MF0N`gNg=Js@1{bv^@2H3 zQ{iR5XSdcZ92H~Ebf7k0LhE^X%PsdnZCVP(;wfKc!z1SP=5yl7)RJhslXWCyt;qUu zE|rjo+~}N_inc~m=+?ATdB5V~+ikhRMdpXR@_c6$7vJ_sLK+AJ?@}UT5x+L0qV*ZH zvZf0#mM%YkEIDa=z3W%2w6J5!syM zN2gzvwSUDCjbV*rN8{h^HaK#stQ8m0hea{?pOm+IujB&q!R>314|2#0Wo<*Ipk;j{ z!rxJ2uG*R{`?Y0iSO%XmH9QT|JYxzJ<-+*UBumbi!wLcz<Pa-B zin-7UW#3cQJ3K?GowMH>zx|X(@{(u{EfKGxJ)Ze6`SidP~>+M!UUaPCqgwo@fiD zTSP0uvX7*2Jzo`)smGL9@!GP)JlZfn=TylW6oNeU zkGZREQo{eNam38z&{=^mmRTL;bU76n>N5k&++dQ%BBN7PG;#h~LZ?eQS=J#r*=(|e zwm0eZ;O(Kw(txu75RwIeZaXC8MmldzJX7`rbQtaVyo&N@*%DwcYTDK?qoGUSwEC-brHcq@lIxxDKfOA>UOyR9#0^Q`Cl=ELmzOePF* zs?~Po-gYScq0IO4himnR@{Yr;ez=H=3Ss@VawX{&RY?CXHl_9BQ_f6t^lWoNnj=v(up=Mgc`h zhO^P(N_igrgo}I7B7E0HQuB8~=J^iZP3hNQw@j%)>1*=97_`Qj+UOudiSS`#r}NOy>waQj;_ajS2?G z>|l=30-M@Xj(OJy3(ULao*%Lzk~h2_&!<@74FhhK?#y%d>0>YhqnJ3h&SPon7=(2$ zX$oQ&rm^{=nOO_FCm?GrZb>=sYunF>$5WXh%RW!*`|Un^*Qt{eQ8qVtT}YeU z-Wp0RVD6$$R?(x@f~0tpE69)gUDM@*?NgEgg3gAjFt62I*A@?3y&p{rDc@Sj{+c;X zGdI@E^;HEjg$0b6MxBh>_Fyx-`a>p{t?_UjgIl!)PwqD}I8GUL<7Ka3=umTphW09> z&fJRuyhw3K1{&lMbot~e3H9mQ$T@`0nx~*&AoD2J%)(MqxSckwPu~VBzd_kXi}p~F zd!Mkfm0iBw0+1o!Mcl}FR!;%(>Km6kB1zkGJ4d~kRFw)^OC!!kA2|(MXN%#oP6Ro#(p1h z;Y&BEc_Q|v8x_D{`R)3*ZzaPrf8nvuy}!oZ_aaW!ILr+vxBIO9I9c+~viHA8;9Rm! z?uk#=`&z_3*HHQ8#w*uYSzP$P11*icPea|!(x;H#PvZNo><_U#Y$kA@TSzXA@}Sxe z*FE2PdNdVuwqGI+J2O0cU$UmD_9}aytY5C2o9&aqq-+RtIt2YQ!)>$Y|E>Oj8z1u3 zJhfD)`U$T6ylF&Jg7D=-X;|6n*(jTsI_17EKc$>~P95oePT^=sIx2FQo6A=&`t+4} z_Hj!3_`X}%?g#km3(q-V@s(8{w8^Qp)@WlQlu(}uT?}0A_hq>yWPQuvq)1C>aWtOT zL+uB5@{jMkXPj%4pnUgxP2WguMl^l%lj^jI6+>VBmOcmNuNN0DNN8`L+R$49!*MBcWtEu^IYL98@9-M~Z^(W0u&mN)9nr(0 z?hmxx)m$4`rH>?|UkSH_m%>r-0!Zs$a}KP7XF^6x)h9y}^YM^yYmNzQBfXHCBOxQk znnU4OxCAn4u1??%*2DtiL=THH!y>beHUT>IObOPNL8EUtDz56 z#k~0oy&$jatnBGmRY_jeDlWr4!-^9`el%^si9)&*6=z_N|7AlkFGU~9v6z>j52e~N zFI!*hRN)_7b*RjGs{9MdzpM1a=|~<>bp(Hjy?V}|eei!29kaRcXt*al2F`@X!rkC; za56j|PJqkcPVfY{BRmm~gXm`&G!~u=$G}ry9XyqE*c6_IxfT+C^n$#u--jLu;TcMA z#m_a&)q}b3*yrQ9_*+-|g>oOr;r;@`TfO>1?IPR_=53*_izD*k27lhS$KqLnnUMDSa2$Yc~-7Iy_G}h}z;t zWq*@)Gwzq;9wI;c4gD5nf2(#I_LpK05fOd6b_eG3Fhk6DYIos&Ey9DC@7C_&{-NB5 z#QR?L{t|B|9>3&%2j=_X!pdK155O>dkoP+Xd#LXPAHqBf{u=Z2%7?W_?fmfw`QzX! zrH@7B8|={+vPypp4j|r-%PcwT!E^F++QCqCmVUJ$d257ftE z{}SO;5zZeluZQ_%+y5)rS7QGv_VS+OGyT(Yi1~f^2K+Nz1z&-GgwMl2!4>dL_-puQ zDCzhYcsJ&^;KItcMK25K`L^~B&y)0o>N)=hZ^YfZ@KX35JO{oHPl6x7!{CST5coIP z4F3)ff*--T@ME|K`~>a>KZO(EXK*|C4>%Tn4!45;geLp~j)wn&o4_xL-%$7!TpxZ7 z<$M2|`|Fnf2f^#|oxjmm+vy5b{h(ogK$R}_59w_P$sZ+pxze+-N-tIZ%EYX`2h<0a zSLgxzexH(gQG+Dh2_J?1WtWVz@5u%eD3N^^vD9?V#|$vTA(;?(bVRM5yc``YJZmH?qx8-?^+tr_iYTP~Wy} zs7@r68S10UYV~2Z8S0yq4c9lZ%~0QzKwYd;gymeTVZ|}^VV=W{>Nf3%sXK2z`P@7>CcSEJPh+s;RbLgDEV|}DCKe&IJk6zK8g1m$o+{h z05MZe>-AkROF5kkrJQ0W9#iz)xUZK^6;}VJg!Uiv)QV~P49rq~cPBrLub3`ol^-DK zPWul>!&z_>xCh(-&W8Ue*;DkeRR5juAo?k2|KaO!E_@!&gHOP{;3IHvcsJY!-U#=F zm%;tug(a3gmS12#0Q2eaKq&RdK~Up_KnlDCO%=cslln!QsBiQh$V19&l%cKZ^ZS3)BA41C2-TM8?{$Bka_>F$Am{mEuPnEM@idnt4W&fc5fU^IU z{;;xtP)Ilr33(3fzY1rSn5%zL@`(Nz_b)8@jZocx)V?p~_i_I?G|)K;>d#@8_6ZX1^ZH6<|GfTt?4`Ye z#N$Q%1!e!DYR~sAdr3&W{|7~B2b}LA`dB1Cy$Yqj_ZpOZ_qv`>KgO;`L&@mUqe`DF z-K{KCc23#XBW%rNbl46{`F$~l<0J^zc98S+T5ofAmh8`*MHEbAAm*AKK%eW_H%ibWXwMO z0Dbxa`t$>+#p&R@X$`4Rsv|im#4Mi7)OOJx`Sr~7=?8H86VfhqznF{k!G+^aD6DvZTvdFTc{`g&h4(&q}K2%(k^Ja-ygK zuuikc`m8$)W0|;5KY%2`cdj2`*W$isUb$XViVLq#-vB$loISa<_SP?RUSkx6oT*N; zIf5Jxwt%nk0&F+1&%#_=MI;tYqPVY%8<-Jt9*F_Yf-xS zBa_#km8fJuzvTXZ+midg;wXWsHn~TY;wMYSe)m*B^@ebcthg2w)1gh2uh#Q^RC+(1 zlLw~d3&%QlwU=zI6v1;zQ%-|Sjl|@%NhF-MpB<6|H8DrbpT-KjTqQ58L2`Dh#~juI zdn0{=BX?3$#`7G0bZQFMo#=XK!;c6}$R{>tE^b7iQAWK}SRcU7^42~79!<1JiIDR# z2x4k+;aK|uldT*{;I!`&H^8k4FXw!C&U1BhIC7ne$0AAg&=vGIyCc!m5=usryX1>+ z&hTw{Ug^iU@hoy&kmRIMtXT=zue;s?|xS|QiN4xIZN-;bpl(1aMb?X zUI<6+|8>GCGM)PL6>tj5uUEZKU%|Jpui!nq|NNF=E;YImx&0={=27k^&_y&!iT4Yu@I>jsiF#GwXp!|JeR|iSN7xSWFTOJ+QFlYletfx6 z6Xv>3eAU-_rLmA*;Xh!_w<8 zjQDpwU!!T$v)jN9aQhrlM_;L#1nL^?-`(kGbL5`WlLi7ct^!K8J~; zq2?IJP@_$Dyowy(XPirO`goFL^NUNjZk~U2pER#GpVKFg9^E1yB^9J?k@+IyJhl6^ z{(JQ&jOAT(j#r&_uRes*jYy()5{H0Mcw+8>po-Q|XOZn?lNFkqGDX%4>GRZ1NaKqu z4}J3a`{eU`g;w^-=cgRG>%57`;%HK-!9WR9Gc!L*u0m#g5u6-v>S#mO&>Y)wvTm=f z#*8r?A5t(iZMHq0+}$uyfj3+?f3^lgmVA2+a_lZpIw%?$Tgm9GR~JQO+|-1aT9LzU zvSm@0kGhtS?Hxv{=$J!wa|1_Kb~UoHIb}n5BK@W7iE)`+ZDP16S}84K=VwgVs#I8WmAYAREjTe>V;Z8%-}W`Gsy?AgThoU+n$GE>C@EKChYAyK=R?AI_=?({o_Vgo*msW-5`m znyC_*&OXKN*vLvw7a1UMVeSWJ zvLCO(*Y<}w#jxftCrg%Eo1e_~xp(AP=Pk$9x|7>w_>swn&buy`9v@lqvqyKcp7YBG z=A^n@CD*P&&j0R~!`BlD8HMZfJ~_de%h>da@>I_`Yo>2oPViy!{m5^9@_9)GGaOlL zhEbT+6lsaHBI`}lIC5y)9~w!-5m%EoCql7sysdxQ%#k*+5HnXmeyQ+6k>va_n#{Ah zm10^xXJ|nLX`G8A!6eg>;>CSld#Y`z-CyGS1XX=0TY z^?kd?9N0+7?Q@^!i2rQ2gsJhI5%Ms?9qJ9&4m4@jXd8{$Aut$eVB*dVCp+GWNK*t^ zrAjY?gohB(tz}zCuFgS{#!nX68fo8`nsxRvTc7+|`4B_omn~PfPkwDWpY_SFrD|wt z6CJcD^R-0&&TnFJ#gTlf<~b>M+ft4vQVCd^32PDFJI$EPPpvsxqgx#_YAMm?NG(vS zid~#Zf>dCrrVW>T=N52l3~b9?3^s?B1}!1b8j_*pDw)o6a+U2q`L$GfNh&sU-%uTE zo03>=vSx^*{XxsG-CS~k`(nA*slG$GuGN|G$yjfZTXIgt6W?yjuU$9OU!OeJ%=GA! z=bE&%v{Tf*`DxbfxljPpAZgzAU7 z{=*?VTs01L?Yk}aSoIHGfBDZ>*w69BFJr&EI2kOz-0;%-pnd)_*3rew2ATe>_5buf zTWfy96Rx$N7eBu5;@PJv0cO<;-u+G|;6QdG~W>r@LR%QSNb&D^$oL-jHCP(6sMnG!W&;9rhRF>&8c z54e>fz9^%Xh0w53Cu5E_Ef8kg?nYyR=29&XmnVAq$s#X^tLS+H%e(x3-l)-@HT?gc zGR{?Yw;=m#rE#-v-A^EKZZ^{IX6VzAl{ZbFf@Hl+pW`sEOouiGiGlKO4FBr*$#iSE zJU0FGBh!C%@R!I>cHFNd%*=nAbI*N_xD)xwj(efp9fr+N+tz+#mKY69GnI`g+mHUCVyPCjSD~*wKSjyp+ zP=}-7e+I5JD4#W7Lds{&=aBMQ{WoZ0eh(6E%{v1v`N?lVPQBFp2{Joe^9I}&_b=lP z*1Ry#lAkPQ%4f}UkW-_$UuoiHAk z-IyugHMhe_@D|9a7WF>VN9z69#Z_}7_MCFAxfXKTr{+qy8@vp18jJX@GAWvI z1nvjh;Qp`~9srx*f$(5>5Ihjhhx@^U;XD|Eb6_Lf12)0wFbsEv5jY7hfIGuxDBraO z?f|23Yq$`OhEy8rd$+yU6OUWP{@ zr+Gv2`O(N}79N9~<|nNC<&VSTG_Cv*cszUvE`#^O6L5DAJQ1_-BzVVwlQn9`p*IgW zMX1UTEWc*JX~|yy8_&Wn$2!9UGgJ;6C;92lgcs4u{o&%48=fcC_FW?e* z9&Cr_!-enyxM09F+J&$YUIY(<7sGwvC9nZr3TMH~;52wSoD8pk6X2C_JiH2ygIB|` z@LIbZ!t%NS*K60oE#M8dJtQ4&(r$z!;LWx@EdL4dy9I6lZ-wi@+u$I0JM0hdfEDmg zSOV{Y-}GN;+zrQKz6Xwj_rme;J~#pX5>AHq!)fpVI1By?HoynrKJX!U5d1Z4gb%|7 z@DaEL{0*#wkHQh~F?a`j9DYSSehdErm&1?X6Yzbw0=^BOgm1#9;2ZF1_$qt`z65^< zpM%fBr{Qz(3Ahse20jlTfWL=#!x!K!@I`nndYv4a%HT>Kzum7a{ zN%{T4F1P>U{$TEZ2?xTjU;us%%izDE2LA)U?zhtT27Uoo!_Od{vGTt|9li$*_!caI ze}bj(HCP5;gyryASOK4amGDtm1%Cwt@Lt#t-U0i=oB9n9dC5bs?l(}V>H%1O1^3s6 zm%u^rLbwh*4-STB!*$^)a6NcDM1FGl5wIF|!Xa=m+yExvhPrmb5bCpyFgIeZfznPQ z{I~o-%tPURkVurzgSBu^I1J8&!{Jo837iB+Ah&bJew&KitXC6=CH_3M*cnRzcMdSa+7Cp zzZv_r=pD8w`>2weEdG$6jK4)nZt`Hv$WO-HCUTRJOHcc+%yA_*`O_-ef6Tgeh)NfE zA16LZW#1w4lkwjna+8r~ztVvE^Y~i=msfQv`N@yKLrISZu!s7c@G#6b!ox9NS9OHQ zNmlvkNb=K%fuqE%@)<<_FYQ0<$NLM_q5PkxpKsq6UWok#@LYHy@u(yo7h#TLz8FT~B`^Xnh5N(H;M~f~MP73C zY|K}{=@7F%x$-KJlU%(s=Br7s?JKVlvq~?hkHP*ro>ReduE)F%<{NDPH)3Co{Y}`* zcc9#;{B#TEk1A;Y;k)oQ_y)WkN_>!?tpB0nPW^7ec^><_;O`)2;(3pbykr&6d+q07 zCg1#0*^6^f~;pY^Cu}_1*ua zf1%33zw|H3Z&EKn{bTNb1>b>RL#ZeJ4d1~0AGo|~wf+r!1TrP3>I6y62P;I*(EUJNVX*{~9x4y)jCFaVE){otXnKU@kKWTOvZr7;jD;aWUD2G@oQ z;2ihBhVQ?NC4yVISXz$AKKLYdVWy~$W-^Zn!1>O0`kOXx>N0>B5Uj>zKMh-hF9MsO;e}CE6HcE87eyms=ZSZ8M~N zZewg~n<3?NoUxs4hLqRsjU8+=q}=XkjJM5DKcbZOUpYAG7px*u{(90>=MvF>HX6f9HxjzQ;T$_0L{V^5@<#hP!=W z1nvu^z1a^+d$T{3cIW^o?aqNv+L?o(v@`Rev@ZukXgQ&K3!&@C2bMH<0pvl5vW%KUt{kp}rpR zJ{9(dr$OmwozC-0=r{fhmclczuj2mCVL3b#8t^Rm4W;^Q_#b!<{0crxJfz?G3qu?7 zxpBU69{dDefW729IOGH4LgOOa49S-l8<#3~wExNa^nizNj`%^{?E9| zxKi0)Wn7E>d8JniDZke!N_iIhNac0L4az<3zj9CekGojejmAxw|3Z9)pBT3pH^Wu% z7WjYgR`@x*9rx0%LE7s(jC+;+UB;d86XPy1tM>bD(s%pHd&I2L*RsFgxKG*t(s)qW z-!CMb2ZTI_@xKa(@ju~gS@DqZ2={{(zZRL+PeN_GJe5a=gNAlS-Q2Oz|gOVSgHQafBU6afDt!XEh zyi+o+^n}vON?$JhSH*^vsmgaNCsZ9!6|ee3)t6Np2Id9M2wWJrI`COQ>o>UHcKurV z9oYYw0bdWOkwDyaGsFfqEox;eaZt1jJ4%LeGAz@bS_ech6o)Xw%4wag@Ub@2U0yv2 z8)dr73U9N_`&KxJGGqZGh>myU8gd-0u1SO_i%V&qyzjw&i#liXp}dJ!Tll^ceM>KG zdOf30uffy^=jU2&;j5(KU`a=_BbhLhjnSC7AQVlY9=+Cy7W~JQcA{+>Y%k9Q$04U!TFwUHQu`S3q=s$J0X32&2ew*vBGz zl5JrEgfpqQ_*jW7dO_{5iVP>z+?-F>1 z+Y^tj3(If|A>*>$6(U+4WUs3vOQT~egly7*X z46TWfAxAEt$O@lLcQHbjRHPlr3A84D=R3ICgQ%L%DA}UV=z-sU&$2~(66xa&^C(B^ z=n+UArN^tTUFCPr>*eJkmZnrLy~5Q~g&x-RVjT+$^@A(kG`h znoLQ$7TI6*?EkcK^f3|`_1|GRw=+3nhouOL9EV;I1Kz3yB7W(GL|_Aca`x9%xndgy z_uXM(XfXv76$~(a$dpr@Se6dnaz@BR}Of~S;Q7v`4m5sF{gZXNvT*4 zp=%)Bfrxp$W_D`kV$G;y=7xjJWc5H&Oi4m%v;JI2P#v`7l5DM5+1J*>{PoA|mUt>I zn~cq5XRK*jY(d+8Se_Xsh+epLW+@1J5(3aN=)bYhy>7FBC0@ zd=q;-Wz~Cbyk|yI$h1#|?tUd5QU$2pl(;>t<3n z|M6cSS98teH@?JP!Dp@QgZ@(rY$AirK zw^B_tN)?rR_+d5T6wJv|I&;-q&Uydb^Aoc|vG|-wGmTcF)9FG&1PV;^D}oj%aIYb|N0`Xi8c2VL-W`99bM`jmyF2@tECq zCC52|1)O6^21AX>cxy*0Qr8|zwRoBxwcps|pQF!>@ukcNa$qwRYHYP819`?;>baJF zLZ=?YN}Z3^t@*2#5Q~l85jiw_*l6%9{eNnm+nI^laW1&_j zc+-ai$ei(wXkm<`$V>;)|HZowmnJb^dN@BGlf3NY^Q$ zwrFc+{ksL>=d3rK@;f=&Bn2gekV~mKWiaQC<9s){H-Vqba`eNJ|C>FYYEMKKL=q9D zQ1$!ME4xcpy4wA2=R4(YceCVgXMdjp;RL6)#v4Peo}kltyvTYi6={vMx5Q(e9jRz5 zH84#o(Ur`@OL_Q$8^c0yKu@RdJLqu|ktx+v1=QGP@iMfTG& z&b_;}g2wq@F3$s(wl_HvN`sB@c!~jL$kW{}c7AlGE4RRU`uaT9t!vb*V^WR(BtBfj z`6<|sny6I5T5@B0K7LmF3o_&+*yr1wv?;Q^%oT2{Of5^lvm5Wzr{C4n_DMb{vY!!l zbgs>kKnmrLtai^Us=@3?wALjeYL3EflO;$gH*WrAP9Z^q8;S)xY?Z9|vP4;nV=fuL z6#o9*)9+g3xXSxdP8Ltct6=)%u9yDj^q*y}ll=Jf>h34Gp-?%=oe#Q}_hRR^v0deV z-@I0D>wVzlrCcSCt-+c=o{c2tX}LuZ=XUN{pg^i(uDS7D*(4KZi*z*i)N$ZQd68}8 zSE27U-R?P|`|@rQ|D?w?y`LUAUrOXITWf+M#opS2BfEesQTej`*U46i zc9!-U)pB5yGReXqip-cK8AoIb)}LARxYKpA=BG#F->t9haZu2$x0~XzR49t})4KLV zd}$|gRJ`t8cj@{)?E!~e5`Mw>Sv{ayM|pu2D{G$FjhBBrYkIq?Z=Kd@T*5&|>p}MO zyQe3i$o525BCYO|(_2)jplPz-H!~eXPKa8}R9|RB)_q?;m=S(`YqZ@-pW1xxt@Y7{ z&;r_B+;DPNu97c$KR=txHS>(zMYY%>-l-O`Q!2O1*0cmGMN&eRV4pA+1&+!6xV>@G z$l(%M0k^aX+MDR`U|(JKo2?zG$Q0r#RDW3ROj$E;6h*M^U%_x=-I7qN^}sa@2icQW zIFf&R6d%i5*Ym=K-(z9CLzZ@UG~s3D+w6SFl#x}NHdq_fB??`R$L!~;TG;ky+MJ6Z zV9^8RP0wBmFP*OPUfoGoZ~Vkd-u+n4{Al;yE1kZ-G$d55n{z*Y47Tx5&TAk&Ju3%D!63S!Z&`&%@8-=r*%>9efo|8==Hq3ytMmu4 zll^mUzqcp*L#zX6dGou~FLZhYc*Y!&Eq{drm*LX-rQsb?H z{TjQz^XorZu98J7d1MXJ<-eg_l6?bm$-GLzbjYJ01<50Fl`PZEwRQ9CHAsz~RALhg zj{Vc4{qLqm&7=CH_=kH{zDqAgb}i3g$R@2vLN++_+vF6~6m}R!Fx#U&V?H0V%XQwY z`3-kUr-AdiQFP162epS&CCzK_MZ2|GGOPvm7O|c7CF9P5`Ou2LNB>Byqm^;jAm#7d z(~Gi0SMe%1KD6fT3%*yk#zFph9%ue3*{7c+(5Ih8vZ(AwEu^32C)Ryy7Ex_LZR}XU zKB{>f&S$<1jUD2^J|91AkA{xK0y%TQ_LSC0BE)=!?Pwiwl)m49R-if2=9ZKt2VHG< z-F^11Qzx@wI5X^O@u%)Hu`Kf!k<2Hn`{{7!uyUMvUn&X?kf#>J6K!>}%g1X+t^|Nd&iSJ2xPVYy;az=)!WqvcgoQjB(F`4dUKS5A_ahlxTgsyy2 zk<$`6miXBu)8Cv(dpwb!!G>sC2RS05OsXMqtdm{h}s{H_mV2jEYm(;T_yX}<=U2?Zim;bw(VH~D&N_1=;f3m zdnF>FHuUMJy;qh)+0X5HQ0Bhx^rk%)6JimyFI1(&><)x2M6At`yDp||&nD5V@O<(# ztc?@lV3Q>a)Y}>F( zBH2IUN!KN4FA92}sNT<;j?`U}iW_G7n>fjt;AUZlS`B&n8Q~%ZB9@A#I-Qpf2czLb zIwBmph_p3E!eQhnggR0!S?ST#wm^yx3BW#PpHq2)HbH*5>6c?4Ct0{P{n!wqFk(Tm zY6`W7&;g?MdJ=?cH{5WV+fj|(#%Ew&yGaVJs_)(VO^e%-4SYzeT)6gap+r+$qT~zD z&dcFoEU7-bKRoBYum1KPhmZd5~Ql?tnxfrXY-^(ZjYY+t*^ea z_Hnw8z@?StRD0>ZUq@8-Z;OzVjzmNfz{!|ue%y5@?V`iXPs z(nJ#Jr1aI7_P$@L>WB(0Tq~it-zUuOe3iN)?Wif<98;%SaN^5Pd~ce)5QRJKLjuau zch(+X5=pRWoLvxt(Fzw0g$RxPdXd%O3OEwmyWLbEF{Uptz1H&7ze(3FU_ z^CHg6V&(g;t{g7+Wbj03G<@H63a8~bZzp1jtQK`$3E%x5jZx%trQ(Yss?y<>?|ym% zgOw{ZO~o(Mzl3O=N2HzJ*=eUUX8bys6<@?pstOT%Q6@2#Fv%g)8e(EoM^%;iQ!TJ9 zr&@gJlHRbO_M5uT^^|L?s-V`DFXT*TSn~s}`>72L^>k3PzB79fyQ^fpPiDKPk~By+CTArjB;i>RA0bUp?w^ zXSMqyBrrD}t-fh}JhmX(jAB}~Y12_@D=w{h$-?d%>StMLK8F)uEmo(dGbo-5`+Z~L!F!K!r$!Kv+`^Gc5-p7ue2n$G9O)k&z)knGfQOl4j>T71ntBXb0 zN+BQH$)CP-XF`a8df5(>6r`*-bZ}|6?tJx%*Ig{WM0!9twCjFx@9WpJ$@tBZHy2g~ z!WX}WNiv<`ZK5O)E?;?;k*C#tOt#CmB!B!p_Zc3v(5s1esFtKw9J}e}y0gd9DpZ{K z`ZJ4VCDv@7-Tc!JX_))Uk|95)`bBMIr~P-D!SGlTsqu_Pn* zcp^BJal7;$oNlx~Tx-?M+9sPTJw5%02CG1**kzStZ~stQ`sRcjLi02dzWhwV3!?8j z8u7KWG7eVXIH)B1@q+5aay*e$KRWJgsgh2X@uj;P9_~Xl0>1p>z0coHtDTkaU3YX_ z+v8DZ8ZW!vcH+hOPsT9L08h=kyWh(V&v9p`u5X;>x>J2cr7(bFwqH7!!9z=VeLr{&()E?C(;Y*n>R1H{fvkt)Dh zUv*$y-oUS?ky37VpzR9LmoAK!Qi*6I5(&cdy*iPT6Si7BR>B)0zufe;IxYFtC;RIM z+r2dqkf8F9KY1HwTaxLTmUp%1h{T^S-^$$0A}TuGzFFoZm`hsBw1uV(5XWwOTa)&C z``SPGzVdn01W#+SgTI|H?3%^uCiv?g>$}O+j|dN?tKj=ine$z;Yn0bgz1YmxQT3!7 z&CKHpmh=jFk*xYF!=dz4eC=t|0y%ak-9qV9FsGf*DlMg+y2R)YD;ztljM zg4SSDJ6|*G^G8%Hf4=f*?U{AXi~bkrzgF#6#y(KdBS<#or6ehG-)DY4mQpXM`UP43 zX}%VP<4a=9L)nS}DRlgOdrS9sT_VyMHX(pi>lG z#>L`~OO4+$;wAf#|NHe7O8?S*?fk_@y(GVU_3SK-ksB~UMVbgdM~P<;yL~?G1fWJog1?w;_C-xL|mNs#wqT+vhCkj59gKx@*V2^ z_N6Q3JuR0)#n{*HNRK~#?OL>e+z1tpuRfX?YL|oQlrAN5#$F$HKcF-ms>iFwiP`c5 z{N=;_tV|fG^ZRys_ZPb1wn^P6*IM$+wP(CBPi+PE*{gXpaq9c-6TS02a^Lq|bIfzQ z@(RSgFQ3%YE?MW{Xgv&g5my!r3Da;NS4zWUvgx6M6Ye`V^fdsrTP&!Ylr zu-accJYRWCkDo@!eK-EH+GFL>;G{@PXmK>2*hAHWPP^gD&l&P()q;a&pYl? zN#ZN#R(kyp>KXT?6ZOj!HKLQYNYZyle%#O1{r1XMOW+@e`sGvk+e@!JBze5w|E_KE zg;8%E;u}}0@{-x9vj!i&a^(#o*K_>x)U9$r?}j64u|>g9IBZSBpyS({KF&S~2B5J> zYtUI-t7~EzFg=B$o~LQQLk8MYS^t)64=TH5+A?hkKbDJj_L0rk4$}75_S5#&_R;2X zem&Fg9L&$8?PeffM*hvP|7E(hT-K#syLY$5PBe`>HqQ`d=D*?GbDv|mt4+HXv)mo( zv9Vuw=m}^qeu@bgUAd4CJ4}0;iR0tYx{3Wj+rIiRv~OarSq$lYRmUK$xU#49s#$1k zA@_%d(O&Ec54~nj$*iM36K$T%n&{K4aLT7ZMnUD1AfvnTT_B^a^6`+><%;d#)|iE3 z;aFoEIo&uki1uQr;tR|FpS?4IkD|IC_{=T@5w%l> z5>}FI+}#jRs-mLxzH7Bw@2d5_>wRCr8SeN>s_NkGa09ppTo>*M2f@8yHQXCU;aK>Y z`J9}Vs`@7!2mcD2c+U^a@p6jk#46GW*1pY+<&zBKBvHevUt$mGa8<8Cx&l={g``8@ z=iz>av8*rlrocYNR86PbxoMqBTjL8!_vefmyvNPl#QvP>OP(3E*WkXH2K@@#zok)J zcX5xpa1I@K?k^N|?fICy`lWamoSoq zBkmyK&NJFjAB`HCOCSsU=3?_%gDE|;2ObW)(O&>FupM?mH-1!Q_>fo>3N26Ch?Q>gamn(agK&_wot=?=1%6h#`&s$o>286_n$v!d zU04S%gpw{7!C~-waD8|&To+yfhr;i}{_s)_|2g9_;uA%EIsBCLxdKW)T#3DZa(nT0 zn*Mr!vBu*EPQF}&{>|pKQeM%&PDsA}(74etzh2$lAZm37&A%Bp8Miv-H>>$AqE>Tg z{s~`hgCD@#p_H3DNKYyEcfvmKF7)5W{BHOz{1JQ`-UELL?}cx``{3)4a-!eO18m@U z#dy$o$a!Cg`eEY{=e^;u7mUY@M^*nZ<8db)AoiXRe>DAE|DHlE`TaDM@8uaN<>JTO zN7UDlhl}zYDvYt_GH$KBh?^FlGT%36M(Rb|YtR`-1@7y~A8@9cC}+=J7t4?5zxw-n zHYK_R@>6I0_sUrvEBTX8|CQY1Q#dZo%N!Y8B;Ca88r9ePhGarwmF2Z+`N_vm%14K6 z^2o%x=%V)|v|m?{UlZI5rm}h-DR@rF?xN>~zBc*SI$4UBndYoDLuZ<0iBMjGXRQ3m z$D>F(73|}ms-ls?_b*LYnLoZBrB8fQVBRI4==il%{9|4JtCmMkkEd7ZlixVwOxbO@ zGIzf85UcByurK3}U_LXYl0`rP6WHQpNP+p9Ij>eNo?CLx;mbMqAoY`1?YiTHug@D; zU-Ef_^~i_+gy?^-uh%n!>GAb?CabvrAJ;Q={w~nJ39c9F zcONkS?_77&bnxn>K)*|h@~(l;yZ7^$?p3UH;z=*o-FB-m9CyBSkc6{F<{7t$Zfa~6 z4gYK${dGk2YPj=!bN<@qx0q*}$C^i*M>4Chh#7_~qspMm+2-ca&GWuZH>c{)baT2n zh2Nmv&D7?_`Owcb#N|20+00*T7M;K>-Db33Tk%)?4E}7Xx_PfP72E|zA*Hr%#gNUTl&ZQ<;qLGgxCi_j+!Ov0GQU{&JGeJ|4~~V) zVIzDKj)T8|P4G21o_U5BpuEp>a3cB=&LsFGWPVY@n+)ZB_l1w5&-`NDgK!GG2Tp}| z!D;X|I33;$XF!Sn{_qCWGoi$z8D0x#L5crtDCsx{O8gFhSHT0}W$+vD68KH{U3d_b z^gb9$dLIJMNB>ZGHk=Djg@?hDU>u$RTi{aI3Xg^fxELnkLO2g*VH-?C<`?TyFa_tq z!(j_#ez9&YWN1=%FzkQ_Lgp9iWIrx$d<0&Gy$9gssD)R+dj?-=T+RI79fPkD zYJC8!ZXEmr<688$8*+_M^#7Qx$K2Hp-Az&l_Yyc4#H+>d%9>IdLB z_#oU1J_L7z55t||BXB$TC~Sa_!BOyWI1)YqH-S&W4dGL8J@_;n44;7m;E!QH_$-XV z=iujSZ65sz`~*G^{{~-xe}pf>58+GjxA0~74*V&63%&w>0bhl$z@Nbv;cM{6@OAhE z{5gCC{sP_)-*C#yFUjA#Q2)v)H*aEo8|t^;pf6ec{Kj3jPK5gTIIU;rp-}z5{FEn{WVp9S(#q!$I&T zkVdoW88{d|28X~0;ZS%FTpQj6*MYaeb>WS0J$Nl#A6^M-;bm|byaa9lFN7Py^WjGD z99RcWhb+ESeH#vkCqNRj>R4D0m%vToVmJaWgqy)GI1(NXH-`zh1w0IH2@ir>!8vdg zoB_9nQ{gsnAGj@?02|;~7=yb*3+@C*!_jaI+y-t3w}jink#GmNG29W>!kyqcaA!CW z?gFdft}qIBgP#wi{fE*%>;eCYdQbQ<+zb8%?hU2h91H)5x)FW|$H8}D6Z|zCZyL2f zA2`9BXc{MOM12BlUl=&a+{ZLd5;d%P7JHN7lW<@75Zn*m3#osXZHT?;EIZtYdYWl0 z+rU;Y8)nR)KWGd;b>RNyOw%ska6`^&M4L@x_(=n2(U%l`>Hir+kH`HS(-?XTJOD0% z2f{`08!!vM3DfW(xBwmu=fgu_5*`ZUa4tL)9tIDBad;qXfwN&NoDLIkKbVA*;5;}E zw!yvNe7GA-!5!h@a12}kw}tI+E7$=?!cMpeOv8;}7wNeUJOcGvkn~t8{m5HPn>m(g zYS8aCW&LoWiGFQg)UJ6c9)&v-drR=A*7%mX`(%LU?ik11b-xtd@Lm+C>?`F*pNk8|!Z^gVX>f7MwHMIXw z((?}Z5$ZeDzq`!49dqFa=>G`54ex=k!F%D$@IEN{a6kMp>Ic;QgXTkyx$sf+ABOkC zM|f`;7d?u44C=?=DEK%W0iS>y!zbZ-@F_SHK8?E}xO)cmKdWi~;YaXU_y_nLd=LHv z{u(|HUxzQim*I=JAB_8#P~U_4Wz=h-{weD7P`?7tfUm-n;m_dl@HNWcQSf!ti>iNa z{?e&8enGu)>cBTdy@`y^;L<_l|F5ujNcG6*oA5x~y#<@$+i)8EHCzOjV}Bs--qC#e zjrp#o+i%SG&>w(4G>2pFebhCme~bFZ{b~Q<6Yv8l-@}LSKGeTg_kS?|=$H#{MgLDw z^83&DQ;k1=K`r_IS19@ZHz@i3k-Gob{JUc=lzjgOJPv<8!F_++{}c70sQ-n!AL>t0 z?}qx{Fa|$^TlW9lG$KarW~f(?e#0SZv$nq(>4W}I)RBlWd_e!Gs5Skd8AZQu#8_H| zzg4Jz(~tHa`{KSo`hC%_M*m6lslUvJ;Q&WH5K8(o$ky~;3rhMAhLYYxa4+dSG$P-{ zI+3+u1g?v|q&GD0#=rGY_d&fr>K@d!sH3Qdq23(z2B>8mzai>@s5gR=Pjyi81y40! zhC|7(O`zmYJ(T>|6h?420{*j#_kfZgBcbHS=1}r$3n=-rC6s*F3jPWEqu_gRYbg1$ z4e^nD*%tL1=r=&gpBVa*KNf1qpV3hAXAFF`YP-k|r0a{=-yS{(QIl^wMs`Lm`L>gj z?x;zxT_U?-{#ezn!rF(hFY4Of8Tnb?!}ZiZ66W}&|!>e+B8oJ0D_cYOfrH~P~4!V@!m*aM%0 zi{JxrF}wpF34aKWf>IAJftR8F7Q6r+4W+#}2A+=kSSalUACI;d$3baFj)&52oB*Yr zSO!nP{)zBNcoOV_--d1QWOyh%1pS7i@J4tGly>Y^%&$kr_T7B1rw+V5a)-v)So|!+~=6zqwek%wSMQ&ygGV+2Wcp!We&Vp}2DPM2H{ZYI9?&T3<*p%qIk$2!e@VDZQ{P_)({=$1u z+Ozkew0D?e|AWZy)cyyN4|yMH&)~3e(cee@;HV+_^~cDc)gJA?x}*J9^+%Dvz&)cM zMg9tRg@04?k0KwFPErp->h-@zK2`lsBL9HKTYX zHPHc%8dA;&MhBs9;STcMtQ8%CTEZQy_G$m&l<3gt+G@`DU-j3Cu8Uf}7l^;>Mb}sV zX#Z7R8y$vPz8{GD4Wk>V{)W+w(3kHC;;v5eRr@1u{tibi<#Q7# za=lr!)IPZHS~rzeV+4)ye9MsvoL0YId%fJYd0q z%Lm*#;4cIIJ>Z;ymkzvb;Liq59{kGS4+hr{*>k9&Prdy0)}d^<6ZV;35n&TgI15U3 zL3^Iu5uY8gvQf~U|J<&6x9LjE-3@(P1nv3dVQ~1&kr?2Uj6wC}e~<7!L8HFBxf^WB zeS+(W`~143><@E~yNZExjxJ!%LDgKkHQmk}I?p=tCupu4%hoQ?mm}(3|MmOHHsHO3 z`>34#a#KZ;f}38tpAShA);w2$(a2Kn+5U9m6Qr4|(fy<+ylxL|Tt~Etx0UVJKjzgAmrS~8at`AD9B6DoVZK)vDlW~}_avEtu*V}gEx-=7NGb$j=| z)EjanKyT!g7c?rp&)9cP+V-x(^a`AR^+&A2_tf&rc~q(mL`nMIv%>Gl@d^Pdj%OA6 zlRuB``m?(v{;JnElO{~JeW>vJqv3SUjXM#URardB$#rmFQG90CS&4qK+uzM!qmHl+e{pBqfQ-FVSN{pui<4?h4ru_kHhn4Y{C1L>4%ibpV_P8kC#Mc zc~m)Qfe2{yXg4ct(OYUsm-1&l|XlPTs(u@ombiYWF&rN)mO>t z!uHKy|CFx>ay_Y>9_{n8OHQtb>c!ssHxFUb(r5Qlr`Wxoz4uQGyBqYQ!&# zaK@fwswM67uy7pE`}nzyIumgSx$$-Sh~uXGmMs?(5uwVMv%>LKSe{1yjSAa^UezBn z!h_7o1?k)?fAVr%xWJ%GuBdP$R+!Gc@~@cuA=gWZp|QWIV29Ix>O4rVZi!lM)V#{A zZ7kf%Y)-nwEKW1meReW;biH(bgDsPY$t@@h+c(3crV`dYHH|n?-Vrwm$0< zw%6QJ%n_ug6Zw)(JR|rm`@O4QSz~{(yz1#%Qa+CRsuj*V6!TYG1L@EA;(a71=IUT+ zt}n^v&PgKx)16(KBe%$;j!b4$SKgmzG{0s24|riYsaLE$=~a0O%Hj9*Ckoq>UisJD zm5eWFW^zO?n{hLNcdD@emWVrkOq0YZS3U~*6MoU1R(GboL4?}2b0rQJop>)Q-;Gy( z+eO@QCKd0Db+@Eg!^$nj)xwkr)RyphWPDmSe;5I}Q>XRLP|%v~cxE9aRA=yPf6Bg( zujTQ5)*?q$Wtq9JP~mu4{LwPL2K=#QEjvkC*zf99xrr~FmlxCJMoH6K))l?{u?0S- znX_h|MRP^!u~p8GruKAqf(v=FEYhj8bSoq4l3qA`xdAaE_IYE^+$|Kc1R5wFoCOQV zCq_VAn$ww^=~&G+%o#I!w1w#F*^|dt*#0xs?#RvdE6lM zyiB|!Df;C3Qhs^9a`_iCB^KrC$>Q}&X}N_?D(w&vj}3MPTHiOVzNU3T*(I(uxVqMD z)O4=7)wNZ*O;#4zdRR70u?ixtC6H7K4a@Nqu73d5?_6wdMWB|g6>5)oGPej zfHgAkzW9C_rqK-?n#fU*L->ueJS}Q61-CIX2z7W<${}_ z7`jW+bfY7+Z)>o+6N#3^%SFj~Mt3M~Z*15W_g=rwm1E?M1L$7m;wdh!K!SOC(PCrE zfPK$ie!P%(fJGkhzi2sh<2O}D)b(yB(b;aH^JHGU!u`?wb~Kg8?b&mCqg=6n~- z!thJ=M_m^hZRE1@lq*LCOCv%?;8DuC$+9P(D+$y15-oua>r)Rl^2ZGGJniQtHl9Z{+kZ)-$bB zRwHSO*3czh)8AgFsOr*Gh=JCi@*G-~Xh>b_<`sQhq9J(|ii$|+T}i#bLI+FDzB!A) zm}|RO_6RPQO(t3zdPE}L8uSl2V1}_-FXK10m-c$`9*1)mZl^8XkM(nBoU~iS`i^OB z_~n(NK%Z<)m7m}jUfGynebXAsXhl1&gE_4^*zA3IUQ-?CvrW6>eC8^IJ%viUMJxRb zeGrQp%kAaX=XYXCe?9s7_07uc$$(^dd3)oVCToqf^8UNiuHk2L zqTU-Bg}#tI}#@X|OWny9`iUG_NxSZH7c?2*1H}S~GG_OYVQN^T}@X z=Qi2*auSD43*upSz?;+aay{`(a&}jOlr@Z!<4w2U?&O2c7|xob_a+42FEsBxMa00m z3jv1F>wW6}-hoAjDOf43N>+6+er)AKTtj_}DdaYj5`5RIvQJ&cPi50d^UWT~WA#ff z&r^9Tce{ThZ)Z=z1d>dmrT4TJeUJP=PB*)Ex)-As?r#s3kK*&P@h-MTI_tO^?k4;# z8m?X5nV(Lj#o~6Q?1jp&*O1swW#3&<|MTvO$*C?=4|?vjUl?1N|N5N-w)x`1kedeN zL4w$qQ?JdVR+F|Yr|ikgoh>|RfcoQRH|y=Fb#v4@GHUG~wbqVWuSKkjBUVqu+9zVw zMyx-Y))OXEbJC`6a`ckCgPFBr7g8lQ_EPlO6j~L~c(v?W$?_Q5&OF80V zb|N4>Kj<2FMV&F^9jv6tcH7?XQ=N@_}E$Le&N#b49qL6biKQv-tJ0vF*zt# z#pmxY_U&gaIqy=e-)!04XuFzs@+g#^YtTPUU#nF5mWiJ@DLJoG#$Ac`3Z(x^_fr)1 zTV#iavq^)d(YafB$5QX*7Jc=nm`icki+w`{<-kAhIk}l@*2l$ZnPtC2+3%;EKR8`! zf7a_*`Xiu=PVzl+3{PSpHe1oy2`Z@9{rIkR-+&J<;(=x zD*@X}Y|GVi&GCiFM17#bWE*`__Fa~BXXmf6jx*mqh_2FVB+06bLmNxAronF48t*R> ztZe#?(FD1joEWPRlOy}lrsaZx%guJZNk8B8u(y=zZtxT@HZJ8)ew-*4?0Jcz`IWaP z<4HqqWRnL;%ax~(H*zo8No7>u6q(4jYUzbKjdf%$MUp9Y4Zm$Q!td42?u1cufGqSl zPqpw%yx*pG^>nfRg&pCN`(9SL9a@QhZoARc+jSS)KbZ&fs#bU1`~Uy_Ju?0-`kiRH z8r=3-{=G8E)?{j7QsvMT9S7SJfLX0SrB>y7=oYTxn#ivRK4{CZDR_1^nQ3ZIv8U6J za^j_9k$V{QBxgf6E*e_Z31D}NyoNlof8Nk=rZr9*KXKL+pWk96`(KU8(;MeBb~Cf1 zq8H>iQOFk8>$&!vQFuGMOTAb+_bH1%h-zRDdcaJa=EIr8K)*~l`az06P9+!i$nj_V zjNZj}{EYJP9Y3Q)d}ThJbiq88<^H3^rBcR;@Aw%d;=8W+Gm`@n}=*wa06d5GuIU&GkH3TX9P6ST1)gvH_q?1+pi=ubcTH&x}z^if$SnR z7%GO2esgzAhn`5oMC5Jc_2nkJL@*=`KM;;M2!`*3qxx>Sk$A}=KEHnw5e-kvCmV-! zAQcQx+qcQnosUE|#I|(Ln-?m4__LveHhFq;cSee@CPOk4rz7ZmM{5Vno0FZ1nW?t< zIrn`Xcal-T@U=eB`0YDm!ldz5SBGGaj%x1uP0tRmWO2p#b*zC+Xv(MtdsTTtN zC5r0zBy4@HPiJ&z@X7<0% z*Lv7zKasNEOU_;S;?)vwU7*_}HSwGjV`Y##KS|k`=b@Y%De8{>ZmkPaotu|3&o1Wr z(2fT3ra^qOr63tbC?CCe==p;#>Q37>3FXWvNB~@OEq}cClKjuK@@iUt2lYE-$84;% zOTVxBLU*?LJY8HC>3teCou4b_kKbN<+Ob{m{dwn&dic}JxS6~ zc=lpnEZrh|pJ?~;2g*X}@7T*atI^%M8ZA-N_S1{MT?k?=?cK>7ZQ^`gkM!k#*gV#r zjKy;~`&}e{q5Ldnzbn<1%sUt*j(p)WV(4tMzmWWg#y-y!--y0jsGgEFD@{q+2jKH3 zccdIHUA)Vx&8&IH>$RLh!&e$i) z@~;_gm*&aJTqfNUW0zoS63L6XWNMMbN95NTc0D*_#;oT27aXb&?EH*#8gii~OhWrB z-g`Rv&AW0xY&$UxmA^^N%}q3n1^TTz+CyK*DV~3=^PH`XvHX83@G9IM=1pUbGz#M~ z=>^G5Bc~H{p?cRZSJNj=v!GtF?KyHmC26!j=f%qv(-QuUb<{R9*^$mAV~IHI6vsTF z{(;|KD$A9CofJQ@7b?eod!6YX85xM&seJZ?zavUzicYVDZ-3~a^mIiT(0I10&?C3Z z$^H;uIrhzQI`7fYna)v2?UmkaejH&p#<4>Cu|zVSYn|UCfABh#4~6z6e4bFbmjz*8o*2Yoj7K(IBfZ*p1bVgj;>s~Bb(6im#5#IH<0-7gz6D@fSm~SBk-Z4mEw!^t=8@?X%!aR z-*hOxK6_fN>wJOly^9D2iOo;8v$fiejx8_Li*GUe%}vv6p++;4?0Szgd%%=|?0Z;A zIOC@^GcxnmYc#}dR_<=b4BsF+)Q>3^KPPr_sd%Qt&DT&rrI?C-oUz18>jxbR+ zcNeK#}n#L2J+hrwZNXX^LBS8-_ch8LglroaVAp} z$xJ>eL+!mI=ZRqg5`W^EM511N@zO1kY9+6Ae8Nm*x~((ibOl4@$vgj+ccIY<_k;ZM zK-5AgJ!RUGnc)o5g6uCn)LwM8cXLcg%5K*J{jx*jW=9SrjbvMA8iALbyth+6)L(P@ zIU@eUt{_6?#q0mKb~A+PKpw;VcxQrHO8d3KA0#y<9F^FaCMy zZObOmxyb!xERoN*P=A)zUFt8Vu5LVV9OJ)nl7X%RO}E*T8=GfM^R??u+T=)(q53oE zUt4@pEdRxb?Sg*WEav@GrVkzUMJcKRcTgD0FV9{kp(E~4x$(?d^vvX1yWNG)P&=Bp zr{m$~)=a94kKBD(;#V(`EJ(-Mc2|vgJhvhYl^0L$`>grh9W9-V)U(>J47Fqa?^04m zgqn9Is1mczM;hw?`0}yYZfGQaJmGRE{W1@0V^|!rp7*BMh=xmlYm$F>Ye)!yr zIaOs_l5Vp-l_~KF^&dU^t?@2t8=Ph`T;2=qIUTA{I(YV|hPu+s{YaoZCGANyld;F} zVlPx*dH&G}jxz`-=vSey^95Nx*Os(X@0J$shQ)0NJq7`%nb9UX{RM|xo@8Ok@Q zr)Fd@aAO+k7q+A_iCB(N3R$L4$h_SZ++x>01@k=OUfqqiopZzR2KIVz;6y_=^Qa4C zHMpAHZzztRC%9!`B9nV-WoU-#Lv950BNtkru(fLO2y}gFW_BK2(LvJLP zNwqLcPs|Mrz{ZYQxV`u{QvP`U*_jgaTb*lyJ&gUNmYCN9qMnj&g((~ zACqwQEJk5{?V7uj2chpI*D8~sJfZiN&(IOX*V;vHCPMB=3EN%h`z&nN?L}Q%ULort zXKRb zP1FHLJTDZ6zu z&JOudJJdW*7UTR~COh14yBq4)JKtSk-xHHQ7M~xPC0=O01k7b0I)ewMkfhy7WI69l z1FqwNfIabt>5T=6bWbPq7Mw+wXMq0Y8fJ&Z-E}ZVpP9^dvA*E+TtoAj%yVTkQgemU z!I}S(WBEC%DEiS(INE;;#82MCIq_lTqi39I+m9|YtX&OjM^360-OePUIOG7H?CD)( zjn*<|)x>rnn=dCOcCL#^8kl10=Bq*R8jgDE1jGDBBD4UC0 zBMW3#j`VlE@4a+2;k;(J9t}7UJE8u-G?w^gI!k=&#jgDI!gHsAkTBYs?2;i=OlAsL z29xR{nURsJN+E1;t|zkhM|d6t?|CQ;ze(phn%!P*K|AD|H`M5b-!C9{U2KHjkNT&b z*&&@$R1ZS^B*!S5(Di&T-pD7n!wdC)`1&1TbGC7~f0Cci3-wRR$r)FlLjB{AeCvXF zX=xaBW>)8M3gu6SzY8zB7+A^>!2K=;O6cBucewrB!9jhM&n#LYeI193eyII!^pEqz zJhXmTR=%~^52bq(?e0_tg!y^v(EPn@snGNY%}W%M-zwgR=TBW>B?awQUOtY~jD_CQ zKQEvSS*TqN%4sCrPUoSLtWySS(zgee(O%WvD!hI~^H>(t(N90y%c-KGg5? z$)&R+77E|ruT={p<*!$M=R?U zBHVA6`*tK|;r4y1_QM+OF{hY^@-r~cA?Bg)QhQL|y)Xs&rr(x)Y~l3JSC?7o-RZq8 z;(eL#)VYU6Z57zle4z63CQ}@Hq3^=Ehozui^miQ9Whfm2a>2wxDBq-qurtmsGYWLVqvu9MT?baJ+#ljHQ?=J&+9yX}n~+J4geipe^2jJ+eygrm&=dDVlv z|CI@l&SZPcT|{VTWqHf3+TSs%jkgPaerdd{dgmGE87J~<+c?TtWE^g!jCn@VNEofg zVaD8$%Y#ub&+E-GX6ery!~O|}BR03s+xARHqqjME2ch7XNyg09@tDK=!`bW`KkbiCJ!{#w*)Ir_C#(d9C#u8TnQmGm;|Rz#Ld>st3I z2O8gS-UpJ8%SF1^@C_md@t?e>lmTPtdbmG?@CLy{QTMm~UD^lpqY!W^q*uUw z-Yuf8{nT8Z*LTgsY{OmDn6LK#TEzYW{9Cc2T}~A&jSvfH{tkPc>Mm_iA=HXHNVrEB ze7v>qqK4*jNLy;YW&YZrcWC|!cEdN&UkG1^J@9AHjn`uJ=SYo@_~Ys?!QS(zzXhLy zN5eQ0<4p9=MgJ@{KgT#*?Vm$EBjxm5p@s|fz0Zg8-rs@0f)~KI z;CG><*M<1IV#P(q_nh>Gn%);{dS7CEpZH07Ltgb#<8lq>GNFb8%|+%F##O3+rBL;u zna17Ka31^tJQ!Z1{wz1HMcs`0I=C+olzg}eNckvz@!n@(x@JCSc?;gyDnD-hFX};YjQgSr@P``@@(BB~P zpnMPLKO`jFhmFS^^GDR(qoP)K(5x{ZH=c6LpHTBBMXl!0tRmc}p$VUXQXYRyK17YT zjc1{JSI?pUIidXoehQz5|9~&Rzrh#bU*SvePmu3gzsH}l@&7~P72{RseIe?f8Lv6- z4TrsF{M>k5^?z>s!bt~+y*I=kO*hxSU!j(A@+Oq;@GU6i>20IbJ;TSDSDGK1e>aWD z$jF$;{t<4})~8Toq3Uba#VW1BeU-A^p-6ccU)!hq0jBi7dcU)XHv;~ zr8*MXj;y`LXm5?SqxD~ZKlM^cFUBcH6`fZ70xlVDH)@h$3DiVjdx=H4^6#AE&Mz!F zQ_EYf%$@JM7OU%&uul&{p6K~y(_zgCu@d1IB2BJ?Uy-dLYZ4-H%#&Cdl-0Bck@K3N zBJ(%%Sb64%M2p@Hl5FUT=jPip$My`)5ZnjP2{J#A-X;b5p?arzYBN?=F8_Cm$OXgl z)Kr_EhZ09TJMkL~H{^f8`TVImh2#XwSe55XJTEKlqL4eUdD4+9iMM-RRLT)g z#q$y)#I??J*!lEDohPl$hg1B#-g=n-C!dF-%O_8C6!py)ajtD$@!c!P1@nKK1w4M$0yMp@@HkSAX%>Osn^>-y1yy~<_|7#`d_H~kuy;%PU z)kFDp=umy`ji1C{o{+gWF0ze{K|=2Z7zf%0p?a}k9JE`&S?}N5T{qNl*T}ks9bbcW zivG+eg@2wk9#Os1n1eiuU)wxqq?zkIjQQY$jf0piK7bkJpvzgPU&`xEV+LD(ra3=B zySB}Sylu~PYxG94e&Oo8grC8m5tw=5*!Jr4_C+nG!+ko=`wqV-vI)8}4<|P4^$X_F zMqChiQPiwosDAC45oO&eklBRV;~?u7s?R8??&!!?Vt@Fe$SA*mOZ%bPhE94s@`Cj8 z%|mQ|s=f(n)vD$|3pT^ia5@~rdc=NkJJdo(Z&i~bJ4kPT__)Z9LX9u1+C8$ftXB~3 zE<)9ZRXgL3(p5DY?hYFuz0<0#;GS?(xEI_QGFwqq3&+Btun`V|%oZq6Z(sNh+z-A5NuR#IfKzqd;U!9ev8)fP z7m{udnYwGVcq?mjGGG6a&^!}+Np&~RXmi{_!ky1bo>6-W=Ft2$ zJRB}FUo;lL<6%2oihc(?8g{}Z(2XA>M&|Q%{ld(m&-w-aW;K4|uWPTHa2B9mi2M0w zk4Qmhg7hU;6D1uNi(1nWnulVK^u?bgvTmXAgQ$;|bqh@=sO9olDB&_|K|GE#j(60M z^@f*>6IA~tS;sIB!rqB+HarPVgREbmK7|zwF+WAtD=3$z3N=1Z-~V(d?|%k79-ax8 z!Ly*G+u4M(V#PVexlX!6P51LO-OrbG3(YS`R4>JFNpuzGQqV}6I4-zjP} zhvrB4ayR@F{1KG$bPwq#-^IPK54;ck-(!A1{2hD%{suk>e+?gkZ^MV-uOQ_`zo$o; z|Nl9w7>_&e3sFB|Jn6hQ9QF#U7Eh`E)3R=%=>W0!WAR7R&-L#))RMnHf$|+a52YNu zP;%X1PxEZ^V)F;)ljcv&znSwQ^#+gE&N9IGdc6RVr_KeFSv}`mbUx_7)^s8{t~=G9 z5r702eWrjZX9%P9|mFjWs)OC@s@TfPWu@v z2=seH^H#oj#jj$$U=N~KG#x!TYQ7`5B&nv0HA7D%$dOrjKc2Djr`&s%n4gm)qO#TA znI@MOx4b|8^zy!s!2a31XLv=mDbN4>yfi(N^7*Xuu7Pb>*7*D>N83kM|Z z*Q~=XxRKcN@~d#3`af;H_v`swcK&yiKESoElnXDz|7YfN*9pG2TQMc-g8C)T=fr~c zzMhv2rpMRwvR}{3%9Y^%vFELJr96ApqFX)m{yde|BfXfH-L1lK*8Du^Z_GM_y=|eN zH_dBQ=R@N|<6ZLu$Hx7P@GoI@;X-y!UcjuxxyCsmx5uMq2dVS3gqa!nS;Eg^eqDW+ zV$-wToi|^=e>*aJxZE7Y9%-=?{@GG>U4MkK-`lSie>X*ExT7l-70-a7yw4`E-l)gK z7!*MbhrdxXLe$JNsG9kSk;XfwG2-=_cf@>f{rq>$EevDuCJ;6Aq{^im;c65E4B^&v zuAixS*W3m^2C-N75Nu$+^gc-IQFk}A;O%fUycv#x*Te1LHIVtw+DqXMs4s%z&v)QX zsLz2r!!zM7@Ki{ttvd-)s_IUFjB4wSh4jMfj)e54>#~sf&$=$SH|&68;o-0m&V%D% zD{O*u;dpouWHeSc2Tp_%pGj~g+y_pBli_}FUpNsm%Fy?o0_DA@!X`Kk?hU8IUEvJ4 zBitWu2WLVHHp6YCuc1y;dU7=a1+S@pXn!}!{d;XEf_+R*iO^w)hQ`A!{4ty z++Ti{ZiuR#a`0mHa3K9s%!#83ru(z%1%JVGiC3@xR}V za3S;08&K|gn0FR3|Jm;n+kDwD)JvFeJ`43x%rn>8>SgOQ3wj*$Xr0wM|EcBs7@c2x z*E|;e!>gBKQ_B5uLhNgJL+9bo3CugUz-4eQJP{rQPl9tG^PfX!!js`NcnaJPo(lJY zr@`^?bl3>bfP29+;qLG((sO%wHtHDUJ@q@f-}#=-V?NI`&X;+-+EJLh`lWag?$%=$ zx7e>QVxRd>=2v^^BOn+ z%KT?F`q#lK_(RwSy79XKeA`q2Cy?tYGX0P0_$9^dZ`<5$FQEc(BMyF=9G4*lMgb2_y#)Nc{bt@^z! zYK(O6s7)xvL=N;4$)bBd(e}jHC`tPCtPSv~S`|z!*<>qhU>#X?v4n7Ylzoz8d zhp3;%-tVE<{{xiw`y-V1{S%b;|1*3D^S|JKfBgR|>Z?)z4PFL6f)~P%p`^>-;hCua z0hhr~;1c*xn1TO-Y4|Dr^~1k^qn?cVGdKx;4kcYzU@qy(G&JQU!XA7{*N7Q4?R16a zUfA!0x(a)JQGeR^UH0r7OZ%ekhx$s?{o(guH9Qm6h?@5r08j2a(4>*9Jpuhe@K}hN z{26QxMJ@R=1WNv(CLU{>>tf#1cO7AE7W<;!q2GGuFw~N7>r>Be)vs36ns3lN9D5tU zINT5(2)V7?oCfRQguWY_!*RbiYH02Nacpi2>){BvDI5kzz@cz6*cXn3pZ0mz+#LQH zZUH~+vn6K(IG=?Yns35UP|DBNP|D3V@OAXJ#h$!(1C;lSq5lH<7U|fBbR3QPLeyj6 znQ%LJBHSJ>fjht+xFc+bJHZyXGdvLP0;j=U;dr9CU4V(fmhg0F( zy#F+KKI-Z4R5$}Jh5N%EI1_flW|)Ap;6ZRUoC)W^$?yO;79I$9hTniO_)RGF+(B>@ z>Vx4(cnI7O9tzikbD`9Ohe4?arLfsC32s_Z1`mq!BS*X+S4A=!vg-1|6PJ|hFG|WP&UvrpG zs_Hh6q}+E_FEo3cau2n>U4;JO)r;vJ%lB}kknj5_)|hPbCF<^5qQ?APp}8n>jCq`6 zeyo}=6}6f}Ge`Kx!!$erCgC!8C_E7!7+G$f1ZTrz|zIvfE{-?ecl3*E7yHze9RRdk(25FEB48-tSj` zSE%uZ<}Q(oSUD5@?+H~OnilcC1a1Mp52by+l<=bT&n|;~;N|FVhWQn+9$pFS;8k!K zyc*WRAHa3ta^fNV{cBBQ*x<+y&FkO*coXJQuU`+Pp1%P~y?-N=b^vqi-(udZ_HQw7 z#UH7M;jq4u+sxY?H6$PJFz-@(@0xe2JKBF$-)r6tjmW*`kKn(}d(C^){9f}u(n;zW zNWFQ#`H1R2Xg&Z3L>?5i)}s%RPFwYRSk#(Mw*KShqpJTHXUs(ZaUuRZAtW5yfAxp< zAAjEO^R)Ra<{$QXMyTdLcFaZn59~jO`TqT1FnHqy2O8H!FmO9UMPUOzW$C3WgtNPs3w{KN*)lF5ut*Ys_U%#vS zJ=E{F{XXq?e*b&=|EB-P{Wqu{S>0WIT=n_YS5&`R{bEhM!Q)LR1mr>MetJg`%Qjdm zzy5~I++@~5um?ATbY<&;{(ABSMKZlB+yy%u1?}nibX(FlwRKKVrz|L3ifj+1;Tw|-lE-PK;q z=BA)_XVGDu#d*oy3D>KRip+1Wq5Teni@YCND?QhEuUKN8{*Ki+ zH`T-mhzvg>s4^3&kBn0hUJ2(eX3IJZi5TCIGh;2DfpxZF_1F?KxH_nlD|ypckPDJtO?XC%eXA&%C*pzeepK0EU&*9^~w@r ze-dI}TbhVJ#r*HR-WQk;FB1GSy$OEx-g0NNx@NSgx!D?Y72 z?6;`RF6$J-T4qEV5YTAV98ZZq-iSN#I%qZGRqB#d=W=gZ%GYxYz+5Qq;p`Z3nq>b^;4p*-^%yh=v^GCexpd~;< z`!k{V*|N3V8%~@U?j@GXwLitn1KmDu)bol%rRSu*ef*AJ6~;$pmN`ei<&7$hkDcTq z2g!*~qj0|rT8h5)NmBz>02jRqLLS^v@$T{?7Tcz=GCSOh`3Bv+dlI#YmBlag&3Hb}s?5J~avTHk-3tH9w#)fzj8n-hcBN7>^EE-p z5VNuT2Fvl(cqhVo6ZQTN+)lo7`#pCn@W)@Dc|Eyl_SGuQc{!@i+l}d^dq)tf`x(j! zh*13f;g+vQGjXnDbt;ER1^zhi?CvY|Cx`bsA$gi!R#n)ZI_I7|f5xs#yvoS$n7u0g zc<)zMo~9SeV(nS4($AM!j{H!^)57x9EB`v&wr9`E-dE+3`roTUf1G>W^22_&N)2j)1I!`=u4*f7)XbMD254 z`<%}sotO5F;pD0YN0d*Dx+2H57jd`GEa6sIey4hJi0z=)$1krrm&+_vfz>Ub5_JXGBSs| z7~4}vCNrul@6R)u-?IJ(ys(_qE7qR$>OBK;qun%o|5mzE5G?`f@0k*Db|v5i*dCuC2KkoK97vc z%jOR=3$EzpdPjtsHQVvb;wmVWf>x|Q(W~_JzmzX^?Rb?*LB2IkZ}wlB;t1E4 zV=i)AS~Ah?*7bJ3Sqf$0yq$M^)S4Mj#4}BLD_1f$&plR3)Mi!|ztZybodR-bL_9X4 z2S%)WO=}&~I^oOeRdgFQoolXFQL1}Wq(c)KPX|G6%W0(RkfW<0bL~R8HOJS>S)ERf z+cS~A*BXkNb%PmcsOE3Y)%J|OvlO&C(UkRrRiA+`lYZ8$h&4Up%*aoTjH;Pxm#-q@ ztX|c#fqMkpI!y}fV@^N#0n-{_T1&sILYpya7F1qnrFYuO8ea$9Ub&#D)DlOT1g3z> zO?Pr&Qu?@U9Ga{$>B6!A(#NcPA*q>yun>P`q|iu5-|p(S`aX<$7HH(7k+r?z3o~V6 zT}`Cj0DRui^RBR+^Tu6H`&2`jFfH#KeaZ3MRJkS5nj`lRN*5$+$;DTb?5iP@iM;-d zc#exUJM)8FcJ#^<{b|{f7931XA&Xjk%b&d(`6P^*1J=aIr&z@|ORKnKa9!3O|E$f+ zdGp6JxeF)91-{uzzuUmQHvaFn!u6e21T19SKB#0wh4Z*}rIT&v{z@)h?eSt(IIq;J z`YGHvEib({EANh*vu{)QZh!FJo6FNmG2ZQtt%Ep^x0cFjp_*%N#up$y*NTGpMPEvq_5`mK=ckn)+1rrSb|9sDcSO#CBuzIhgLL3pRh93`RUl8; zor028KwFNnH$HOZCV1m%Cew5A6c-_L17CX4V!8RnH{SB><;UH52kQOG*P`dE9_q+XrpLrxTejWMYfBx+)N@*^zqdw#=&xR@bdnRZ<;(68@*`nocUG!OioN^I^v;qxHHukBYN^`q+`+M zxWu3@OIs#8TV*IJm)Xj`%|x(b(-_Tk>fb35*(`eAYQ!#BYAe|_c$Q(E>h2mmnez8V zq*Z>eVCB_%iEOYoidcU(t$R%C6tid-q)Z_XW=v7n{voUk+UIGOrfQZH4{R}c-p!2kJpT6IswZXOdW5rK}!+Z!M9D8jjRG`MEkA7{(AvSMWPsGxEMxeV+qc zN|@etH!75@7u7)s>(+>Z_=m;|&Zf?l+Ov0Ls@$w#dW8JLo*vk->j|U2RQPs1 zm)}xavL9~S^SW&I%1BIZ?w*_F=!6qa$^A8j?h`F+abVs&oz2llwc9@T`fs_JFqGe+ z_jBq;H{!CM5KIq|@2!EVP3cdT9bdTqb;i4xF>s_d8X^Hyp6D&BQImZY{SjU4CgR&m z?8}X-n&S)E94HGGsaBmStCwv&NhybA-P!47ti!j-6CGq)XRSsOm8b)Y)?AI~mL72B zhgfU8LM|Ga*__(gk9IK^ta4Yr|K2HY-UsCkY25{DN!X+059!;z8i_lFI+Y1zTJ|Qb zw`J$O?8xZSx?3iC87*Npk!=_<bvoBo-Ek5 zbkF1Jw_vPP9EsR#?#{@rK}`lGv~y`U>TBEnIOfgC&cw`A+x(pSzK;G(b`S-9mU%<_ zzM_3+Oqeu2lVU;MZ$s+)|KxjwbW)RgE^b)6P}R6=Q%TmTrc%X@=eORn3>|^gBRtgF z)~MM`&&_GSv}RKr`A2|K$H@d{D}7ZNxk#TiD3!q8z%D z4S&+!h&}l)8Ck?%dCRo!xJzh_ZojFP8!!A+*L;?HV(~?MOq3v}+z0vx!Fy9Sl(#Q1 zk7wKGraHU2b4EWg=aF%5p*`sxCel5f>;-RKAT~li<+d1f-(mF5y7BE=*9ecyy7 z#{{w&>0^e@pF76~WZE#tUe#2qI}fSfb3weBC+*DXRyoc8fcgLCeK4}0(3j5sbHidH zH(mIQi=5kCL-)n3D}j0Cl$zMt%q99fq4Hp#14BRL&K@NA?zdk@9DDxS<}4tD+Mt>ubp@Y)WzUz0)lj;7=NH6~ zCzKw}xdf-)@ZwQy|FpW-_SLiJE}DepQF!|boc-L|EO_qhc3yXTs<+{E?~vUEfy&&r zX7@8Ze}elnu@g$qzL|^y&717skO2^4w{8zs3 z&57Sgq32GfLhZ5=8<(6PUzkc~rg!N+499*b9RmA*#7ZcB`TPpG3+z7-ccJgi{@(NZ z01Ccqd%pqhLh0*Y?-y_N+@0_JeCyF_tnTCI zB|!MRhwkSzEa`|l(-B$A{ub?t9y!e%(6GeQp#5N+)kRQCoQOOXo{H}e)$s?tkC+_h ziNzBMyW67kR^IEm>#_^jVw7x;rRj2I*pkxF+ST2W-{Ne?#Q2;#_|t-)KXT{0=$_2a zXZ+eWI=K<)8^(dgEcT1;Z_MDHrzs(qpJDs6yxv6CrQ~O#^Aiq7Y*ogoEKudG1Kl!PYHuJrxq=m@c`c&=%Q?k2<_Z=&{i8O-Y*D{tMJoLSA*;TLMPE)y-)8$^Q+AHzb z)ep0ocwgi*pY5pU;7>KT(24uAedezFZ{q)o6$f!!oybl5OlW=^dxxmIL%9jeb_X{$ zjl)EmL+$aHL*(*(X0*VgqyIMO@taE^U3T+G^pmg$&V$|14R1dF_M2xYw0#AcS!_%Rp?-{sTvEod*2Tbz^ zYW|#!x*FNq=Q{ZVkr#QM+yh3r*89LT9;nR&BKCb?pGDpKz&?|E!OUsA$3<`g{2r9_ zx)^_=#QPG|l8)bplCGCRN$1O;r2FMi^5F_7`En)P1%IxBlFnB{N#`FxN#|>zr1Q1- zFZIZEsB5wRLyh-mvMb0OjQR%DQa{{?`fa3=-UMHRH^ZO6TcDKlTjArVZ-e*2+u?2S z4tOoR6J7%Ef)~KM;py;4Q1ba6cp~b12~WPm`%rhIz8|*32jG18Ae;vuf(iIAjKfFZ zf$&k%zZpIT_k)i+<>Lv=CnF8_SuGb&aU+;rF5rd|-ZSW58~ri=iT<-f((5_7A56`E zqVAp-wdNy4=H`pWPaX4@)cj>pt2s3HCj3|6Ztzto-`&rg^7ook{$59aXUu;NcYwcu zqv0EHTlh=34g3|{3cd+9M_MfL)B5ObecxXj%bBRF$6Q#4G~9QwC+PxF|HgPv?R_Rh z{l4*A)RI1MSS`}xf2aB%AUodvo*=Sb|6u$c_J^Nh9>G4;aQ}q9d=GzyQa}9#N_qV& z=2Bk&hFZ$&M^MV^$56`a-=UP(e?Td(pFkJAH6;LaP-CKo6!%W1>?+>%DvmkAjrUcMo%h}M37T9FD$}YacD|+bTl!G zDzmB5t!~97U8oA&i@SRH<8^rGo>g{FT*x2$ePyW0l#pLu;W`8td{4UzySBt5|Nd;b zwC1y}m?iy1-|3eI%w+~lZjurUPX9k(&YEN{-I{KIh`*bh<)I@MCOc{>UAXvTBrnKP@+b{O;BJF#)eb^SpeWeJYC&t9k9+?ePo){W!}^ zp6H4S)2TqtT!rs9RTndxr#8C@wS`vrMzsDvR&GLmwcdK$D7#=kLzj8nMIrm7S(7da zbz)*4d6WerS=yJ~{2kD?#e%<9B9w*QD=QC^CQP?ed`e~RDc)JuYxq?7s5_Ibp;O|9 z^x)-*URAc9^lxG-5JPEoOZvsxy4oJu$5}d)&1#EDkyb~4F3W`WqMB_YJJeca0dEdT zX3MUy#Z0to?Htxq>opl7+DBq5`xS&d%{HP_4K6#Bs$Lf5(~(~g&MCu0Pj=*>~<=%|&9T8~6z!{}nu+S0UsZ&=5dO+VSqz49GF<3i<6 z;w0{*WVS>atYeX*x>%OG%XMY^LCLEXOORQbfb8kAekVsFgQ2`fC~rw9HSd)TXeE87 za&dGw2*^e#sUhv%Wl~E>?P_mDjav)lIJSl&k;$&c0fi}U@>_41Ut|?u$vgXty4{-0 zBMsX0fIxmrE}1l)0y~Q$EomlIWPASHa5t&uI~8W#6|rvTsJLcpYh-~W-Yue*R;q`8 z%f+&M1;11D%cj~$Uhz_CST2GZg(XbWVeWnL+t@6N~A z=7R;gzp*=>$;A@xxz0g({nl~z-tVBUVVE7j1#@#7Zml@|xa@;5a8kXN^Y_je<4#p&d+6VK`7?I@lF%2hFc zin$brU;TdAYKerVQ)hR3yJ7EFP;~-{U#-dc$#(j-{{5>6oJzCIlXsUPP17A-{vZ!p zG{l^zM*gUO@nm-HXq`v$>Iru}F&m$kZ0KMR9LutUP@H)2>dJL2a?TggKZt3Y=~P|T zaDxU+j;3~PGkVwfJgQy=c+BO!l5}srgK5iVw+Wn!%LB=;j zE)PWga$avHds5_Qrt=dHM{JJC+xARj=xxQmju&ZXHskNh1wSKH*K;BN)${B9h~L9~ zYE5?5H7|~Ag08GyIW_IXTz z+rx2i2e=ocx72Sp$m(8|aA&wvWEX={G<-~CSE2e3tG15p&W;@kcMqZJ!>TQCw-?+5 zGFw|!2gkx%*a(L}TI;HTunAVd@z8)1;J>*Ybt3#2PJ(}h%p#vyMS4xA63<}kaX$$B;22UEPb#y6GoXclXSbD+m~lM@rUHo z%f=k^ui^IPmsMZN1@~0r{u@*{7uo)4elh!|JeYN9lQs=??fICy`lZ-{y9m2Y#QteT z?9bEv5^ctO>`6I++*SCp>^H&P;j+&}-9f@_ms3-B3(lbhK-v|4^`_ca+<`2LR zq3kz#A3g-%fe*vw@DcbHq@3t?^B4=MZ?N0s3Fmzw>L-n-ocD&qe#S17r&a$MkxrrM z0I~P1_@n9P`u7vmlHbom`CeXtQZ8O3+4^e5O!7HY7<+T)=UMEzdB}Xr{D8YY&yLvo z^#ZTqtazWn+Tu^X-}v=DfrZI->5J()ke9qg`XwdjqwGr`Hx6WvJ8n!aO15_AMD&#; zyF6p%Pd@#9`x)HzXaBgc@ce_j%%|rS!uuw~YZ*V=`vSD%YxK{nd$&(u54B%pzl9q= zrZVQG+MG+AW@OTuF4m0h7B(zT?wm&rug_TdTkbsz&i~q7(Md_B)!MxUv<$^YTcfk%Ccn25zm@+I88uL+?UR!=YK{> zdN#^=PWwChqRuz3M=)Q{Gl}5q)I8^e#$0>CPBOpTg-|=dI6%jWmciRp_4<~_Bl7| zziPwkYka(-TG|VFcI3C${##5LlATcbMkvNkMQMfDTDo(|#9V*gX2*_Ms8zLmhrW1Z^+Lna#UOl6$gxjF-bQDG#|rw#Udm)fHi7UG zwk(*uj<-QXoJhUxi$|h6nOo4A?&0mZ<17|uBgsNeRy*q@-ut!79H%^^<&UQ?JK6|Y zH-g66v)%mf`e7$^CdSPkIN2!Z&R(=|uWXddKZ54L_E&dJWzsTvlnK6$%KP-9<3H9% zLg;Q$@mPlg{&)v0N(_gICC{VQd0kvTnI%PJI~qnClrT@klX?c4tH~Kyp!QQqM~woj`vfWj3z{bSx;>4Zi=`oSYG*O$*^OVXc=SFTciyo9_u>AwU#Zv6k)I}i9Ms;z;~>?Ru$dePt`#?VwmvM4Gl zDkW5__p?!F7F(3LygP&LU78cu+_*uoTme|lx#qi`qq zFx(m54|(-u-3?_vRJbd=-LsqQx68lDGf=4Mgubhp4;_U42cA8JY7c#v6OPfk?*h0t zJQvD*=oxS@JP{6o$HAd+F&qZx!y;G@hr=4k*O;#gj)diK6b!)8@L)IwPKNu!ad1C4 z3XX+Ea2(tRj)#Nb1UL{*gu6iILw!5JNw6O*hTFr*uqT`X^Wjw34Nikw!UJGu$b4vS zYtKQ<&l}6K$X%FgdJd7*y<^1;eZQHjn87!EKf>woJ4pFtehmZ6!}{=70yCKp#XkRa zGbsD+G(RErVU_H^%YWG{<3F+2a_sm#;lteTaX6EC*@vxo7iQqToDWZ7CG%4zv!R%C zZ^PZOZ;VmGdD(p@{;y5pf3D6W&Xaw2%)_qI{dbq(?+6X2^Pw8{(FKJL&w z7ajx8GT$^7z%$@NcpCPL;K^_?JP|tSTS~kptzntQcdVvM;&a@O!~YTH3YquRe3JRm z*Ub~etoa9XYw%CL>U~bO?{f+~1N&3qS@1L{={sGYPv=AR`Od^%p6@JuKAjKM=Q{_p z!S1{Bwf;Nvp{sQN-8Az8ng66+Tqx9ZKyy6tTntCROW;26Qn(wu4EBSU!#?l|xE;I_ z_J&u%9`I_o6}(38ze?sqbGu-^4z_{U+t15lgxL1%&h3s*h@Y@%+`FUJpZ$5 ze$IH_&Ij1_17<;APz)WWr9*>q;`Ufm|A@$WX&nD-(X!fA;KU135U=M&2-d=?wctR~Y-x znmO#5c>kDdAx9gP537lw*=VRtG3F)ubL%VUSISg8UygcdJBXKK!gy3XbdofIawUC7a0H#D?7^wG%n-TL z(X#H5m>(_c9<28K71uqsmU2q?K4@9j_$#k#w3YJW-S@}!_$@+m~vz|B;e|qB< zzmMgwXUxBt#kD)X`L?ZO7#HgY>tpK&pX>U8_%!kdvwi@Xhf^~heJ|0+)MGF27h=!) zf!gQp;#KDP;r7gfZ3p{6vEPC9gPz{L8sFC59o_MvpX_s8Kk#`aZHCW_f8JWY4W9M7 ze()>YS?0Il0M-w_gS*H)H{2C|W3L~45nDf4FY5@twf6eK*68mWWTzkcJ|G-l8NRpS z-tbMh4}1joXG2*(sDhK=OjrynYF9kU4^X5AnY&g8zoG4nbL^N*1D(Qo%T`Y$b3>HK>{%(-9S z?$|fRTAjD8Q~!TY;eVdav)9|}2J2OS-`n_Owt)HGqeO2Xa_;MeF?s6OF(1QZ(5r9( zdp&@tmgdo{r`|D}Nxf!|O$^8aeOvvVMS^_j==O>@UXt z9C$7~7oG;sQ}YG7esD4C2bXZ)t-Tit^}Y}(-SxVDa3U15JnyAYp7%2N0=yi)1h0US zPgio^4I8eKbpzIQ*6aF#<(8#DX&NHw~hIz$V*dBkIA}$rVncQJ%N2&&yzg4*gqwte4j>g+H!wJ z!#yiz4F_3YarF1Cm-PeUb@cbGS9$6!xbMsO>i}PYQqNu`pS`q~*I)*G9s9P}zX5aL zo6rYWK@WTjn(%G-JE?No+iKP&enxxW8tf$>Am;bbNozen#QcHrp`8z~>%WYTRDa*k zaIKv$!anHlBi^pxxZ?kWc%@!^3Z))=2BrRd-sn2VQRY?VU954eGruvrdU|_Ccv^c6 zt^)ZJ|87b6u5{~7XdhHAyk)mr}8_HzTXLX3QqzC$gMMVDSaCgr03KTEzox551r<^Q%3 zcjoQ4LS8m5|6Ss#^>2y3pZ2jG;~nsnxZY;1!yu06&e#TlKVq_;*%R10sT#rOA z3MpRB|NZMg+HQ0`YM8Bm#eK?`)epC<6Sb@pCGS6IStt7cT_=)$%GFV&TGwe=2hzo& z!cAHSl5w{yUwIWc>vY!oTgy5T*=g(6lC0{Um|rdHL@nz?sq`y4$}&aCXq{@jEJwd# zKRH;l(#Q#-ZnRtfLjOD?Cn5?tqbPW?G&hPy6jyU>e4CS0L%DQ36Cc1O1Q7Q<_>DWK z7{~ub_P?~1#BP>#B8f<@rDhvrk(vB6-;AhTTQdtuq!>78&N%U{o!e=$oc zx?_`X+geX6>qSdUzWQ1hFju$8l>H{+)5u@t>mg?5JJrm@TQ6g=Y4mvAw^-a+FH-xw zmwZdi?N}Fj4sH*hhJD~;a0mDh>`R5a3+{;dHb{6SZ;8C?G5g`wus^&E?gY<=JHs;} zU(I=^!d>7=a94Od+zlQJ2SQ25?oiS}?bUSb2_+rOerY=RI?Y>zd2cu$vR;%|4+q0J za0raTp|A?FUX(in7TM_^j(v%5gyc*9A-<9B{8`u<(`Y`5NBAVKjfFXw_hnvMh}pL% z@r-3%W;Zwv4uIpKA5LIBtS_91S-3yk&NoTchw^*)iiKJZ(AUj3Mb?M7|5TycLtif8 z4uBotfv_z+2)2R;LlYhXf6H8A9twYevR?EpoDRQ)hr@L+0N210xC)lSmthb-2Se~F zI0HTg%iu~_4)23ucsHC0Z-=wsO^`_`-!-rjUIv-K@?8ug@H|)z&w{hz>97W#1fy^T ztcA;99b5qCzuNAUiN$=nB6vAK6df^H12DlvF2p7Yf;L-4Ao@Wlc1@ml3y0zWB zVpzPL^%9fSBFwoJxI6ZZ@m|7ZvRWkmOH=rNkoY!icu3ZXSVvr9Lh~T}t<-Rj=s8ak z?oqw3t{3G_!TdP>#=$3~ox>;LF!&T40-uI^XDl|KfrH?)a1ZRCgS)}!;V#fg_lt(C zw=Fhb()+xu>6QC9?yMJ?d6-{=o#E^Fm;PDSi=Ol@VP}+;o>lNc%x@8oht;BYYP)p1o;O_88xHJ3-7Q&xlU-%2`1Am3R;BT-1{tk2D2G|7} z+&7cwFrnnL2b;Fod*SZhOfv)S1346s{?{ke=YVDg{#wCbJWI@MDEG^Oa{t!wC+yq6 zAE5Y`dcjLn>qUDw2y+LxH|z+dK6N4;8#Z({yU-q_oS10Fw}Y3$?ctfQ4_pp+fQvnS(fwuQ9)lU0b6`JM2@7Em`r#q4Kb!=2f@9#$ za344T4uHGB?cuI)Yq%Ti3Rhl26heptgto;Mb&Q zEc^tHgYUud@Ete-z6B@3H{t&9H8=@A3yX>O2{;)(2&X`4UsG|vA5CzFP`(#s9AF-3 zmoLBKm6+90vBEMvuRISfB8(9LQ>zUXK zPc@@vE&e1wAm%!Aj-4M6^IUVDoiDKK3G7g;SNkK(Bkg>GU6-TrOztD?+qvJ-#4GLW z7%2V!0x0E3;c2^EL`RTm$c2SXg|W^v)BC))SH>Y3Wf^B=T$%A)#upiT`}Xy1A(|X*=T3^J(RKAsa=)0|W6Qq3mVJN!UF+jR6YBRy^w!1OW$YYwM+e&< zh)2(Dcj6hFUV6f%6_L7N;f!!qu(BTQV;q1OI~q)46bVFEJ8t%K%0ZGSuH)o0M?DM* zNTPg3@dcVre3lZgVU~zNZMk(4g7fSWC10?cBi@+qA3M1sLAg2NMIVu7ZtP%*37aS0 zq*ymmpJKdT4x3zz)}v7Te7Q8sJr++OT*IBS?8syI8vd75UNf8kQVxq9%MDDRLY zx1n)GMe;VCdYZcZtJ*MGQ!NRU&I$$5nC3JGkr>{5_dx;K+;DZQj!4w|rWb$g%$g~+ z;fio=IOH_6H0up3?!|T0qKnRc^n=n%*U$;Y<6WxpY>jLwvUYfS@lOmz*s3})OfkjV zu0*vLzfIPgBDc!87QLkrPB05|PKBJhn&P~RY=0yB(pzh}iQdkVT9LEL(tNj;d&OxV zb$81Ny7daASQci?>}d9K>aavnw8`2Afwf5vCuXiR z`_s}uO-h-3CU?a4A3jNZb8`z7Vm#EFxK>nq&~u-!)e$BR|Gc5cLfZUg&7IXOvJykt?!S2$~OQIWj7 z8M+M(29W`b4r5cVL?f4^tI2*KDNLH5sCAOfLH>Y|GZ`b5w>#;JKVPGt*Rm6->3XG4k$7%a zd1<&&y~BMQ-(xX{!^xZW~8pBN}j>W2X{Z- zp#Bx1#BekpIgy%rKl)`Wrk7iW6#0;LJh6P}BafHRKQ)ye&Ik8set7$O{FnTJlPV|b zp-(fkakx&#^dD&YJDC3G4F45Is@JDy7-vHkYp6N;w@@2d4X2HX#DO$6*9noFLYCqc zoE%5aS*g8^qZK>v@?k_@N948GMfh8;$EM1`yVhC0(R3q`fkKeqKOB*q=UbByO)Bw> z)cw_1o}z@%B5PhxPt{1_q|8h?EIOjuA0nLO#w<-qLNQQf8qQBNRnHpK`&j$gr9pkQ z`>AmuUKOq{BukU6sA!%wJ<8ehT5bRL^z^jV{E~5H;`xqysC~NqnI&J-{C*?3Jd@vZ z4dt)@s^<^(BH!Zg=Z5Ka&JC3B?SF^oM`{^jD)Kj5{`^k9zKUpqa^MkkT^y<>e={nOoJz5%>?x;W3b1{vE?y;Gh4w75q zuG-TJYYAL94Xaf4lTz3RN-I+O7klxq^(S7To$s2$O7yxjw-g&E`0>l-{j<)I)Or_B z$N#(@rjC-^@%$+LU(>H7-$4n_ACu2c)T1Q*vCChIiI5gONgTY5GNnzEkIzrc*I|=~ z)-m}rdg$1R6?M#D+ou;Gvytr2p8pTbsVS|-P3L3c^*GkQI43vBytS+RV(ygz32nb` zQiQKAu{>-ep5pG-SL&FmT7AP6qvPH_sXVDZO_bw*#_6FKm1r50yb(oJ4bEd=LbFV! zLag&dh$}Dge#OJ&4e6em6?d+res!9Co_A3sG|#$ijpeVMAfA4v9jti=?QdQ7@pCMg z6L7wr<)rjbqMW|WZ@A){QNx2-hc!j@XbnP>U_F;Yd?uG4cTC&|v6Xm=rz5`Zs7nlp zK_$9}d2dL5hAK;#yOEPKQ0FFIlKL~w&9JIaQu$ZPC|(li9LS>MsQCS3+e)h|*ry?@ zDNO#!jt!j$i~DmXhJrG$;Yxp$5nEN6l_9byQC5R`yPzvm^n2J9kITP(fJnG%PM{*p z(Hp9uEUBHi<4?%vr01N=DL1@htH>>@B6Lbjr%aqomQBz}>EWc0s#*?maN-Uo=XCqT zcq#)N3?f!Z_qRTpv<$8KhPaJ8pN0+_9^ia6ieh-Al$i)!KXT<`qj~{%N{pvrdc(ol zb)gzgqDZVEN&R?fXS=)KgoMkzXns->pQTU zly3YzL{FV42b1*PO`4szc(+IZ5NR23FC(9C zxnIG_CyR`QoYOKN?Q2J>mc+!6>(BtT&W>#z`+mauGYgGz<@_f4U8_DF-)q@jw3Z!5 z0poD=-mPW7+xE79E6&8f+u;@uDe?9;dfNW2yNGLdZ1QbetuE|y>u9Wt?RQ(N``yH+ zk^g9`9{3bFXEigR>t%dw8a*Cv^|83OFDPGU@^#RD8;BXveP!PLt=8#&x4R*;b9uKz zM$Ng`Lu!5ARS^GqmqSKNc^5;zPVz2*{o%Qg)|q!E+!>w*2f&jcv-No^;I42f+zm>6 z1K~orJDd-hjn1oww1&Jn5Gk*`*^sxKrf+X3=|c)4uL>e9kT(+!fk8MF9u9}WLtzm- z2o8tS;0QPgj)W87C^#05hNB@;YI(yTQbT!z;eJr^VJzGovYMT@3mgyqa01*OPJ}(+ z{%~tJiG14v7TftZ8T*cyr@*$Yrb_wbXSJHtw%M&N_G~{0JU~{d;gad!LnXZ{vMS}Ad97EFdbLjWyX7y-s^&kjmzr#) z;|iX8QC5_bm5ha5u@_4E>ePM?x=D?NxtJmTtn-z&B$j&JA9IB0^UK|lbU+Q)7>~hy z3uA%$@0r5?V%)nB?-ISwQaM*?VQ20O*^i>~}N2g{Q!;u|E~Aho`~Mp_A@2h{uC=#IuNB+AZX{&lY`% z*qK*0emC}StkeB&mtlSm|B|lfvCqc-1x@#h+}TR^ zOSU^^^7|Fhi>UbxF~25y5w#veZKrR*rNsLtJO-|UN5Z#YEqohR!FQmP=V~o)OFyER z*I+OG!F$BJDC>RW1Jc!sbV2retusGV|Lb(W+hpST2zRM(Yt{Z^W1Ve=-2YSK6Sx$9 zO@3sx`b?<#0kz$Hq4!yDe2H1w4a}X8`IY!vn1vadL%7d3a3K5^4uJoFJHdZKKl~2v z2>%6p!tV+1BV9jeeCuStTW${aKS8NKKjW`e<}dt}dh@ICo1HGG{m$>CcUjg3VvzJ2 z((h2;Ofy6G`>d1wZiMrSS)T`*p3F?y*QVip>YgQLb%*Bf8S8Yv+fOhD^Vd-JyRCz5 z;QLVaySOy``p-6NauZQew z(|XQ+H`;eEG3#?ea~}S-<-U^tvfnL&d3!hm%6_*);SR7E_J#Xq>?r%(a))Dv^bdaB z?{++7pPTj%Q2Phj@3trYc7}ye_Ph0lyTEQx_Pe!*yFm|>{ch5q><)kN^8Sa?Ze_ol z^rwTM^ry1l?OV7v{3qN8N=i1`}dRN3FA{I9vFhR!Wr;NSO(9BKh=u#ezR>Z$B^lYVkG_Ep%|zz~e`93JYK?0fTLu7kZH z``yeuI2U$;>~~{-D(`>jfk(g}J?muOoB0(y3a*9o;XCkX_$oXGJ_{GXN8mzu4_pLq zf{Wpma0$EsE`?{nWpD*N79I_kL+O`}gVNqtz*_8&hqK@bP}={AQ2M)*p!9bq!!q1Y zfdP0bd>Z@H;1tZK!}0J8I1-*oe#m(HEX*=KIGcLnr5`;9X25m0%Q)#g+^_MS&)IxN z*KIr(nis%s5VO{si?rTcEM~2*mi^`CrD}hfd6n8rPG&6#sXlVb@qF?{Cbc?;i6(^?#pvue#qSW_`~4^?4o;vp%O~ztVh2?H@KD zQ~Q-d;(0`<&-tjvvrf#^1*cZmC&?2$FPw(_hJ zsy)R1ZS)QsT|J(6gbQVSE#_{X_sw@Tp7+f)Fc&=Her}T?|hrhv( zp!A<>&BpeBer@*h?CHHI z>7MA%y`H6Boei?xHsX)riu*ZOq3Rd4_u{H-NI}!?&TWj=43oIn^Y1^p$)ehfDrO@_ zPC1&MR4Oox>~k%WJn2g#4yTkI@yJR1Uxt(+aayv9jsW%Fjhr_`qtqxoL_Cg!s4bl7 zN0|Y#p#B_&kAoyP66U=tRj@fGn(PwccS#eD8Zp6=LN6qElXCF(zK2nvh|HW>lWK&S zoZfxIky+u|!Z8!9`Lt0rf$H*bX>??uGF(yb7K@jYE}Bl)@NlWDSh66l>t0)^e@Ff= z$q~1r2I+O}C-J8cvv6gWd!NXt2Jtj2zsCit_v69Cx{&YQ0Wc-K_)@G7%FY67THT$I z%mAfRKU|qph!|d#v)$0xGrjmKo&92arx$)&sAS3*_j9Eg&y+Dz46$8%hMY8#PW}un zWp+6lw$B`M#WyUy_=;FR8OMe=#9FM#2B#N~Eg=$r!rh6dIqf_CikUK|7%_~x=&(Qy zVFzw<_%W=tM77tDM;I=D68a}s)!InAV-sX8f-muhA*zPu)%^Ho1WH3C@{V(r*B^>6Z(~AmDj9Ly(KK=G}(sjzgh8A1*#&_@rY1Qf?^0Aue-($$Z{1{1nR0v%Y%jV zJ+;wV#yn1?;}Ozq594%@r|ZvFWLpwfybq_Er@3FAm7jF-Rlf`9Z`?0MYxUaB=rqS6 zsp3_I88ZHCvj5V&(G$w2^RZD8n(oT7=~E*NWS#Ns)Ch7^;UhvdYAesr)t}!c<4=gf zZ{3YBY1XGXk|1YM*;PH{1hjO@qqsU0m{p7rnGTX&5vDnQ3kK{s#&0Y=_V+@(E?OIx zWcyzz=&!4(=!g7iqyo9N*jPuR+>75P^SkIjdtZK|^=X{$^9oO{<7n6EJfw*2`iIu& zalYiqbjh4e@8?p>pEQssiC2s?ze7^rr$v87Of^Wu@o%%uFtc!ZIf$^@eLGzfHC)B!e9B>)6)iDRyLjWS_O+rW(gL>p9$w zKjAqfU1`*7ku#fv5N>RU{0HLEcZ-v#KM+rXzNs|JJ1}R43T`L$iilZ|P4V(pDY0Or zG+Ky2xt6kwA2zvsi$u8F(^JTe z>SR;GB-?AW-_)J@_xDc>)l3;P90?7%yunSFQA<-Ffesw4SyjW^^yJ}Y(tp6jo$Ro# zVG?gYhPbu)K%!@bh=kg%^eadnQ^RKD5 zaTn6baLGge~sjqT;9hvA)k|1 zBOB3|;Xfg@Vv*F|UD@1--jWf_{6su6c{!zwA?Ij$5UtNmTePj`9Hxiq& zzjxlJ4Zg3PDJ`p}Z8X2^@N9<*jf~V(29oB5Wxb%u_F#v1tq1yR%j&|+Zprbda^kjJ z-sApF`5h%MMTb=t>!>AEC(-#5Ov+P9&~@^MbX~Ct=}L2)=|9oXfgWXD>8bY5vB!M1 zFmd7EIy6Y8Kuf6)QgcMhRupSPPIQpVd&!@l-sEKIE5e$nmAag=ar!T?pXxj-oyLx) zmELVPL5Whj`TIzNoFvI9lZkyZW|ZC4MHki+i>ZmoQ>kNWh6bUWhje@xf8Qp5Z^gtN zlD_|(udQGqTcu?HYsmX3vA<~Sd&>!76_fomdWb`kj6|>HXbkKW%+)#j8dm zdY@$668H3q=DT76tcuaF zJtURGI9)kuFh1*S_g`&I|0(~bsx_1f*Z2TI1_y`*{Sir{#=68*^?V8+1Ug6I?hF}^ zZ1nrO!FVJ-1alTxq+}|s;_;UKfy`}|S_Py2^XyT=IeLDfq;o)%=?oFxPmdeu zTUf{ui~Wt9-ga3gu5UWur`5I2IA7+WB>sGjKS&&Nh^dyJdeV_+aAIRlXSBD7zj%Mr zuzVbSXQyd&hWCUf)4RF8R~w80NxOWY%ZPTKf4QBDGH3X2EN}mjGR|s{G;4&^z}lVS zoO#ARc7MA2zhOLRn*KKp|D}e1L4$!|>fxNL+UCq}5QZmldBD`5UZ)O}vb#;~)e(ef zbbL)P>q?yecj|rorAHV2AFWTW%z8|3!0_)*QyWV6A-YdPo&wJ}n!s>=3;cdVzwip= z*wr14oSxDr&@$>gwK?4hWKC>Y<2C7fWDHlzQ@b6*xca_c|Rk1|1 zFoJdm-CxVzpHs+Gs+WTFYoWLmYo~pVu-4av{7bFZB=LJ7;rQS}bUOtYP0PBeh;-_u z`4O+52?4}|yl-9k>R#s%mw(%N#5yk;PiK?z29hpaN7|VG267M$>e0VluSQ!*d_3LA z=Zl54-tV$+N`7AbC$;+|x$}m4%N+eCog{R_b(7@w1Mem$Mdou8#62?jF;yr~OjgK9!uO zgiO{i;!MUS>lZ;FFHzr3(sL%r6H2`Lx{BZ5`f61vGjVNDUsaYN;U!~vOV)>%C>MsG zq;w?6p-B`;2u5HX!?@MD`~dJTIY2oAXz?oGwP9f&)nKr&5paopH=Mb6q`?t zkBn!GPi-IPqa&i;m}k_X;UbFmm@ryl62q-wuihFvF6)2y-$cKw)u-coHTq*#$Mnan zR{b%Ke|H?#|J&g=9#Z^?{usx@(!Nbn(f4arDPP_FJl% zh4x+s`wx4Z+v;6$M}N#3TYrqYqd!K8-j_A1Kju`p0}bs&*q4T~6z+(50VF(nUe>7o zn0n~Pehx&+FE0vt3*|-N&aeUwfaQ=`KlHn-QT;K~;cl2EzJc&y$m$FFUDl}nm|{q+ z&6@}rjppqK8I5WB_J)$aec))wEKS~UI0Wtkhr&G}yHWB6LZpPy_p(Oy$Ls`=Qq9{D zj)Z;SD7Y;|+8_NdYgB(s9^4o6R&YNk`7joCg3QI{wS!25=4C@(R(T#c5&oLBM)k-1 z04I@eU&CTM|0d)91?DO6ldP#yKKUPJO>>u%`EJ%~)gP0G?Lkc7JcIdQCRd*z+#yW3 ztb~Wc2jOAZ-vg17H1B|{)GzEtIC?21X7g&oGg4GD`%bei$6pBjF@K}HXP`eu$X7_# z>DZGV^>;q$JvnQpF^h0p5uZ@vtx$W_AA>%V)pA}s{vt*-?zzMRw>FL0hJ@dP_@EPC zO3uN3OSH&{|NbfbAA$Q8#CxRP=P0y1i9U|5@WX%#!~Q^Yg|Fn5AAr zZEr8a1;qOjJOaK9=fGEB1ilKx@HHsq`?{9*8^)WqSt#v#74e>&^%f_kiyoLYqCW;b zFl$7A4E2L{iN6WN^DgdE|JJDed&c{=8FK#*jSt`g_$m4EVb;a>0yH~_9E9v}DrQp2q=zk+|m{%a`p<{SKV&HUE* zUh9jVm#+8!r(KV}!@f)AzlcH7^}Uet{=xX!cK=bs{Ul}$2hDcqkNMqp|5e?86SKNQ zGl%ba1!R=rX+#U{uec%po2PpkTU*b7AOZCT~ z_hyagkJ0v7hM!gU(8Jz`w4TU{2=8wPR>Qw@*A(^H$lvLU#R8B zt~V{eNtmVlilLO>WGLk~1xoo%g*6$|%mau|$`6_!k=_I0YKZ0he6EJ4~F2e*w4V9s4kIuRR>O{PHq3%G@HfvI(H~>}6V}4dU>*Dr&Vg@3 z(I4|NoClwR_3%L``eW{ZN5bpjQSfp&AD#=3h9|;fp!81*ptSpia546a;1O^!jKU>w z7F-HT;4*j^JQf}Rm&3=1=QubP^9ncu9uN11Cy*a9PCgN{j1Nwto_OguPlg$A4el~d zIu-XjeW!_Dn66uT&Jg`E=npwV%vx{G)OvH4n6=(m_UDQI82W>A%?s83JR$L%FYMZm z`(L2(tWk3(&qe0NxJ&;GiT@JO8$*A-Mu_<`^K#76KSR=SrFn(gUnzQHw7-VJ9sVJ5?+r#sTabNvu-eNQva$yM&I9V4LTnRS*T5sOs zIi+8G8_Ib09Vq?hYO^uDFX$HYjPZ8OcrxSlj2@XqnNu?tXI`24TIRaUZ!@!eTl;4F z9`JqYYm?PEYx}HSvi8Z^KWj$TIaxPkJ)33db&7=+y)UALB~n#UZ{>&4T^OG*(RmeX z?Z8qa<47oV+larvCAudIIvE8`yF0gO(fcB*fm-yw)ca%NCC$_OGDPZE!upAITuHFN zHAUyQWrP~ef5-N8?Aah5*HpM`zxQ}+e~PHku-2dK7<64CAswm1C+}}z<|Zlq?r<%7 zYpU2b?aF>v=CtUoNwIw@VLc^Qxv65q8q~8Sxw(lcw`0ZEQ|!nFrx#C)-kRD_CA+_8 zgv*dGlU<;$O5LKjhOSiV6_<=lnv}C`(OaVeuC6_YskTw3TF-QM2Q7MQWYezbs*w#m zj<{Bf-Wt`tBJHr@xTIO{3)ecfRo%8EuJ~sL%j7M3Ya|P#_ixc#5`g+@3v;uyVP=O z4dl+^In9dr=DSae{+$;6JC=;ITP`bJ*{Etm)2nYS`giJrE&6wmHy25COKqdboQvwl z;h4ovbxuq&a>gJ#?WnU37&()zjXX%8$o2oOf2S9TX!<*{d3tNQHi#!tFG!m6A^)}d zX+%!4x*||J1Kk7tq>l=h+9wa=z$N?XO#krEoKQui8gcbOnB(6EDdaY1geyYP!a#}Y z6b$vN4%C)gis`MzjD->@_3gi1e@!bM(p0@l?2+YvD<9+fY<7`cARk)v!Z>=cTJ*xq z(H=WQ-!1>uz{LHG$-6yMZgBJXTlB(^ck#)h)EkCc^uk#E&tFY1%mhuA;T@B5+g9p! zk#hgEeE&5R0?c-0>hw?3FIeeM$v)=f^ z_{3OaylZ@AT+7e-{GMl=i|Hivf6X_JQk^JsjXA0l5=;z{rG=7V_W|AMk|TLnEcaIZJqcm7GM|uk+}0+W@%tt z`QLiB!B+NFiVvg5SDtS~YMPB$Jq-4#WByv~+u805vv}^_>}wawzV`R<5A)uJ+hcwO z_Ob1E!2ShKUvbZW%Cn=;xexn&zcQHRGjH*HC8x=lHxO=TJ6_&G8oy&EoO3_lwfNiB zFnm|S-QZ;qeJH+*;O^+YEFP!)iDJR=|;P1{?(shoj*ka15LR_l4u(esEtn7LI`9;689X z+!L~@;M)yOgahFIus@sxcZ9`oTR0hZhe&_^*F$2d~`U!21K(Zsi5!!gDJ{7LM2>y(qKr_m!Pr>*FN-7Z?}X>4%sv zGA_m}`3SZBU4p%o|E16aFT=hZ_sd}kyaFB!uT=BZa_Ru?SJNL#`@Tk~>4ogc|3+4| z%xUm?I2qmm_k%Z*E~ytcasOR0-wgY~TcAAWt@!JUHk7+HA5GWzk7`PZTEXM+=)i0>^>jlgn<3-~oo>%G@BtKp@ z(0@Wcz9Q6gL3C!kX1t;HuM5>4qLbqr)r;~gPrnMYl>1w70el-uy?clId#MepVFo0h zv|Ty%;yn&3`Vp-tAK2vpF@I?M-7XK<^`FLCbbyKdTH|B8d?4m^2JvXQI`MsqS)Thd zDDCKTDEZ^KJN#1AP#AJGwoiLc_V!KU)G)MNj}fYKe6UN?wql$6N=ec4s3Y-6wOMm|9N??0g?*|^F&GON48%6Bz%-&_`!LyfK zj;X2*mC5q{6f{Q^S^BPb#aol*sTywk)e)kfr6L z)2|$C_;)k>+Zg^WRUl|2d;i9H`pGFA6Fft$e=Jqp%tw0q=~?wIKn^HKpM!?&p*}hl#06YXil-*z%PHePai_K*EKhn-tsOIdprXIWo0#?GS2!6 zial3P`4e}a6snHY)E3nQqUD9f;mSHBb3G6(Mgm(A=!uWHgP>fJm zTx2U}m=q#yfs$|qRkQcT!=Y@SZQ1s7cT4ndZCDHz5?@tWsJyPEW1@RWpp*#8G2PuCaDt1e~u)~G*qw)Eb| z^Cx!hs&kOAQ$hM9#)Hc6s#>y1RKLgx^})hWWl1O)WR^KlS6i;bZ+H5v{U+8i#hS3B z{HP!XO;G#9`&0&MN+V*Gl)tKX#ya(c_@dR3%0Ji`{hj}F;sjy9oQiRp;ellUf% zNl4ZoZTpw)3)Z7)e;2>Mw3ixDZ@@#;M5s{Fm<`Wb6)F`sNkUS+57vchXH`Y!^7Ld& zVE}(~sFsGMH#r_Z^-HrQxgN;AC8rz2|*ys%CMy8=6ft!S1s>`!qRF=Gnf>Pq*&o{B|i7K&7XL_gN*AF-BYjE9WVZP zFZ@-`U6A)eJewLXW=%DJG#?rXAb$4XH}0I`eHoQwhl8AY=BR6M?_#mn<7O3&bPdmk zR@KXZD{%wOo@w648ZBGnZK6o~ypOg7Hc(>3k#1G93IoBQ-NDIwCI0-*xNKIarYclX z7~x2g8eTR1N~`O%mP#bfb)2`mvCNzNv&dVdcDs6Z^=vSIH!b&z&}bNCW+%d|P9@qJ z!^~zShCBfC@>pz>&|E1$llYmyZ=zqz=Lxa9FOU6q4F3&eR^0KwoH!GIw#O}gAMv*> zV=u?QP+aB7@@-rDd0TfhmV4Fa0u)N2SIwbyn&EjJ8uBwZJO5~ z?gab7o#FP7S4Cbg$S5$c05W>Z?Fx6p+y!#qybf@8%xxgGKQ9|nJM%K(AZS9q?(%-` zxZJxp{2A^8zk`FJ#4`kbi+L#g5)Ol(!y+ipF&xTsjewtEKN5ZfM?rb6(eMMzW8j*O z<7ECm?;W@wY}09+%-`p&!aSbzzluLdzD$sLdo@GcmwWez@4!iL4P+><`8OH9he56j?k$N(*GDGb8}a3-7&XTc+21)KvbVKuCRQtk}J@@8SK zhCw(R9tLU5S|6fN>H}{atq*lj>cbo;^;q%~9%(-wG>Y2p_cVp>Jo>_YfQjABJP#N;n=q0*m3Ja2k9J9s(bS0r&)*0iT4k;8Somd>Yol zXJ9>i77l{X!6EQ@I1s)7KZY;DLiiHg9=;5F!dGBEd=+j5UxQuX>#zfS1Ga^4!fdz- zdf{7eL;L04x8X1F9r!P}8h!=eg`dJT@I&|>dSM;dU?w_JplrK5PTGg6K2% zb%wkweeGd;m;*b&4A>F=-fp?K6Z`>ohW~(F;1_TUxDKMv-1i~Og{#|j75(M;ueaMu zsQm%-y@Go;_yRO~^0PX^d z;jWa^*3=jDnfpd#9telS-QiHU2OI?VguB5(us_@j?g00O+roWd0UQkT;1Jjq4uxId zFxUYW!Pam%^uZC(14p7y_~*8xM34EhJkkSmziB(h+?RSIX6RercDZ*y_z4^fKY-)l zYB(Os_<{Gv(r);l#B$b)*za!|OaEq>mu_VgGfp(}Z)iJN^q6b8!oL}~qt875nzqwS zYA*IN#xpuzLHGkrqvIv;Ab0^h7@i9cfoH-);VJMicmkXbkAsK9WiS92!4h~3EQLqG zAgqTWSO;hDyp^yFb2%iPoU^gadlCATg)>#J`z#Z4?!mY__KgvJ=IFVet^Oya@Lx-O z8#dI59&_~7^ZrL)^BDZi)o}Afk9n?ygH-V&M2~syaLmvg1doCP;C$Ez9u2pF$G}{; z0B!*n!cJ|E^)7-P;9}Sg`z5e7Tne+H^Bl)=KgP|X$DDH?c>lvLjFMNV{qds5-2AZ3 zaxX;h{;^*4ndAQ?&PX!MyRbhQ-Uu;cf2!y&H?P8c8oUr<*7(j)_cK`=<-7sxA^y)6 zJ?7@Am?7qK&GYcziF82B=ZhY5b2jdfe7R8bSMtS4|HZh6alZr}1}`PNd>34XIS=#Y zFc)4SB;1v-9pj$kq>- z_rp5)AmJi}gPfOgtoI@8C%0baeHe~yeXMsS9EJNMa2R|P?hPMc zQuFg^^C``Tr_E=uZ;L%NbMW^p<~Eq0!+b*y?|*nDd;v;*d=Z|H`6UhiGMdaScj2kn zzY15t*Wg0qV_pLX!uQ|+ z_&)3dKY;o0Ln!6_cd_R_AHgozuhsi}Y_7B2g*n)N0ykvy{^ve9+~+gQuVelkO8fc( zK8tz1hX2z1%61p7#Qtk|C;W!+*@XWV^Xb|DFu$X`PR9P9a0SF{F3$d!`6K4}n7^mI z=Vt#P=56G=6Pgk1eUKhU??m!8Qx!`=~GW zndJM9>dyNg`(Ik|{^z-+zx1npf6q>~8S-2MJUhd_kn-U>XBVNCGc^A}_}$>=a3K5; z?hcP^y{BgnSO*7@AJX2Tw%@(rD*WvYpM(3rN8n(1CmaH=fkUD6gTvs(n2Vsahv7o% z!w4w-;z%g{;3z2l-e`Ch{>Q)*;l6MQ+z%cB$HLig94v?9;dD3wN`E;KO8>Gylzws& zlzy@pNDQJ* z>DQJ)>GzI>(!VW-(w`j%ug3ohco94vO8<5OJSXc!&&lNH>DZqHPllN3?@sZYCT9Gd z3Z=ipOh0tG=S%z`NmT@E*7v-V2Y0_rY3tKdgWcz#x1O9t!$;t5@KIO@AA`N% zm}lzQ_a>_@o2!(Q+sDCM&jcE|iN@p*}F9p+y$c>hD` zw?4&Q#zmiLz5T-Tx%TT{c-CVt<08m;L45yXmU-r{FyDyzYs~Wg{s!|T%-_O&;Xj~^ zqy7npVEztDJ^dGy{{MR@`Sb&n{{KfP+NcrA?3G~_iwft(*C=7^K3JuAK2QPZ<`_g!8YCk+YIUNx_f)rW~k%Co>2OcUQqgx z-cb6HZK3p!+d+9xZV#p2_kmLHcYspw`@+{4ZS4qOhW+5%un@|3l^@D?Re#t4?gTr* zouPb>4e-i$-!9%=d0zSMgZkaK8|GYNpm%rDE8l&P{Mf@gNauI=6l#A6%_qHkdG}HK zy@hHI%?J5v9t`h*L!f-u4ds4bzF&vI4C}jEzh{SgjjlI)M|wxV>*2ommv%M^O1m2k zr5%oe(k^kw|5)#S>VK?v9O;wx0lQx59q*lBn<4FIqIZ(|gOWdyCb6vUdvp zq&>i{mwKmpr>gxl??KqV?L9z9JvmS*<3q6@kaMv2Q1#FIU;Xp`$KSwKhk2)CzJTWz zUhggS9uCij0eC4afj7e-{-vLWymvz0nQC9=odK`+mWf&4L*?Y}-0ZNJHGeJpO7ASS zukco@eWj3is)XE!`G1Xv`G4a1-Z$G@i~G;M8lk#JZFe!BhW|R-evWNFS2@pHPdFLB zK+<)D_egzC-v4So$~zykjAtOvb&U6DwLiwY0DBqVK*BAgW?KC#)N)^pS?b{uI0i0- zQeT&O8eZO64cvAxmJ-_g)3PyWUiGH2I?OJ|9cldjgLaeh)k zVtiH6x|)h8Vi77L;X0G4TcSUeixGi_P>ppS)3%B3Ry;_WAQw;=nuh?2#Mn>8i^Qi4 z@7&M9dVfDhNKo!-6g2G~lh57@f2rg^W9JVPxev9NXi2a{{S#G!WlYtKh}?&3i2O;A zBS2(1mHqR2kY`@BRA;xR5KzEtJc0+G|x4rzfUwA2JweZR?kFF zIa*t5`5lf~^|ZR|qS>gInvFDL7^jebiQ%s|{Bsar^vuO~1@enIQ8B5MqV?}gqN*bq zRpJ3F``THUsvPw>{S(V0wUOb0+JHY=UsWpQZ)+tkBv{J)Ob$1>ysomODiE%)ZrN!4 zOAc4e{rn>XrJJNMqViDbtm;U( zs@8hoeKr;@bv@NH@1rhF&S}OoEmX2!*iMQ*$*}a&6PGWw(=8uk&(9D`8E9_H>2XoHC2I%SXVXDxqH+6=5f(_k2?2t+SU3hlR=mbHb6D3DuG|r!4t$mdji1@jq+&yP34XrW*Ph3=;FkllY*W zME}jEr(ZUIbFMKPP44A?Ah{dSSJbS;mU^uG^iTKr5AulUy2qb$fTs_?u1uY1)jQb% zo4Vh2`mxmgQ4p!ZejHd*i?pm$l_e&F8FIOpS@(A~{R^9{QJb+c*BCjo(yz?Jd8d`~ zRug5dqTpQAns2;T_~I2eDm9s(Fu~atfW{vY{rBf=aM$C{n#_!*n^!R{WDYk8dJ1Sh z)pnyT#a3=AYS{~DQu2DY1_m2X{YpFaG6HbocEym;0w~YT~vxoLt!wJ+IT>#QjO#sw9k5jmGNLWG%r^qIy(n z5LYLD&Dfi263wkPQiVQ}G~fTFyk~0yt{3Adxyh!Nt2IcERv^3?EsxBNN4QYpqdfk< z^{y95DmMMO-17hWX|V&*Y;1g3T+63ZWmMkvD(~H3UuIDNG1pK{!7xT9Xswr|9h4z| z4e#U(|7TwRSzdpx*ME!0zt;5Un*LLotjwFS+gxbm9Fcyvnf$VCRy+F6$oWLt(I^^P zgg#3~E>7c%`a9VjXNN!V5^Yv8jx=+s%+1i83we+V9;AdOUXi*}_(S8W#1TQNZawUo z%&Uum65We*;IfJ%--cr_O`$&<>lsGc%CJclI&my^xifaS#DjkKOFY>*=X&H#79WhA z!P=&unCrEN4AHeU)aop0uHh%Fgh^QJ z**VqTX59XdJ>`4cW|dcmi3|$<)F&E~k)1Ov!*wgeX!N_wwfO_8&%3)$Kw z8(|qn#bY-_qCK5*a%E1-Ims>OB-{IO{IVZ^WAmxD-iuep8NDo&L4uoa6{Qz(cW5s)?@GMSLQDqvs?Kk<8xo z_vEZly|ua6c_*eh{~}wPrGdz7I$LVvFIZguN=yuBx;=SXhF_4YmOXs$BsZ zzCV-tfz03A5H) zTi>q+%>lBOD(UBv`LL$TKfXn`pxD|{?Vn;t=4aD(lttQ*6;B%dNXvPg|7GWKrr8gd zM=F_sqpDVwS&gjWxU5P@Ne}Wv(Aw`VOMMm6v(2*FeZ*z$9Tp`J=CTSwkAoK3kt~4EC8fljQf9<)fIaK1!dG6}g#20^$I-*4l z_4&2e`&#oe&R86)2IrTyQhy?cL+`}@UDfRVZcRLQcL?r@?R%W1Qm4Q@khS~7!cnSF z%H8{sVU}$h`xWt{HA)69U6ZJ05ae%(R$@ECAolVm>B|Y&5+stz!;!mFD zJZI|r*ymToV^4dYv*EcFcBBWTmoGyn6pweQ&9XId6{1Q@G`)p_D7*VZ_MDlO!0oYb+f7 z6Q8j4=md_vw!~}aM*NGMYUB4u-3iVqpWAwl;c|YbM1jT)xxA14f#F|j(TbMyrjv#I zQmyBT2$LoIE8}*NXo>P8vU)O3mqBs8t`pW_Bj!>y$$v<^AaSxAg_p9No%&?28^&K5 z&XlH#HK;so+|AMV#n{cBPhkEPzz2CggRU^fl71 zyAw8kpJcK3m{@y~Jhn6G6D&lCsf^K83VGqe;gQn1O0@7zvS)~*{ig2JzrWuJp~)6a z@N%JfCVe@jf3GaS!?Ns;T&Dj4#5MSnopYz0a_y1@KugfZ!gHtj-6cC6tmPDE^~lOb)zh2!eh|H$+VHfc_rhPId(!tJ68fkF zueRP6hEdR%e`{P(9GJo6CVtQqB^Mf|HhXRLKWX?+Mq77^rjxpUy9AZ!4^xG!C$2iJ z?HB#$m!*Oti(MdkJ7)J>bUj7l{-(At`k`a_W<{ z6T~kNpt;&a5>g7nwT$T$C3 zQCTi8CpOT@tw+e8X58N$&TofD@3Vf-x$|=~#TU!hM&Cn8`RY!eJW`|Y!zRL|c&=Ff zp5u{N4KyYA-!lCpP5&jEzoDjVYKa1jr`v;;#8Itl%(ChZ?gT{@Bcq(oSq#Yk!4fDQQi(U49H~Pi1mFY z<<8OzyEG%bC8}_f<(MF@&5_%Ujn(g`I&ER}$+_1(PQQa^KSf$6?emWeIuq-Es`p-E zU7zoKLDbu+n(IzgjV7pozbVVbdjIRbQ5h>VT7E8n@-EA7I=;rZ3L&a7J?PJzEfCgQ1ACMY1SPxw#5 z6Y{mLig;xrNZ}+R8G>0j778rX{@3{#y~Cs&7=I*@jgHh}aNj~leOjCh&QUY?t63+5 znRu6^NFN_YMA!?=dV`L-H?Ycd_9?u6*V}%od4v__Z~0tezlz|+X(kd$#tK~IQUP4# z08+8cmLkpy(g)V$TaTS}bc2H2g%=~22;mk4XDLsSK&x5P7SIu&@yl}javckoJYatc z-F&G(9=e~h)`c2n+N43tqMS1N{^2uUzlwfW~b+YyWIzqBXG7`$GSeRK?T$ zWX*$=RYZ7T;sYjw`;zcl=coJ4s{RRQl&FILRu4|ky50-!?ZK;kf-(P3<54l>Ki%(F z<(tXR-=3%ZO}cng6wMjZ{^nFA+%;!J;)5*`0750JkDZ zd2r3pPx%~rzR*mW^llfrvMY&;q>6F3`UmTFW}b);^Q52&s!)xq2kG#Jh5tb<|M!)i zH!vKj-gSf4-u67E{2kHnulU3WUb2AifDB787qU1YSr7r*r}}J}3e>A8#I<{2}`q|De1COGm^5L2EPPnAP8DzmmJz zx~hl&%7^I%pW@FC$kaz-|MmG>?+hFT`kH-UbWpIyg`e_!>iLAWGoxu&JUUX4LC(>rhWz|NNgmllV0JqVxNxp0V$zTQ z57PffioIA*AI_OVAB;ClcyfT#-FKw*oHTu2bclWj`~WFzSIBeURE2F%WzOE@|B3-{Fb=!6?stfy>me!$Oe*- zmd`;eWQx8IlyOI=xL~Uedth^WjC+JKMuas5!KW??q;khsrfDZ-Mfj6)K-CF%CLQEL z->3JJ_)ta~A|jPOGd2(vql^RjPwiA0dwM}35lR`-Ld3;H7E2_mdv9ye@i6`o&@00e z;}aD0eSNrndWZT2_`+3y+HvFZV*fsZG(6dAr_9s`6EA82ZGSWX{=a-*E*2(&{?DUa z-QiPJ*}M^eotwTeRr&%rxVln!;potyorh~%%DgF-PrxT{=1m|Fc?gaz*umTy3#V~t zCk&m+$^cGP(4{tEeF<3d_+!zTAGAskTI>T2bZ>M5bVK z60K{AjVk(9Qd)}-{RN>B`U2Q?+I0W;K2yB@)C`RO-`w+yn<-Q&g9f67#{H5(G+Zp z1u1b@!W+d4j|2LnsSiSaK!c*PA$hOArK9h8gRWKb!`QF)_1O= zW8I>xQy;&){}*Kx%V}!LMKfQ-J;+V7BF7b&bJ3{6`kuVJ;UEYLN`SN< z%U#ck&n%6|IbA+#0CeF&(_Z7zrB&aoY+B+V`0s(yba**}HqTiU`(!?K|ERsh+ z<rjU!P($lQ!338ok8jCaaJG+Q7e$x4|3Rep!3?>=%Z#ZYqqlxs9Brg?30Yc3*RSJYb<$(uSKC)a|?X5{whb~SA3=3UxNIgt0g~bJm zi9O!=c!k4~LLgIDC5tbi`wNVk3IUFd?|>rFv=2Wq7TOwW7g-aJmBfp|<`C9#$NaE{ z4%(Zsf z?AJz#YU)=_hu7H=v9d%d6hu{6AZ4|y#%{hwkHrg3eynyy+ZA9m9+|zy>^Perk4Xgk z_Xe`cZyB_R47VqX zA0Y1~AZ{aI_H{Jn(Ygl#RS0W7SEsy{Ck}4!3IiJ-Jlxh#Uo!R^>q%5MB_b#zY zDV~*RewM`-5Og$O;DqASdRkfXefk3`V&HdjJ4mOkDkdLGTx8mq3C&nHD2ip2crncrrDmtciS?doC9p<6%HU&(_ z^cFVC0&D%uqW_gYA1nY+_}ql(|G4hyx}?8A7GDB8Pz*aNmnNe0S?dnMA9hOGr z<%rG!{n3198akOE9ynL^0)^Fn$!I454Q0&u!~X6`J8LKfcK=3v3Y?(H_=#eAM8tXy zntXu38DgA)!GVKv&<7C9h3Ig=B>)y!h#OVU53KK%=4)ZlQ(YdSLFsy9%?rQWH)6Ea zasFBRW*P>Y84y|h16ETCSz-)GO!B!}8w8&1lkt@1gksf{SDpri{l)eNK+8TvoVJ=s@IJn*~3tH*q802;>+RehCI(f(g#Sd8EFzCgZxNt z0!gGJOkj`-f6*zA1heh5U?F|d!y3<6>vx79)spvtNfjYiWv5(m>qUg6d64F=|#ZPg$v|TSeG*+L=8l&sZZd8|&K5PDCO4c+xq48pZXmd?cUv6Y8G#fQkSKYoYdd_# z1$r!?By0!`rh8Epvc&{f+<;mG4=aJjg6Ig}z!@Ffi70bEi1IaP=i-`5nM+WLa)=eg zTlN&k!&;z~cd+Nl(QN!c}Uq0(@@|oDT9} z!3EmuDzgf-6uIgOI2Iq$7azWZtSW0=qOsS5Q`I>K_@#Xm6r?@+qsgd#dVJX$X{1D_ zzv$XYLGi-FnvZ^E-y74jzAKhpY>K_^L<2tNRPp*w*B%bLUu&uxHi8iAr|Q?1D0NLe zi120xI9Y4E!#W`<2syFb@%|WcXYnCk+lHLhM&&5LZ2O46g_)gtTMvDo{#7Zq5D^u;h8o6)BV#6?VsUj+4YY3HLXFK zCS%Vl5mEs!DFTd_!$gbA$f{4R{WTN?tKIlKCSF$l2>XUK0qgt4`6G^lXgyO+fB1X5 zJ^Itd@zU!bn!o{mG|{s3V$@nnI_H&$kH9Mp*0_M&@!Cg^J5HN5-b4R|jep1kt6ypE zVWYE&^%01S;Jn&gF7(q z4sJjPh1pWeni2u?oVTw!Wjp|W*H)*#K_!*Xs7~z!x@g1d)YvRY>Xj8W4BS1Ft*D); zKqs@J78-(kLn|sb3gX{wNzD*Ix+5&9tHI#^#e#Y$h5S6TppL^Jk+a4E=jZh-3u-B( zo732W8V3H+))tgA3`)`u=F|)L=w9D2rDR?evCld*Rm=@-?vgOj$uW^CZU9H@N&Hy1y~i0}Wc<##9vKFSMaCwFU;$P%C5VD}1!k z+l{CfgP@-07*P)$z&*)`ss+r4w675^|Cahj)Xt8OkLQNedDv`dS7JzQg8FK=-;nwS zMe`ceULHW-4Z<}uq^uy_5+nG9MRO=z^{#|>=~x5mHuUkF zkp|RF3wR%5K-oh1qx}sibEr4U)_{tFdI){Yq1HgUo{u=V{L~o^7&`ht6CG`K_jR1k;qgMMG51BZG6bX)3hs9|Uk`Gum^0A0KL6m=ZjYg~Y& z5dH7xcMbfmf!{Uoy9R#O!0#IPT?4;s;CBuDu7Te*@Vf?n*TC-@_+10PYv6Yc{H}q2 zy9R1HwhZ?U_mdihdqwARywZ(qq&1{A@UMont#oL*p^elj!be&IXnZ1k!hIvX!@bcP z1AY;H;Ny*aFnC4B!GE80drPU2)Lv>I?c^Py`sX*;H{45V6x})qlCy;Pt9E&&3yi|x zOxTkf;@#Va>l5r15y5rh_KN@^VmKHR3c%7?s6-;9!erSEa&)MCctVhp#5Wl|7t0*Ogo|9(nP>620EM!H^1nDmMt%)`;8 z>CY1?A#?R|Y&^M1KH(tC4vC3qb=;7M{zxoLA_moNDt+NYA{I6&6D~4MDnP_Jbv?QL ze8ag&R|7;?(+kNQK>dL{Z>&t95YYD;c_XnCDm}YeUN)!5zyUHzkbspMP)(pI@;(q* z;BrB|2#f&5CM0p=m7uynrN7ro25HzJtuHQ8_~(wKTY#%}r6m%%3dk~002yR98C9@; z5;zBi6x@I6uSgW3W;jM>L4A=aSBeyXAuLWv!IOjSB7rcDOQp92M~PIylf_f%Wn@@z z6v$*KOtOe81u-bDJaH7XRNEXcZZgtQ63FP-MDlouOhKiuCxY|SgnXzUWegYOfst%Z z`g4tMJ)NGavBg5A=jiFlOeZACEFovCuOcL71e~kWWx`&4{UW_IAC1b}G6#Zkxjz2T z3!n+b3c8>AAgP3Km9z@=&W*1~|omsRN2dt5guxc8+7~$wk5=3NF@wg1_+Eu>(q_ zgj2_p%ZRLV;hb6uJ(~*}4>$`~v^;T5!w4wjiEytdC4J*$0s-Myrt2q@sG=<=Jz>P8 z!=c<%aL{};km<_kWAm3uL_Sg_n$HlyV?@Bkvk)3TV0_>r$&Yw3@_erAi6$8^e1Lpk zW8Wxo3XH?th!MdfxU?J}jLG2pUXQOFRE3e>XC1#Nu?))q(qXHxKgtNG#&Tr}oSAe3 zlv6HD9iaRTkz~;CpnM!Fg#j-i2{~rcj;i{n>ouEk6k{RLI2COUNkEOE_)$%pvA8d`F{M4CTcGBFGBBXet?Iq z2?E(ME$4XXDDn9EMJ_1H1Fr-Wr?e;#dx2cfX}cz(X&LJ@f?tW2A8j(RxaE8s_+@d|AUJhwo7LUwSIKGy54&d_sx-Y6M5 z25thhHK=HzEWZ93Db`UYDc}E$l4htNuFqN&$Qh+jg2)u~K2b5%K9t@grSBd}vM3lBY9?E}mkie;nP0WpeP+`*Y%utnPotQpWu z5YF!oZBLPe4_s^<9wrO5y<`ID1agIzas*0wKTW3kqKfb<3>FEv8IP%6rNGlezsIl8 zv6);zVp3rm!`#9Lpz=n2PTQ+Q#S&E@7wD~EbQ|aXG4rk}+;ieR4n_Hzc0k4#a5KC|@2XJ|Pc7g7g2nxRqu3%Uyok#k^@vlU~1`rXf|R;=2O~&UX&tW zWRTYm^ag7VvY!<)Zm|+NOZ%C3?cP{qRQD%q6NvU03PMW_!rLkI2Fey((0GD1oJwZ} zrGJj_63dZ~M9htWc@I}si9TQG6DZ^rBUl5_?7bKYN-IpEr3;pp1cFjE0W>(WafU*b zu^mCMR3O8(RBi-IB_DrpkmE+`Q_?gV0~IM0u!8gr5GaE9pgslGxabk^G0PV(w1G`S z+=XTxg%``fLeRt-cZiN&nL|3SX-{xM>`0I=O8Y(S2Fq^9t0E1tel$yp7?**4gH=4> zXPPdY-m5?%t7sQ`%?0w5Pz#VN7!HwVx-l*=?MX+7ijBN7biJ5Wp^73?mjW@2K6Gp- zj%@uDXjwyZkFf86^qJu5JynzC{3M7v%kxMAe_*nJ4~J;LOcfp>7n0skg~0-GJiSI( z!t&8nZXWG}jOF9G4;7HEDcFKROAH^Rjwyz0qC%}^QDYHfF`sD~uxf*v1e9cG%P$aM zJu3jJBuy2lmM|L`Dp(NFxj<=cVLPI@wbo2K*c6)DFGOCN?u?6u()LRgfZYVN$pj@1 ziVFtSWO;C6l7Q~)kSxXFazzO+pCUQ|HvvXi=;L(_(5Bv1hf@Y6oJ@oL25mEp%MIRh z$_x}$27ztY8+2C;jU4Jb)X9_Y+1-=B!|;@WuccX_(L7E&{zj9s>SMaMEpM5_3G9@^ zNpQD0#c{IF;FNI8Z0f20Wpj++S;ARjy2N0hlf79zOEdcngEEtHPL4q*OS5^L5<^So zfqayM%wJ8)fNI%+qRc1`RpLeeMg~Ck!TneiMMYAE)Ym(fAWaD!{i;m6yLXN&?^b3g#qleU2Z5n~!8LaM_330z3v z6A644fo~!3eFT1yz#kGgN=TI!y2nq22M{=qz|#mko4}V7_z41kP2kp0WAKX0*pR^8 z2|Sp_ah)a-cshY+5%^*P-$dYr1b&ggpA+~u0=I?~A#XU{HUu6-;Bf>#iNF^TcmaW5 zBk)%Q-UJ$6m6i{I#}IfHf$t&k2Q&_UDe41_t9Z| z=MwI_3HPf6{+ysOgq{tN`1{Z}&JT~kQwf?4g!@qfze(V42;2l>QIA4uSFG>*UHv4s0{0$)tvn+Uv!z%LQ_I|8?coT&2Fmd0^fy$E-I0`EuQ zF$A7O;7S^Yny08N!hIQmZzk|v1P&tQ>inD}@Dc*QLEuja+z4{6DobqwZ%N=?2)rMG zM-%u+0?#J!)daquz{?5T&|H&;Mg$Hb_v*a45qNh3_a^Wl0uLwffdn2+;35K7(m2!% z)IW{m?`}PTpCahX2>ca+e<5%ykV9A1ZBqj8Lf``kJb}Qa1fELZ=>)!zz&8?j5rLm4 za3mKG`GK0JsP_bJV5xDhL*vlf!FB??~X?3EY>!!wGyKfpZC5 zNZ?8W&mizQ827|&v7T@*An>CEev`mKjYeHYQ0KsQFpzE&Qdt0X3#?C#bhnXx3I~8D z0FD4n0h|Du0W=3_0niel6+ml%HUMn_oB@z+0K~tv0|1o|Y5~APfIk2h11tdmwhP}8 z(F=Zk0DJ-b00IC40fGSf00aZ{1wafKuw+z!08kU61_BHQ7z!{9U^oC5AR2%N5Caek zzy}Zj!~w(uBmg7=i~vXi5CVt*!~hZiDZoeoP#K}*015ylKr%oIKq|l(fUyAM0LBBP z155yz2#^6V8DI*)RDeu?X#iOO(*Y2lHV0rXz&wClfcXH60G0wQ16U4_2e1NQCBQ0x z)c|V%)&i^pSPzg7@F&0qfQl)W&q3tFaR(FFaj_JFaaCIP^c9>)A4ya4|E?z_MH?ti=QqAsRy z<*Hc&Yi;SMowfIJNavq#;sBMN-5YS#Y}>%gulH+!K($c=sGc1fwX0@df?~OmdonC9 zax+Gcmu3rswF{$^(1)b5%M7t)E@X#uByvc*D@{d#YOq|~#ig1j}mDOzvZ z+bCLI%>KzQWdm5ADyaZ)X5;|?)0PAv9q99S>_VUZ1FAWzhAKoYgZH@E9>jS+^3po! zCmqx&5Qo38=|>#xtEuskG^D9@rmy2m9_H(KlBf7Op7{7)#}#jS>9}et0kx*;z+Q(; zb>yt}_{T@|tPrT!th0GN6y%}2uDAZvcwIW8C5XZ?$M8QR*Fy<;);@SA<*t5yrp*@J zVGFde{k25d*q)k!k79f2O1QBpbVZAPLZSK)SwcsQybC)}2rY}mcK%5u^jo{x~kV?_7}7kWRPExz{?0(2+{c~GDAlY!}T zW<7FYjBo=SP9fXI6qlzf&H&Xz%P|1L2r%fCc+n@$K)7M)K$Tnr7pzc%=m`CTPBKA0 z23wE=1mzWE7c>Q-g%&jL@o@60C9RG4>Yt)-7``Ly6*T~f+!+GuSd>6CoH1T7BJ9D!nC+Lv-rRsga@!J0V6~}OAjz& z1Kc=9UVw`Zg(;PU0Qyyn2A~%t6QEa4@zd5F~Mc zevzmF`o%H^Gy=!E2*FYX2*Kh6aHT3OM}QF!AkdZ^pk-SaSph8}0rV1!j*1aNb}%jJ zW&M)Nj97p^c>t9gOAtWE8J*?p$UMtz%fAVxye!OKoxs}aKo7>}7?2s)fT6S8lFWgw4 zO&jNoU(i`nwSg0GyMKn;sp?nKs=u9R)U@0q;aQry`M@KGlfAQc)GEI5F!Mx(@ZtFI zxjA+>M~}(9vvoq)bF+PGH#>PBTD5YDq20c;T6Y`d1-sbSDx71KW;b>B)+OznXBz*p zE@1k_hEZ;Tla7V7JpQDrT7Fpif^XSw_vZ?~FKRhE=;rm(t+#J+=j6^T;YZ{zKR3A1 z?joZXxBME0F7DZTYhLF?V~(tm4GpU-U+up!&~?|>7JoU+aP4lTG+ohf)AZ|0tamo9 z*doupHaQ_-ML?T_hsUh@em^X;jWlmnP7G(J`>yS$1LXI|THl*}Z)aEkUgtkG>-}=# z-Mt@!@*S47TN9LfXn%c^Z?5JsN5vhTn{2jiaK!JK(f)j1^@lgtq&^z^ImtY@L+m0> zznmU1w`1>M~?gz{9*&hmK#fxoO~)<2bSNq(j?{Ce>-#^^caGkH>meWsPz?IP&wW zdaZJE!_QT0jc6~l-&FHkRa^&;C#M_r8=7sH7kX)=LD;yrW>c#lXUx_PxP177aPtW9{jBBnMuQX zotV3r+q$?@%b`XEeJ;BeF8%B47W)oQr;Eg%jUKlDG%?0c+RD`7$K=-jGZRKdy}KmI zGw?DBco+~vY1!!MUzS0s$FTxB@n)spfb6&0=K@r3R-3VmBPoqY5KZ}f>9g?6jgyz0^M zi!XZz65lBJJaIZq42BX8-rI?R32R(@?~MiXOXr~T*nn$OBsJ;X}bZlj3X@X z{1{mw?b_$ei~GKPHg@~e_pkCUt=(gKG~PZTz~$^_`>!v&c-`*?dObb3@rnqiZ)Hd_Ptk^EwdX0!V zbh^*nu&~9OK7KoLtG?5i-A+o+?A_fm#^0RJ9dyXshm!4y2`XukJ!@VI>j4MXKU(|H zc>A_dnUNcdVOI@@AoU;jop!w#W}Xf+V=L9Gx37b+w#5DTT2@s5fw*e=j~p! z)U0rOZQuhIraFMtJ{!A4a)YFR{P*yEo1Z2)n{fo z?FxKxv$b!%CT~t09XREWQJ0(64qtg#!SS=5ojxp|lfSuQ(xJgY7s4-{Gs{@&U*E2i zNvA88qb64lwAjtHdU2!Xch5z3FK;9?YiZkcoaw~}Plp~09Qxv6^&@7M9UIKOzVLf# zWpQRu{ZTgY#r5xA3XJOiru=U1k++GfcV6(#zHXUa(fmMTw?0PMVM345;&r|~w>-Nw z`PP;3hi9KpkBqO~F=Qt-dH2&I*Ed$X>k0j0=9dcXLjF9_+qCiIy4w#8zO{E>)bRwf z?3b;+Tr<6Xwf@?v{c9HWNZ&ZDX{Yr^AB=yP%9V}1yWB6hROJ65)1-F9rbpf8T-xYg z9BI0#q+|1)H=fOq{9$Sv7M?S=!`ypkn|*R`wl~bd>1qAu2iHECGqY7^YQ9saT79-0 znVvh_{ZQ%jBL~hFyIx2uyK8!%s`)I%Q4#6+s7Id;d1>-*Y2yuMn;Ug|>`}jdjzyR2 z4pR$4R`r^AT4b_2ILRq^bVBaowA>4)uH1a|C~UTLUTXVY&vw1fICcH#vvSeMN1kEmQLBx1^){;^IrXq{l27LP^RN3}c`L0wcG=2^uqGdS ztY5I`Sk1%NN7cGhZ=2cc3o~l2+b}6{TR^c*)QoULUs<`=&aVe|d|tcfPJ@0Yx0eP^ za~(bUTi~r%KQ(Y|yAFFMF;vPHV&M)N=C9i{oO}TpZwbr{Zq$!uEB0 zuDqW2wfTc)%N+9yVsF^Jc+};AjkC$BtR>qmTppDA%y`tN&ArbZZ%&x2xHo?IK;Q0p zQK?zOZa9D7l~BRYZ{FR>-CEaSmGJ1$eN(*0&05vO?cOk(buV}W?yMPH;^erta@y`= z@=~)2^#^tyvZjfxr^B`D+q#SoJi64^Gk&7&uuJuJym>!o{>9;0{AQJH)=zwxKJD<2 zt#y{Kt=+q3L}|nG53MqzmpsiM&`FeR&r}?7+L{^=d7?%9x}F#9J1#DEN~&n;!hc>< zey^;!+_j)Z<-;Y7`gqK(R%R2jUSzaw=mY4VJZV|IvJ-MbprFhb_!s<%{e#k8pF};Tt1p!{ zF&y^k%*VKT%}2Mnz2i%zUbs}%5DzT9?EfXNRb6+VRVV)3ezvW|Xw|b- zLvAl9jc&0gwBOp0ynUlNPwEGoz4W_%G&k(iePs(zzX?NvgKbuyUU%uhjo0U!bm})G z@Y<@(JuCN2``WX5Mv?nlPxsO`)yG>ER21;OIL2~$SGT<=Y7+VQdO`SU=|X4Q!-J~b zZ~WXZ-R{_lZD|#k-|@5m+|e%=9l3C;S z)0^GvEKg~(Tu{&YBBdB%AQ*AiG@x|-ZL{k)?}xN~=Co^<-Diu<-{waz5jy`C6emFJ|cYW!y6xw5-{Rr6hz-3qN}?8S3A@|AC~rbP1YaL#F& zRg+z9tUtZXtS1)SFxq-fY$=mwP7Gc7WYyxk_u}`zFNv+;VP=)-a=EGfhkK10eG1(> zIy33+j@>ttb{@`;vdCG`v#w+DMz8Q~yXEC^ca}Of>DuDZ%%e{)?_QoIZSK9qGO6*s zT}@rvPF(f;k=(oO&Z$=hcA0E%k)P7R`@!=;jTXqieknaNL|Qy!*=S4K-R)a_J(@Q_ z@n?;DJ+5r}v`*S~Y|Fh31|N8kRqIE{^{7dbgsul_%I4e+A8R>2UcRHh{6{C=3766W zho)oa9~DP`w7sxCc3gsu@4MYL!wwb{Y)sl#Hzpvv=dz*#+2G+n%nv`iv!$g{JWMg} z&WA>Ioc7<@J>BMPhZkYrx?G($!*5{YP^$XiIG^mY#TGY@yzUT{P$Mq5;fbA_QyR4h z%3mAu@av=ed-kWsyuQ@!)KP2kkt54ON@rIO^Pe^G{DLa!V1w4HN7kO=y~UolYjBdd zwrQZ{^EWMKSC$R$YVfk$?x^WC^H0lfd7Ub4(^Am7&7-U9u3y>S@aex7>)y|#x{Yz^Jjd6d*|Y}Y4KCl?PrE7|VU+**VL;zu z_xdHh{(soq z$^#eVC&GHA4Ym9tWjG)|J{0n*yF69M;t)t7zHah{n9z2IYsnj?UgII(_rPDtXt+r?E+y^T!{^ndduq zZqnEo_sy}B-!963v~|A8q16i<_D38FyqE9Q>1j&dl(k>)Triam4q3iDseia#4cb~1J-=J^($TrKQSBqULXT-0w;Ldok_7lO?P2e0dPWx}So83?Jnw}^y&Z;AvDxK=(Ts9+hSgPUMT75Ws z#cTV^nzvXulIxUnq@kqEmdaw+IvHpB20yW^yKVc+A3iqi^Y$#=>!Zx*Ik3w#^IAgIQPO-=jWcJk+Dt*1|K z(6)I>Sd!me&dIiuW5%@~pSyU|Dy!;W<5vwSE>0-AJk6~4$f?g8G|nA-Vsw%qt4-hP z4;mh{U(DIM_ROKpL5&u@dtxElyRvxqqi5TDy3~5zl$u(Eb+whqIZGU zHpHJi7O-Smt?iKplPw<@zWI1OfhrVs`n0lX`h=4u`>IUEn=B8!?Y+%%Myu&*qPcIs zo#@ILd)~eG`-|h}f86iZ^7F`R{3ZiFMm5^s__a7CaJcs#L5W+ZnX>F! zJ1)JOxHTcZze!-_{GK0Lelq*8q}puJ^RAqHp?#O!En6Q1lutMozN^*|%Tu4?FTY6l ztv^9w;rVc5mz0I!oR*Ep#Tx8A8@zAL&Q}MHJPHeREbYG}u+_vVhZe}|R|REHkPZ54 z>)KCan{EB^p=;-AGub+?$D@oZu5DH*_b;06Gx@m0ZT;u^-xcGU zj}A@yGO=(~k$c$Z=ef%dyETd^-#B9M<`G|Slt?x|IO$^ZYU$c(GrlEdok`!`XyP&3 zYa>6d%(V_H6g{g}%j@RkV*7rkacNt=XI^+W(qqn;v<2;~mL9*>@ZH$q1NSHgd*12X z+jOma_pz5gEgtSrJx(%35jU#LsGg&7!N(ihWABF8{&iyLkEgq9T|V&qqozQ zJ}Rnx^G4Hi-Loqn7ui40n%?x?-TikZC5}Tkb^N2p3D2d6J?#4SsB3fX_O?^WleQ{s zO2!^+)cROJ#d+8L?>kzYYu&oyQ^HoN%_iI1hfNhj3cpt-6vU-)FZr%1I^V@hkTb@7 z=?tR*A6LI_eRi(Jxw#voHYRz*m6bJJS+@9)ZG7KpEpr}@h=_Y^H7w%RhUIq-i!L`B zX&SdUZ&a7WeBs{qM^0um9p$s2-eLb|p3hJEH zpnkIbq#E^haUCrF_;A}%d>}ozhT^fGnaht5(-8x=6{Uapkv4QR@8-@S2Spwx#}g-} z*U2w>IA%&y`S%8H!ZD7QO+)v#G!eBwE7@auIOdG=;%tvMtt0oI3TV-wIN{b%n>SH@ zNs|xPGdwW;-onX?Hl01+|3;ggjb1k18n!QTj>i_WxQ)IsS;vM4CMc2;v?!7cGZ~J9tRd>r3{MFV=-Q2D@=iQye|8(TjSBF`ihu3g; zlfL<$i~K5{`e9?IgER7W*Q;ZFt8>E_n`=FPx#Dit7W2`ga%+z3>}hT5g)2n^e#wknlr@rVn*Qb8ROcV zGUtjtZ%*De{X+SS(RW{z4wtP}#I5=K_;_LpXHw|2uREVh26vAz-?rwjB+o82PF}aJ z88)lMz%GU2`UjtEdN8a((irCjQN4S{4qfE(s!zDcYG9M68}^u$%<_IOmS3IrYReAi zJ1%#}2Cq4_vn*oFhB_bo&i9J>ba|WKpn0Dwi$zPDcH^{J@xblPvgsbjGtQleD>zm^ zvW~xlWxn@X_mNfHAj8)agR7N)ALakG!^fq6^*knZAKP;|zsJC>lu(6$wmle#|cKjX{Ah#O&9rqPWfePRp;*IF?C*sF2Z4Hq@;Fkw)F ztjc@tq6UR$@ALjJGIU7H;5j$k9Bx#z*V?>#5m$R@r)|ugpMKEAxa3 z7cV%)ND&~dBxKz}z=v}sd3RS75+dNqWITja>kj7tP{N);Vw9G^7w&|J1&y=ru8cd- cx-!JwUFqbzyW-6CH2-?X0#zdtIwYR|18(SY1ONa4 literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/logs/.dummy b/tests/iPad2__1_8.4.1_12H321/logs/.dummy new file mode 100644 index 0000000..e69de29 diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb new file mode 100644 index 0000000..379c335 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb @@ -0,0 +1,1102 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Media/Purchases") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileSMS.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.reminders.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-journal") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad.LocationPermissions") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.iTunesStore/URLCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdLib.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdSheetPhone.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.adtracking.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad.adlibd") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (subpath "/private/var/mobile/Library/SMS") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdSheetPad.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-wal") + (subpath "/private/var/mobile/Library/Caches/com.apple.AdSheetPad") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-shm") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.AdSheetPhone") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Cookies") + (extension "com.apple.sandbox.executable") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]HomeBackground[.]cpbitmap") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (subpath "/private/var/mobile/Library/Fonts") + (subpath "/Library/Dictionaries") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/.+$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPhone/(?|.+)$" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (require-not (subpath "/private/var/mobile/Library/Carrier Bundles")) + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad.savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone.savedState/") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (subpath "/private/var/mobile/Media/Purchases") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPad[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPhone[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPad[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPad-.+[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPhone-.*[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone$") + (subpath "/Library/Ringtones") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Media/PhotoData") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/null") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))))) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$")))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow file-read-metadata + (literal "/private/var/run/printd") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State") + (literal "/private/var/mobile/Library/Caches/Snapshots") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Media") + (literal "/private/var/run/syslog") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad.savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone.savedState") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore") + (literal "/private/var/mobile/Library") + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage") + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/mobile/Library/PPTDevice") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/Mobile Documents") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad.savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (literal "/private/var/mobile") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage")))) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb") + (subpath "/private/var/mobile/Library/SMS") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-journal") + (subpath "/private/var/mobile/Media/Purchases") + (regex #"^/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad.LocationPermissions") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-wal") + (subpath "/private/var/mobile/Library/Caches/com.apple.iTunesStore/URLCache") + (subpath "/private/var/mobile/Library/Caches/com.apple.AdSheetPad") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-shm") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad") + (subpath "/private/var/mobile/Library/Caches/com.apple.AdSheetPhone") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (regex #"^/private/var/mobile/Library/Preferences/[.]GlobalPreferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdLib[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPad[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPhone[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]reminders[.]plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad.adlibd") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (subpath "/private/var/mobile/Library/WebClips") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPad[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPhone[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad.savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone.savedState/") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (subpath "/private/var/tmp/MediaCache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/.+$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPhone/(?|.+)$") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Cookies") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/Databases")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/LocalStorage")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Cookies")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$")))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Cookies"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad.savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone.savedState")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage"))))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelSharedUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.networkd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.ait.client") + (global-name "com.apple.mobilemail.messageuiservices") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.iTunesStore.daemon") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.librariand") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.GSSCred") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.UIKit.pasteboardd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name-regex #"^com[.]apple[.]iad[.]") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.tccd") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.system.logger") + (global-name "com.apple.calaccessd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.mobile.deleted") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.webfilterd") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.lsd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.geod") + (global-name "com.apple.bird.token") + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobilemail") + (global-name "com.apple.bird") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.imagent.embedded.auth") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cookied") + (global-name "com.apple.imagent.Embedded.Launched") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.springboard.services") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.eventpump") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.companion.camera") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.dataaccess.dataaccessd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.passd.in-app-payment") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.aggregated") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.dataaccess.dataaccessd.active") + (global-name "com.apple.coremedia.cameraviewfinder") + (global-name "com.apple.fig.movie") + (global-name "com.apple.marco") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.webinspector") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cache_delete") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.chatkit.clientcomposeserver.xpc") + (global-name "com.apple.passd.library") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.twitterd.server") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.securityd") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.coremedia.remaker") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "ScripterServer") + (global-name "com.apple.frontboard.systemappservices") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.FileProvider") + (global-name "com.apple.sharingd") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.TextInput") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.revisiond") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (require-all + (global-name "com.apple.coremedia.endpoint") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/printd") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.WebUI") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.da") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.mt") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.reminders") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.AdSheetPad") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AdSheetPhone") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.AdSheetPad") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.reminders") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.AdSheetPhone") + (preference-domain "com.apple.mobileipod")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb new file mode 100644 index 0000000..874e526 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb @@ -0,0 +1,86 @@ +(version 1) +(allow default) +(deny file* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-chroot + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-ioctl + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-issue-extension + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-mount) +(deny file-read* + (require-all + (require-not (subpath "/usr/share")) + (require-not (subpath "/usr/lib")) + (require-not (subpath "/System/Library")) + (require-not (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist")) + (require-not (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$")) + (require-not (extension "com.apple.sandbox.executable")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (subpath "/System/Library/Frameworks")) + (require-not (subpath "/System/Library/PrivateFrameworks")) + (require-not (subpath "/private/var/db/timezone")) + (require-any + (literal "/private/var") + (literal "/private/var/root") + (literal "/private/etc/master.passwd") + (require-all + (require-not (literal "/dev/zero")) + (require-not (literal "/dev/dtracehelper")) + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/aes_0")) + (require-not (literal "/dev/ptmx")) + (require-not (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist")) + (require-not (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo")) + (require-not (subpath "/private/var/mobile")) + (require-not (subpath "/private/var/tmp")) + (require-not (literal "/dev/null")) + (require-any + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)))))) +(deny file-unmount) +(deny file-write* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/") + (require-all + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-any + (literal "/private/var") + (literal "/private/var/root") + (literal "/private/etc/master.passwd") + (require-all + (require-not (subpath "/private/var/tmp")) + (require-not (subpath "/private/var/mobile")))))) +(deny file-write-create + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-data + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/") + (require-all + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any + (literal "/dev/urandom") + (literal "/dev/random")))) +(deny file-write-flags + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-mode + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-unlink + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny job-creation) +(deny network-inbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-bind + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-outbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) +(deny process-exec-interpreter + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny system-info + (require-all + (require-not (info-type "net.link.addr")) + (require-any + (require-not (debug-mode)) + (info-type "net.link.addr")))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb.xml new file mode 100644 index 0000000..65176aa --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb.xml @@ -0,0 +1,23 @@ + + + + + + + + + +]> + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb new file mode 100644 index 0000000..e4e55e5 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb @@ -0,0 +1,584 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write"))))) +(allow file-read* + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/db/timezone") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library/Frameworks") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-any + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (subpath "/private/var/mobile/Media/iTunes_Control/Artwork") + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/dev/urandom") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/dev/aes_0") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow file-read-data + (regex #"^/private/var/ea/ea[.0-9]+$")) +(allow file-read-metadata + (literal "/private/var/run/printd") + (literal "/private/var/mobile/Library/Mobile Documents") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library") + (literal "/private/var/mobile") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/PPTDevice") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Meda/DCIM") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/ea/ea[.0-9]+$") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$"))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-sem) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client")) +(allow network* + (require-all + (require-not (literal "/private/var/tmp/ubiquity.socket")) + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")))) +(allow network-outbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-not (remote tcp "localhost:62078")) + (require-any + (literal "/private/var/run/printd") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog") + (control-name "com.apple.netsrc") + (literal "/private/var/run/mDNSResponder")))) +(allow user-preference-read + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.CoreMotion") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.da") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb.xml new file mode 100644 index 0000000..f29386d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb new file mode 100644 index 0000000..5af47dc --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb @@ -0,0 +1,587 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read")))))) +(allow file-read* + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (subpath "/System/Library/Frameworks") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-all + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-any + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/mobile/Media/iTunes_Control/Artwork") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/dev/ptmx") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/dev/null") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-data + (regex #"^/private/var/ea/ea[.0-9]+$")) +(allow file-read-metadata + (literal "/private/var/run/printd") + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Mobile Documents") + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write")))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/ea/ea[.0-9]+$") + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$"))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-sem) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network* + (require-all + (require-not (literal "/private/var/tmp/ubiquity.socket")) + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")))) +(allow network-outbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-not (remote tcp "localhost:62078")) + (require-any + (literal "/private/var/run/printd") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog") + (control-name "com.apple.netsrc") + (literal "/private/var/run/mDNSResponder")))) +(allow user-preference-read + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.TelephonyUtilities") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.da") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain ".GlobalPreferences") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mediaaccessibility.public") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb.xml new file mode 100644 index 0000000..7555962 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb new file mode 100644 index 0000000..03a2314 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb @@ -0,0 +1,431 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/uart.log") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library") + (subpath "/private/var/wireless/Library/Logs/awd") + (literal "/dev/urandom") + (literal "/Library/Application Support/BTServer/pincode_defaults.db") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (subpath "/usr/lib") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/uart.log") + (literal "/private/var/wireless/Library/CallHistory") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.BTServer.airplane.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/Library/Application Support/BTServer") + (literal "/dev/zero") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileBluetooth.ledevices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (subpath "/private/var/mobile/Library/MobileBluetooth") + (literal "/private/var/mobile/Library/Preferences/com.apple.BTServer.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileBluetooth.devices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/private/var/db/timezone") + (literal "/dev/random") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileBluetooth.services.plist") + (subpath "/usr/share") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileBluetooth.debug.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (subpath "/private/var/mobile/Library/Logs/Bluetooth") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/"))) +(allow file-read-data + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (subpath "/System") + (literal "/dev/btwake") + (literal "/usr/sbin") + (literal "/usr/sbin/BTServer")) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var") + (literal "/private/var/wireless") + (literal "/usr/sbin") + (literal "/private/var/run/syslog") + (literal "/private/var/wireless/Library") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/Library/Preferences") + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (literal "/usr/sbin/BTServer") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") + (literal "/Library/Application Support/BTServer") + (literal "/Library/Application Support/BTServer/pincode_defaults.db") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") + (literal "/private/var/mobile/Library/Logs/CrashReporter/hci") + (subpath "/private/var/wireless/Library/Logs/awd") + (subpath "/private/var/mobile/Library/MobileBluetooth") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]BTServer[.]airplane[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]BTServer[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileBluetooth[.]devices[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileBluetooth[.]ledevices[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileBluetooth[.]services[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Logs/Bluetooth") + (literal "/private/var/wireless/Library/CallHistory") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (require-all + (vnode-type DIRECTORY) + (literal "/Library/Application Support/BTServer")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/wireless/Library/CallHistory"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (literal "/dev/uart.log") + (literal "/Library/Application Support/BTServer/pincode_defaults.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleBasebandUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOUserEthernetResourceUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "com.apple.BTServer.magnet.shm") + (ipc-posix-name "shm_notif.tacl.R") + (ipc-posix-name "shm_pcm_audio_sco_read") + (ipc-posix-name "shm_notif.tacl.W") + (ipc-posix-name "shm_pcm_audio_sco_write") + (ipc-posix-name "shm_notif.tsco.R") + (ipc-posix-name-regex #"^..:..:..:..:..:..-tacl$") + (ipc-posix-name "shm_notif.tsco.W") + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.system.logger") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.BTServer.avrcp") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.BTAudioHALPlugin.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.lsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.BTServer.pbap") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.symptomsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.BTServer.map") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.aggregated") + (global-name "com.apple.securityd") + (global-name "com.apple.marco") + (global-name "com.apple.BlueTool") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cookied") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.system.notification_center") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-inbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.MobileBluetooth.ledevices") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.BTServer") + (preference-domain "com.apple.BTServer.airplane") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.MobileBluetooth.devices") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.MobileBluetooth.debug") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.ids") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileBluetooth.services") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.MobileBluetooth.services") + (preference-domain "com.apple.BTServer.airplane") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.MobileBluetooth.devices") + (preference-domain "com.apple.MobileBluetooth.ledevices") + (preference-domain "com.apple.BTServer") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb new file mode 100644 index 0000000..bc823b0 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb @@ -0,0 +1,267 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/urandom") + (subpath "/System/Library") + (subpath "/usr/lib") + (literal "/usr/sbin") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/etc/bluetool") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-data + (literal "/dev/btwake") + (literal "/dev/btreset")) +(allow file-read-metadata + (literal "/private/var/mobile") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleBasebandUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.networkd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.accountsd.accountmanager") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cookied") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.system.logger") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb new file mode 100644 index 0000000..ef0282c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb @@ -0,0 +1,241 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/db/timezone") + (literal "/dev/null") + (literal "/dev/ptmx") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/lib") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cookied") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.tccd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.networkd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfprefsd.agent") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb new file mode 100644 index 0000000..2cd10e1 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb @@ -0,0 +1,239 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/db/timezone") + (literal "/dev/random") + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/usr/bin/codesign_allocate") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/Frameworks/OpenGLES.framework") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name-regex #"^com[.]apple[.]cvmsCompAgent") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.agent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.managedconfiguration.profiled.public") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/usr/bin/codesign_allocate") + (subpath "/System/Library/Frameworks/OpenGLES.framework")))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb new file mode 100644 index 0000000..3694c1f --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb @@ -0,0 +1,293 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/mux.spi-baseband") + (literal "/dev/uart.log") + (regex #"^/dev/bbcdc[.]" #"^/dev/dlci[.]spi-baseband[.]") + (subpath "/private/var/wireless") + (literal "/dev/cu.debug") + (literal "/dev/uart.debug.log") + (literal "/dev/uart.debug") + (literal "/dev/mux.log") + (literal "/dev/dtracehelper") + (literal "/dev/uart.umts")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath "/private/var/wireless/Library/Caches/CommCenter") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath "/private/var/wireless/Library/Caches/CommCenterClassic") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (regex #"^/private/var/tmp/CSI[.]scratch") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (literal "/dev/uart.umts") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/mux.spi-baseband") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.cellulardataplan.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter") + (literal "/private/var/mobile/Library/Preferences/com.apple.videoconference_override.plist") + (literal "/dev/ptmx") + (literal "/dev/mux.log") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (literal "/dev/null") + (subpath "/System/Library/Frameworks") + (literal "/dev/uart.debug.log") + (literal "/private/var/mobile/Library/Preferences/com.apple.tethering_override.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/preferences/AeneasCustomFlags.plist") + (subpath "/private/var/logs/WirelessLibraryLogs") + (literal "/private/var/tmp/csilock") + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$") + (literal "/dev/uart.log") + (literal "/dev/zero") + (literal "/private/var/mobile/Library/Preferences/com.apple.operator.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.commcenter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileSMS.plist") + (literal "/dev/cu.debug") + (regex #"^/dev/bbcdc[.]" #"^/dev/dlci[.]spi-baseband[.]") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.iqagent.plist") + (literal "/dev/random") + (literal "/dev/uart.debug") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (subpath "/usr/lib") + (literal "/dev/urandom") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/SyncedPreferences/com.apple.coretelephony.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/dev") + (subpath "/private/var/mobile/Library/LASD") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (require-not (subpath "/private/var/mobile")) + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/mux.spi-baseband") + (literal "/dev/uart.umts") + (literal "/private/var/CommCenter/spool/loading") + (subpath "/private/var/tmp") + (literal "/dev/uart.log") + (literal "/private/var/logs/log-bb-live-stats.txt") + (literal "/private/var/preferences/AeneasCustomFlags.plist") + (subpath "/private/var/wireless") + (literal "/dev/cu.debug") + (regex #"^/private/var/logs/CrashReporter/Baseband/log-bb-$" #"^/private/var/logs/CrashReporter/Baseband/log-bb-.+$" #"^/private/var/logs/CoreTelephonyTrace$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-.+$" #"^/private/var/tmp/CSI[.]scratch" #"^/private/var/preferences/csidata$" #"^/private/var/preferences/csidata[.]tmp$" #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist$" #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist-lock$" #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist-new$" #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/dev/bbcdc[.]" #"^/dev/dlci[.]spi-baseband[.]") + (subpath "/private/var/logs/WirelessLibraryLogs") + (literal "/private/var/tmp/csilock") + (literal "/dev/uart.debug.log") + (literal "/dev/uart.debug") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist-lock") + (literal "/dev/mux.log") + (subpath "/private/var/mobile/Library/LASD") + (literal "/private/var/logs/CoreTelephonyTraceScratch") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.commcenter.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-owner + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/private/var/mobile/Library/Preferences/com.apple.commcenter.plist"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (global-name-regex #"^com[.]apple[.]CoreTelephony[.]LogChannel[.]$" #"^com[.]apple[.]CoreTelephony[.]LogChannel[.][-0-9A-F]+$") + (global-name "com.apple.CommCenter.lasd")) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (local ip "*:*") + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.videoconference_override") + (preference-domain "com.apple.commcenter") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.tethering_override") + (preference-domain "com.apple.cellulardataplan") + (preference-domain "com.apple.iqagent") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.operator") + (preference-domain "com.apple.MobileSMS") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.locationd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2)) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb.xml new file mode 100644 index 0000000..5831a8c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb new file mode 100644 index 0000000..e6e7c18 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb @@ -0,0 +1,585 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Photos") + (subpath "/private/var/mobile/Media/Debug"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/WebClips") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Photos") + (subpath "/private/var/mobile/Media/Debug"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (subpath "/private/var/mobile/Media/Debug") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/Library/Ringtones") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/private/var/mobile/Media/com.apple.itdbprep.postprocess.lock") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Fonts") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataActivation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]DataActivation[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]DataActivation[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]DataActivation-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation$") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/lib") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilecal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/private/var/mobile/Media/Purchases") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/AppleInternal/Library/Safari") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (subpath "/Developer") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (subpath "/Applications/DataActivation.app") + (subpath "/private/var/tmp/MediaCache") + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (regex #"^/private/var/mobile/Library/Preferences/[.]dat") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/System/Library") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath "/private/var/mobile/Library/Caches/Safari") + (subpath "/private/var/tmp") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (subpath "/private/var/mobile/Library/Safari") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilesafari.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtube.dp.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (subpath "/private/var/mobile/Media/PhotoData") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/Applications/MobileSafari.app") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation.savedState/") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-not (literal "/private/var/mobile/Library/Preferences/com.apple.accountsettings.plist")) + (require-not (literal "/private/var/mobile/Library/Preferences/com.apple.OTASyncAgent.plist")) + (require-not (literal "/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/random") + (literal "/dev/null") + (literal "/dev/aes_0") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (literal "/dev/urandom") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation$")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.revisiond.staging"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.revisiond.revision"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow file-read-metadata) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp/MediaCache") + (subpath "/private/var/mobile/Library/Caches/Safari") + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp$" #"^/private/var/mobile/Library/Preferences/[.]dat" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]DataActivation[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilesafari[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtube[.]dp[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (subpath "/private/var/mobile/Library/Safari") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/WebClips") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Media/com.apple.itdbprep.postprocess.lock") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (subpath "/private/var/mobile/Media/Photos") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$") + (subpath "/private/var/mobile/Media/Debug") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]DataActivation[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation.savedState/") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelContext") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/asl_input") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (literal "/private/var/run/printd") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/lockdown.sock")) +(allow user-preference-read + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.youtube.dp") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.da") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.DataActivation") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.Preferences") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobilesafari") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.mobilecal") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.camera") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.DataActivation") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.youtube.dp") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.mobilesafari") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/Applications/DataActivation.app/DataActivation") + (literal "/Applications/MobileSafari.app/MobileSafari")))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb.xml new file mode 100644 index 0000000..34fb0cf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb new file mode 100644 index 0000000..160e121 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb @@ -0,0 +1,240 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (literal "/dev/random") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (literal "/dev/aes_0") + (subpath "/System/Library/Frameworks") + (subpath "/usr/lib") + (literal "/dev/null") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.securityd") + (global-name "com.apple.aggregated") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb new file mode 100644 index 0000000..44c9410 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb @@ -0,0 +1,253 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/dev/urandom") + (literal "/dev/null") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.imdsmsrecordstore.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.MobileSMS") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/mobile/Library/Logs/SMSMigrator") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/SMS") + (literal "/dev/ptmx") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Caches/com.apple.MobileSMS") + (subpath "/private/var/mobile/Library/Logs/SMSMigrator") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]imdsmsrecordstore[.]plist") + (subpath "/private/var/mobile/Library/SMS") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.search.appindexer") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.searchd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.ids") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.imdsmsrecordstore")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb new file mode 100644 index 0000000..6cb1655 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb @@ -0,0 +1,929 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/dev/urandom")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$")) + (require-all + (subpath "/private/var/mobile/Library/Caches/AppleTV") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Caches/AppleTV")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$"))))) +(allow file-read* + (subpath "/private/var/mobile/Media/Debug") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.Radio") + (subpath "/private/var/logs/CrashReporter") + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-AppleTV.log") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]frontrow[.]") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]lowtide") + (subpath "/private/var/mobile/Media/iTunes_Control") + (literal "/private/var/mobile/Library/Preferences/com.apple.mmcs.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (subpath "/private/var/tmp") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsettings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide/.+$") + (literal "/private/var/mobile/Library/Preferences/com.apple.iqagent.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Cookies") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/tmp/AirTunes") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (subpath "/Applications") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (subpath "/private/var/mobile/Library/Caches/AppleTV") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (subpath "/private/var/mobile/Media/Radio") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.storebookkeeper.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CrashReporter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.LaunchServices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.airplay.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/private/var/mobile/Media/PhotoData") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/Developer/Applications") + (literal "/private/var/mobile/Library/Preferences/com.apple.appletvservices.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide.savedState/") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.apsd.launchd") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]lowtide[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]lowtide[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]lowtide-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide$") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (subpath "/private/var/mobile/Library/MediaStream") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/AppleInternal") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/System/Library") + (subpath "/private/var/mobile/Documents/var/nrd") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdLib.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/mobile/Library/Logs") + (subpath "/private/var/mobile/Library/Logs/Ubiquity") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.soundpref.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-wal") + (subpath "/private/var/MobileSoftwareUpdate") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.celestial.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (subpath "/private/var/mobile/Library/Application Support/Front Row") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences-sounds.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (subpath "/private/var/mobile/Updates") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.datetime.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ConfigServer.plist") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.revisiond.staging"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide$")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/dev/random") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.revisiond.revision"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/tmp/MediaControlServer.log") + (literal "/private/var/mobile/Library/Logs") + (subpath "/private/var/mobile/Library/MediaStream") + (subpath "/private/var/mobile/Library/Logs/Ubiquity") + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Preferences/com.apple.apsd.launchd") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (subpath "/private/var/mobile/Library/Caches/AppleTV") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mmcs[.]plist" #"^/private/var/mobile/Library/Logs/awd/awd-AppleTV.log") + (regex #"^/private/var/mobile/Library/Preferences/[.]GlobalPreferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdLib[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]CrashReporter[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]accountsettings[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]airplay[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]aggregated[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]appletvservices[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]celestial[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]coremedia[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]demo-settings[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]iqagent[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]preferences-sounds[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]preferences[.]datetime[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]soundpref[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]storebookkeeper[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]voiceservices[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist") + (literal "/private/var/mobile/Library/Application Support") + (subpath "/private/var/mobile/Media/iTunes_Control") + (subpath "/private/var/mobile/Library/Caches/com.apple.Radio") + (subpath "/private/var/MobileSoftwareUpdate") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp/AirTunes") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath "/private/var/mobile/Library/Application Support/Front Row") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-journal") + (literal "/Library/Application Support/Front Row") + (literal "/private/var/db/timezone/localtime") + (subpath "/private/var/mobile/Documents/var/nrd") + (subpath "/private/var/mobile/Media/Radio") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]frontrow[.]") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-wal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileAsset[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.iLifeSlideshow") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-shm") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]lowtide[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide.savedState/") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]lowtide") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide/.+$") + (subpath "/private/var/mobile/Media/Debug") + (literal "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Cookies")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (literal "/private/var/mobile/Documents/var") + (literal "/private/var/mobile/Documents") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide.savedState")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-flags + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/private/var/mobile/Media"))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Updates") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAVServiceUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "AppleNANDFTLUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IODPAudioInterfaceUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAVDeviceUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAVControllerUserClient") + (iokit-user-client-class "IODPServiceUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IODPControllerUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOAVVideoInterfaceUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "ASPUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IODPDeviceUserClient") + (iokit-user-client-class "IOAVAudioInterfaceUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IODPDisplayInterfaceUserClient")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.sharingd") + (global-name "com.apple.securityd") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.fairplayd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.awdd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.networkd") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.backboard.system-app-server") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.revisiond") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.FileProvider") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.absinthed") + (global-name "com.apple.librariand") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coremedia.cpe") + (global-name "com.apple.atvitunescloudd.xpc") + (global-name "com.apple.backboard.applicationdatastore.service") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.uikit.GestureServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.cookied") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.springboard.services") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.adid") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.frontrow.tracerouteix") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.GSSCred") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated.addaily") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.frontboard.workspace") + (global-name "ScripterServer") + (global-name "UIASTNotificationCenter") + (global-name "PurplePPTServer") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (local-name "com.apple.coremedia.customurlhandler") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.apsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.CrashCopy.OTA") + (global-name "com.apple.tccd") + (global-name "com.apple.coremedia.wirelessdisplay") + (global-name "com.apple.TextInput") + (global-name "com.apple.symptomsd") + (global-name "com.apple.absd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.logger") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.backboard.checkin") + (global-name "com.apple.marco") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.webinspector") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.bird.token") + (global-name "com.apple.lsd") + (global-name "com.apple.itunesstored.xpc") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.bird") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.coremedia.formatreader") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.corercd") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobile.obliteration") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.tzlink") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.coremedia.videoqueue") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.coremedia.capturesource") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.coremedia.formatreaderloader") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.mobile.softwareupdated") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.backboard.workspaceserverconnection") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.SBUserNotification") + (global-name-regex #"^com[.]apple[.]appletv$" #"^com[.]apple[.]appletv[.]" #"^com[.]apple[.]lowtide$" #"^com[.]apple[.]lowtide[.]") + (global-name "com.apple.airplay.xpc") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.frontboard.watchdogserver") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow mach-task-name) +(allow network-inbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/tmp/hidmonitordsocket") + (remote udp "*:*") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.storebookkeeper") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.soundpref") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.MapKit.internal") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mediaremote") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.accountsettings") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.appletvservices") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.da") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.airplay") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mediaaccessibility.public") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.airplay") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.celestial") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.accountsettings") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.storebookkeeper") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.soundpref") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.appletvservices") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.preferences-sounds")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (subpath "/Applications/AppleTV.app"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl) +(allow system-info + (info-type "net.link.addr") + (info-type "hw.uuid")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb.xml new file mode 100644 index 0000000..a6fa739 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb new file mode 100644 index 0000000..2f92f5d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb @@ -0,0 +1,231 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/etc/master.passwd") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/null") + (subpath "/System/Library") + (subpath "/System/Library/Extensions") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/logs/Metal") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/logs/Metal") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb new file mode 100644 index 0000000..b94afc2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb @@ -0,0 +1,883 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mail.composition.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath "/AppleInternal/Library/Frameworks") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (require-all + (require-not (subpath "/private/var/mobile/Library/Carrier Bundles")) + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-any + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MailCompositionService[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MailCompositionService[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MailCompositionService-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/Library/Ringtones") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/private/var/mobile/Media/Purchases") + (subpath "/private/var/mobile/Library/WebKit") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService.savedState/") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (subpath "/private/var/mobile/Library/Cookies") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))))) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.revisiond.revision"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.revisiond.staging"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mail[.]composition[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath "/private/var/mobile/Media/Safari") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MailCompositionService[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService.savedState/") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (subpath "/private/var/mobile/Library/WebClips") + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/LocalStorage")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/Databases")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService.savedState")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelDevice2")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.webinspector") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.uikit.GestureServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.securityd") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.springboard.services") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.symptomsd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.bird.token") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.bird") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.bulletinboard.utilitiesconnection") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.revisiond") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.GSSCred") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.lsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.logger") + (global-name "com.apple.marco") + (global-name-regex #"^com[.]apple[.]dataaccess[.]dataaccessd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.webfilterd") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.coreduetd") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.springboard") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "ScripterServer") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.coremedia.capturesource") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.librariand") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.TextInput") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.suggestd.suggestionmanager") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.nanoprefsync") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.cookied") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.mobilegestalt.xpc") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.sharingd") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.FileProvider") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.endpoint") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/printd") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.mobileipod") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.da") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.WebKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AppSupport") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.EmojiPreferences") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb new file mode 100644 index 0000000..eb78f23 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb @@ -0,0 +1,26 @@ +(version 1) +(allow default) +(deny file* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-chroot + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-read* + (subpath "/private/var/run/mobile_image_mounter")) +(deny file-write* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-create + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-unlink + (literal "/private/var") + (literal "/private/var/run") + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/") + (literal "/private")) +(deny job-creation) +(deny network-inbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-bind + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-outbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) +(deny process-exec-interpreter + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb.xml new file mode 100644 index 0000000..c2485d3 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb.xml @@ -0,0 +1,21 @@ + + + + + + + + + +]> + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb new file mode 100644 index 0000000..14435e9 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb @@ -0,0 +1,599 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/Calendar$" #"^/private/var/mobile/Library/Logs/Calendar/" #"^/private/var/mobile/Library/Calendar$" #"^/private/var/mobile/Library/Calendar/" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/System/Library") + (subpath "/AppleInternal/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.calendardiagnostics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilecal.timezones.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilecal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilecal[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobilecal[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobilecal-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal$") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal.savedState/") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/Library/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/Media/Purchases") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal$")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/dev/random") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]calendardiagnostics[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilecal[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilecal[.]timezones[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist" #"^/private/var/mobile/Library/Logs/Calendar$" #"^/private/var/mobile/Library/Logs/Calendar/" #"^/private/var/mobile/Library/Calendar$" #"^/private/var/mobile/Library/Calendar/") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilecal[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal.savedState/") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal$"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAccelSubmitter2")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobilecal.timezones") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.da") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.accountsd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.calendardiagnostics") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.keyboard") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.calendardiagnostics") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.mobilecal.timezones") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb.xml new file mode 100644 index 0000000..34fb0cf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb new file mode 100644 index 0000000..bca6b5a --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb @@ -0,0 +1,686 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Library/SMS") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.backedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mms_override.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.internal.Voltaire.plist") + (subpath "/AppleInternal") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]Maps") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapsSupport.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.skyhookwireless.wps.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Maps") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.weather.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.GMM.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Maps.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/Library/Caches/Maps") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (subpath "/Library/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps/.+$") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Maps[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]Maps[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]Maps-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps$") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps.savedState/") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps$")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/aes_0") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/dev/urandom") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps$")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-data + (regex #"^/private/var/ea/ea[.0-9]+$")) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Library/SMS") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Maps[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]GMM[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]skyhookwireless[.]wps[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]backedup[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]internal[.]Voltaire[.]plist" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]Maps") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Caches/Maps") + (subpath "/private/var/mobile/Library/Maps") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps/.+$") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Maps[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps.savedState/") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Cookies")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (regex #"^/private/var/ea/ea[.0-9]+$") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSubmitter2") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.da") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.skyhookwireless.wps") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mms_override") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.internal.Voltaire") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mediaaccessibility.public") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.homesharing") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.weather") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Maps") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.UIKit") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.internal.Voltaire") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.skyhookwireless.wps") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Maps") + (preference-domain "com.apple.assistant.backedup") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (socket-domain 39) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb.xml new file mode 100644 index 0000000..34fb0cf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb new file mode 100644 index 0000000..2aa51b5 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb @@ -0,0 +1,565 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS$")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/System/Library") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (subpath "/private/var/mobile/Media/Debug") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/Library/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS$") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath "/private/var/mobile/Media/PhotoData") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileSMS[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MobileSMS[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MobileSMS-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (subpath "/private/var/mobile/Media/Purchases") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]MobileSMS[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MobileSMS[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MobileSMS.savedState/") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (subpath "/private/var/tmp") + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/SMS") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/dev/random") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (literal "/dev/aes_0") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileSMS.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (require-not (regex #"^/private/var/mobile/Library/")) + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/PPTDevice") + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MobileSMS.savedState") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/Mobile Documents") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Media") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/mobile/Library/Caches/Snapshots") + (literal "/private/var/mobile/Library") + (literal "/private/var/mobile/Library/Saved Application State") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MobileSMS.savedState"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/mobile/Media/Debug") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS$") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileSMS[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS$" #"^/private/var/mobile/Documents/com[.]apple[.]MobileSMS[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MobileSMS[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MobileSMS.savedState/") + (subpath "/private/var/mobile/Media/Photos") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS$")) + (require-all + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileSMS[.]plist") + (subpath "/private/var/mobile/Library/SMS"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MobileSMS.savedState")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.springboard") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.da") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.avfoundation") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.MobileSMS") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb.xml new file mode 100644 index 0000000..7dd92d4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb new file mode 100644 index 0000000..b19c1de --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb @@ -0,0 +1,786 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read")))))) +(allow file-read* + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.imessage.bag.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mmcs.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Logs/awd/awdComponent0x19.log") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.airplay.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Library/Preferences/com.apple.compass.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.notbackedup.plist") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.ImageCaptureFramework.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist") + (literal "/private/var/mobile/Library/Logs/MobileSlideShow.log") + (literal "/private/var/mobile/Library/Logs/awd/awd-Camera.log") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (subpath "/private/var/mobile/Library/SMS") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes/iTunes Library.itlp") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (subpath "/private/var/mobile/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanocamera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.videouploadplugins.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (subpath "/private/var/mobile/Library/Application Support/iLifePageLayout") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (regex #"^/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]HomeBackground[.]cpbitmap") + (literal "/private/var/mobile/Library/Preferences/com.apple.GMM.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileSMS.plist") + (subpath "/private/var/mobile/Library/Caches/Snapshots/com.apple.camera") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Logs/awd") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Artwork") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.act.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ConfigServer.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mms_override.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]")) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (subpath "/private/var/mobile/Library/Dictionaries") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/Library/Fonts") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (require-all + (require-not (subpath "/private/var/mobile/Library/Carrier Bundles")) + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/private/var/mobile/Media/Debug") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileslideshow[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]camera[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobileslideshow[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobileslideshow-.+[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]camera-.*[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera$") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Safari") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow.savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera.savedState/") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/mobile/Media/DCIM") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/tmp") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/Library/Ringtones") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/dev/random") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/null") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$" #"^/private/var/mobile/Library/")) + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")))) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Logs/awd/awd-Camera.log") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (subpath "/private/var/mobile/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest[.]log") + (subpath "/private/var/mobile/Library/Application Support/iLifePageLayout") + (regex #"^/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]HomeBackground[.]cpbitmap") + (subpath "/private/var/mobile/Library/SMS") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (literal "/private/var/mobile/Library/Logs/MobileSlideShow.log") + (subpath "/private/var/mobile/Library/Caches/Snapshots/com.apple.camera") + (literal "/private/var/mobile/Library/Logs/awd/awdComponent0x19.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist")) + (require-any + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]nanocamera[.]plist" #"^/private/var/mobile/Library/Preferences/[.]GlobalPreferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileslideshow[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]camera[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]videouploadplugins[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]notbackedup[.]plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/mobile/Media/Photos") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileslideshow[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]camera[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow.savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera.savedState/") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/Databases")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/LocalStorage")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes")))) + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Logs/awd") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow.savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mnt") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.nanocamera") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.coreaudio") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.act") + (preference-domain "com.apple.videouploadplugins") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mt") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.MobileSMS") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.youtubeframework.notbackedup") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.PeoplePicker") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.da") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mmcs") + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.nanocamera") + (preference-domain "com.apple.videouploadplugins") + (preference-domain "com.apple.youtubeframework.notbackedup") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.camera")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb.xml new file mode 100644 index 0000000..5831a8c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb new file mode 100644 index 0000000..6b85530 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb @@ -0,0 +1,194 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIKit.pboard") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (subpath "/System/Library") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/random") + (subpath "/private/var/tmp") + (literal "/dev/urandom") + (literal "/dev/null") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIKit.pboard") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/System/Library/Frameworks/UIKit.framework/Support/pasteboardd"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb.xml new file mode 100644 index 0000000..6587f2c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb new file mode 100644 index 0000000..c071291 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb @@ -0,0 +1,519 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/db/timezone") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/usr/share") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/tmp") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-any + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ConfigServer.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/dev/aes_0") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.stocks.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stocks[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]stocks[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]stocks-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks$") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/dev/zero") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/private/var/mobile/Library/Fonts") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]stocks[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]stocks[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]stocks.savedState/") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Stocks$" #"^/private/var/mobile/Library/Stocks/") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks$") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (require-not (regex #"^/private/var/mobile/Library/")) + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/PPTDevice") + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]stocks.savedState") + (literal "/private/var/mobile/Library/Mobile Documents") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Saved Application State") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/mobile/Library") + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Caches/Snapshots") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]stocks.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stocks[.]plist" #"^/private/var/mobile/Library/Stocks$" #"^/private/var/mobile/Library/Stocks/") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stocks[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks$" #"^/private/var/mobile/Documents/com[.]apple[.]stocks[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]stocks[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]stocks.savedState/") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks$") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks$"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]stocks.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.stocks") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.da") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.preferences.sounds") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.itunesstored") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.corevideo") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.EmojiPreferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.stocks") + (preference-domain "com.apple.Preferences")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb.xml new file mode 100644 index 0000000..7dd92d4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb new file mode 100644 index 0000000..35c975c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb @@ -0,0 +1,236 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.StreamingUnzipService.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (literal "/dev/urandom") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/etc/master.passwd") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (subpath "/private/var/tmp") + (extension "com.apple.StreamingUnzipService") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/random") + (literal "/dev/null") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.StreamingUnzipService") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]StreamingUnzipService[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.duetknowledged.activity") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.StreamingUnzipService") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.StreamingUnzipService")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb new file mode 100644 index 0000000..2ac53ef --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb @@ -0,0 +1,839 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (subpath "/System/Library") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilemail[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]accountsettings[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]OTASyncAgent[.]plist$")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebSheet.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-not (subpath "/private/var/mobile/Library/Carrier Bundles")) + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/WebKit/Databases") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebSheet[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]WebSheet[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]WebSheet-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet$") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (subpath "/Library/Ringtones") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet.savedState/") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet$")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet$")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos"))))))) +(allow file-read-metadata) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (require-all + (require-not (literal "/private/var/mobile/Library/Mail/AutoFetchEnabled")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]accountsettings[.]plist$")) + (require-any + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebSheet[.]plist") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (subpath "/private/var/tmp/MediaCache") + (subpath "/private/var/mobile/Library/WebClips") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebSheet[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet.savedState/") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/Databases")))))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelDevice2")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.mobilesafari-settings") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.symptomsd") + (global-name "com.apple.bird.token") + (global-name "com.apple.bird") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.itunescloudd.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.SBUserNotification") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.eventpump") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.GSSCred") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.tccd") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.logger") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.securityd") + (global-name "com.apple.mobilemail.messageuiservices") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.revisiond") + (global-name "com.apple.webfilterd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.TextInput.shortcuts") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "ScripterServer") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd") + (global-name "com.apple.fig.movie") + (global-name "com.apple.aggregated") + (global-name "com.apple.marco") + (global-name "com.apple.librariand") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.TextInput") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.mobilegestalt.xpc") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.UIKit.pasteboardd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.webinspector") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.mobilemail") + (global-name "com.apple.SystemConfiguration.configd") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.cookied") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.sharingd") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.FileProvider") + (global-name "com.apple.certui.relay") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.springboard.services") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.endpoint") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog") + (literal "/private/var/run/printd")) +(allow user-preference-read + (preference-domain "com.apple.youtubeframework") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.da") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility.public") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/Applications/WebSheet.app/WebSheet"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb new file mode 100644 index 0000000..2101ef8 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb @@ -0,0 +1,204 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/null") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iapd.plist") + (literal "/dev/aes_0") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/random") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols") + (require-not (subpath "/private/var/mobile")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]iapd[.]plist") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.iapd") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iapd")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/usr/sbin/accessoryd"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb.xml new file mode 100644 index 0000000..7dd92d4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb new file mode 100644 index 0000000..b07a1a2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb @@ -0,0 +1,280 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.afc.root") + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$"))))) +(allow file-read* + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/db/timezone") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/urandom") + (literal "/AFCDEBUG") + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.afc.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.afc.root") + (literal "/usr/libexec/afcd") + (literal "/usr/libexec") + (literal "/dev/ptmx") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$") + (literal "/dev/null") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))))) +(allow file-read-metadata + (literal "/private") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Caches") + (vnode-type SYMLINK) + (literal "/Library/Preferences") + (literal "/Library/Preferences/SystemConfiguration") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$") + (extension "com.apple.afc.root") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.securityd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.system.logger") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.xpchelper") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (regex #"^/private/var/run/lockdown/checkin") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.afc") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb new file mode 100644 index 0000000..fbdc31f --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb @@ -0,0 +1,257 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/dev/aes_0") + (regex #"^/System/Library/CoreServices/SystemVersion$" #"^/System/Library/CoreServices/SystemVersion.+$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$") + (literal "/dev/urandom") + (literal "/Library/Managed Preferences/mobile") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/Keychains") + (extension "com.apple.sandbox.executable") + (literal "/Library/Keychains") + (subpath "/private/var/mobile/Library/Logs") + (subpath "/private/var/db/timezone") + (literal "/Library/Preferences") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (subpath "/usr/lib") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/preferences") + (subpath "/private/var/mobile/Library/Managed Preferences") + (literal "/dev/ptmx") + (subpath "/System/Library/Frameworks") + (subpath "/usr") + (regex #"^/private/var/mobile/Library/Caches/com.apple.persistentconnection") + (subpath "/private/etc") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ApplePushService") + (subpath "/private/var/tmp") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd$")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/mobile/Library/Logs") + (regex #"^/private/var/mobile/Library/Caches/com.apple.persistentconnection" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$") + (subpath "/private/var/mobile/Library/ApplePushService") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"." #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/System/Library/PrivateFrameworks/ApplePushService.framework/apsd"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb.xml new file mode 100644 index 0000000..5831a8c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb new file mode 100644 index 0000000..29a0edf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb @@ -0,0 +1,14 @@ +(version 1) +(deny default) +(allow iokit-get-properties) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self)) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb.xml new file mode 100644 index 0000000..7baaeea --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb.xml @@ -0,0 +1,30 @@ + + + + + + + + + +]> + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb new file mode 100644 index 0000000..1d58a9a --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb @@ -0,0 +1,305 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (literal "/dev/urandom") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/null") + (literal "/dev/random") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.AssetCacheLocatorService.plist") + (literal "/dev/aes_0") + (subpath "/usr/lib") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols") + (literal "/"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.tccd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.system.logger") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.cookied") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfprefsd.agent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cfprefsd.daemon") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (local udp "*:*"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (remote udp "*:53") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics")) +(allow user-preference-read + (preference-domain "com.apple.AssetCacheLocatorService") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb new file mode 100644 index 0000000..99df09c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb @@ -0,0 +1,230 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal "/dev/random") + (subpath "/usr/share") + (literal "/dev/urandom") + (literal "/private/var/db/heim-credential-store.archive") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/dev/aes_0") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/db/heim-credential-store.archive") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.duetknowledged.activity") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb new file mode 100644 index 0000000..131dcca --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb @@ -0,0 +1,212 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal "/dev/null") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.tccd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.managedconfiguration.profiled.public") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-audit) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb.xml new file mode 100644 index 0000000..ee527ac --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb new file mode 100644 index 0000000..d8edef0 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb @@ -0,0 +1,263 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (literal "/dev/ptmx") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/random") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/urandom") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.app-sandbox.read") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.app-sandbox.read") + (regex #"/Info[.]plist$" #".+/Info[.]plist$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY)) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (vnode-type SYMLINK)) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.aggregated") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.cookied") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.ocspd") + (global-name "com.apple.networkd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.securityd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-audit) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb.xml new file mode 100644 index 0000000..ee527ac --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb new file mode 100644 index 0000000..07886b0 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb @@ -0,0 +1,555 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.LaunchServices.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/zero") + (subpath "/System/Library/Frameworks") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/dev/null") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (subpath "/Developer") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-not (vnode-type SYMLINK)) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSubmitter2") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.TextInput.shortcuts") + (local-name "com.apple.cfprefsd.agent") + (global-name "ScripterServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.TextInput") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.FileProvider") + (global-name "com.apple.securityd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.librariand") + (global-name "com.apple.springboard.services") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.tccd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.UIKit.pasteboardd") + (global-name "com.apple.revisiond") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.fig.movie") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.system.logger") + (global-name "com.apple.voiceservices.keepalive") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.GSSCred") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.lsd") + (global-name "com.apple.cookied") + (global-name "com.apple.webinspector") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.aggregated") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.bird.token") + (global-name "com.apple.bird") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.marco") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.sharingd") + (global-name "com.apple.itunesstored.xpc") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.da") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mediaaccessibility.public") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.EmojiPreferences") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-audit) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml new file mode 100644 index 0000000..ee527ac --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb new file mode 100644 index 0000000..4f3c3c4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb @@ -0,0 +1,468 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/usr/local/lib") + (subpath "/private/var/tmp") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.token.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-assistantd[.]log" #"^/private/var/mobile/Library/Caches/com[.]apple[.]siri[.]") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voicetrigger.plist") + (subpath "/System/Library") + (subpath "/Library/Audio/Tunings") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (subpath "/private/var/mobile/Library/Assistant") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataMigration.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.avvc.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.weather.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/siri_recordings") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.logging.plist") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/Assistant") + (literal "/private/var/mobile/Library/Preferences/com.apple.AssistantServices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.siri.backedup.encrypted.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.backedup.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/random") + (literal "/dev/urandom") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/run/syslog") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/PPTDevice") + (vnode-type SYMLINK) + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]siri[.]") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/Assistant") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-assistantd[.]log") + (subpath "/private/var/mobile/Library/Assistant") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AssistantServices[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]backedup[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]logging[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]support[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]token[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]siri[.]backedup[.]encrypted[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]voicetrigger[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]weather[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd$"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coreduetd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.assistant_service") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.marco") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.cookied") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.geod") + (global-name "com.apple.awdd") + (global-name "com.apple.absd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.tccd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.springboard.services") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.BTLEAudioController.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.logger") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.absinthed") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.networkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accountsd.accountmanager") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.audio.AudioQueueServer") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.avfoundation.avvc") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.mediaremote") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.assistant.token") + (preference-domain "com.apple.AssistantServices") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.weather") + (preference-domain "com.apple.siri.backedup.encrypted") + (preference-domain "com.apple.AppSupport") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.weather") + (preference-domain "com.apple.AssistantServices") + (preference-domain "com.apple.assistant.token") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.siri.backedup.encrypted") + (preference-domain "com.apple.assistant.backedup") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (socket-domain 39) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb new file mode 100644 index 0000000..a998c78 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb @@ -0,0 +1,427 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (extension-class "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Mobile Documents/")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (extension-class "com.apple.librarian.ubiquity-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$")) + (require-all + (vnode-type REGULAR-FILE) + (extension-class "com.apple.clouddocs.version") + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (subpath "/private/var/tmp") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Logs/CloudDocs") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/mobile/Library/Mobile Documents") + (literal "/dev/random") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]bird" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]bird") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Library/Caches/CloudKit/com.apple.bird") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/Application Support/CloudDocs") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/aes_0") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$") + (literal "/dev/zero") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Caches/CloudKit/com.apple.clouddocs") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/private/var/mobile/Library/Mobile Documents[.]") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.bird.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ubd.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.CloudKit.BehaviorOptions.plist") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]bird" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]bird") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (regex #"^/private/var/mobile/Library/Mobile Documents[.]") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]ubd[.]plist") + (subpath "/private/var/mobile/Library/Mobile Documents") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity") + (subpath "/private/var/mobile/Library/Caches/CloudKit/com.apple.bird") + (subpath "/private/var/mobile/Library/Application Support/CloudDocs") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Caches/CloudKit/com.apple.clouddocs") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") + (subpath "/private/var/mobile/Library/Logs/CloudDocs") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]appleaccount[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]bird[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$") + (subpath "/private/var/mobile/Library/Cookies") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/CloudKit")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Application Support")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.revisiond") + (global-name "com.apple.networkd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cookied") + (global-name "com.apple.bird.ContainerMetadataExtractor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.tccd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cloudd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.FSEvents") + (global-name "com.apple.apsd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.logger") + (global-name "com.apple.securityd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ubd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.librariand") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.persistentconnection") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.bird") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 30)) + (fsctl-command (_IO "h" 31)) + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 32))) +(allow system-info + (info-type "hw.uuid")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb.xml new file mode 100644 index 0000000..d118cf1 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb new file mode 100644 index 0000000..e140a85 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb @@ -0,0 +1,426 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (literal "/dev/ptmx")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (regex #"^/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/var/mobile/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/mobile/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/var/mobile/Containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/mobile/Containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/preferences/com.apple.networkd.plist") + (mount-relative-regex #"^/[.]TemporaryItems$" #"^/[.]TemporaryItems/" #"^/[.]DocumentRevisions-V100$" #"^/[.]DocumentRevisions-V100/" #"^/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/[.]DocumentRevisions-V100-bad-[0-9]+/") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/Logs/Ubiquity") + (regex #"^/private/var/tmp/CKTraffic$" #"^/private/var/tmp/CKTraffic[^/]+$" #"^/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/db/DetachedSignatures") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit" #"^/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+") + (subpath "/private/var/mobile/Library/Keychains") + (regex #"^/var/tmp$" #"^/var/tmp/" #"^/private/var/tmp$" #"^/private/var/tmp/") + (literal "/private/var/mobile/Library/Preferences/com.apple.purplebuddy.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/db/mds/messages/se_SecurityMessages") + (regex #"^/Library/Keychains/System.keychain") + (literal "/dev/urandom") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/zero") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/logs/Ubiquity") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]cloudd") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.nsurlsessiond") + (literal "/private/var/run/diagnosticd/dyld_shared_cache_x86_64") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Logs/awd") + (literal "/Library/Preferences/SystemConfiguration/preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.migration.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/etc/hosts") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/db/mds/system/mdsDirectory.db") + (subpath "/private/var/mobile/Library/Caches/com.apple.cloudd") + (literal "/Library/Preferences/com.apple.security.plist") + (literal "/") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/mobile/Library/Caches/CloudKit") + (literal "/private/var/mobile/Library/Logs/ProtectedCloudStorage.log") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-data + (literal "/dev/aes_0")) +(allow file-read-metadata + (literal "/tmp") + (literal "/var") + (literal "/private/var/mobile") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library") + (literal "/Library") + (literal "/private/var/mobile/Library/Caches") + (literal "/Library/Security/Trust Settings/Admin.plist") + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var") + (literal "/AppleInternal") + (literal "/private") + (regex #"^/var/tmp$" #"^/private/var/tmp$" #"^/var$" #"^/private/var$") + (subpath "/private/var/db/mds") + (vnode-type SYMLINK) + (literal "/Library/Keychains") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/") + (literal "/private/var/tmp") + (literal "/private/etc/localtime") + (literal "/private/var/run/systemkeychaincheck.done") + (subpath "/private/var/db/icu") + (vnode-type DIRECTORY) + (literal "/Library/Logs") + (literal "/private/var/db") + (literal "/etc") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/tmp") + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Caches") + (subpath "/private/var/mobile/Library/Caches/com.apple.cloudd") + (mount-relative-regex #"^/[.]TemporaryItems$" #"^/[.]TemporaryItems/") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit" #"^/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Keychains") + (regex #"^/var/tmp$" #"^/var/tmp/" #"^/private/var/tmp$" #"^/private/var/tmp/") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Caches/com.apple.nsurlsessiond") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/logs/Ubiquity") + (subpath "/private/var/mobile/Library/Logs/awd") + (literal "/") + (subpath "/private/var/mobile/Library/Logs/Ubiquity") + (regex #"^/Library/Keychains/System.keychain" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]purplebuddy[.]plist") + (subpath "/private/var/mobile/Library/Caches/CloudKit") + (literal "/private/var/mobile/Library/Logs/ProtectedCloudStorage.log") + (regex #"^/private/var/tmp/CKTraffic$" #"^/private/var/tmp/CKTraffic[^/]+$" #"^/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (regex #"^/cores/") + (require-not (file-mode #o0000))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write-xattr + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (mount-relative-regex #"^/[.]DocumentRevisions-V100$" #"^/[.]DocumentRevisions-V100/" #"^/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/[.]DocumentRevisions-V100-bad-[0-9]+/"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-read-data + (ipc-posix-name "FNetwork.defaultStorageSession") + (ipc-posix-name "com.apple.AppleDatabaseChanged") + (ipc-posix-name-regex #"^/tmp/com[.]apple[.]csseed[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name "com.apple.AppleDatabaseChanged")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.datamigrator") + (global-name "com.apple.securityd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.coreservices.quarantine-resolver") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.fairplayd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.windowserver.active") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.xpcd") + (global-name "com.apple.cookied") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SecurityServer") + (global-name "com.apple.ocspd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.apsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.tccd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.distributed_notifications@Uv3") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.aggregated") + (global-name "com.apple.awdd") + (global-name "com.apple.fairplayd.versioned") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.assertiond.processassertionconnection") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/asl_input") + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.purplebuddy") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb new file mode 100644 index 0000000..caf7524 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb @@ -0,0 +1,243 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (subpath "/AppleInternal") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (subpath "/Applications") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/usr/share") + (subpath "/System/Library/Frameworks") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Containers/Bundle") + (subpath "/private/var/mobile/XcodeBuiltProducts") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.logger") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.hangtracerd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobilephone") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb new file mode 100644 index 0000000..cfe23ed --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb @@ -0,0 +1,270 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/Library/Preferences/[.]GlobalPreferences[.]" #"^/Library/Preferences/ByHost/[.]GlobalPreferences[.]" #"^/Library/Preferences/com[.]apple[.]security[.]") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/usr/libexec") + (literal "/dev/aes_0") + (literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") + (subpath "/private/var/db/timezone") + (literal "/Library/Preferences/com.apple.crypto.plist") + (literal "/Library/Managed Preferences") + (literal "/Library/Security/Trust Settings/Admin.plist") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (literal "/usr/libexec/discoveryd") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (subpath "/usr/lib") + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.discoveryd.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "wlDNSOffloadUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "mDNSOffloadUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.tccd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.discoveryd_helper") + (global-name "com.apple.aggregated") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfprefsd.daemon") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.blued") + (global-name "com.apple.securityd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.snhelper") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network* + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.discoveryd") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb.xml new file mode 100644 index 0000000..d8a3680 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb new file mode 100644 index 0000000..447359d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb @@ -0,0 +1,462 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/usr/lib") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]homed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]homed") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Library/homed") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/urandom") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.homed.plist") + (subpath "/System/Library/Frameworks") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-homed[.]log") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/dev/zero") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/HomeConfiguration") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Logs/awd") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library") + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Mobile Documents") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-homed[.]log") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]homed[.]plist") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]homed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]homed" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/HomeConfiguration") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Library/homed") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.lsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cookied") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.symptomsd") + (global-name "com.apple.revisiond") + (global-name "com.apple.fig.movie") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.marco") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.apsd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.FileProvider") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.bird.token") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.librariand") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.securityd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.bird") + (global-name "com.apple.aggregated") + (global-name "com.apple.tccd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.cloudd") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.system.logger") + (global-name "com.apple.networkd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.awdd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.SystemConfiguration.configd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.homed") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.homed") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb new file mode 100644 index 0000000..6a72965 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb @@ -0,0 +1,332 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/root/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/root/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist" #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (subpath "/usr/libexec") + (literal "/dev/aes_0") + (subpath "/Applications") + (subpath "/System/Library") + (literal "/dev/ptmx") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/root/Library/Cookies") + (subpath "/usr/lib") + (literal "/dev/null") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/mobile/Containers/Bundle/Application") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/sbin") + (literal "/dev/urandom") + (literal "/private/etc/master.passwd") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/root/Library/Caches") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/root/Library/Cookies") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist" #"^/private/var/preferences/SystemConfiguration/preferences[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist" #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.lsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.networkd") + (global-name "com.apple.cookied") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.tccd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.system.logger") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.assertiond.processassertionconnection") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.nehelper")) +(allow network* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (local udp "*:500") + (literal "/private/var/run/racoon.sock") + (local udp "*:4500")))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (control-name "com.apple.net.necp_control") + (control-name "com.apple.flow-divert") + (literal "/private/var/run/syslog") + (remote udp "*:*") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.net.ipsec_control") + (control-name "com.apple.net.utun_control") + (control-name "com.apple.network.statistics") + (control-name "com.apple.content-filter")) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl* + (sysctl-name-regex #"^net[.]necp[.].+" #"^net[.]inet[.]ipsec[.].+")) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb.xml new file mode 100644 index 0000000..d8a3680 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb new file mode 100644 index 0000000..f974d73 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb @@ -0,0 +1,284 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/etc/ppp") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist") + (literal "/dev/random") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/run/racoon.pid") + (literal "/private/var/mobile/Library/Preferences/com.apple.networkextension.plist") + (literal "/dev/null") + (literal "/dev/ptmx") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/Frameworks") + (literal "/usr/sbin/pppd") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/private/etc/master.passwd") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/usr/libexec") + (literal "/usr/sbin") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist" #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (subpath "/private/var/mobile/Containers/Bundle/VPNPlugin") + (subpath "/private/var/tmp") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/run/racoon") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/urandom") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols") + (literal "/"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist" #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (literal "/private/var/log/ppp.log") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (subpath "/private/var/run/racoon") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.nehelper") + (global-name "com.apple.symptomsd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.networkd") + (global-name "com.apple.mobilegestalt.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.neagent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.aggregated") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.securityd") + (global-name "com.apple.UNCUserNotification") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.ocspd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.logger") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network* + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (literal "/private/var/run/vpncontrol.sock") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.networkextension") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/usr/sbin/pppd"))) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl* + (sysctl-name "net.key.natt_keepalive_interval")) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb.xml new file mode 100644 index 0000000..e19a9e9 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb new file mode 100644 index 0000000..17ec6e2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb @@ -0,0 +1,264 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Application Support/Quick Look") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-journal") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-shm") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-wal") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/ptmx") + (subpath "/System/Library") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session") + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Library/Mobile Documents") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-journal") + (literal "/private/var/mobile/Library/Application Support/Quick Look") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-wal") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-shm") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Application Support/Quick Look")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.system.logger") + (global-name "com.apple.mobilegestalt.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.revisiond") + (global-name "com.apple.aggregated") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb new file mode 100644 index 0000000..8e50e58 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb @@ -0,0 +1,334 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/rtcreportingd.plist") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-rtcreportingd[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/Retired/rtcreportingd_.+") + (subpath "/usr/lib") + (literal "/dev/aes_0") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.VideoConference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.rtcreporting.plist") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.timed.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (literal "/usr/libexec/rtcreportingd") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.rtcreporting.upload") + (literal "/usr/libexec") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/urandom") + (literal "/dev/null") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd$")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-data + (literal "/private/var/mobile/Library/Logs/CrashReporter/Retired")) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/Retired") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/Retired")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-rtcreportingd[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/Retired/rtcreportingd_.+" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]rtcreporting[.]plist" #"^/private/var/mobile/Library/Preferences/rtcreportingd[.]plist" #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/Retired"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.rtcreporting.upload") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.aggregated") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.networkd") + (global-name "com.apple.system.logger") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.powerlogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.securityd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.cookied") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.awdd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.commcenter.cupolicy.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.nsurlstorage-cache") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (local udp "*:*"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "rtcreportingd") + (preference-domain "com.apple.timed") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.rtcreporting") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.rtcreporting") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "rtcreportingd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb new file mode 100644 index 0000000..88082c5 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb @@ -0,0 +1,66 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/dev/dtracehelper"))) +(allow file-read*) +(allow file-read-data) +(allow file-read-metadata) +(allow file-read-xattr) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/logs/CrashReporter/Sandbox-.+[.]ips") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.cfprefsd.daemon") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc")) +(allow network* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/private/var/tmp/sandbox[.]"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (regex #"^/private/tmp/[.]webdavUDS[.][^/]+$") + (literal "/private/var/run/asl_input")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self) + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb.xml new file mode 100644 index 0000000..9b1bfa2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb new file mode 100644 index 0000000..0673efa --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb @@ -0,0 +1,230 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (literal "/dev/random") + (subpath "/usr/lib") + (literal "/dev/urandom") + (subpath "/private/var/db/timezone") + (subpath "/var/mobile/Library/Caches") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (subpath "/usr/share") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.tccd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.snhelper")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb new file mode 100644 index 0000000..1149877 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb @@ -0,0 +1,53 @@ +(version 1) +(deny default) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (extension-class-regex #"^com[.]apple[.]tcc[.]"))) +(allow file-read*) +(allow file-read-data) +(allow file-read-metadata) +(allow file-read-xattr) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp/com.apple.tccd") + (subpath "/private/var/mobile/Library/TCC")))) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.backboard.systemservices") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.system.logger") + (global-name "com.apple.companionappd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.springboard.services") + (global-name "com.apple.librariand") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.pluginkit.pkd")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (regex #"^/private/tmp/[.]webdavUDS[.][^/]+$")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb.xml new file mode 100644 index 0000000..2b51e53 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb new file mode 100644 index 0000000..fe00f08 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb @@ -0,0 +1,233 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath "/usr/lib") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/urandom") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/db/timezone/localtime") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/db/timezone/localtime") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb new file mode 100644 index 0000000..0cfc664 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb @@ -0,0 +1,363 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/mobile/Library/processed-Mobile Documents[.]delete" #"^/private/var/mobile/Library/Mobile Documents" #"^/private/var/mobile/Library/Collections" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$") + (literal "/private/var/mobile/Library/Preferences/com.apple.bird.plist") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/random") + (subpath "/private/var/tmp") + (literal "/dev/urandom") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.mmcs.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]ubd") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Preferences/com.apple.ubd.plist") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-ubd[.]log") + (literal "/private/var/mobile/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Application Support") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Application Support") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-ubd[.]log" #"^/private/var/mobile/Library/processed-Mobile Documents[.]delete" #"^/private/var/mobile/Library/Mobile Documents" #"^/private/var/mobile/Library/Collections" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]ubd[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mmcs[.]plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.logger") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.securityd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.symptomsd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.absinthed") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.FSEvents") + (global-name "com.apple.cookied") + (global-name "com.apple.absd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.apsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.awdd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.bird") + (global-name "com.apple.tccd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/lockdown.sock")) +(allow user-preference-read + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.persistentconnection") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.bird") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.ubd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mmcs")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Support/ubd"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-fsctl + (fsctl-command (_IO "h" 30)) + (fsctl-command (_IO "h" 24))) +(allow system-info + (info-type "hw.uuid")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb.xml new file mode 100644 index 0000000..f2db312 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb new file mode 100644 index 0000000..0c18d5b --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb @@ -0,0 +1,239 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/root") + (subpath "/private/var/mobile/XcodeBuiltProducts") + (literal "/private/var/db/.debug_xpcd") + (subpath "/usr") + (subpath "/AppleInternal") + (subpath "/Developer") + (subpath "/Library/Audio/Plug-Ins") + (subpath "/System") + (subpath "/System/Library") + (literal "/dev/aes_0") + (subpath "/private/var/mobile/Containers/Bundle") + (literal "/dev/random") + (subpath "/private/var/mobile/Library/Assets") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/urandom") + (literal "/private/etc/master.passwd") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile") + (literal "/dev/ptmx") + (subpath "/Applications") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb.xml new file mode 100644 index 0000000..15c2995 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb new file mode 100644 index 0000000..d8004d3 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb @@ -0,0 +1,2831 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (extension "com.apple.sandbox.application-group") + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$")) + (require-all + (subpath "/private/var/mobile/Library/Cookies") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.sandbox.application-group") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/")) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (subpath "/private/var/mobile/Media/Podcasts") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/")))) + (require-all + (subpath "/private/var/mobile/Media/DCIM") + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/mobile/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))))) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Media/iTunes_Control/Artwork") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/System/Library/Frameworks") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/Applications") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/AppleInternal") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.notes.objectcreation.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath "/private/var/mobile/Library/Carrier Bundles") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath "/private/var/mobile/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (require-entitlement "platform-application")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]restrictionspassword[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (subpath "/private/var/mobile/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Cookies") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.appletv.WhatsNew"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mobilemail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "platform-application")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (subpath "/private/var/mobile/Media/Books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath "/Library/Application Support/Mail/Plugins") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (subpath "/private/var/mobile/Media/Podcasts") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (subpath "/Developer") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal "/System/Library/PairedSyncServices/com.apple.pairedsync.mail.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]HomeBackground[.]cpbitmap") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath "/private/var/mobile/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd")))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-shm") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (regex #"^/private/var/mobile/Library/GameKit/Data/[^/]+[.]gcdata$") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (subpath "/Library/Dictionaries") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/Library/Ringtones") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/random") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/")) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.notes.sharedstore.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Media/DCIM") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath "/private/var/mobile/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-wal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath "/private/var/mobile/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.AutoWake.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Media/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal "/private/var/mobile/Library/Cookies") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/mobile/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))))) +(allow file-read-data + (regex #"^/private/var/ea/ea[.0-9]+$")) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/GameKit/Data") + (literal "/private/var/mobile/Library/Mobile Documents") + (literal "/private/var") + (literal "/private/var/mobile/Media") + (literal "/private/var/mobile/Library") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/run/printd") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (require-all + (literal "/private/var/mobile") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.appletv.WhatsNew"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Caches") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "platform-application")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal "/private/var/mobile") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$")) + (require-all + (literal "/private/var/mobile") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "platform-application")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal "/private/var/mobile") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.appletv.WhatsNew"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.notes.sharedstore.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath "/private/var/mobile/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/")) + (require-all + (literal "/private/var/mobile/Library/Cookies") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]weather[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/mobile/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (subpath "/private/var/mobile/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd")))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]restrictionspassword[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtube[.]dp[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath "/private/var/mobile/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.notes.objectcreation.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath "/private/var/mobile/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]accountsettings[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mail[.]composition[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MailAccount-ExtProperties[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]OTASyncAgent[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]OTASyncState[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]GMM[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]NanoMailKit[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]skyhookwireless[.]wps[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]internal[.]Voltaire[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath "/private/var/mobile/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath "/private/var/mobile/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal "/private/var/mobile/Library/Cookies") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mobilemail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (literal "/private/var/mobile/Library/Caches") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music")))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (regex #"^/private/var/ea/ea[.0-9]+$") + (literal "/dev/ptmx") + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Media/Podcasts") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$")) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu")))))))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelContext") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (require-all + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (iokit-user-client-class "RootDomainUserClient") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow iokit-get-properties + (iokit-property "gyro-interrupt-calibration") + (iokit-property-regex #"^BackCamera") + (require-not (iokit-property-regex #"-mac-address" #"mac-address-" #".+-mac-address" #".+mac-address-")) + (iokit-property "compass-calibration") + (require-entitlement "com.apple.wifi.manager-access") + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys"))) +(allow ipc-posix-sem + (semaphore-owner self) + (extension "com.apple.sandbox.application-group")) +(allow ipc-posix-shm* + (extension "com.apple.sandbox.application-group") + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-create + (ipc-posix-name-regex #"^/mono[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.assetsd.notificationServer") + (global-name "com.apple.videoconference.avconference") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.networkd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.librariand") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.passd.library") + (global-name "com.apple.gamed") + (global-name "com.apple.iTunesStore.daemon.public") + (global-name "PurplePPTServer") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.tccd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.audio.AudioConverterServer") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.prdaily") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.managedconfiguration.mdmdpush-prod") + (global-name "com.apple.lsd") + (global-name "com.apple.sandboxd") + (global-name "com.apple.iaptransportd") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.Music.MPMusicPlayerControllerInternal") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.coremedia.cpeprotector") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.mDNSResponderHelper") + (extension "com.apple.sandbox.application-group") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.calaccessd") + (global-name "com.apple.Music.MPMusicPlayerMigServer") + (global-name "com.apple.geod") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.commcenter.dm-helper") + (global-name "com.apple.midiserver.io") + (global-name "com.apple.springboard.UIKit.migserver") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.springboard") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.TextInput") + (global-name "com.apple.coremedia.formatreader") + (global-name "com.apple.managedconfiguration.mdmdpush-dev") + (global-name "com.apple.telephonyutilities.remotelogdaemon") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.ReportCrash.Jetsam") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.iapd.distributednotification.server") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.VoiceOverTouch") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.awdd") + (global-name "com.apple.gizmoappd") + (global-name "com.apple.UIKit.pasteboardd") + (global-name "com.apple.webinspector") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.springboard.remotenotifications") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.audio.AudioFileServer") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.MediaControl.daemon") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.cookied") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.telephonyutilities.callservicesdaemon.voip") + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.fairplayd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.iapd") + (global-name "com.apple.AdSheetPad.server") + (global-name "com.apple.bird.token") + (global-name "com.apple.gamecenter") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.imavagent.embedded.auth") + (global-name "com.apple.homed.xpc") + (global-name "com.apple.airplay.sender.xpc") + (global-name "com.apple.iap2d.distributednotification.server") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.commcenter.mobile-helper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.fig.movie") + (global-name "com.apple.springboard.alerts") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.syncdefaultsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.dataaccess.dataaccessd") + (global-name "com.apple.coremedia.capturesession") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.cloudd") + (global-name "com.apple.iapauthd") + (global-name "com.apple.mediastream.sharing-nowake") + (global-name "com.apple.ReportCrash.SafetyNet") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.atc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.VoiceOverTouch.xpc") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.healthd.restriction") + (global-name "com.apple.mobileipod.MPMusicPlayerMigServerExists") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.revisiond") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.cvmsCompAgent_armv7") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.coremedia.audioprocessingtap") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.mobileipod.MPMusicPlayerControllerInternal") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.audio.AudioUnitServer") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.calaccessd.xpc") + (global-name "com.apple.webfilterd") + (global-name "com.apple.weibod.server") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.AdSheetPhone.server") + (global-name "com.apple.dataaccess.dataaccessd.active") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mobileipod.MPMusicPlayerMigServer") + (global-name "com.apple.instruments.server.mig") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.sysmond") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.passd.in-app-payment") + (local-name "com.apple.cfprefsd.agent") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.testmanagerd") + (global-name "com.apple.system.logger") + (global-name "com.apple.bird") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.backboard.checkin") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.marco") + (global-name "com.apple.itdbprep.server") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.scrod") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.ReportCrash.StackShot") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.iap2d.xpc") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "ScripterServer") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.ExternalAccessory.distributednotification.server") + (global-name "com.apple.coremedia.videoqueue") + (global-name "com.apple.springboard.watchdogserver") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.apsd") + (global-name "com.apple.FileProvider") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.audio.SystemSounds") + (global-name "com.apple.gamed.note") + (global-name "com.apple.accountsd.accessmanager") + (global-name "com.apple.sharingd") + (global-name "com.apple.MobileFileIntegrity") + (global-name "com.apple.backboard.workspaceserverconnection") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.ait.client") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.assetsd.keepDaemonAlive") + (global-name "com.apple.xpcd") + (global-name "com.apple.iapd.xpc") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.mobile.softwareupdated") + (global-name "com.apple.vsassetd") + (global-name "com.apple.gpumemd.source") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.iaptransportd.xpc") + (global-name "com.apple.bypassBasebandAutoBooter.msgport") + (global-name "com.apple.ReportCrash.DirectoryService") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.iapauthd.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.midiserver") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.wapi.client") + (global-name "com.apple.backboard.watchdog") + (global-name "com.apple.healthd.server") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.Music.MPMusicPlayerMigServerExists") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.symptomsd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.MobileAccessoryUpdater") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.iap2d") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.coremedia.wirelessdisplay") + (global-name "com.apple.certui.relay") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.managedconfiguration.mdmdservice") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.datamigrator.dz") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.cpe") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.accountsd.authmanager") + (global-name "com.apple.mDNSResponder") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.appleprofilepolicyd") + (global-name "com.apple.coremedia.wirelessdisplayserver") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.ReportCrash") + (global-name "com.apple.clouddbd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.iTunesStore.daemon.notifications.public") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.assetsd.messagingServer") + (global-name "com.apple.twitterd.server") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@0v3") + (global-name "com.apple.securityd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.nesessionmanager") + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.coremedia.recorder") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.safarifetcherd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (global-name "com.apple.mediaserverd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.utilitiesconnection") + (require-entitlement "com.apple.bulletinboard.utilities")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.Maps.mapspushd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.unfreed") + (require-entitlement "platform-application")) + (require-all + (local-name "com.apple.iphone.axserver") + (require-entitlement "com.apple.accessibility.api")) + (require-all + (global-name "com.apple.identityservicesd.embedded.auth") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.absinthed") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.bulletindistributord.server") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobilestoredemod") + (require-entitlement "com.apple.private.mobilestoredemo.enabledemo")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.AOSNotification") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.endpoint") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.suggestd.suggestionmanager") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.mobilemail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.observerconnection") + (require-entitlement "com.apple.bulletinboard.observer")) + (require-all + (global-name "com.apple.nanomaps.xpc.Maps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.Maps.SpringBoard") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.endpoint") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.nehelper") + (require-any + (require-entitlement "com.apple.networking.vpn.configuration") + (require-entitlement "com.apple.developer.networking.vpn.api"))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (global-name "com.apple.securityd.xpc") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.icloud.findmydeviced") + (require-any + (require-entitlement "com.apple.icloud.findmydeviced.access") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.audio.AudioSession") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.lskdd") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.medialibraryd.xpc") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.bulletinboard.settings")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.admin") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.routined.registration") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.mobilesafari-settings") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebSheet"))) + (require-all + (global-name "com.apple.aps.alertprovider.xpc") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.suggestd.suggestionmanager") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.backupd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.managedconfiguration.profiled") + (require-entitlement "com.apple.managedconfiguration.profiled-access")) + (require-all + (global-name "com.apple.familycircle.agent") + (require-entitlement "com.apple.private.familycircle")) + (require-all + (global-name "com.apple.icfcallserver") + (require-entitlement "com.apple.private.icfcallserver")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.systemstateconnection") + (require-entitlement "com.apple.bulletinboard.systemstate")) + (require-all + (global-name "com.apple.SystemConfiguration.PPPController-priv") + (require-entitlement "com.apple.networking.vpn.configuration")) + (require-all + (global-name "com.apple.coremedia.asset") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.harvestd.manager") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow mach-register + (require-all + (require-not (global-name-regex #"-idswake$" #".+-idswake$")) + (require-any + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (extension "com.apple.sandbox.application-group") + (require-all + (global-name "com.apple.Music.MPMusicPlayerControllerInternal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (global-name "com.apple.Music.MPMusicPlayerMigServerExists") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music")))))) +(allow network-inbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-all + (require-not (remote tcp "localhost:22")) + (require-not (remote tcp "localhost:873")) + (require-not (remote tcp "localhost:23"))) + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-not (remote tcp "localhost:62078")))) +(allow user-preference-read + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.itdbprep.server") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.network.eapclient.tls.TrustExceptions") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobileslideshow") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "mediaremote") + (preference-domain "com.apple.GMM") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.madrid") + (preference-domain "com.apple.nike") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.VoiceMemos") + (preference-domain "com.apple.da") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.messagesbadgecontroller") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.softwareupdateservicesd") + (preference-domain "com.apple.atc") + (preference-domain "com.apple.managedconfiguration.janitor") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.mobiletimer") + (preference-domain "com.apple.apsd") + (preference-domain "itdbprepserver") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.twitterd") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.mobilevpn") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.dataaccess.dataaccessd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.mobileme.fmf.assistant") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.certui") + (preference-domain "com.apple.mobilecal.alarmengine") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.mobilecal") + (preference-domain ".GlobalPreferences") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.preferences.network") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.OTASyncState") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobile.SyncMigrator") + (preference-domain "com.apple.MobileAddressBook") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.gamekit") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.voicemail") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.XCTest") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.imagent") + (preference-domain "com.apple.mobilestoresettings") + (preference-domain "com.apple.persistentconnection") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.demo-settings") + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (preference-domain "com.apple.coremedia") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (preference-domain "com.apple.corevideo") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (preference-domain "com.apple.NanoMailKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.accountsettings") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.AppStore") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (preference-domain "com.apple.OTASyncAgent") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.coreaudio") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.WebFoundation") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.frontrow") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.appletv.WhatsNew"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.medialibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.internal.Voltaire") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.homesharing") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.skyhookwireless.wps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.MobileStore") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.MailAccount-ExtProperties") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (preference-domain "com.apple.internal.Voltaire") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.accountsettings") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.MailAccount-ExtProperties") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.NanoMailKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.skyhookwireless.wps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.OTASyncAgent") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow process-info-pidinfo + (target self)) +(allow pseudo-tty) +(allow signal + (target self) + (require-all + (target others) + (require-entitlement "com.apple.taptoradar.extension")) + (require-all + (target others) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd")))) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-info + (require-all + (require-entitlement "fairplay-client") + (info-type "net.link.addr") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain 39) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb.xml new file mode 100644 index 0000000..a0a1131 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb.xml @@ -0,0 +1,24 @@ + + + + + + + + + +]> + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb new file mode 100644 index 0000000..286bc1b --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb @@ -0,0 +1,63 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/dev/dtracehelper"))) +(allow file-read* + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/") + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (require-all + (file-mode #o0004) + (require-any + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System") + (subpath "/private/var/db/dyld")))) +(allow file-read-metadata + (literal "/tmp") + (literal "/var") + (literal "/private/etc/localtime") + (literal "/etc")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/System/Library/Caches/com.apple.coresymbolicationd") + (subpath "/private/var/root/Library/Caches/com.apple.coresymbolicationd") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.DirectoryService.libinfo_v1")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/asl_input")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self) + (target self)) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb.xml new file mode 100644 index 0000000..42bc466 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb.xml @@ -0,0 +1,32 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb new file mode 100644 index 0000000..e4b45f4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb @@ -0,0 +1,217 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/Logs") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/System/Library/Frameworks") + (subpath "/System/Library") + (literal "/dev/aes_0") + (subpath "/private/var/logs/MobileMediaFactoryLogs") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (subpath "/private/var/logs/WirelessLibraryLogs") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/logs/MobileLibraryLogs") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/urandom") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/lib") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/logs/MobileLibraryLogs") + (subpath "/private/var/logs/WirelessLibraryLogs") + (subpath "/private/var/logs/MobileMediaFactoryLogs") + (subpath "/private/var/mobile/Library/Logs") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb new file mode 100644 index 0000000..481ec86 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb @@ -0,0 +1,372 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/private/var/mobile/Library/Logs/DataMigration") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (subpath "/private/var/mobile/Library/Caches/DataAccess") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/DataAccess") + (subpath "/private/var/mobile/Library/Logs/DataAccess") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/mobile/Library/Caches/com.apple.mobilesafari/ReadingListArchives") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (subpath "/private/var/mobile/Library/Logs/Message") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.sharedstore.lock") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Safari") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/mobile/Library/Caches/com.apple.dataaccess.dataaccessd") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/dev/zero") + (subpath "/private/var/mobile/Library/Logs/ManagedConfiguration") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-journal") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Safari/com.apple.Bookmarks.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.autoincrement.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-wal") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (literal "/private/var/mobile/Library/Logs") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-shm") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (subpath "/private/var/mobile/Library/Notes") + (literal "/dev/random") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/mobile/Library/Calendar") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.objectcreation.lock") + (subpath "/AppleInternal/Library/Frameworks") + (subpath "/usr/lib") + (regex #"^/private/var/mobile/Library/Cookies/com[.]apple[.]dataaccessd[.]binarycookies" #"^/private/var/mobile/Library/Cookies/com[.]apple[.]dataaccessd[.].+binarycookies") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/mobile/Library/Mail") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (require-not (regex #"^/private/var/mobile/Library/")) + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-read-metadata + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db") + (subpath "/private/var/mobile/Library/Logs/Message") + (subpath "/private/var/mobile/Library/Logs/DataAccess") + (regex #"^/private/var/mobile/Library/Cookies/com[.]apple[.]dataaccessd[.]binarycookies" #"^/private/var/mobile/Library/Cookies/com[.]apple[.]dataaccessd[.].+binarycookies") + (subpath "/private/var/mobile/Library/Logs/ManagedConfiguration") + (subpath "/private/var/mobile/Library/Caches/DataAccess") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-journal") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Notes") + (literal "/private/var/mobile/Library/Safari/com.apple.Bookmarks.lock") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/DataAccess") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.autoincrement.lock") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/mobile/Library/Calendar") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.sharedstore.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.objectcreation.lock") + (subpath "/private/var/mobile/Library/Logs/DataMigration") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/private/var/mobile/Library/Safari") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath "/private/var/mobile/Library/Caches/com.apple.dataaccess.dataaccessd") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-wal") + (subpath "/private/var/mobile/Library/Mail") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-shm") + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Safari")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Caches/com.apple.mobilesafari/ReadingListArchives") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.accountsd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb.xml new file mode 100644 index 0000000..847eba8 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb new file mode 100644 index 0000000..e6873ed --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb @@ -0,0 +1,227 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/mobile/Containers/Bundle/[^/]+$" #"^/private/var/mobile/Containers/Bundle/[^/]+/$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+$" #"^/private/var/mobile/Containers/Bundle/[^/]+//[.]app/" #"^/private/var/mobile/Containers/Bundle/[^/]+//[.]app$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[.]app/" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[.]app$" #"^/private/var/mobile/Containers/Bundle/[^/]+//[^/]+[.]app/" #"^/private/var/mobile/Containers/Bundle/[^/]+//[^/]+[.]app$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[^/]+[.]app/" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[^/]+[.]app$") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/XcodeBuiltProducts") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (subpath "/usr/share") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols") + (require-all + (require-not (subpath "/private/var/mobile/Media")) + (require-not (subpath "/private/var/mobile"))))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-priv-task-port + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (local tcp "localhost:*") + (remote tcp "localhost:*")))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (regex #"^/private/var/run/lockdown/checkin") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (subpath "/private/var/mobile/Containers")) + (debug-mode))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-debug) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb.xml new file mode 100644 index 0000000..7bb1f1e --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb new file mode 100644 index 0000000..ed1bc4c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb @@ -0,0 +1,239 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/tmp") + (literal "/dev/null") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/usr/lib") + (literal "/dev/aes_0") + (subpath "/System/Library/CacheDelete") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.cache_delete.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/db/timezone") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Library/Logs/CacheDelete") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Logs/CacheDelete") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]cache_delete[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.mobilegestalt.xpc") + (global-name-regex #"^com[.]apple[.].+[Cc]ache[Dd]elete$" #"^com[.]apple[.].+cache-delete$" #"^com[.]apple[.]mobile[.]cache_delete_") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd") + (global-name "com.apple.aggregated") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.cache_delete") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.cache_delete")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 24))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb new file mode 100644 index 0000000..4f7d027 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb @@ -0,0 +1,408 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.fmfd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/empty") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/usr/libexec/fmfd") + (extension "com.apple.sandbox.executable") + (literal "/usr/libexec") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/usr/lib") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]fmfd") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/dev/random") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/aes_0") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/PPTDevice") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]icloud[.]fmfd[.]plist") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.tccd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.lsd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.networkd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.marco") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.geod") + (global-name "com.apple.securityd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.apsd") + (global-name "com.apple.cookied") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cfprefsd.agent") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.conference") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.da") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.icloud.fmfd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.icloud.fmfd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb new file mode 100644 index 0000000..5314dae --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb @@ -0,0 +1,268 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal "/dev/random") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (literal "/dev/null") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/usr/lib") + (literal "/dev/aes_0") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.tccd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.pfd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.symptomsd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.networkd") + (global-name "com.apple.cookied") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usymptomsd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow network-inbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (local ip "*:*") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb new file mode 100644 index 0000000..1617ffe --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb @@ -0,0 +1,393 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/usr/libexec/gamed") + (subpath "/Applications") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.gamed") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/GameKit") + (regex #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[^/]+[.]app$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[^/]+[.]app/") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/System/Library") + (subpath "/AppleInternal/Applications") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.gamed.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/mobile/Library/Logs/GameKit") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/Logs/awd") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.sandbox.executable") + (literal "/dev/zero") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.VideoConference") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/gamed") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.gamecenter.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/Caches/GameKit") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.VideoConference.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/usr/libexec") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/dev/null") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]gamed") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]gamed") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Library/Logs/awd") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/gamed") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]conference[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]gamed[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]gamecenter[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]logging[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/GameKit") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Library/Caches/GameKit") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Logs/GameKit") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Caches/com.apple.VideoConference") + (subpath "/private/var/mobile/Library/Caches/com.apple.gamed") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.networkd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.fairplayd") + (global-name "com.apple.cookied") + (global-name "com.apple.awdd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.apsd") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.marco") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.gamecenter") + (global-name "com.apple.tccd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.springboard.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.accountsd.accountmanager") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.managedconfiguration.profiled.public") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (local udp "*:*"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (remote ip "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.gamed") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.gamed") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/usr/libexec/gamed"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb new file mode 100644 index 0000000..29a0edf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb @@ -0,0 +1,14 @@ +(version 1) +(deny default) +(allow iokit-get-properties) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self)) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb.xml new file mode 100644 index 0000000..7baaeea --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb.xml @@ -0,0 +1,30 @@ + + + + + + + + + +]> + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb new file mode 100644 index 0000000..a849f39 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb @@ -0,0 +1,332 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/CallHistoryDB") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/dev/null") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/GeoServices") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.GMM.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/private/var/mobile/Library/Logs/CallHistory") + (subpath "/System/Library") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/MapTiles") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ConfigServer.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles") + (subpath "/private/var/mobile/Library/Caches/com.apple.GeoServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/CallHistoryDB") + (subpath "/private/var/mobile/Library/Logs/CallHistory") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (subpath "/private/var/mobile/Library/GeoServices") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") + (literal "/private/var/mobile/Library/Caches/MapTiles") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") + (regex #"^/private/var/mobile/Library/Preferences/[.]GlobalPreferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]GEO[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]GMM[.]plist") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles") + (subpath "/private/var/mobile/Library/Caches/com.apple.GeoServices") + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/MapTiles")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.securityd") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cookied") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.CallHistorySyncHelper")) + (require-any + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (local-name "com.apple.cfprefsd.agent") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (remote ip "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.GEO") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.GMM") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb new file mode 100644 index 0000000..ad82661 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb @@ -0,0 +1,293 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/ptmx") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/private/var/tmp") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (subpath "/Applications") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (subpath "/System/Library") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/Caches/com.apple.watchkit.imagecache") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/Containers/Bundle/Application") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$") + (literal "/private/var/mobile/Library/Preferences/com.apple.gizmoappd.plist") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/PPTDevice") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]gizmoappd[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath "/private/var/mobile/Library/Caches/com.apple.watchkit.imagecache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.tccd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.carousel.glanceservice") + (global-name "com.apple.system.logger") + (global-name "com.apple.managedconfiguration.profiled.public") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.securityd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd") + (global-name "com.apple.cache_delete") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.carousel.backlightxpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.marco") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.conference") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.gizmoappd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb new file mode 100644 index 0000000..000fc1d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb @@ -0,0 +1,279 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/random") + (literal "/dev/urandom") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/ptmx") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/root/Library/Caches") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/root/Library/Caches/com.apple.opengl") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$") + (subpath "/private/var/mobile/Library/GPUTools") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelDevice") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAccelDevice2")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.aggregated") + (global-name "com.apple.tccd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.assertiond.applicationstateconnection") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd") + (global-name "com.apple.assertiond.appwatchdog") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.coresymbolicationd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow mach-priv-task-port + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (local tcp "localhost:*") + (literal "/private/var/run/gputoolsdhelper.sock") + (literal "/private/var/run/syslog") + (regex #"^/private/var/run/lockdown/checkin")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/Developer/usr/libexec/gputoolsd"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb.xml new file mode 100644 index 0000000..728a4ea --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb new file mode 100644 index 0000000..0069ed4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb @@ -0,0 +1,408 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (subpath "/usr/share") + (literal "/dev/ptmx") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") + (subpath "/System/Library") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.healthlite.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Health") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/dev/zero") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Fitness.plist") + (literal "/private/var/mobile/Library/CompanionSyncCaches") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanolifestyle.plist") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath "/Applications/Health.app") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanolifestyle.privacy.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.companionsync.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.healthd.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (literal "/private/var/mobile/Library/CompanionSyncCaches") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Fitness[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]healthd[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]nanolifestyle[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]nanolifestyle[.]privacy[.]plist") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Health") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CompanionSync")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/CompanionSyncCaches"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.aggregated") + (global-name "com.apple.awdd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coreduetd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.hangtracerd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.marco") + (global-name "com.apple.springboard.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.healthlite") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.TelephonyUtilities") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.Fitness") + (preference-domain "com.apple.conference") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.nanolifestyle.privacy") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.nanolifestyle") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.healthd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.locationd") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.nanolifestyle.privacy") + (preference-domain "com.apple.Fitness") + (preference-domain "com.apple.nanolifestyle") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb new file mode 100644 index 0000000..191e364 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb @@ -0,0 +1,343 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/ea") + (literal "/private/var/mobile/Library/Preferences/com.apple.iap2d.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/dev/aes_0") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/iapd" #"^/private/var/mobile/Library/Logs/CrashReporter/iap2d" #"^/private/var/mobile/Library/Logs/CrashReporter/mp" #"^/private/var/mobile/Library/Logs/CrashReporter/haywire" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistivetouchd[.]enabled[.]launchd") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Caches/com.apple.iap2d") + (literal "/dev/zero") + (literal "/dev/random") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (regex #"^/private/var/ea/ea[.0-9]+$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/Panics") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Media/Radio") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iapd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iaptransportd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Media/iTunes_Control") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/CallHistoryDB") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.backedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/sbin") + (literal "/dev/urandom") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Caches/com.apple.iap2d") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/iapd" #"^/private/var/mobile/Library/Logs/CrashReporter/iap2d" #"^/private/var/mobile/Library/Logs/CrashReporter/mp" #"^/private/var/mobile/Library/Logs/CrashReporter/haywire" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistivetouchd[.]enabled[.]launchd" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]iapd[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]iap2d[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]iaptransportd[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaremote[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]videos[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Media/Radio") + (subpath "/private/var/mobile/Library/CallHistoryDB") + (subpath "/private/var/mobile/Media/iTunes_Control") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/Panics") + (regex #"^/private/var/ea/ea[.0-9]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (global-name "com.apple.ExternalAccessory.distributednotification.server") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server")) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (local udp "*:*"))) +(allow network-bind + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/private/var/ea/ea[.0-9]+$"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (remote udp "*:*") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.iaptransportd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.iap2d") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.videos") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.da") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.homesharing") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.videos") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.iap2d") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.iaptransportd") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iap2d") + (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iapd")))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-kext-load + (kext-bundle-id "com.apple.driver.AppleUSBNCM") + (kext-bundle-id "com.apple.iokit.IOUSBHIDDriver") + (kext-bundle-id "com.apple.driver.AppleUSBAudio")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb.xml new file mode 100644 index 0000000..5831a8c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb new file mode 100644 index 0000000..dcdfbf5 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb @@ -0,0 +1,327 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension "com.apple.sandbox.application-group") + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (subpath "/System/Library/Frameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/dev/zero") + (literal "/dev/random") + (subpath "/usr/share") + (literal "/dev/urandom") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$"))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelContext2") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.fig.movie") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd") + (global-name "com.apple.system.logger") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.springboard.services") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.aggregated") + (global-name "com.apple.backboard.display.services") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow mach-register + (local-name "com.apple.iphone.axserver")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.Accessibility") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info-pidinfo + (target self)) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb.xml new file mode 100644 index 0000000..982b8d8 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb.xml @@ -0,0 +1,25 @@ + + + + + + + + + +]> + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb new file mode 100644 index 0000000..5d3c5a9 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb @@ -0,0 +1,242 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.librarian.ubiquity-container"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand.+[.]log") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/Mobile Documents") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/tmp") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Application Support") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.librariand.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath "/private/var/mobile/Library/Application Support/Librarian") + (literal "/dev/urandom") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Mobile Documents") + (subpath "/private/var/mobile/Library/Application Support/Librarian") + (literal "/private/var/mobile/Library/Application Support") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]appleaccount[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand.+[.]log" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]librariand[.]plist") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobile.installd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.ubd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.librariand") + (preference-domain "com.apple.appleaccount") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.appleaccount") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.librariand")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "hw.uuid")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb new file mode 100644 index 0000000..4ae2ad4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb @@ -0,0 +1,216 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdLib.plist") + (literal "/usr/libexec/limitadtrackingd") + (literal "/dev/ptmx") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/usr/lib") + (literal "/usr/libexec") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/db/timezone") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.logger") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.AdSheetPhone.management") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.AdLib") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb new file mode 100644 index 0000000..08cdc30 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb @@ -0,0 +1,332 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/AppleInternal/Lockdown") + (literal "/private/var/db/launchd.db/com.apple.launchd/overrides.plist") + (subpath "/System/Library") + (literal "/private/etc/master.passwd") + (literal "/private/var/mobile/Library/Preferences/com.apple.purplebuddy.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/logs") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/usr/libexec/lockdownd") + (literal "/dev/random") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/private/var/mobile/Media") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Applications/Preferences.app") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/db/timezone") + (literal "/dev/zero") + (subpath "/private/var/run/lockdown") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]mobile[.]lockdownd[.]plist") + (subpath "/private/var/root/Library/Lockdown") + (subpath "/Developer") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/run/lockdown.sock") + (subpath "/private/var/preferences/SystemConfiguration") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/usr/libexec") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all + (subpath "/private/var/mobile/Library/Notes") + (vnode-type DIRECTORY)) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Media") + (vnode-type DIRECTORY)) + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (subpath "/private/var/mobile/Library/Calendar") + (vnode-type DIRECTORY)) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Voicemail") + (vnode-type DIRECTORY)) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Applications") + (vnode-type DIRECTORY)) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/tmp/MediaCache") + (vnode-type DIRECTORY)) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (vnode-type DIRECTORY)) + (require-all + (subpath "/private/var/mobile/Containers") + (vnode-type DIRECTORY))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Media") + (subpath "/private/var/run/lockdown") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]mobile[.]lockdownd[.]plist") + (subpath "/private/var/logs") + (literal "/private/var/run/lockdown.sock") + (subpath "/private/var/root/Library/Lockdown") + (subpath "/private/var/preferences/SystemConfiguration") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/db/timezone") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleEffaceableStorageUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "AppleNANDFTLUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (iokit-property "auto-boot")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobile.notification_proxy") + (global-name "com.apple.crashreportcopymobile") + (global-name "com.apple.lsd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.syslog_relay") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.webinspector") + (global-name "com.apple.mobile.assertion_agent") + (global-name "com.apple.symptomsd") + (global-name "com.apple.afcd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.logger") + (global-name "com.apple.mobile.installation_proxy") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.atc2") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.crash_mover") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.streaming_zip_conduit") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.aggregated") + (global-name "com.apple.AOSNotification") + (global-name "com.apple.mobile.insecure_notification_proxy") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name-regex #"^lockdown[.]") + (global-name "com.apple.ait.client") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.atc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/run/lockdown") + (local tcp "*:*") + (literal "/private/var/run/lockdown.sock")))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockbot") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.purplebuddy") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb new file mode 100644 index 0000000..7d0e5eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb @@ -0,0 +1,129 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/dev/dtracehelper"))) +(allow file-read* + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/private/var/Managed Preferences/mobile") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds/" #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds$" #"^/private/var/folders/[^/]+/[^/]+/C/mds/" #"^/private/var/folders/[^/]+/[^/]+/C/mds$" #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$" #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (literal "/private/var/run/mDNSResponder") + (literal "/Library/Managed Preferences") + (literal "/private/var/Library/Preferences/") + (literal "/private/var/Managed Preferences/mobile/com.apple.mDNSResponder.plist") + (literal "/dev/null") + (require-all + (file-mode #o0004) + (require-any + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System") + (subpath "/private/var/db/dyld")))) +(allow file-read-data + (subpath "/private/var/tmp/mds") + (subpath "/private/var/db/mds") + (literal "/Library/Keychains/System.keychain") + (literal "/private/var/db/crls/crlcache.db") + (require-all + (require-not (regex #"^/Library/Keychains/")) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (regex #"^/Library/Preferences/[.]GlobalPreferences[.]" #"^/Library/Preferences/ByHost/[.]GlobalPreferences[.]") + (regex #"^/Library/Preferences/com[.]apple[.]security[.]") + (literal "/Library/Security/Trust Settings/Admin.plist") + (literal "/Library/Preferences/SystemConfiguration/preferences.plist") + (literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") + (literal "/Library/Preferences/SystemConfiguration/com.apple.nat.plist") + (literal "/dev/console") + (literal "/usr/sbin") + (literal "/usr/sbin/mDNSResponder") + (literal "/Library/Preferences/com.apple.crypto.plist")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/run/mDNSResponder") + (regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds/" #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds$" #"^/private/var/folders/[^/]+/[^/]+/C/mds/" #"^/private/var/folders/[^/]+/[^/]+/C/mds$" #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$" #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/console") + (literal "/dev/null")))) +(allow iokit-open + (iokit-user-client-class "mDNSOffloadUserClient") + (iokit-user-client-class "wlDNSOffloadUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "NVEthernetUserClientMDNS") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.blued") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.webcontentfilter.dns") + (global-name "com.apple.SecurityServer") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.networkd") + (global-name "com.apple.distributed_notifications.2") + (global-name "com.apple.bsd.dirhelper") + (global-name "com.apple.system.logger") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.ocspd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mDNSResponderHelper") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.snhelper") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.awacs") + (global-name "com.apple.securityd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration")) +(allow mach-register + (global-name "com.apple.d2d.ipc")) +(allow network* + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/asl_input")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self) + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb.xml new file mode 100644 index 0000000..024e7ad --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb new file mode 100644 index 0000000..9d2f840 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb @@ -0,0 +1,592 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.rtcreporting.upload") + (subpath "/private/var/mobile/Library/Caches/com.apple.VideoConference/logs/mediaserverd"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.airplay.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.rtcreporting.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (subpath "/private/var/mobile/Media/PhotoData/CPLAssets") + (subpath "/Developer") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (subpath "/usr/lib") + (extension "com.apple.mediaserverd.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.VideoConference.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/mobile/Library/Logs/AirPlay[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/mediaserverd") + (literal "/private/var/mobile/Library/Preferences/com.apple.voicetrigger.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.settings.bluetooth.audio-route.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.audio.virtualaudio.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Media/PhotoData/Mutations") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Music") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/VoiceTrigger") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/logs/mediaserverd") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/private/var/mobile/Library/VoiceTrigger") + (literal "/private/var/mobile/Library/Preferences/com.apple.celestial.plist") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences-sounds.plist") + (subpath "/Library") + (subpath "/private/var/mobile/Library/Caches/com.apple.VideoConference") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.imessage.bag.plist") + (subpath "/private/var/mobile/Media/Podcasts") + (literal "/private/var/mobile/Library/Preferences/com.apple.voicetrigger.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/mobile/Media/PhotoData/Sync") + (subpath "/usr/local/share/firmware/isp") + (subpath "/private/var/tmp/MediaCache") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/dev/zero") + (literal "/private/var/tmp/AirTunesHALPlugin.log") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/mobile/Media/Purchases") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mediaserverd") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Caches/CoreMotion/CoreMotion.log") + (subpath "/usr/local/lib") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.mediaserverd.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.VideoProcessing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Media/Recordings") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/mobile/Library/Logs/awd") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.facetime.bag.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$") + (literal "/usr/sbin/mediaserverd") + (subpath "/private/var/wireless/Library/Logs/awd") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (subpath "/private/var/mobile/Media/Downloads") + (extension "com.apple.sandbox.executable") + (subpath "/usr/sbin") + (subpath "/System/Library/Frameworks") + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/AppleInternal/Library/Conference/Environments.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.audio.penguin.plist") + (subpath "/private/var/mobile/Media/DCIM") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.facetime.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/tmp/AirTunesHALPlugin.log") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Music") + (subpath "/private/var/mobile/Media/Downloads") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/VoiceTrigger") + (subpath "/private/var/mobile/Media/Purchases") + (subpath "/private/var/logs/mediaserverd") + (subpath "/private/var/mobile/Media/PhotoData/CPLAssets") + (subpath "/private/var/mobile/Library/VoiceTrigger") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Caches/CoreMotion/CoreMotion.log") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.mediaserverd.read-write") + (extension "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media/Podcasts") + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (subpath "/private/var/mobile/Library/Caches/com.apple.VideoConference") + (subpath "/private/var/mobile/Library/Logs/awd") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]airplay[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]voicetrigger[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]voicetrigger[.]notbackedup[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]avfoundation[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]coremedia[.]plist" #"^/private/var/mobile/Library/Logs/AirPlay[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/mediaserverd" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]audio[.]penguin[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]audio[.]virtualaudio[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]celestial[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]conference[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]coreaudio[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]facetime[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]facetime[.]bag[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]imessage[.]bag[.]plist" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath "/private/var/mobile/Media/Recordings") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Media/PhotoData/Sync") + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/tmp/MediaCache") + (subpath "/private/var/wireless/Library/Logs/awd") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoData/Mutations") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/CoreMotion")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccessoryManagerUserClient") + (iokit-user-client-class "IOAudio2TransformerUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOUSBInterfaceUserClientV2") + (iokit-user-client-class "IOAudioCodecsUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "AppleH6CamInUserClient") + (iokit-user-client-class "AppleH2CamInUserClient") + (iokit-user-client-class "AppleH3CamInUserClient") + (iokit-user-client-class "AppleH4CamInUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOUSBDeviceInterfaceUserClient") + (iokit-user-client-class "AppleVXD375UserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "AppleVXE380UserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "AppleVXD390UserClient") + (iokit-user-client-class "AppleAVEUserClient") + (iokit-user-client-class "AppleVXD393UserClient") + (iokit-user-client-class "IOStreamAudioUserClient") + (iokit-user-client-class "H3H264VideoEncoderDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAudio2DeviceUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelDevice2")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "shm_pcm_audio_sco_read") + (ipc-posix-name "shm_pcm_audio_sco_write") + (ipc-posix-name-regex #"^[0-9A-F][0-9A-F]:+[0-9A-F][0-9A-F]-tacl$" #"^shm_notif[.][^.]+[.][RW]$" #"^com[.]apple[.]audio[.]abl[.]" #"^AppleAudioQueue[.]." #"^AppleAURemoteIO[.]." #"^AppleABL[.]." #"^AppleAudioQueue[.].+" #"^AppleAURemoteIO[.].+" #"^AppleABL[.].+") + (ipc-posix-name "shm_pcm_audio_acl") + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.aggregated") + (global-name "com.apple.iapd.xpc") + (global-name "com.apple.carkit.service") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.b184_mcu_commd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coremedia.virtualdisplayserver") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.cookied") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") + (global-name "com.apple.GSSCred") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.iaptransportd.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.securekeyvaultd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.iap2d.distributednotification.server") + (global-name "com.apple.nsurlstorage-cache") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.NetworkLinkConditioner") + (global-name "com.apple.springboard.services") + (global-name "com.apple.apsd") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.SystemConfiguration.helper") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.awdd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.lskdmsed") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.wifi.manager") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.b184_monitord") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.iapd.distributednotification.server") + (global-name "com.apple.coreduetd") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.lskdd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.iap2d.xpc") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.filesystems.userfsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.lsd") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.symptomsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.audio.SystemSounds") + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.midiserver.io") + (global-name-regex #"^com[.]apple[.]coremedia[.]")) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (local tcp "*:*") + (local udp "*:*")))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (literal "/private/var/run/syslog") + (remote udp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.voicetrigger.notbackedup") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.settings.bluetooth.audio-route") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.corevideo") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.facetime") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.rtcreporting") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.audio.penguin") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.da") + (preference-domain "com.apple.audio.virtualaudio") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.locationd") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.facetime") + (preference-domain "com.apple.audio.penguin") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.voicetrigger.notbackedup") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.audio.virtualaudio") + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/usr/sbin/mediaserverd") + (require-all + (debug-mode) + (require-any + (literal "/usr/bin/trace") + (literal "/usr/bin/syslog")))))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) +(allow system-suspend-resume) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb.xml new file mode 100644 index 0000000..6f43bc4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb new file mode 100644 index 0000000..712ccc9 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb @@ -0,0 +1,299 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (subpath "/usr/share") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library/Frameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.afc.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/urandom") + (literal "/dev/random") + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (literal "/dev/null") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/usr/libexec/mobile_house_arrest") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-data + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/GeoJSON$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$"))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (local-name "com.apple.cfprefsd.agent") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.afc") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb new file mode 100644 index 0000000..3dff23b --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb @@ -0,0 +1,358 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.assets.read") + (require-any + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/VoiceServices") + (subpath "/private/var/mobile/Library/PreinstalledAssets") + (subpath "/private/var/mobile/Library/Assets"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (require-any + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/VoiceServices") + (subpath "/private/var/mobile/Library/PreinstalledAssets") + (subpath "/private/var/mobile/Library/Assets"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]MobileAsset[.]plist" #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$") + (literal "/private/var/mobile/Library/VoiceServices") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/usr/lib") + (literal "/private/var/root/Library/Preferences/com.apple.WebFoundation.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/tmp") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/urandom") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$") + (subpath "/AppleInternal/Library/PreinstalledAssets") + (literal "/private/etc/master.passwd") + (literal "/private/var/mobile/Library/Preferences/com.apple.AssetCacheLocator.plist") + (literal "/") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/mobile/Library/PreinstalledAssets") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/root/Library/Cookies$" #"^/private/var/root/Library/Cookies/Cookies[.]binarycookies") + (literal "/dev/null") + (literal "/usr/libexec/mobileassetd") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/usr/libexec") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Assets") + (literal "/private/var/mobile/Library/VoiceServices") + (subpath "/private/var/mobile/Library/PreinstalledAssets") + (regex #"^/private/var/root/Library/Cookies$" #"^/private/var/root/Library/Cookies/Cookies[.]binarycookies" #"^/private/var/root/Library/Preferences/com[.]apple[.]MobileAsset[.]plist" #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileAsset[.]plist" #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.networkd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd") + (global-name "com.apple.tccd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.cookied") + (global-name "com.apple.cache_delete") + (global-name "com.apple.aggregated") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AssetCacheLocator") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb.xml new file mode 100644 index 0000000..44a376c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb new file mode 100644 index 0000000..8846811 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb @@ -0,0 +1,286 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoMail.plist") + (literal "/dev/ptmx") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/null") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/dev/random") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoMailKitClient.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/NanoMailKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/PPTDevice") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/NanoMailKit") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]NanoMailKitClient[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.hangtracerd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.marco") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.NanoMailKitClient") + (preference-domain "com.apple.conference") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.NanoMail") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.NanoMailKitClient")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb new file mode 100644 index 0000000..d474ddc --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb @@ -0,0 +1,403 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/private/var/db/timezone") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/tmp") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-nanomapscd[.]log" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapsSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/aes_0") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Preferences/com.apple.companionsync.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/awd") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/PPTDevice") + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (literal "/private/var/mobile/Library/Preferences") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync")))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-nanomapscd[.]log" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MapsSupport[.]plist") + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CompanionSync")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.securityd") + (global-name "com.apple.routined.registration") + (global-name "com.apple.Maps.IPC") + (global-name "com.apple.Maps.gsEvents") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cookied") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.awdd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.tccd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.marco") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.logger") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.networkd") + (global-name "com.apple.Maps.SpringBoard") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.geod") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")) +(allow user-preference-read + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.demo-settings") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MapsSupport")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb new file mode 100644 index 0000000..3af464e --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb @@ -0,0 +1,363 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/Applications/NanoMaps.app") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-nanomapsgd[.]log" #"^/private/var/mobile/Library/MapsHistory[.]plist" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoMaps.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/mobile/Library/Maps") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/usr/share") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/usr/lib") + (subpath "/System/Library") + (subpath "/private/var/tmp") + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.companionsync.plist") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/mobile/Library/Logs/awd") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Maps") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-nanomapsgd[.]log" #"^/private/var/mobile/Library/MapsHistory[.]plist" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]NanoMaps[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CompanionSync")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.tccd") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.marco") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.logger") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.geod") + (global-name "com.apple.assertiond.processassertionconnection") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.NanoMaps") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.demo-settings") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.NanoMaps")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb new file mode 100644 index 0000000..b239d5c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb @@ -0,0 +1,276 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/tty.stockholm") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.awd.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-nfcd[.]log" #"^/private/var/mobile/Library/Logs/com[.]apple[.]nfcd[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com[.]apple[.]nfcd_") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/dev/tty.stockholm") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.Duet.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (subpath "/System/Library") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/usr/libexec/nfcd") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/run/syslog") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Logs/awd") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-nfcd[.]log" #"^/private/var/mobile/Library/Logs/com[.]apple[.]nfcd[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com[.]apple[.]nfcd_" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]awd[.]plist") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/tty.stockholm") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleStockholmControlUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.awdd") + (global-name "com.apple.tccd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.system.logger") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (control-name "com.apple.uart.stockholm") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.stockholm") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Duet") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.stockholm") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_SYSTEM)) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb new file mode 100644 index 0000000..9402004 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb @@ -0,0 +1,229 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/System/Library/Frameworks") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.logger") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.pfd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.notification_center") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb.xml new file mode 100644 index 0000000..d8a3680 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb new file mode 100644 index 0000000..d13ea38 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb @@ -0,0 +1,19 @@ +(version 1) +(allow default) +(deny file* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-chroot + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-create + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/") + (local ip "*:*")) +(deny network-inbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-bind + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-outbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) +(deny process-exec-interpreter + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb.xml new file mode 100644 index 0000000..fa56c88 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb.xml @@ -0,0 +1,20 @@ + + + + + + + + + +]> + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb new file mode 100644 index 0000000..f952ec1 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb @@ -0,0 +1,375 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Logs/com.apple.nsurlsessiond") + (literal "/usr/libexec") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/tmp") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/Library/com.apple.nsurlsessiond") + (subpath "/private/var/mobile/Media/Downloads") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (literal "/usr/libexec/nsurlsessiond") + (literal "/private/var/mobile/Library/Preferences/com.apple.nsurlsessiond.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.Duet.plist") + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]coremedia")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/random") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Media/Downloads") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/")) + (require-any + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]nsurlsessiond[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath "/private/var/mobile/Library/Logs/com.apple.nsurlsessiond") + (subpath "/private/var/mobile/Library/com.apple.nsurlsessiond") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs")))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cookied") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.coreduetd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.fig.movie") + (global-name "com.apple.ocspd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.hangtracerd") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.CARenderServer")) + (require-any + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.lsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.tccd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.nsurlsessiond") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.Duet") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.coremedia") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.nsurlsessiond")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb new file mode 100644 index 0000000..55270e3 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb @@ -0,0 +1,254 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Applications") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/ptmx") + (subpath "/usr/libexec") + (literal "/dev/random") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/db/timezone") + (subpath "/private/var/tmp") + (literal "/dev/null") + (literal "/private/etc/master.passwd") + (subpath "/usr/lib") + (literal "/dev/urandom") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Containers") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (extension "com.apple.nsurlstorage.extension-cache") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.nsurlstorage.extension-cache") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb new file mode 100644 index 0000000..9f91048 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb @@ -0,0 +1,501 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.biometrickitd.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (subpath "/usr/lib") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/random") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]passd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]passd") + (literal "/dev/ptmx") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.purplebuddy.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Passes") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/tmp") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.passd.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ConfigServer.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath "/private/var/mobile/Library/Caches/PassKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdLib.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$") + (subpath "/private/var/mobile/Library/Passes") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]passd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]passd") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]passd[.]plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Caches/PassKit") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]plist") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd$"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (iokit-property "reportStatusMessages")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.tccd") + (global-name "com.apple.seld") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.system.logger") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.revisiond") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.librariand") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.bird.token") + (global-name "com.apple.springboard.services") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.AdSheetPhone.analytics") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nfcd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.symptomsd") + (global-name "com.apple.springboard.carditemscontroller") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.icloud.findmydeviced") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.biometrickitd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.geod") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.bird") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.FileProvider") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.cookied") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.fig.movie") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.GSSCred") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.apsd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.locationd.spi") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote ip "*:*") + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.locationd") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.passd") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.biometrickitd") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.purplebuddy") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.stockholm") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.passd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb.xml new file mode 100644 index 0000000..d118cf1 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb new file mode 100644 index 0000000..97e8831 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb @@ -0,0 +1,232 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/pfm") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (literal "/dev/random") + (subpath "/usr/share") + (literal "/dev/urandom") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/dev/ptmx") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (subpath "/System/Library") + (literal "/dev/pfm") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/pfm") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-read-data + (ipc-posix-name "apple.shm.notification_center")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.tccd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb new file mode 100644 index 0000000..8287bee --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb @@ -0,0 +1,301 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/random") + (subpath "/private/var/run/printd") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/urandom") + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/dev/null") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.printd.plist") + (subpath "/private/var/mobile/Library/com.apple.printd") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/tmp") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$") + (subpath "/usr/share") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/com.apple.printd") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]printd[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$") + (subpath "/private/var/run/printd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.springboard.services") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.networkd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cookied") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.tccd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.logger") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (local tcp "*:*"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.printd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.printd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb new file mode 100644 index 0000000..7f9c6d0 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb @@ -0,0 +1,232 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (regex #"^/private/var/mobile/Library/Logs/ptpd[.]log$") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Media") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.ImageCaptureFramework.plist") + (subpath "/private/var/tmp") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (literal "/dev/random") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/") + (require-not (subpath "/private/var/mobile")) + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CrashReporter")))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Media") + (regex #"^/private/var/mobile/Library/Logs/ptpd[.]log$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]ImageCaptureFramework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileslideshow[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CrashReporter"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.ImageCaptureFramework") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileslideshow")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb.xml new file mode 100644 index 0000000..7dd92d4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb new file mode 100644 index 0000000..667bdc7 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb @@ -0,0 +1,855 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.quicklook.readonly") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (extension "com.apple.quicklook.readonly") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (subpath "/private/var/mobile/Library/Fonts") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/TypologyRecording.framework") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (require-not (subpath "/private/var/mobile/Library/Carrier Bundles")) + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/mobile/Library/WebKit") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (subpath "/private/var/tmp") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (subpath "/private/var/mobile/Library/WebClips") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd.savedState/") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]quicklook[.]quicklookd[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]quicklook[.]quicklookd[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]quicklook[.]quicklookd-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (subpath "/private/var/mobile/Media/Safari") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.revisiond.revision"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.revisiond.staging"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (subpath "/private/var/tmp/MediaCache") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]quicklook[.]quicklookd[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd.savedState/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath "/private/var/mobile/Library/WebKit") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Library/WebKit/Databases") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/Databases")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/LocalStorage")))))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd.savedState"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.librariand") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.TextInput") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.revisiond") + (global-name "com.apple.GSSCred") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.sharingd.nsxpc") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.aggregated") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.tccd") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.webinspector") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.securityd") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.springboard.services") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.bird.token") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.UIKit.pasteboardd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.bird") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.FileCoordination") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.networkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.calaccessd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.marco") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.cookied") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.webfilterd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "ScripterServer") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.FileProvider") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.backboard.hid.services") + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.endpoint") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (literal "/private/var/run/printd") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/lockdown.sock")) +(allow user-preference-read + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.SpeakSelection") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.da") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.youtubeframework") + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb new file mode 100644 index 0000000..6dc9e71 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb @@ -0,0 +1,142 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/etc/master.passwd") + (subpath "/private/etc/racoon") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (subpath "/private/var/run/racoon") + (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") + (literal "/dev/dtracehelper")))) +(allow file-read* + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/preferences") + (subpath "/private/var/root") + (subpath "/private/etc/racoon") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/sha1_0") + (literal "/private/var/db/icu") + (literal "/dev/zero") + (subpath "/private/var/run/racoon") + (literal "/dev/random") + (literal "/private/var/run/racoon.sock") + (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") + (literal "/private/var/run/racoon.pid") + (subpath "/private/var/db/timezone") + (literal "/Library/Managed Preferences/mobile") + (literal "/private/var/log/racoon.log") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/etc/master.passwd") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/dev/dtracehelper") + (literal "/Library/Managed Preferences") + (literal "/dev/null") + (literal "/Library/Preferences") + (subpath "/private/var/Managed Preferences/mobile") + (require-all + (file-mode #o0004) + (require-any + (subpath "/usr/sbin") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/System"))) + (require-all + (file-mode #o0004) + (require-any + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System") + (subpath "/private/var/db/dyld")))) +(allow file-read-metadata + (literal "/tmp") + (literal "/var") + (literal "/etc") + (literal "/etc") + (literal "/var") + (literal "/private/etc/localtime") + (literal "/tmp")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/run/racoon.sock") + (literal "/private/var/log/racoon.log") + (literal "/private/var/run/racoon.pid") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/dev/null")))) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]") + (ipc-posix-name "apple.shm.notification_center")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.securityd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.ocspd") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nehelper") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.aggregated")) +(allow network* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (local udp "*:500") + (remote udp "*:*") + (local udp "*:4500") + (literal "/private/var/run/racoon.sock")))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (control-name "com.apple.net.ipsec_control") + (literal "/private/var/run/syslog") + (literal "/private/var/run/asl_input")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self) + (target self)) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb.xml new file mode 100644 index 0000000..582149f --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb new file mode 100644 index 0000000..4a46a3a --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb @@ -0,0 +1,238 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/urandom") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/dev/ptmx") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/null") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreSuggestions.MobileAssets.plist") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type SYMLINK) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.logger") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.mobileassetd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.webinspector") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobilegestalt.xpc") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb new file mode 100644 index 0000000..fa4ac06 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb @@ -0,0 +1,245 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.revisiond.revision") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$")) + (require-all + (extension-class "com.apple.revisiond.staging") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/aes_0") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (subpath "/private/var/log/com.apple.revisiond") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.revisiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.processassertionconnection") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30)) + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 13)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb.xml new file mode 100644 index 0000000..a453c1b --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb new file mode 100644 index 0000000..19ae18f --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb @@ -0,0 +1,405 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.routined.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/usr/libexec/routined") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/Applications") + (subpath "/System/Library") + (subpath "/Library/Audio/Plug-Ins") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-routined[.]log" #"^/private/var/Managed Preferences/mobile/com[.]apple[.]routined[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/AppleInternal") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System") + (literal "/usr/libexec") + (subpath "/private/var/mobile/Library/Assets") + (subpath "/private/var/mobile/Library/Logs/com.apple.routined") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/XcodeBuiltProducts") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/Developer") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Containers/Bundle") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/dev/ptmx") + (literal "/dev/random") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Logs/awd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]routined[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-routined[.]log" #"^/private/var/Managed Preferences/mobile/com[.]apple[.]routined[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") + (subpath "/private/var/mobile/Library/Logs/com.apple.routined") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined$")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.aggregated") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.cookied") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.locationd.routine") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.calaccessd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.geod") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.symptomsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.awdd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.carkit.service") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.system.logger") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:443") + (remote tcp "*:80") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.locationd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.routined") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.TelephonyUtilities") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.routined") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/usr/bin/ditto"))) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb.xml new file mode 100644 index 0000000..601522d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb new file mode 100644 index 0000000..68d732d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb @@ -0,0 +1,368 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.tsmreg.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal "/usr/libexec/seld") + (literal "/dev/null") + (literal "/usr/libexec") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]seld" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]seld") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.awd.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library/StockholmPlugins") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.passbook.plist") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-seld[.]log" #"^/private/var/mobile/Library/Logs/com[.]apple[.]seld[.]log" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld[.]seinfo[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com[.]apple[.]seld_") + (subpath "/private/var/tmp") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-seld[.]log" #"^/private/var/mobile/Library/Logs/com[.]apple[.]seld[.]log" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld[.]seinfo[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com[.]apple[.]seld_" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]awd[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]tsmreg[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]seld" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]seld") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleSSEUserClient") + (iokit-user-client-class "AppleCredentialManagerUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.nfcd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.aggregated") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.securityd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.apsd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.awdd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.tccd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cookied") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.system.logger") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nsurlsessiond") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.seld.aps")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.passbook") + (preference-domain "com.apple.NanoRegistry") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.tsmreg") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb new file mode 100644 index 0000000..29a0edf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb @@ -0,0 +1,14 @@ +(version 1) +(deny default) +(allow iokit-get-properties) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self)) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb.xml new file mode 100644 index 0000000..7baaeea --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb.xml @@ -0,0 +1,30 @@ + + + + + + + + + +]> + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb new file mode 100644 index 0000000..35758ec --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb @@ -0,0 +1,289 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/MobileSoftwareUpdate/restore.log") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/db/UpdateMetrics") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (literal "/dev/null") + (literal "/dev/aes_0") + (literal "/dev/random") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileSoftwareUpdate.plist") + (literal "/dev/urandom") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/MobileSoftwareUpdate") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/MobileSoftwareUpdate"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/db/UpdateMetrics") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/OTAUpdate-") + (literal "/private/var/mobile/MobileSoftwareUpdate/restore.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/MobileSoftwareUpdate"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-set-properties + (iokit-property "IONVRAM-DELETE-PROPERTY")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.sharingd.NSURLSessionProxyService") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.GSSCred") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.system.logger") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.symptomsd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cookied") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.networkd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.accountsd.accountmanager") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.MobileSoftwareUpdate") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb new file mode 100644 index 0000000..96036ef --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb @@ -0,0 +1,276 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath "/private/var/mobile/Media")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/usr/libexec/streaming_zip_conduit") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/share") + (subpath "/usr/lib") + (literal "/dev/urandom") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Containers/Bundle") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.StreamingUnzipService.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/aes_0") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (literal "/usr/libexec") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Media"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Media")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Media")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Media")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Media"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Media")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Media"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Media")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Media")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/mobile/Media"))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.system.logger") + (global-name "com.apple.securityd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.lockdown.host_watcher") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (regex #"^/private/var/run/lockdown/checkin") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.StreamingUnzipService") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb new file mode 100644 index 0000000..ebc5a20 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb @@ -0,0 +1,293 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Calendar") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.suggestions.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/mobile/Library/Suggestions") + (subpath "/usr/lib") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreSuggestions.MobileAssets.plist") + (subpath "/private/var/mobile/Library/CallHistoryDB") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreSuggestions.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (literal "/private/var/mobile/Library/SyncedPreferences/com.apple.CoreSuggestions.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilecal.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/dev/aes_0") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]suggestions[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Calendar") + (subpath "/private/var/mobile/Library/Suggestions") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.reversetemplated") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.syncdefaultsd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.securityd") + (global-name "com.apple.system.logger") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.calaccessd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.CoreSuggestions") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mobilecal") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.suggestions") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb new file mode 100644 index 0000000..ab4121a --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb @@ -0,0 +1,291 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]syncdefaultsd") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Caches") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (literal "/dev/null") + (subpath "/private/var/Managed Preferences/mobile") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/mobile/Library/Preferences") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/System/Library/Frameworks") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/SyncedPreferences") + (subpath "/usr/lib") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (require-not (regex #"^/private/var/mobile/Library/")) + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Preferences") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$") + (subpath "/private/var/mobile/Library/SyncedPreferences") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.accountsd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.appleaccount") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb.xml new file mode 100644 index 0000000..9024fd6 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb new file mode 100644 index 0000000..27472b2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb @@ -0,0 +1,224 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/System/Library/Frameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (literal "/dev/null") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.sandbox.executable") + (literal "/dev/random") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Application Support") + (subpath "/private/var/mobile/Library/Inboxes") + (subpath "/private/var/spool/mdt") + (regex #"^/private/var/mobile/Library/Application Support/Containers/" #"^/private/var/mobile/Library/Application Support/Containers$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb new file mode 100644 index 0000000..cff0a1f --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb @@ -0,0 +1,262 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/dev/random") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (subpath "/System/Library") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/etc/master.passwd") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.aggregated") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb new file mode 100644 index 0000000..3b23533 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb @@ -0,0 +1,267 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/share") + (subpath "/usr/lib") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (literal "/dev/null") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-metadata + (literal "/private/var/mobile") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.filesystems.userfs_helper") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/System/Library/Filesystems/msdos.fs/Contents/Resources/fsck_msdos") + (literal "/System/Library/Filesystems/exfat.fs/Contents/Resources/fsck_exfat")))) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb.xml new file mode 100644 index 0000000..5c03ca9 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb new file mode 100644 index 0000000..127043c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb @@ -0,0 +1,271 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/db/timezone") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (subpath "/usr/lib") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/null") + (literal "/dev/aes_0") + (subpath "/System/Library") + (literal "/dev/random") + (subpath "/private/var/mobile/Media/Vibrations") + (literal "/dev/urandom") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Media") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Media/Vibrations") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media") + (literal "/private/var/mobile/Media/Vibrations") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.tccd") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.duetknowledged.activity") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.aggregated") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb new file mode 100644 index 0000000..af892f8 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb @@ -0,0 +1,280 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$"))))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library/Frameworks") + (literal "/dev/random") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/urandom") + (require-all + (regex #"^/private/var/mobile/Containers/Bundle/VPNPlugin/[-0-9A-Z]+$" #"^/private/var/mobile/Containers/Bundle/VPNPlugin/[-0-9A-Z]+/[^/]+[.]vpnplugin/" #"^/private/var/mobile/Containers/Bundle/VPNPlugin/[-0-9A-Z]+/[^/]+[.]vpnplugin$") + (extension "com.apple.vpn-plugin")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols") + (require-all + (require-not (subpath "/private/var/tmp")) + (require-not (subpath "/private/var/mobile/Library")) + (require-not (subpath "/private/var/logs")) + (require-not (subpath "/private/var/ea")) + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$"))))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$"))) +(allow file-read-metadata + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$"))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (global-name-regex #"^com[.]f5[.]f5_sslvpn_plugin")) +(allow network* + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb.xml new file mode 100644 index 0000000..561e3f2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb new file mode 100644 index 0000000..472d9f5 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb @@ -0,0 +1,243 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/AppleInternal") + (literal "/private/var/tmp/webinspectord.log") + (regex #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/dev/null") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/XcodeBuiltProducts") + (extension "com.apple.sandbox.executable") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/Developer") + (subpath "/usr/share") + (subpath "/System") + (subpath "/Applications") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebInspector.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.webinspectord.plist") + (literal "/dev/random") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/tmp/webinspectord.log") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.duetknowledged.activity") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.system.logger") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.managedconfiguration.profiled.public") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.WebInspector") + (preference-domain "com.apple.webinspectord") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb new file mode 100644 index 0000000..f8b6800 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb @@ -0,0 +1,216 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (subpath "/usr/share/firmware/wifi") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (subpath "/usr/share/zoneinfo.default") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/usr/lib") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/random") + (subpath "/AppleInternal") + (literal "/dev/ptmx") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/db/timezone") + (literal "/dev/null") + (subpath "/System/Library") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleBCMWLANUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_ops b/tests/iPad2__1_8.4.1_12H321/references/sb_ops new file mode 100644 index 0000000..688f105 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/sb_ops @@ -0,0 +1,114 @@ +default +appleevent-send +authorization-right-obtain +device* +device-camera +device-microphone +distributed-notification-post +file* +file-chroot +file-ioctl +file-issue-extension +file-mknod +file-mount +file-read* +file-read-data +file-read-metadata +file-read-xattr +file-revoke +file-search +file-unmount +file-write* +file-write-create +file-write-data +file-write-flags +file-write-mode +file-write-owner +file-write-setugid +file-write-times +file-write-unlink +file-write-xattr +generic-issue-extension +qtn-user +qtn-download +qtn-sandbox +hid-control +iokit* +iokit-issue-extension +iokit-open +iokit-set-properties +iokit-get-properties +ipc* +ipc-posix* +ipc-posix-issue-extension +ipc-posix-sem +ipc-posix-shm* +ipc-posix-shm-read* +ipc-posix-shm-read-data +ipc-posix-shm-read-metadata +ipc-posix-shm-write* +ipc-posix-shm-write-create +ipc-posix-shm-write-data +ipc-posix-shm-write-unlink +ipc-sysv* +ipc-sysv-msg +ipc-sysv-sem +ipc-sysv-shm +job-creation +load-unsigned-code +lsopen +mach* +mach-bootstrap +mach-issue-extension +mach-lookup +mach-per-user-lookup +mach-priv* +mach-priv-host-port +mach-priv-task-port +mach-register +mach-task-name +network* +network-inbound +network-bind +network-outbound +user-preference* +user-preference-read +user-preference-write +process* +process-exec* +process-exec-interpreter +process-fork +process-info* +process-info-listpids +process-info-pidinfo +process-info-pidfdinfo +process-info-pidfileportinfo +process-info-setcontrol +process-info-dirtycontrol +process-info-rusage +pseudo-tty +signal +sysctl* +sysctl-read +sysctl-write +system* +system-acct +system-audit +system-chud +system-debug +system-fsctl +system-info +system-kext* +system-kext-load +system-kext-unload +system-lcid +system-mac-label +system-nfssvc +system-privilege +system-reboot +system-sched +system-set-time +system-socket +system-suspend-resume +system-swap +system-write-bootstrap diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AdSheet.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AdSheet.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..6af241eb88c43d08f8850b436fe927a7b54534ea GIT binary patch literal 37573 zcmdU&33wc3{rG2g+d|U21xh(efO3}X6e<)bNYkV(fgYi0DRR}x?j%{VSNBL8PRmgW zh#(+`B8PyWpr8VxfS@2K{O|%qKoqn=BL_y_H~(X5_v_4!X2HyxSu|vZAH87tq z{w6l{Zi?<@7!!Aam?yaYcUpq~eGOx$BjGIA2KR&WVKbZuV{k6C;2by`&W8KLS?~b3 zH=F}!!VkeFc%WfS+a4Z-c^k-ccbWtb#yk!l0vq6=a5S6;O?Vjm&*V+f!{NK|!|-i* z1eAE@!#6Rvz&GFm_&RKb@*Zta-fJOz75hc-*KjeE_c{{3jJX}YGpA2t>Yv9fBqwsoYLn)UocrE5Qyc#CpWzd12fZgyS z*aJ7gUU(i%!jHjI;2E$Fo(fa2AEsdrW}uXN7WQGz!310jPlkCY^`QWzJ`|zUhZ2+oQD0;m`{g`C!ZnpdPd9SGlTVegVg?y8HTy<yvBNmm+I zW8X6QDxtE6W1c14HSh=U)9^|78Tc5y7Cr<&3-5>5!F%BK@J@IGydB;MZ-$?P*TI|M zRq$qbIlKj40zVHgg15qr@HV&segU2VzX%5=-D}(qOYjc37Jdo#!7syZcqg>sUGPNs z6}TFH6?Vd}!DaAn*beW3i{RJYb_2)EpY#pmJ~$74)3t}>-vh?|a4vk%wTEL4AbsD0 zi{L}B9X|%Ou7%%&CHQ?f0H1*K;FEAZ{69Ds zJ_UaZe*k0fhj4HBBe*;KF`NN^0;j{L;WqFYI0-%r$HSk(2KXF|!k@wSCvJ*958s0? zz`wy4;h*5o;qT!~@D=zA_yYVTd_@J6@?{0!U^UIF)lm%_c_#c&^Z z0o)g!2WPFh_QBb(2ksB!@BnxcoCA-8AA+6mK+0)n>dQfxkHkC| zw!wp83p@nQgNMR{;5;}R9tQV?hr>PLhhY;u0`3Io!|h=U+y*XylVB?x3)|orxDZC* zBGZ`m?)b&#k)&rQ(gUacWqiAN6!k{TaLgaaZ;BobUxiEH%Wx@t5iWzGKhSTSwn zn8xTIV1JBhoVSBEpEup;L{Btk+%bNoxymh9xPyWFv6T01<5!#1T#8V1JY(|Bg#U9gjnIZ?!!CFhjKkAm0uDe2mS8vUn}$7@ zdm-uEus!Lx&eS}`G^lEQCgy1;;O^NE#vI|M8EcjQ6*c@9iSPaQOJ+a*w&VSw*^a+; zD%^T=fagd!$a7CMPs7}X8JhFp>2MA_1MUOQguB4A;57I#xGmfOr;I;8dN!N{&w&%L zKNpUL=fMW(y~p`H553vEfOKq2x`f-HC10rQFET%l|5wIsioy+3vA^N908fTD5?;mypToQp=9}O&c(agjx4;RQKd<7y)x6Dh z7mmjM3($aHB%Vpcb35i|$8L(=0iS|jf{(y2!w2A<@NRe)yaRp(-UPo2uY+HMSHZjC zC*VDl>qdAl=4Z!#-TbE89`2((+%f(eVx~Q8ibC_Wu@9K{!xDUua9P5^4HGGcZ(+Z3 z?8fLraLL&7qYuNyxPKcifZu_K!$+Xx&!bS@UxX{QREzxXOp`ncv5LJoeCR z#NQK`$66&Cj)2{1TiCe*x#fU&4Lh%WwvK1xk7UO6+;g zui-Y>|3*FMx90C$cVQ#;ufq2m=>K_6BhPsa^D~%Vhtj_O0H478M-~1J^G~k3@L}x# z4DW$|A$$Yj-^6@*!&~Otl-DKL{}o;cF`MT!{LTCa<})zALwT=j_`8@@c|$Xc{XdCk zYvOqq^D&s;bHo1&`>nA5H}(f$kGxXt=)j1y3nOAiw7h_rBatX(ky}vd_oHBpaHHWY zI0o(kw}R3hwzai!KAMI7X!3nOrPhP>CD$N_K`q=Pw9tF>ZN5fO$61WyFg}rbYTmzRwk(V7%dP4F&pON^$JfIrx1#@tkHS;MjK9;M$hXs> z$ni6vl;@dZPkEjNMecnJik#a3MXsFhNtIC2U3c{%onA;*>Aij4nL-P&zMJV$4b|`ZA z4)`keU&5cf_m`o(=bhNUg#BIc8Tb|WefU-Q5d0dv7v2r;fcL;#;l1!$_;q+0ybo@I z-+*VrZ^9zHAEw{~FaaNgC%|vP74RW=Bzzbi0ly6og5QBL_z0W{ABEe)??P$kk3p%2 zkHZPre-Dm^--pufo`BNso`llw{tueCKLy_#P5%#<(5`+6|BU%Z@b~b?P~_TAsNW(t zpT<13VPo_exO())=(F$`{QVS4KlU6HJ>_Rm^p@wL=rJ$ABk}hl@r)v#pJNtz@e&ky z@e3&O;+Ig`#mi9Y%`32(aKC~x;jf{T&u`$an14%rQR4d@=J!U?|3i^mzsFwmqSsWt z{X^t+CD;ED`6KqC7eVta{J()&=9&M5`AeApj9K)xzhGX0`Av8fd<%*m^;b9_^V?AB z>EEEp|97C|)8C=U|9?Qyul@-|zj_yn-t`_7J?mdk^s0YD(X0LgMW1>fiauo^uSCx> zq3Bf+D0);BO8pxJ49MJ{XwXJXzO?g$&8=v|Fa^sTW_^sRAl8{Egk@uQ|h zC%{o~BK&uBN^}x@2To=jWf)VUQ=__{7rqqTCb}K&&qucv>i!>pql{_M?OijZ{H8~D zaLthRzhiVK*9?&ZJ4a`@W{5o4CEDbgA@Xk5=x(kVD*bSGC~{;b6gjd76gjdd6#2Lp zlzwt=DD{3HDD{3{DD{38d>U+9zyf6=wZ!0m60u8tn7 z>{myR$Nu@~aYE|JM-)Xr6#F@iCqz$D{^|dffBJv?&E5Ls=o-w|^4`MRqw(lR;Z@Lv zH^MG>Crsd9K;G-D=$Xp?tmwzE7ySkjZUZ$_%U7t%{T$3v56^||@H{B>bz_tX8$&(} zC|oKSuS8E8_4QGsN6#I7;^=3#n%nS^hEF%V*s!4S-o}Yz_Z@rU*q@EvW8C_2-x~M& zxOc}LJ^tA7A07X-@ehxGdi>wVFP(7lL}RiwS;w=JAf8Rf>|8G8#MYLQ@xD|x+ZW3_ zb|RZevC^SFyUMrkFYP3fcEQQ_JNbn2+Pp5GEINkKROv5MDCJWHr%*^{GuopY=Z=;B zs^Z(T(p|?>%;xPLC+4g#IvI(vIc~>$c_<&$!(jS&o92R@Npxk`tK@~#6?XTMZyZK6 zrj^Sl`|YA*_1k$Xo$X4d9BWCkD{toqtk!I%JK0mp+eH%4k#v;38Z=}0!xg-c4=F6BFc$;PE4 z(u-S>|7|K%rCp&RQi!Z2SW+Ui&NZw7!|FF8&5?EZPVKX;(O3{ufmqV|&r^u1#6vUU z0W0@&fUs6Ms`s=ydb7oBn_aZ6!azoqznj@Hf(@QOfp9B(OX;qRolNOR4qE@h&+FuQ z)*?IZw4}O9=};_&vEN9aztkz(30^?nlg}Las`b9*`mgJ4Yp)aU%Vm=px2k@4xNx=W zX@4@|WD9``T4y|~ovx#keycHz1@)!J?&--pJv4o<(HvP{JOkNMvDD>s=k2t!E}QQw zzhRy2nfF_iEoCSuq)s_9(snTaO{+zOcYCJjEfXx ze+HDCshyA-kB+n;ojQ>y4*!bQ1e3S0u?i$*Tf-GxnTXTKR2vT%ndl2AtCPg(TuBU? zSHmaqK{tukoo1xDf$zrK%t4cT(-tJRm5hk1oRLE8R7IUr(pO}-*bSf9ctq!?wI*U6 zABi-RmsaC(k$w0d$kYy9@9OP06HYqYOixAE+2d7ZRgsw?SM~WR)0%2p8-}b=A7Ew9 z8;yPSSLQa_N1R?QO@+*iIHSk-6}KQYnSV)w_e2VoY0{X;_V>^v`DEA)!)_bw@_!$ z&up*vGmQ4Z;?e!~v7$XH`Dm>|ZC>nT9L!FlY~NuQMS7R(-18D2^7H8}$lNwEwx4Vi z;kknUJ^YP4)RJvpbMx#&T8_68M&oLVG_s7`%8=u=C9fxMe1B56(u9$!F<1j$sY=j^ zR7fvs5T7ahH_JWM3YuFnn{f(8o&A5Del~9hI>yEFkj*bwt?U<4s3nEo>^eWf4H6&a zaoUjO@d38{l+oyfTRsVBl~ip0dleYbWO@RlfqjW)IQ_J<$RIFXkiOp7MfvX>C={J^ zx!79md_L*qn--v%Fba~S9Y0FGjp)iz)@xDg%BVFhYTXsFeq&nGOzYDBRpxCl8cz*p zUj3czh}zNHM&ql}juz9$vCnGEAx=@r5FCxHY6-UN~?U+^}&z3|MkhUIdYK5-U#cuL+hZ`ah z%eo=b(0ENmdNMtV6lLrR);2{m8Bh|^L9|(wVhgjRInTeOD%>WXFX>At#S;-|{eyVl zPx@;wIhzb(!(Ki2BUuZuP`=At8b{Fc4tFL=yzQKcrL6#Q4;sC`sJ?u-*))!ye zn@c#nzVM9KSG5P4Q+hsQsQK6Myy>d;&Z1o`6&Bce(lD3*L$<@#aQOB(vlhx$UZG9CD&$0vXweqDZy}kn*Ez|qY#@P4 zwje$`9;fLR3rz4cxbj-CL}(bh@_)#3U6duHVbnQaw=kVOCE4Li*zy}y%i+*^Kp;>+ z1P5$&RD+HWz5XE(A`p*1&McI2xoqAOOLEdDR8L2guJ%l>R9u=(IDyBN-&LZVFJBe) ze?;;2IRk;g1yNMj(-Fm!u`}5m#UQik-W05)$WZG+fs9$7i^o!SDHHEa#AqYMLXo~X z@FsPZ+tREo_Oz(Q3f1bid8ly;N}(jAO+6=I3i#R#RvfvV!Ib zZ?)9qy=tBPWvzJCij(L`BX}Pvi8X4;a7`e~)*PEf;qvsZW3zEPl|0qSD_ePgKC}5h zWc(FTSZ?msU7z|TL9$LM@bXO3Q7!jIR6jd&j@{RZGNY8aK!kPb83}LBVwogrsQOXW zZzYQ*CQJ&fi8=|3Ro3RbQ^=;!uPPP@q}}-SH>DOalXfOn>PoWKTO1%%e^S;`<@tPM zK5WSHk)?)YT+L-Qb!wSpt#Tu?dRUj01nGE&e4l^-3N-6Dfz_Ijm$h}y&q+M0j(-60 z*d^3yFP>`sU_|xC?(eR-d=pwHji<7uL?Rn6#8_BYr6O`{v&*AZqG=-<%Uyc6^0MCU z*Mso#w_)sD;qFxmS+cLF9>%Py^u%~jDeYv6D_pOI=41DtJ=^MV@~hh0>XgI1*)$Vy z0o}09d{=cq*ZK;zx8C(ZUD(N7*6W<=Ojoe+dR2>@)$6ZAmUn2*&00=PVOhRT{X4E_ z@cblj5<)(lps=R@f3wa}F~7_NNT<81CW{sem^hMYn*wUCV;!aOr6K1qhg8Kq(qr-b*vR-*>C(!HTeSQ_KQy*BW^!m=F zonA)N84p@TGLxWh_Ts6ty|g4cdmX39_Mwd9MI|{~Z$5eP*Rp|Bfa<@=^lZ`1rZt2jSm1adF&m__V2^5vM?C{YesZ6%mMICbz zrN98P&Uwz-&&d{;8p>4^be-e2mEJt+s`5Olo*X*9zIKmGc!c;Rwg%NNv{Z@HX1_;DM{oZ;ee$8Wjp zI`p+{k2iU-$8g~~I#$w)QD4QQ-q$ze`)Wzor;eF^eF?|ZFW z>)l-vQ!BouGGpQIZ0-)?T)4JX2oeL-JLt z{Ji`<+MUs}mdG?td4bB?|9iWHCqHia;Pa#AOUV`{z4upklIiV$1zu6_4wh}c18SYH zgiQ+jxH8FK?08|Z?I03cvz)#6t(sr)rZja6lKr&4_;B^KSgJgq!XiS^PO__~IhW6_ zA26i;`u=@?<$0HK06g*;bib~bzCqfx=-2*p!sGh#w)W6GgEy*A#Ms0n1ArROA8cIj zg;2>hexkw6GxhJU_}}gYcu1E0*_UZOz;+G38XE60D)$0#OVIH9Vyo&)a;412b;|UY z4r1fd@<5Tr% z(D&Z__$uDJPJL8PI_TvTPXW`}sPv=C{-K!8=>kwKeJ1`Y-9!2jEB>viWX{vKng;W) z+fk?8&EzJ2{>^_r+%WZl*H-H>!@8ulicq_LS2UiQz3>3FyQJ!S7yWTJb7!_pigBt& zYJFehhT4x?jhC*-A{AIB+RD3o3E+N)T}RU=Jd9z-wc4L0n-;q`p;qw!ig_|q9=V0_ zsJbojNWWdPU3>LAoF4JdXV~#iI9%m>l-q*H>*4ApTS&APC!G^>M)LfH@>NS7h0?9G zKR2A^a-~ekFrEwM=LZyDIbR3uhlWU>ywafk>k#2;yjMAYuZ~Ep1~(;GKQpaGrgg&y z-%x8dwaN{Qm%BL7v15Il-r%4!_SdB3*#fXW6oYj+E zmV0i-_SgCjFFZN;;f2TCJ-CksQ}pG{NKy4NgLlB7=>s~vaGtwQbtH!uQmSUkIDE+V z@Am)yB|W_XS?->_YM_J*^bUE(Uvh4wz(0M2gQXWvX=dpqGPucdOaiysN?m2OFYD^} zQ=PUo_G$b^aL?}Dy!)lnI%%I)*Mfd;e z+^FaZgO*>wpY&xj@H<3&ZLRG}(;9wU?~YrD(^-_wr|t5{L{hEK6AsxgxZwl)Ypr5W zDakIJr0gNMM8#roL+uBy&(su?1*)Iy$d)CwE>*W=sjotlQ7PJkZ-1OzjK^brD_dLL zttu^v1e+%c3s9AH@(ne9ubJOoKN1QvtezW~uL|hmT8WgMu}-XzbDV_iiVe=c%Xwfw z-J7#+r4Qtbo-yQm3^|TnwPJ~KH;e-Yi>Kze&_B;JT>UQPrWD!;t&Qidbg-&7SoX(xE5jAu5poLK7-?M$Y_*=vzbs!JBU z@yF)p1L=s_iBz&nl4DG&N)O{9><)3q`E$0Q->g0Qu&hSYdeN}%Qlpj;oIj~-) z$ZgeY4>mHX5bSzhXrx{}oo0|Rj~rG>E5VfDuY9DS$2x<~H+%JqHA>0D+wa(J}%CY+nD!S~Zk&0f~_ey2nJh>J;swi8) zSWikbXpPIheQULyO66=ebPT$Fq5BKJ%ha=7F%}N{*2u16Rjo!aZg=H$XU5KP64c#Q zVi@1j;iLC$K`wvrhn{bDHPV{n28Lq(2yuAvhtGH|3*Jw#d*!6kq*U>To_c}EB7bib2|PK zq_@Fbism%=qMs;jL3@;LfZGiik+vegZ2sz1=jCNdAy3Lhs)^eo4#~@X2<~iWWDV!f7co8kLoBYxH}#+Jk7 zxgIN<9#=MVrIlESnUCyO)A8F*Va;r#df!;69S+^E4?f>Glzy+=+zL@%r;vn=VE(d3 zdIB5fWB$5_j!*RdA=~+o^RXk4H*WZ#fUBN&)aRUhk>;&47wm4QIi2likmzKTe(slR zu9#l$uIJMZVyYgB%GuBA<_v@CDof+JS+ftZyJeX(7ce*OXjGnW@%A<5irzZ^Or1Ua zs*}hIH(oc=g0+*evsU9QR%#7(-o}t#iQ|WIRA&+Y<>I3r+0H3fYp@8zUUcKYiuBYNH>;Dq%_TxK z$5jx(X)FD@hOv$Ov4Vp|ZP_&Iw}F_oj|qbI<#MhvrT6E^2-z?u%9m>|tGL`%ryNxK zbnQD!U1@bv5SM8I|8f}8NmM>+e84@p4=DJ2_c`KI?IZP`AC6BFva@*d&NHk1wOyrd z_J3AB)xA%zeR*doFQ*XIYs!r!SucO5=y+WBPHN?fWKVBV-3zD7=ctZ_i`&@fTN$@{ zUsZl=Fj1Xk<&)j~aO0H%sB{+r$c1&qZsx9<+3w(-MUmvlNA?@lsE6KuU$25EWM2<0 zD#4IleQXVW$;zT??qXQmsS3Y{z2r+}HhX$xIdi<~4_V}uO(=a_ASctAbRFW}Lyav) zn&-)_D)y(pi<>c4GR2NTG<^Ty$xo27J>ZTxStEJF<( zn`m6ten#W&ss*T(x5ixwRGxCBPgOVA!8ogNG7~1Nas^Tnb9)L^-jYvPy^iJ0 zerw`16zL=6Bm1NI@XKd|C2GGwqV_Qwn*xbqa#F^%!Hnm&KqsM3@yR!vM&x!#JwFog zC+GcQ^2M!d?&fh7l8%inZ=NOL)cDgc*cFZ(hHTB-h2B_aGF_rZILf46+xORNbFmD| zRa{dkPuFtNcdj89(&!z{aswv2K^ZjIspbrK%jkAZ{xlfYXyb41izrf`VdYFPz8Uue#?;?#`|icNLBu`#;uOhCSqB; zRO~Gzd)S&JQ7O6R$7gfMUyDC+RzVS!(JHhmn&wZ&= zTe=#t_c!iM?5h6Ee?R}6n2xVM>8z7Y!d|m5nkv&9*gxR^Deorxy#nd*9b^8V%&&25 zkWP@#)Jp%HQ^*u^r8K8H`1tATNvFL@9dU5wx9?uQztcM~=C~QXhxX1dFHW!7$I305 zzLcnHUuwur{aTprVosX9(o57?TPG1}=bk^u^Cz`U9v#Y$v_7mrb@eY#jj>ZsPF<)J zPnSUcduip8`zH__sT4j!^;WynGrQYh^!ea$cyW($kgUM`K`ANKN{)fblhk?gs^=;H zo;O|pLiIH`IYIK(x!g=Y$6P68b%+vC7<`W$Dn)|Vkgkd|B?HoE#fR?q{q$;oDZSTL z+~qt-Rr+GOp-F~?^2@z?fc<=`?YQ+TC|BrnMXKyj8E?yiHg}^08;0rK^?2J)7x!Rg zifC3|rtmI_wIzo`KA{qySs8CUt&VV$?^L3YSMh1gmoNW0HSPyNbZ~R9F0zEp5ddlP zsZ`v~+3F;;zDH%>%6I~UZyKHiY7TaJ1$9qL;JMZQ$z!`1?_DQf#4Y#O4(VUq`KWmj z|9zxOOEYsMl_(ZiD>Ibd=KJe$va0%r%ex0z;L!BB%OtP1ek*;;4;SxG7dput-7op} zX*(Zhlvh=M+_RL4Sf-%Fs=9wI@LryKNPh}ecj>}Qg)Tc^C=R3?#v=S>@^5w@b2S)UT2P?CscyF7N5=D2QBa1#dAO+*4Yt~@l=*3uk zMP@X2%jM0@cD{>ko%v8Z@}HAP7UZI4)xgVAtm?jP-+wPlvR?Bc4WV|Q%;K&(or1d3 zE!>YL^^&B$UZP-#qj~ zENb}>(gQ2+HRyAk9DR^z7NLBq^j9nvLiwc6wztR$_hU*<$!}7jeorfL-W3!r$1R}# zFOa*%y#iACu&TYKb7k;6Q7htKw}d?^%cnBF9(#SPTytyY|4PQu>h6+QipybW!d%j- z8d)g+eSi6c>S#md?YlFnpD%KF(-mMLeXQ(H$?MK|KAGc1yq6`3p>p-_&G*l-v`FU{ zDp#4V;GC*lai9lYA-$$6$#w0;Y@d_S*$~!yw1&V14!Twt;r>LztB`FvJikEg>VFkG zbxMpc`(#$OLETX(8#ralPWi^dh6d{}qwzrIbwc@4J~*K6WAW>Kpj~TGfz*`}Dod(R zy-dp~Ay?f=NGGZ0NBsB}cXqZifUN3Q{c(-^msTwEdj8W7AJ^-kRpH~^?$-QR`7foT zgv+z+8f!tJU67|l@~S*T`atk^2?D=HP^I5h{0@Q?O{hQjj?0GgyD*T>6|?C=B2-UG zWd~i(VSSdINbBK!EMCf~UP#}%+n0>oVI116%SU=3-zb9($~?^K{z=-k#h30hkuTnI{EPi*$<`riIBXi z^&F%SgBji2!u=~JK^S%rl~+GQ`Obtc`@g##luSJ}5z2RFi)A+w>RewTw$AC2YrvGj zeOy>B;DwV_dR;7mp{UrPhMRU;|tGF zIa1+btOF#SQ2*o4W2oD6C>SPEk`!u4Z}9!OGofBqh2*pEkIb?Wej&LRbmwocH>)ad z-yiCn`nd=<9|lbq<2%vqy@5|?T;<2-`EzqOH2(1YDIH2pQ_vmjDQrnXX#5=VKa_id z8vqQoZW1U*Rj+hj>J}K%OJpWd4@U~Qq&z<~?g+RuTiT13oGlf^Uz2?K?acS*&W(EV zDpY>`GLs+=bmdRD-OKn?E^a9AhzQkh(NkDK%X3?xeu6sZ;HQHPXQDWx;IL56d4NoT z8Q5$-wwQTX(MG-DPq@8my%wS8{dkD~r_Q%fzcA#yk$YNQa!B2$8ptQK3s=E*1!Aav zFq$gnlU*ea(yghOAeg^@zv|LvN~He#YNclI>GSY>j_Y3!6eOy_$EWTzQd!c{tpvuW zp>~oeImJE%9kXWK{h{X*nVvBWwNB)xH&t-oJJkP4J(p@KdRZ)0DDk(NlOzterf4-G zJdV)i*5m#-5voF{oGO2BNTxh_Ev4mFzK*K*eljbLqPdHml3Rnw+X7XLw-!w$)St$? zRc$6mMCm4cxP5!>dQzxLZ)QWV&ahBB5;fMncrl)%G!qjfasCUC6df)kr>e&{?kxK; z5}tL0qdmQxwVU92j_f{=ee-&eNq)3J)^_CdgzQ6D&$q1dWR=>kHx}xZp3wV-#_z5^ zTCv}UPL&@mD)3U0ASJJ=+$oZb9)K#npvqk)))U!v8Rn_n8TPFtGCsBar_t$FIE5S+ zIJgo*_L&Cq6Fs<)XWBp9FT472OlELsx{RA893M5lt4Noe+jDP*w93gcF4Eqk=NZ-^ zhIQb`mY!$3OV2Tuo}(04^{=(aT}=GM4eNlmIs_^|a*~KN%femSXiTt`Z^zj&YrWB! zl_wS`IMxki7l-JVel;4r`RHU@Qz_LTmf4y0@jOzEt0nBJuJG z>5oI*@2&iY+EwUYYf$iyXyOJ!u8tEZYF|6_4Der+Lz0 zw`ZKNs=bE2njaJUkRH+!yh>EuL;Yfnd3YJ9(>c-V#DA!~TM@|m9%ymo6B@_M76g?a zp>aj6duUbo(74#UgdyA?=>*BVohzP0>t?!sw#fXMiZ-0@N?)rG(%M_NU#YzB6F;H+ zte9VuC_?3yu-$k==?mO%s6B+*uS#EFIY^%~^~-(udwXg>H!%Lu9-4q3ZRlJ~`IJ&s z`xiYzjWni8G=2nPuf{$#?A5bF@}Bz3=~SW!)hqvZ*d%^Fp>XQi(pExx5BK^g@8S4Z z{c`W?(azy{ma<+Q()(m}Ot+cv@0_{ugz7`Z??;K3P(GCFZ75t&A6E)RNbYF;tNgn( zRr%qrhFA3i!FxwlibM4B9-blYP(AS6 z)fpLien|eQ`^v;#jZgbp7j=~TuR=>^fMO4A5DJwCqg#ESTd4g7@2!&P!{h&jq5Hza z^M}>)#T~4K-cOgS+$XA@QdNFI1zGtBm0#d>bp)YtT=;hgb$daZ;_8}AALo4%dfG?r a%kaz9+jq#oKjWlg-eO;KoMlOtQT`vzLk>Xz literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AirTraffic.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AirTraffic.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..661967375a1eb1eb6e5f03d1de1f7a3a25ce8958 GIT binary patch literal 6069 zcmbW5dz@8O701^(1EbuE;-feiIDi61aL*Yar~y-O6hZ+f27F=Rx##SA?`h7f^SCpE zmY{)#q|t-SN=q}fw9GQgik?Oherum|=iYN?82fncXYTjz z$69;uwbx#IogsRjj;CjHpJ(W4dW!x)zo%ik8=sHh?`HZiN;lB;^bWd`hG>ums74Wm zkbFA@Nyd5^ z^7ZlB??%7nMD2HgE5O^p*Mql!Zy-AEX0RJ&=1TB@x{BV2@%O7|Fy%VI_Py$vv|7&V zET*gn+xI|j4R{rJHh3l20}g=afB|?e=zwd%GPn-B9DEaa8Mq$Y3Z4gU0?!A}12=%@ zf*Zjz!A;;w@B(lJ*b6QL-wbwvo596kAGiSA0?q}uf~SBNf-}I2z!SlX!D-+n;8gHZ zumElYCxMrN|5ZllE!dwIl(*7$qCJzb?_kH%%H?DbUCU*#{VDV-fscbGcm! zMY~bnk20v-2<`#*DbLZh;9l@L@H*7L8{7@<1+M|?^V=u&yhqN5_0;QcM8BQNd+Gg| zz4pUi2bK46S^6c|F^K*jK)(dzd=L!51E2?fNXn1UO<+Iz4QKXxra{dAqx7+C{vgV? z(5)!59YJ~iK8||c|4)D_cpK`gXulmSfu97ofp^IAo%AW$ekbA~pYOYva=xH)3Hp5+ zya@aZxCOiiJRiIl^J2gFEXH4s^5?)Jcpu2?{5<+CQtqb*r5(ONU(ED^(w`oX{`4hi z;PD=0!hT<-uV(FEk#Y}lSzKfoFPq9^Dtvi=GBYqmci`aMa|Bloqg z?{6scy8jOHIr<04_Nlkm`79|kiTF`yaz-Vi1g%tVQf^lsRvuISsXU-Qsm|eQ(|0u^ z2pqxR#mMlil0T@0!mx@1p&bi!fqP8UkIq1|q6eW}Gh(6Fj8J#|lI;k6gIx-Za7gd* zy|P_NLL;_)uQ&9|XpHpUq~zGqHbAPOJrv9U+?W zO){~b-cXc9C_FQ#tduy8h;6Ur8=*C-460_}FTXykq{p@^cK9CKXRd7T8;WA#j;^^k zHOJb}aK(Th_D8856}_cjQ-=j(#>wn>vFTgl?8J6r7|%+~7|QSzWdCzSO*noaLRy7# z!#0sH6Kvp+CI(Fru;n#rcg-k8zLUhF7#MLi-D%%*hTzV5`OFo>AQZ($$>F8S2giz^ zwkzmlRaXNwRBg4U8fvTxl=)W(ZUjC2RZwfGbJSkc3bl+srl*?tj?m9leYFG)4$3-e zebi`>3-IAOZHn$tK@cjr!iG@1a5_(5HGfUyFU|X`t#ka6;WSl^Zt*LjrgdLf_3^Sk zi9+46OZc7Io6Awv2n8+UP7{sallp7m4~Wq5E1F{@o>{d{e=)hHNpjZ{j?tg%^M0B7 zi#)HR^AfSCy9RtS)B+=l1}vI3MqlXrI5;nFt>-cxKHo3RuhIzeD#+*O8M^`Mrr?is zOVo4^M-OSsXxWNG!xUBFuv<6v+aW>(i`y531}_*flMgGF84Mj0*% z|7?^CGwCFVHO8xl)*!}Flh3>qZJo_}Go_I}i)MCp7fzt*cspsY5;V`f@5@C;H3oqtOzj;SSUBsWF z8_l$@Id}De|14;zj+USzkql(^R2UM`=84OenqRa(BPh z*Rx5)d>w8Un45tt0j@cpS?It~CDSTh#X!e&Bp3$=N>X2YqDd_hZdzEr6=M>heczzVy zX6CQ*zHivsVk6ikWMJ0z<`@#KUQ%1e3g_`xqkkk5%VUQd>KL~_5{^n5kz~AU=;QMe zaz2PfggzW98m+-vJz;Vit8DRmD-m(O=MOl-f>|^J{c3PaqF3a{hktR!7(X!K0QG&; zoQSWNx{lP;VYYv*{wI_CN|xlqb6fT)pSN2^Y+zY6oEo@u^Kxi5=F~7ldQ2jC0v3~9 zQgYg@?>o7Ud~o=Eph=Ng4)8vKLj`Za?Ml>gK1SOu15OIdPR+~5X67g@>&8tJB>~?J zni*g>trj^Y(05e6#8WjiwaZ8G@b}A!E9VrwN2-@jrWaXak04}W z7^;HLz6YuaeYjHlE>eq#QTxY`;lexiSuFD5I*<=l>Sbz|R*P@nXP3kuuxNNfAEnd* zhePCfN6LF z9EK;t6nrJz2v35d?_~HIcnUlpE`|N@RM-bkgDc_bQ0zMcihXCobKzOA8=ei%gq`qI zcn&-ncEJ;2H#{CLgU7+;@EEuP9tF>Zi(wC30MCPmz?D$yVHKPOd*MvD8qR=gU<~%b zzr`o?tKhS6E%o+$*dNy4I>LX8ydM5KzCqe&;nVT+qwS=3#dqpgE46h2p%*GO<4NS# zD5bwdzSk<%_85E}d=$Q(@K3^x@F6%rzWL;{Ln7<&6 zIHXkk7Q(T|SHr)xPUvgkU*KEdv#@0Ub?Awy>(veDpT+Ya<-Sqf zWWsM!+d{jL3BOt0V#04xZzWvn51H_{sas9>t?KQBOZ^4%JJfAF?`J#@Zat7udOPW~ z+HUGa>@L}H2kCaSzDwPOz7LcBPNf#!*ZOXe%{Yhp&er#;_rTlW-K2Xf>7c$A-UF|I z_wt;VP>%N@r;*O)E~Z%pV1cus%o2Sql|fqGTzgX$xsKbQ0$ zhFwtPZSjw)kD>nn$_J4@t{y_3i42iN2dP2s=kIS^$(H1uD*dR{TiC__D#42z2AbH;kV%^{0{Ws zccBZv2c><#Z`%I{>Zwo`%DDa^dbh=Yq<)ND`(PJ5tOfqWq-R``ZVh^N5ik93!i4`+ z{VbFr&wpC|3)}*qp+26D|6FM51DbL4ujV6FobtljH4Ll3} z8$2EU7M=kAoph}{|36H=3H>{GDB-_{(r^Bgbn{yNp#E(7%OBOB!skQNkN%7BgIfL@ z4Pw`yg|zpx>VL!d|1tUgBC@d?>X|KnRsRU%|7POQ2U{ScTK~0qLTmU( z7=yoqP4KtPJ9RVsC2XO+x5Zm^ocT`b86xkaXCOBtL*zESFS7JYs2^+IPxF$T`w05> zhYv$!`p*ISKx7#QFM-m(km)b8^g+Zw*gRV}_kPlgyrcDCJr7y>?HuO+`&#FUY{~=m zU8FmN=Sn>viu?}b`S3=#0A2}Et}lTLVZQlry$F42WXSkmtdD@V!Iu&);~$#w|1vm0 zx+CERcogh~FNa<5Xm~O_1|AEKg)(0(LC?1Mak?G5ny^bK<1<10fuyrw8|;8GPLGE& zpS}Xhe0l=>2Rsof`ui)P%)=*9PtQGfvOWcUGLJ(uk1s`@qfXVQ@m!h5A@y;(KGVD} z&k&mWf?747r8`ad*+LTz^|MX9|Kaao7ksR_TQ5hSwBIr)?T1YJtO_aRIBtv2nqMr89`Xxi^p#$Mk4$kKlOP}*-Dl=fQ>rTsR* zeDnGG0`y7yLH!HteKp((FNEKLuYpg%*TTo(>)=E1_3(bU5xyI~0d8-y^#J;AMTYtY zn1nJPrl8D&4!oN1LDES*3_&UPFyWUH?!p4Rh;oQOIf8s9avGipGjIva!Xuyu7r-1m z5MB)9Fc1G8o6tV|6D+{rz#@Daj=~?qP4L@r3_bzJ;iGUfdq z1AG&d`DqK3alaK_PWYSQW_UUD;T3QMUI_=_Rq*xjYIp&>20o6Sx4>1%*TQA+I(P=W zp860!`37Y14{oHNG%*gg!Dcu?y!c5s6ThSNt@<5W&6^W@o4y6kg2<-dyxsJhTSYeg zCJ5iIZ!_Vy>vx&(?LzdtQ#fxX&%eXynK1IK*q!>_#LN5)(SMhI5BkqThRE;LcO%RE z46);0eUAyhSHF*NnXe(~?$_^!GvEi{On4uh10Nur^b6s(_y_faCjEo@LzGkA-^kea zVf~Ov|55!B6aP_>O*ubi%JXrNO*w<`hxHB<{t5kQ6aKIeJ)absa(>F_nGl(N{D}T6 z@!Oj|BQ)`khVdddQ!k%0@?-jo#?H^{FJPa{>kzvimvA$01@T|fUm^XR*c1B8Cf^ex zn|U6R{z?6H!e_?5roRejKx7jSiT{TF7U9q7ZwgH~B>da@yM+Hme@D1g{3elS#h%jN zGkTuV--k1ie*oveo#d1Hg{I&9h;quj_+u#k>`$P~pF6cyElNHFgfvjU((_|IP4k++ z-2DCK#VuVe8(J=JxwqweEx&5{Lrc8%u-1!PKhye5>wfXs@uTA>#?OquDn1y$E&jpy zSK~qcn*uals}6}-v0N-4b7P}1J64D}$nsYnW@27!fS9xi?Lx|u!X_k3NIvG1rrYGQ zW7hnRgtb<+^{AM2T6=rP(#{JlTeYo2jIAQa0O>{RIC2+%C1ba@diSYLWa@r+0iwl}h9tJLP55 z<0M&7neO7En;c1d-bgf!BsrooUB*edw(sOeoqV9KeN)~o@aXw_NQc`KwTsfU`*t=p z;EkClR@+@2UwVw%H)!^z7HwVDu&H{f(k$O0Dm4{b6zij^o!FphCWn}$RCZ01CTY@4 zEJ3~;|D>4{Gb~TF4J!gAz$H`Rn1dTWy0Vv4w{NxfRRygOxej4Sg|6JD_aSMr_HND2j z6?r>1>?Zx?cE(MQ2L_2=K1cIyXjiwJEYPX#ylX5v*rYENx+;>mv-wuq+iPbTM5#ql zL&LgDtVnwUb~+L>Y1^qadUACuc(qg5bq~d8C((GMy-^ZY2%pW(!U}Yo|+ADa8&>Re7eQ zui&Je+_0A&FBaUiTc8aSOe|@eiHbgHdZs8=ik+wF=#Nxt!uN{VRH^=J+iyztW=ck# zF+F?EcLvt?M9VczJ?nd<86x$wY`G<(*zn`dw(;S<}k-GYy!!>mvm!J;tmOB(iz(j9-m>}(JA>kKuIWIps7u44ClAH=-7%Tw9n@r%br3o8APrAMqTsJ;v%g^5T%MoXMz_anaOH)AY zd@`kW&)Qi}CJKK%n=C8CB(vU#_zq*aWFl=Bv&rF9g1M*Q7x398pRUw2$3w62|2lo& z348Dyo?V{9>E;dtUe+s8Pka{hZ8+YIE?;rtG@W`i>l)^p=u5FUkam-$qE6Efsi#-m zZsR{sp*+$O8_m*hW2DM9Zt!r#OaAxuj~u@#R|tS*y+jF zK^;G1O7%WaOsAcKo2{H=Flo2_saJLcEO(t$(nbnd$a`t4GjCQuQWU;*>!ohKKn+>c zRr14oXUkr!w5Pux2Ud(ssMB0e)qjrXgKk8QU;Hpi;`czI8j-&bj~ z+2Y#SL~+1nFRd`nEHUcJuA7vLPbc5HGG4IHdQO`q5_*1`vp8SNUJud`p^Iy&K5hS>PIx#hdux`)$Jy#_c7tpKY1tdcTkU}zp}OF zs1qd-<2<3PV;KZ;Mm1BlwTPv`nTN$`Lsx8LtOs{!kU_&))C`nV&O4=}8)uA$DA)sO z>Eh;dg8VirU+7=wyiHD?-d$Q;zAeb!bYsKzd7prmUGAW4Z&kgF$S{d$`SgT~2Jb5rw zn$I5)CDg~gFMNH}EmVfymZC^D|C0QZLrCA$ube9LZeoi`dSHPnSx&!TwD=*D$7x|o?hh*`Bqon z_J`Lxa^Qk5Dj)HO>gHo#%eK0^dU{PVb#s8G>-J(iP4Rup=&kp%-D58>=MUmf)V06# z9;xytcKhB4_VLP15bQK0(q3|8qns`TjV(73oP?iqoRr)`DD5GLEz-}+c9;4qzBQL?WWR^Q;)3mF zoqT&P?~RQcyUXdz=_dDuCNl&jtsO^I{ckt^;_PtV+h1EZy+~cFlMc6gheezfu0}nd zn^Ai++pTATV%GA}`Hh~v$8~m%e^hn}O9v{_GMS)xnueZ7=Kj|&--<;&R z7CXgOmaTZD4xE%zoV+ESVJ9ui;Yd0Tet2>3JDD!ewK^}e-=xfaAPEqekE{m+{Wkmc z9aZmxQvdetL5JCQltJNSQ<9}@SFVs53;k~VrG%-U6mOc*m}Mx3o$*1Z1hW5Tt>*pHZky?-q1M#rOtZTwrlrx+cvAwNJ#D%IcE%2;r zf}<9I$EQE9q(9g5bL?>4%qxd6DC?Jm zNhg0fu`zyg_`aUGG%K?cez5U-4yk;;8@&4MF*&=Id3BM*SNIY5nO5oT&0RuHf(j%N zzmreXNy>VKv`9T0ePdZF92M;{GjM5liP=w^E4eG4lP_j1f81wJOrjRnjn8zi?qBQp zIWBXDeyI4xk^1D?sGk>~OWL6_TsCsWeGl)WN<5$Xb}-Lm3n__@>&yNqyiR^7@0H40 zs;pN|t;ii=krNcTsqVyNma0@=nyQimSh)nBinTNQSsB%qVp~#nD92Q=Wc6v#WN;`e z{&!{lNjrr%RV-;HNua9y&dTF$j(KdnHaW+l<%5r@k8=O4$RH_XUXRpkbYER!%zLAp zz0P{Xmu=V--eT!mc666IY`2lFzaGdmtR95hc+#?Oq{(eV6NvY30vWy9*HuQ`{l z=|{Eaz@a?{3CsF1I6TA*kU>%=Jt|#Y<0Vsv*n7HOpr{;d0nLbEAJZ-Rb@xT{U*s;)vhU9 z0{K+U57BdX6L0qA%l6ATy0NiNxH-?R(ic6S-km;kF8@-AEkCEW9>S{ z_}_l2%NxBfVeG4FugJ7!qRqKt#DMC1x5|uv-f9WCtemjfCFXom;)=4K= Rxa9N9>g~x~F~b#%{{t5(M(O|n literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Aquarium.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Aquarium.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..dcd72297b7cc59f8b0639477dddee267e035f2b6 GIT binary patch literal 17981 zcmd^`d7NBDwa2UOEFBtSBp3oFB*PAp=^JDXh%lKUVaPUS5`>|fDx3<2#DeaZV0&Hj;N@(;1Wik`i$s%K7BsL@2Pux`t~xN$%y>(?tHp` zeQG&%s_N9ar%u%<^(#GJ?bOwOKhrmxv|Z{q>It{@+>P_krl~)&4 z)g9CF7jPTXgDP$Q2GyWi&!@T-DOoDLQ>V!9Q;vG0I+tJV>d3Hsz_arE2=dA`h3{eN zkg$BI^_}`4Qs#xJDtPwZM~%^AwRf9pBS%fQpuu^MO*>fV`8uFqq12)3S*;HK+_YyU ze@5H-F@3mFGvH9#h1*cCtTjpn8Y}z@| zdD7Ojo%(f3ZIpRFPpQ3j#dhlRmD0bBjp^4b6(0jH0DlR-f%Kn(>%gbMKI$DvJtstH z{SE3TLwZcB*jFg$Dz#-UdeN`cm4X9G#Xdr@wFzswsTcG!)UGTu?pTAOF1wE5| zQ2)JkOuyCe+p4xvUig8?bG3RK^k2va^`F6Oz(2J9Ht9F3n?kvuNxwyHH|g8eyGfVvgC_kw>Nb;po4S>B8NYyj zuX-QtJxP1u#+R|$Z>OAAcbIVzxl3}~MY$cVcdHM;?{?DP&-`s~-66EG7ofhr^Px{7f*Zj5X=eug_z?6u=nsSEf)7x>2mA>1iq?;+PlS5%G1}Q0`?%1i z9Z)Z6eNcUp@{1||5O^vm^rqOS)TiP9Qu+r%e@1;4dO9=+{jmBR^nTDF^dss~=$9am z;NJBAG59~xvQvK^e7xmZ{RMDG>lfAIl$U;g$@KfnLK}HN{YcB0{tETu@cAnA?a*JN zyvX%+()S|$8>BC3{U$93a(^q#hi1ILt)7II@dly4qrM9*dJLL%`aN(ne4hf}41OQH z1pEP50DlN(!KXo)&mWoj{;~Q=NDGQR_$hoh#hy_=L#}Da1s>P}{@j!w)4!nH8u4PEY+#I zkWcJ5NPo}JOBs*Yv?YROJV5)HBs&@w;gnE5$ZXwxoe=I6X{e$I!M z`FTAk^K$_x^YaE!=4TyvR`VOR13#G`P=6PB`@pY*N$@c+1wI72-~(Vkco#STz8hQ* zUI(VZZA};ILHJz>4eHCl3@G+-2o$@R1xHBtC@15P1Et>=k)9C4ZSY!GU@b}=Gz@6Zw;M3q`;FI8+!LNdsgO7q6!H2+2 z;QioRz`MXJ!0q5>@J4V8xD~t-ybQbw6ub0RP}ciaut54Ya1gv2l=c5MQ0(0`pxC=> z!2$BG10C>s@Nv>_0M|ml9b5_C2rdEN!FY(j{Z44{58j2IG+{??0-M1x^2JZOh5Q|@ z@7C|tYXAAxd-Qg24hU`Z=2oLOw+U_ZCP=?Szt5!KuJ1PKcL>7gPQm?W)BatC&zPa- zSnt<6$QQc|!v6#M9{8_<2BGiO_d$zY29e`_{Xvs{zy1*EVy8jMeN=xKoC!Vv&IUgM z&Idn6InfKjO|g&b2Tl10^(W}3yuYE5?;-tJQ~p!>lP3RDLYsbm+Vtl$LYsaD>5u4# zP5S5b=S}(}g7A4%(Dd^$!)Hur^!N+<%j9os`l6u8|5BJQ^mNAMaYKJaf5XW6RsA*O z6T1x}_tz!e*!3X)oBG?7pKm>(zh&w@A+)jMAmyLb-y?mt^@*jUN%+I(O0XPalXoY``I%T+D+wEUpuw=KGLc5ABj zL#;n*eZI9dHYavO?3h?r>~*p0W4Fd0h&>#8GWLgbd!wj8Tq zxzO?}4-Q$L)kjXoq;^7ODdCWkB_(h9l<6|H9Lt`wFk!D&@or_=r?j^(T-0%%?Wp(~ zNNYJY`Y114N1;3Um9*Bw!?(9kV3s;6euWX}aQRMpLkTCB%eaZGU(9Fxf|qv&+=M$) zaI=2e%eE(-EvL>^9G}3q{u;)<%Zl; z+VS1|u$vFqwQtC$3p71vH|215qH@ujcHhaS`n(a-Vzu1W`K4ym-odmtwP^dYhEuhI zAxMCYPL~40g?wCYjP9D?z;+e=^O9y=+g#*DDewAx)*iQL`F0 zU8yD2bKM2gVfcsutN9EBJOfQADatQY{ClD(ODW)4y?p1#EBUt4NMPA<+{aU7T+mcGKQqx{&BzwZaIwH1Firr<48?XDFQ+4FnRtJV)|rC|6fH zSwN|seA-Af%akv5x+;^rPCk|L<{|^rJL(tQp-wN`pB^aY9bp_9th|#-dww9^(i%RK z8t)ZOZW$dtxDZT{|^?1vlg7)_d8}Vj-PL7Z`&C3p3-e(3w*+v%**@B0yFB zo|L?i!AbaDF`EjzuTGvCzoC*)r%tW@Id0$D?r6WJ$Y*W0OhaUR&X}4!9Z42~pJt_{ z3l)mHcxwDQy}Y}^6TJ(CJ8f!wde^fcvIFHFo&=wU>nL2`Wz(>>ySLyJivD6JPu&yu zxPEui%ld|^bfHVWD(pl=wd}_0uCO6pV7-((1FPEknmoULC+YUdJFemUPo7^UogL(T zSei2FsahgmQ|zyw&N>_1be|UykcjP+`8mlXOSjew;DnU6}4ETiEd))!N}n@vC9gJvF%k1L|(lB+wLD;8FG zDYr&Ik&oxKp}(^1|A)V_(s*6o1m0FJ&aQY~wpA+EW&EwcffjEpfya{}tq(q#`dn~* zcutqEJ=e=YceKxQ@LfwLpw^yDYTmO>))PbFk7ko)W{70`^@#5G4&Qe}4c?Eo%QhS}cUkb_@5?yx9L%TTdN;g$#mUc9#?|Z# zus6|{VzDoiPL{elML(n-UvXQF|2c{N$V{v=Tc>rAAzOF0ha+3^XV3PMP9}Y^n>VS_ zf1ZVW8uG7TVTYqv@BK8X`5YF3WM3sv8Z(ij_I)xbe!V%@8SKSLG){7a;S~M1loRq; zDMB?`cQyV*x=_rb7VKHwl+Et7J@5Kn2ETRO*AbSl=F@PzE1dJ5yw}er$G3Zol67bM zJz>Igx_s@Ce1Tppb^U^q8Gjwr@iQhh?tR5f#x10?l|}}UCe)`DvZJ=sYh;kt(aA#I z%h(rdpx6EQpKWX3C|68-6HYG^d&idtc&f)$zd3Vluz&!reKL{r>{ z)NjZ0aouumMD3=!4_Q;%=d2yy=LD8}ihg!SF4tS};y-U{!P4ixUrR zt^YeIJ?e2i!aY3%WvcvNdB2qHe8z0@(@r)~>`N2FDU7nZhSL)5k$&-X@M*ZN7!l00 z=|x*OH1^t%nLR*!NfvHBKYmjEh%Wx9IvBYcuG9K@okW=7bjlrfk)?lAS(@%(m*ap;1L?FXSj zJ1_COay!-GH;!E^@=Ho4F~ACSQ%Bdxlc1sEkee;64vYHjXCJe0q21%=*LHVZNO_*7 z)E-3CrWkiMj^huUoqxP*1$#??;6>*X&uG^LD16I2Oc%=D? zFp!Cx>oC3%iN%^Q?UKAR z-{lUw887GNO?hPeM5V2P_WT(RZW*P z)YBI**q%{ww>sF445y16jr_Xk`y#P4s~NDV9&ceCjGNI*LTIj zhsPlcPg6qKuf*8M8PrQvyhTPdIMWcL)M>4=x-kd+7y-_j_M-EZ_Pum8MjtvjHO2=Z1ST3-Bqc+7vT~r*2?$%)-k08|HT&yQ zNGs5^-HumSzl-C-C0>5Wsfr8BdBJ4XcjP?KE({dYM7Pqi=eSntGv04~k;dC+Eaj{| z%Qn=`vd)TX60y)(JZGJQzuK(@#C+tUSMiPFuoA%Ke{@*SD13wn{U;$Z4cJPB;RkW!g?>a-Oi>tkC69wUHMCP zyXyTtp`8x;Tb_a-f|AI1$-#AU+7R?#iQiH#R7fThgKIiF!;p4IDn*dhU(8u&SX}K^ zzN$KAv>Uy5BmIfQ9fL`en+a~h&$(_&ZY7L6-v}f6T9!NXrxW5moJwak9Un%2zpw(9;)J06ZmKQhW2Z^wy%4URI3Apo7h1R=YXq5|H@6H ziA-WWJzvX)z{Dt`b_&hj?f$yPA1S+Fr2`h3nW12Mng;%b!JX92sg#PJqsGG;YA>sP94ZtEA_t$$6m z;E{W}WqmE_efgy)&IbY1LO*-CcHGF)Sx#78i9c4ZKd$ekIADok%Izx-V4+f_K#vnJ zXgXinCn$TqviCC!VF`n=!fKbd(kdd!<_B*nv)LWA+RfdK0n3;C0rn0BtNj$Y`0QM4 zFIVx?l+|vZO)x-a#gF$&69Zv8j05B`+_grarI(($94v1Q_8F$92UND74qP&4MD7?!AKN6q!oS1+w@Y3XcRo3J zEKo%D13XPA!K-AY)RWO?2C|HCV6EECK-lr4OvCq(uuk@4ghz|V^>EbF5(T>|T}JqqKZlFw6L4%S1qVBW_uec2zS+&1~5 zznhi4NZH3vuFDI(p2CYSo#I4K6~cKN>|7GrMs#FHJ8BG=>{}voG`w#hMa?-FA3p&vT}N(`}3xJ z)w-{`cOLq`Wq#o~m{K#PcI~-D_4+DLryt%6H?1mV{Npm;A+a6u%#g2gy1B<)C*9o3 zmh>vUthi?_`BnPR@E*LBubQv&J!{G2G5dkCeBu4+&@PqJ>)rD-_071I%aww$)&CE} zg*=XFBKJE`}KmA#4HhnR?;xd(EH|nwnfD_a^szUCP|HiGL VteZ)&q0Hy8>g~x~afmBF{{)prkwO3f literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BTServer.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BTServer.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..dac432f95ef57863ec440512c620bfd433333c28 GIT binary patch literal 14053 zcmb`O3!EKQdBD%y-7I87z1PG51_D*<82!ZTw5(p$=$tFA_>)e^y-C^h6xy;Pn z&4S1y;ZZ>tgqVEVq2@$wnC}e`2Wt#y>su}n@!wi z^4t5r=k?8beCIpgIp;>H+l~FyZASjzO-7*O<{SGMKUMS7^slJDR)4BKqyAWZT0N~k zrJhuu$d&zl!aEw$9##+Oe-EqVU;ZtU^OBr|i`6=HA#r``#74>vWVZf0q2)b^+~XVh zB`mU!C1zn7tCDBlfog|wj8gL!sYRry`31so;VV7IN%$Be3BOsX#cI2uj{92Ac1eFz z8h_N6dUhBmDRtCK@MQP}xCA~APl2C>OO;yiG(45?laTV7MZ!-IHsMF$GWaMw4Zati z4j+JL!295t@LqTpyc?bk?}TrGQjc?>)MGi6dYlWT9xI^K<2-m9TnTT2=fi1u0i1-Z zUL%?o;A`h3%B;HZSJ32=MlO{DPv8K^tHORm+-|ZA>p2Lk+WW@ zp0nWwcm~`EO?atN`z(b+goT&ElX^C(%}Omiu4h=N#{u>n*|SAmLHyR9%Y`}~_AH>> zmGA&~6`T*RhWo;6paHkSU(VTKycNC6~R7<>+n!)KreKMk*gpM(?e7;c@CG;zZ-h2{JG>U&1h0ngfS1FY;U;(s+z4-l>)>s04crbd zfIHwh@OF4QyaO(Ucf!T+F1Qf>20Q}36CMihh6llW;QsJka2~uD_Q2nS27EXCMfVQl zKKKUwE%+L|AN~7r_j}X>O5HJ+`3M($zxzS;+e+OjVc7FM^8F6{7W`fK3Pexmd=NcUsv!>Qgu z?7|M?Bg8+{{ZYP&K0YqIy@yZUf8e_*|AbNp-UB}d?}C2-x5JOacfdcSJ(KW{2wx8= zr{~XCRKiaxb+nBXk1Oc=XAM0 zSAW5Kq#WeE&#S*AyoE3{Ho(uxJclp90r+{i3Vs2u?A~tt6lcj3c?|6Z5-p8AJ0U3fq7{|Mg&{|Vj+zYll7e}*@~ zSLv5+T|ZF&LcL@?fQCc-zY@O{{+rJKL-pfSPySu&&yOUm?G`jH>-rD%6L<+^+!w5& z9Hig>Q~g)k?~w3+tDg~;@rOn~`CfzP!`IUu%r+l3>=WA$$=M$v7NqEP|K7me-+)8#>+mx8GTa1Tgu}@F9NY|_g;Ika6ECq`q%8-j=3ctILf@SnCBeK4n;jlctw+x-DUy z4vkMB#f2Y(qfqSG7<$^p>>Y>Q&?EkF(yxObh7<5n=)*@~8NLrz;6v~>`b+$!s&41? zMrf$RA0S?MpAi```J_J};hHg-_6H<9Wo%3P1s;Bnaf30f<8Lr-O#2BQewXof{T`X$ z_4mC4xiZgghGPG3fijK^o}QPtVF>0Zd5B1iEvp^|I|<)T%s`ff3@Do!cbR;`rznzwiZ8D`NaUE+(3`Yk*K}js91o&6N?KzorR&?09=YM9XS80;DX0CtV_{IMs$%y4-rCSAyHi0p zfoN%eTfU|YC+hTiyC$vBEC(gecg-v9z;Op^o*xf|fm5?-t316r|7v&A^@FM#suhH@ zVTfG2M#oPV-EFp8jp@YVD8izmRf+Sy$G*Y?ayDnKSXrWu38kD(YO`5YG0jC z!oFAH`{6p=+)qx)jJ>jZLr{@QuHvt?ejBWcHRd{tnrcz++ZpP2ZkwEH)(SK0>5XnI zBRm{iF%9$VC~e_sdsx1bly~YK)8AGu)q_s`n^nUOLbvQXp0yX`ST)BB>T=f4u0Eda z2Q>$!t2pIp$CU}#Xrf5u41i}(^(bp6bCGVgDseHYRjWZ5*Xzj+bT;xf=t(x<*W5S= zm=TU!s*TlUib!^_dqZyB2sK1sws++EZqm7RwNsbw9l1HFo#xdZ>E*!YVa%@^HrhSQ zac{`6ys+w96}K)>?A|Q&$aB&j8<<^rJE){qF0IG~vylnFrnkhN@5LTVXtILMQg8aJ)!`Pyb@lA()qm;m z#vt}aJ)3oh)xEl_u3bGl`9p4iyEo)9OxfHOQRneDquvZMGrX}{sOyExqWunYNY`&& zWi${WJgekmCcPT8>~UO(Or;VPztF|}`wg?N*6dDBXZ)R5jS=e<78Qnwbqk~X2`dGg&xm~GLQp6n!6$4I z8xT{ZT$O(kSDb75s@GLSN`yzDc!_pl=SeM0%&=LCr>qHgAA)s%Ns`W&kCy&x_D>Rj zv}GvB+wO%a)oyQ^@}+)ltDI~^LJLPBoe*cV)hD+;q~lo)rrZ##SM;q~#U6L|%a@Zd z&n)e!ZH1xNtg@~90r6L-ypTy9C2q75zqhp?>*;lGUNR^(S3XSbmzKOreIHT}oAvcc z9isDfaMmQA=LGp^8MjH651QfAew z$R2paaYwD1j~nBZ`lc*j1gQV7oM^n9$Vuj9ecsMgpCo^>Pur9H9qWHxPzx*4hNK^w z_p@#KH)#3(MeKS4P8MvwkBldQ4*f7|IgNf;BF$^jqnYZX)M*9XA6-ie<_C#`^gh@*+lHpKd;sw^gvZ1Me2()PhwvmX*K7Z5g@{wIR|G`}3R~*4*9WKLfDG~8 zAoXsBbZ<=PnzRf9D${<>F_WIP>3w7VoY|(Ysh!#&ry))5qZijIc<+8-PmDy<6a#Y4Mo0>4RFOBlKYtt*#Ouq8&04W?`_fwy=@!abZfwPZUP5?}=X_ zeqIHal9tk^fXxZ+#>&x+8Q@$JA5GOkG4@1uCf^y`m4itZf48C+;HavZy^61!t^OuL2Sp+VnsE3rDOMP3Jg z#tSCAxUWWuK3f+7oQfsY0)j`?vDlKUuLi?4vT?1C+mQcOcELr*`?({HgnA@5zegjX}Vs*saxrK8( z{Pof67PiLM8zb@OIRJ`BgRtCZWp0C(!bg$64&zZj53dijKIcQT95*d!CG5IJnP)5W z7-b%&2YxN9%Z5VVp#&~1^e11~qv;Aw6#7^O^wgL1F${NH=vyHUoOOe_UiDs}3Vr6~ ztR|v=QSY$4LiY!&?MT%wkLZ)uk;o24>enR6{X~1Z+<@pBiod2Lol_KVv=~#kcm+|N z;x~1Ow`{*-euiE-C+P*Hj+abXdg9Y+_qI6f zm1}5-t3&#=S-x?rGN$cnmYL^g^N7_{QZ2 zb|u$ejnra)Egl~T1I~H+CF4=8@{)TvrY%zXY&nvVbRMn8Sv_0s>m>ak`DjW{uQ`(a zX%-(%m#cA5j-1?h*BS{The!57P4bXXPSmAn*Qx=Vhw0+BDvSE!)_fffLW=bzRdT8` zcAtNEaAQ*YO)ec^aVsY`Yr8MEdgE}*$%&NE`>LjPbgJLb&=BR~FyM$PT(Kk1AM$IQU?-hV z9=V@uYG1>CSd*bG`^wyWY^2w381?;ZR_{i7*^<(2de=y=mXZv|NT#fOve?Q(D=XYE zSBjjrOO~8I4au=oa#L7l78L0l833h@Y?a4>CWa`A5_^NJ+0rxUvsXhnG`m1i(9XZ!%>W>JI ztumH$h+Im@rGCX}>J+^nZj#fKpC1lz$sKu>Nz3<~bmHaaNwfTxe$KUXidB#`R&J^j zMabDtIXKxIppd!xcn-abIjYNc@;$wOYkSL9XtR4re+QAZE7>&ZF--I=XAk-ZR$KfI z02gm{V6zA09tOuyCJa$4*A+w1E&*Vo*TUn;a}NY0Mi;s)dP&N)Kbfq%c9-(&ahgAw5K_Ng z+mBR@W$d*@X|*3YJLzyyK2Zs#Xg$BFV6bCv67^HbzA|ec^I6`iRBrtedr=>Rq94`x zUYC(-OuCZf>~5l;W9j7&6FfIgt@k-hMvG=mqHU;qvpLlEDXV63C?H2`GMdS+c9MGM z^uHye*q6MW9F=PmQGe}isWv-VPj|HDDV4MH9JnVPmTR|IqV&Gdt}>cVt{hcK%E`SP zPZyh)(>Xcrcs3L1BQb}Ax1g}i>{GHWF?*LPabETM)N<~}Ik1^t(wGsaCdmu#PSAC` zGM6j!tUY_xvh-C&Ue%@dRr!mxm`y{KYRjozO<$mmvuWsKmu;3+ufqkIoRV)-y@9+j zq5*bcLNhVUIX)bk^db`Zrx4%p2l%|^1BwPT5f&nbWbnY^7}6_ zfXT1AbZXmt=l2vzLVjIOe&5h$ACvm^Cq9Fe%-P3I^(t1=dwt2DUspQ*-l*+TJRP5G zfZOl)ML17xKf(Z}_Yz66I#rm-+5LTdS}wQlH{Y}C9Ot%(-E;k`A0XuRd3il({9Y($ z*Yo)}NKAe+nfF6B4{K*E?-w`x@cQp_a(-G~etiu{)(u?qqVH8EiWV1*Nk@sFlXY+X YT#a37#r2CE2y)Hqup_P3SjW|`08R+*qW}N^ literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BlueTool.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BlueTool.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..8aae06b45bf58b4e8a0f2a1f4902de22cb4fa3f1 GIT binary patch literal 6693 zcmbW6dz2hS6^C#4kcDgv5D}6PNW$9~rh9ptfFzrRgh&#WtY8E*^mNzGG~3hNR9DaL zCMZM&L`4zt0irxqP*L!SiZ6Ttf`}lZhz|rrCGi~okaIX5HU4gO&vei1Le!o!{Y|}Y zRo#25>eepN->9FSoAP;Zl1u@;{^MjF_+Pay1(U2oe%asiFPM}kAtrR9|KPY9|l)|_k%0Jd%!{PZg3TN z7dQmo37!Jp0iFup2CfEg1=oN#fv17jfos8Qz}JIUf~SL*f$P9a!1dr(a0562o&hRw z7`zZX6AZzP;053aD8M&>=YwZ~=YnU0o4_}MBj6@*7O zK>jkF7-n;a;SYEsQ-H?Af((ggL+l=?p`*Xcr3BAoR-^Xd~ zpWwE9Jz-oQpsVw7fk=Olu0fjh0~$AjA42{N%uh)+t{|4lL6ucI^7Q7m~PN%P@ zkLmL3v2XD@{5Vth3mR9U-VNZDAg6i0H-S9go52UcPl6ADp8{D=pGLnsciuv`=6VLT zo;vJp~~Cn3%cLWGj+e9A&uMVi#q=frp^ZqAML&bo)3N*JP-T|cn_XZyZ+0Pz>%Lq2~H=_l!rxgNlIFVNHUl+J&ep2_vXTw?r* z<<5J)B>&Hl%YN|}kk{K^LH3{L$e+ruoc32X?p5O(P~CNIA8DO{1Tc{O;(lG|pn~VpK>GLgTizCWvZIFf2P+Rvh?= zf{4BF?bQd1&gPXS(oPzV6f{rQE9=Fp*~)Kc-A|iQy1RiQm<`YzRY-* zPmvQBqqYkN-yjrQbVNA{6Y2T967AMFCeNj*v>_)7WDu3P=5VDly(DgbQguu!qxH;Ja(X(MU^~PLH|& zwe33OxDA-J(8PM}pKC;-oItgw!;w~x9(v@I%~A-fr9mK+AJ!sAc67s{w(*OovX$nW zwi%n!^v#y(n93AL^Dham2Sa@8$o0&{<}h-FIf^ecG+n$C)N7iNS%ZWCX&bo_axAoq z@!>pcrX5hfAY^iek49>V-cnw{qp&^EvTI6;M6eI@GmBq&{O*JB)w z3mHUpD{#`#ZFooQs$EHMT(x_jD(pUYiX54Sb~2fuFD_cdFX(f=)~AO#x1fodsqFn| zX8&H4&6a3yR4V+A<*R0lJodN3Z2!wXlkM7FeOY^U+i4vPQG+Gf){_|RI@qnQ z?Kz}#6SHA%#7tu3OYIr#6GP@|a|3dfIj-}^%+0W5w!YYoAzTh&E{{gr&r{NIMMDI< zotElt5fY1}u(QP87&Qxjz|!IjmV<})uS}jJlFbA9d?@sl`-PP_qoUf3TEa?1=y8)` zT(N3S5Z|2msaRz@*$WBNQBXp>bYPh?3S(i?MY?~1KHrM|+DB}x_zdRf&FNMG1 zddlM&j-e064i>JU@C} z=zdNYlOrmUq9nYle3g@k8cf<<&YM6SIBGPK%_^c2?4Ei@W!e1TW?ULyM_=u8xNQhe z)Y3XE@3jw9N4KWRxnx6yiwMh*H@em42sX9qzDS&54rV{F7eSG(Ic8R|H|Zt7<#lLQ znbi{qmJOccY_Zo-{|Yjz_Ss~*tmveFgu6g!#7|`jT9o!X*ruWPKo`3u@2ij~GgLToP*G{Q5n5xDq8I1`!$Q2LZ@fQ7LaXOX(q*Pr#+VlD7b<$fe zkLS6Hj)P0(c{r1uM@4=z*^E`xOuQbyNIM02fBGCNwaXWb$8mLOyr|L4+|6>+IKt|i zv?gLV-_MHnSs>mO^H}XIUH5oQx7_LKj|}BO-bMk%IEcbIlHPT@Q#Oorb*%eay6bks z!^3E&WP}h%4(z&qJ~|HGWV5{q9k%Osu8surb<}gu3K7!iOIzD7Iqsfb|61*Ozblnz z&AhCOJlM2wv*KtI@tlq}Sz>lSE9~X@PCdj0&Uf>1={Trdo+#e)`F_sOChCy0<7Ib#ws!ks4RjI{b-c0MZ68_ z-HT{G3n@Bs+vT1knylG9yUUfEJ4(;IaY7|&%x8+_#;~T>(+)$)6s^y*&V4G6YwbJ; zx0A>n;|_`c0?1G0QnHtkecXQ++6?5OjfK#rqR;W(3yZ>G8{>Qra0sXRV$#52TSe4m zH>uyl#bd#MWlvCl#62cB<#FC~OwQ}OP}57BQI8t0o_)Nl0oPfEZy|4*b5viyy=rlb zE&sIu|0ZA|V?(P;*OI|-k^`*nz=-eF|4%>dzX$2{g0s&G{BX>2JTH$omUPK&$6Gk< SLJ?R9tfhogSKT;eFZvI<9V=}B literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CFNetworkAgent.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CFNetworkAgent.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..8b9f53f116e0a29c29b5fb20b7fecaa97ceff897 GIT binary patch literal 6205 zcmb7|e~=VM702Jq1_DQnB7_4WfcywS+?gXL#0#2m967`QIl25Ys5m>*w>#eK%-A!t z+<~YV$qyrmMno}DW1_~WiAq$|sA!DQXhc-PS(ShCkCs|mmX;|~Wm))rJ+nKrdk4h1 z+Wl;Izkc2C_3Q38NA!D|PR~yG`wjh6)!jvR(KtS-#O?G!YEVLw-c2C|Xf6LL9kCXOX+LGrox4s&mg;_17&y1O9 zSwu8rF)c<5y-Zh<7od4WI&9t59)^p)quv^pL zMsFv&jmzNF|7zp(4)8^A2ly`#>on!>phdKADQ6tdO&ozNT-nLk0q!#EAY&&RbY zezBj`I?j9s{auXrB=|0(nMYH-d(T1p?L>-oq6;FlhGzK}2Ur@Ura=TQ&-Si%e!~H;vyNBM3^1Ud7+9B|L;6d#qy&pUP?gj5b{RhCi z!CS!nU~_)^pjX3gxK-)9P0fq-HQVoi{4VW7v_JFHo$%8M?ZaGF@d$QH$iv@ioV&Ae zJ^~&<{YSxr;5{JE?_{os}0=fE}K17I0^5L^j<9$W!_0bCA#5nKX31kMA$q{bhohcTbo zD1R9|5By4I?^hw$r9DE2l|LS(uVwQ9RXlwi^~beuWbt&E2|qqY-_F{pJ2;)Bv{s-E=5Ar(x0RAk&`#%IZE{~%AMYR72d;$D1_z&<2 z@NeKxz`ue|f`10FZYqwSBAWXL`WgKk_3Q@_<)`Tvnf)Njzocg}KY(+er(^UhRey|r zo%w}1TRYBr=RQ}^|6Azg_5U5n@q7a0czhOSO(A|@UPcA7v_0Ab+9TQ#?K$mF+BE%` zp4KmB*g@T}!q5|jA0^U@L=?G!?-){8PT+gkHPj&o>2hTGP9+#sQste}jRoYeTt$7I za`Z}WH$&+*tXP;Lw#`})#Zfw2ljwp8?U9fT*B037{LJC6w*H|E;=m5PRAAP`b}Nc@ zIupmO${-1G^TAi<&{!0Uy1Ch{NK1~HgX#1Jq*WI?133cKY}W+2g1|+py=hm&l4d=q zxSlX?vI9q~Ph2k^l!24ju$7-KCBH#5gcpQD@{LqjhDg{696Dx*QCoyD7Q+~ZvdFM1 zQQ#%9D2G;DOFf@1(1q>&v!xNEP!wAgkC#S0>-f9nzrs9o+r_Yu!iUFAW1|;TEN@V@ zs*KQcqZle)j!&mQSaoVw5=k?vSyIq6CC6pYt>E`uRWAC;shF`_7rO$VC%F!v_W5nG ze5)#)#f4ckeS3!aT`@sVm|J1y0l!tmyuw4V6~i#sjxr08X>`nE^8S9>-)TAqnFRb& zv@eT;rhoebf7q=i65|CvLPD*pIha&D*WTn02RtsGb^LWkJ(gX=66Ka`QSr7>M6ubkn0QL8#;k7oFmj>WE-J z=hOXv_DgzFy#oE)*D0=tsN0PXo>Fo~``YKd8566(GPZpTc5H?nRb^kls*UuTz75ud zsF%u9?4y2tK;MemSl_AYNAw-AY&wr_I-+6vSOTO;t+EqK%N8}^@o`a*+a)A|W=2a+ zV($m_^IBzu8dq=`5AV-Zza^p_J?i|+{g}nA5n02cTn`$;h=lKOmwaAfTpuOQxcMm= z%1;jLXy~T7kYG*>CxokddaYqB6^zcyUGvrXosZYNLc*Bu7=D(eC@n1N&6Gyw0-E2` z+cgWf1k2@mCeB+5TeuCunLR(HHDq2wlgAiVilf!R8V35PStg#g*|mzM!&ytXcOT!4 z>HZqPF}%r-MU{`|>v1>rd#>C98Dbbp=ZUzfvlHttKzg!CkS`r2X9P;@mv0A-Xl#%JED?Qv9eC{LaV4@C>^(Tj)<^U*_M!@LZm+^~v0h%=)7y8mwaeU0U00D_ zHg6!^W=BR{Lp%hoc794L(W9`x;rp7}^EOTgK27+Ph@jC>yBuj4_hNeyinY4o2eCVx znZCn@<9RReGn>EifUv4nDXK^@RPdr{X?y!N5e72umsV6WhTM7r&k9vi!{&NwmS0u- zPG*WY?(^nJ*13*zx$FhOND>-eU|U|uI@PzlxHbLHj{Jv38WDj#1&&QxTy@=+WrrohbojrSgdwXnW zfzn|&Zm1{;`A#wH5Uc5Q^uttAN2~j+Ew4x3X?j-T+cn3G0(*o9B)T(2X&;%rWM1~t zQkR}Abuo~-l+-=mnV`qGY(u0$9xmZTCE_()wq;~hW}UhmB--DvG~<;!hM&NlweM%0H;WKdjO!tF#LLu&j#T*E4&wdwU`1 zZ0&sRz3zV9{kq@l-Xr=Q_0#d5&#&nxT6Y)SMQ_D7tI?vE1bO7p%``!8rW@&oc`dJp zJUge`M`QZ4kFwAFez@kkx!Ogk1>MW(QoL8uO1x)#J}b1gXu*Fi$G7;f?PVP@WzVvQ z%t2^r(9q+gmlC~(^w7VJ{1h;@o!L8r`xD7lH+zy@% zj(~mOH6VdI!2cMtGzvZo?gak{zMAMrAN;rr^M1y74ZRlfBFNytAC29#hv*KL!M@+4 z{_DV}z`fv;ApElEaq#s-htEL0ePD^kwcm~zZ=n78_(81GEM1Fv9W}1QUpz0~7c}rN z+P{(LMGt27^m?`Ob$b)h#RlC(kO%HZd0T%fR?*HRSJ%ILf%-MrJ9)BB4bm1Vu|;K0qO2R~yx2kCA3ctFT+r$dn0FQDFs?|`1y>vqrt z-wFLqC_fBd2Oa^(z&o^jC%sFT---Od`~2NZ-7l!;bvMZKx(A#B-viEo?*-W(_oAPZ zC-0;8<^BY9U++p!Y)}0l8B@|rUCfoAvaWxPXo)~ZLeXZ(g?nS+rf}$t zC8k{wCB6);8jQu3Q;lViCZZBKNh9;T41*bLyYBY+(uipoN}OuIOQWBy{GRh)$2g0* zi<(d(gvV`bXCSLiFs9~IRuuR#vLl^~?|gr->1^9PLRyabI0lIbU3HOSTzj-k@#U%I?9_f23v>N9#QF5y2!N6$W*3pwoJ!N zOaYnyQs5pi#J3KuXD&C#pcQ5fUuI~!c*m&MG^JUEg#fY*t%Sxxy9giFS^aiEWkFD~ z!bhWIjSjK(Jc{SxpGZy#709|3IBDoMyh~5luEQT(wL2b*{l;-u`2LjXgw8`fqidW= zGlGuyNzwj)iI*%>^`kx6o@m)2mI~LHIoV5;_likDCs!d>B|1+Q{k2ndlps~;XH|yMvQE3X(b!%}ONNHa=OY_) zy~0lKxRr2)-x9Qf?QP?;A&a9?q^n(FBI=yR_9KUn1ilCpzEOABTVUOMIq4^r6fG*Q zZUP{Kvw41a^G1P_)TC-w_$=~Woe6XyUKYL!jJKUn+m7%=HLb(*UOO>5nSs)cWN##U zkn9V!V@Az!1Y_j_2z$+K*&m1@gqUkinia&9M3BZ@UPq)RW@Yox@U|PA1NLqzZy~c{ zUrVOT>l2s9xeFX|{FK(9MMs<>FdI5{T|_x&1&;O@7A+mES$-#;FSbgfX@xTJYx&eC zTsW5ZDnBpbSK$DsURR=yqgHP&6s_zo-zOrek`d*^4Qt$QrtqxLlJ2&!({RGNjti9= z;(b{ZFR+eHzK7TzYaWJix z?+MjC9U6q)!VP|shM0STQL!WRC6znwxz~18Jl+ zQhlLmpmhbOj@_iPhYQP+AUNyynG0R|BpyjBjCY zfjp+Kv0jCjGrJad-n#McCN?rTGTL$N*%r?5LD+pTZTdg^Y5%UOp#A*&wq5-Gu=hqH z+_`(lxK(TaXyJjif4A`cyXuFypn4+q>*0hGa8AZAHoiyUDdEt&;`uFZC12dNSlm3$ oLy=g4A5L11=jG?n8W=77+P*hT3KfdL!i7gE1Y^aGQr`Xl1^X+7!vFvP literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CommCenter.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CommCenter.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..42e590a93e30cde7502c0cd518b85f0d7dbfd769 GIT binary patch literal 8813 zcmcgy378yJ5w7VDkW2_SB#@9SkpLk~zYRwqi4ZoEY!cW_R(2%_V(jU8yVGt@_t4$5 zM}WYJL=F*A5k>I=H7W{%;DHAyiV7&6sL0_JHJzvj1@2aX- zRj*#Xw@dUN+LxZ6@cBJGsp_tzD`^~W)Wf9#dKH~ReRLMRf_kW%x*A4~qxX2Vu9H@& zPbWp6Mn2p#>Ag~oJB?1I<@j|hEv(XssMdZTQ#UfAyP(>i%S`uWc<08o6g|`1Xdbl@ z&Ct*TIDLQM5x_Q@kDfFmrAE@+wNsAd^1Qe_fAy4cI*RBpqNC{rB9vd?_I={^nWv&1 z0X!BcfJXt_f%Acjf%AaJ1Lpuw03HfF5qJ>rB;dZlB}6m# z0-g+Hey5;bpR$zs&K=j6)yg}z4@xg5N^RF!7c@2l<R89R{-6;;0-qDY4kdB z(0)GJ2Z4P+l)(hW#DPRA>cCLFz`g+ z2yiiQ6nHFfGjIX$Lf{d=i-5C$7XuFfZUOEMyac!>@KVhGKiW8rp}bgsJzXB#@iN%) zR{afJR{jqh+Y|cSiuvfU>l=YnfLEY?56mC_r}T6cko9ym@FL)wfLnmq09n6p#<(3j zuBEqN9NPz|>~kH;)99`Aw%9(vu_^R+dWZ7s>lu|Cz|=Cbnv+eW!B?+fvnf}0a?%Q2eRHj0AxFS5Xg498F&il+yZ1he+bBW{xFdB z{1G7Qc^l|+9Qi29GtvKJO73y`ILiB?d@ITvA3lNdQ>k(KB=Aw-ZNP_tw*%SFKLxxW zHvm5ayaxDLAlvzKz^y2M9{hM6-h*-(Ull<5yk{!woEfMU)!ol{VM%>{Z9Q}{So~M{aKxOha^ni|`R0H$@`_hp?AiC_F zZ~CJm%bf#}^@_!;bVKQ99Ww}QON|$k7|#RS_$!eU(q;nF&F8!k!_cb&viyY;y}Fh^DKHf+mQz_{p$Q>Xo-Rsgh8ZrOzz+b?Sb@%Y)b~* zKy(Oy)r~LtUg%k#6Lny|4ee0gaDF1+0pBZ^IFo^#y`w=Wi&YEsMCR%A&7vIk{6Uar zy-es=(}De<*?h%0mY0_+%eE8t_+GwjVXpk7RsU6TNIG6g`pDpF)gDNz41{2s#*)M(R zLgT_%<9IpK>G7*oM#-@Q?6Sy#C+dSqNAoHNz6c7YFKMdk$7RRP;rA?6uJ!+XPK0(* zZuVRj@^rlQ@^zao7E`{hMv98eE#zA^fleuzg-8~{dKt2XdqXqC#B3{wXV}5xiS*@k zs3x=$R==$cAqs?=M45m2z)&lqO=wxIS6inUTA*2|=U$dpP_Dd~sZ{-y_1#ZfcN8Yd*D58Ml;!y{L{KReJa;srxCr!``ezb#eBYLS+sd+=ho|-Iihpy? zLv~(bF}kq}ZSsaB$mV5bTAcAV=%Zm?&FO|REJ)vW2O24^m>fO(0{E00R>f-Kce^DQ zuU!-2zDh{>O`W}Wi;m-2a6pcs@d8^rxp`UAamtSA=grV8Ii_17N0Zc(Wh$?zlHn83 zWbD_if`4y!Z-vrPDJDdETS{zcxx~7$oLsyESa^A@P3yq|lUhGsMi&cBV%Z5SL{H0M zkvb>~)Ox5fFs_6T*BR4;tW!odsScH2Er2aFFOhjgL0P62D!vWYNRLM?%sNEnMO-!crH3Q7?>BK?I88{h>aN z?3Q1xS-m0Bc-Q2{!@UE`N(|DkRdV#gX|S$giy}sGailG#Ypt!IwL8=wS z-3{@NrCM6xC5HG`67FoywXPoRCjHRC0Gu;QKr4I71~_aVT$=YF4v`MZ&=TGwtB7?LCNzR;do{qnQg?6^Yr@ujyJ%U0lw_3Wb}Q$X~|v-TZdIRx_N&L z%H(nx#~zXyYy@Fogd==xX9hBd^L{jNqJ10kM4r0H`esl# zOO`wz*Gr_;d@ z!jY8Iv(-IV!mo0bR|@&=jh`bU(C60Djfn&e~?y31zb_`qc6mWn!_cw(gL@#D7qsK3Pr>9 zLc2en`ld*c+=1v&{z?>?t!@?uE`hPe&*ygV-w6Iq4!Kw#_SDD`;G`I_+z6g{N9;5{NTOhpsvMaT!^dDr19kA*K#mQ2Hr1RL@NQ-pK%NT3XlKB#%(nrTI*<`_|n()K@M#N`6LsGx9dr16uLtVdS z_Z!@U`2IK{xBK?0{2fKfiA!C>vE4z#%;#fISy)H65+?_x?@Gt0+?HmnQn~24^j}w2 B@gD#H literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/DataActivation.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/DataActivation.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..ac40d7d34865d139e53016eb024914e6a5ebe26e GIT binary patch literal 22277 zcmc(n34B~txxmkzv`sU$vX+*ughimXnOk-$2u+iwgf?wyXxWr{XXYlEW@hdRO80K`#$bhx2un+538Hh2h|7E`_=o@^;Kan z#XMe;wnbf_f3~PCYK-6NSj1=OyI67`=C9+_BEA=>Bl#Y$`8h({mdksCIuyI`N8}!i z&3xZhd7oK(ke`E;n$@n_aZ$4)nBn|qqKAn2Aj327r_^C;r=bpcI=WNbcWWOSHx5^7 zw}T+&*Zcmq?oX%%N@>1PDdW-TxUmpE4DolsgRn!X1MY({_*H1aFT=&~3-Bm-J3JcR z29Hr{?#JM@MyRWny?=(f@i`b;Cgr%+yD=TXTbyE*>EmA2THk~3#DAogHo<Jp{qXWK4P?^Is=q|3)=oJ^+o*uV&=F3x9)-cm$dzt)!o?N zjXfm%J?bl%@4yT(e^q@A|GOg(V!l^x$Nd`IA?dzP=U>ttq~q(jUxoVv@G|%yybwMF zUHA={h2Mlj@L`yMkHGWcx8OPOU*H+=+muT${0`=xnUAW+{Py%+-Oj!zW<8F=t-F!V z@59%VzaQZLxz?S=S^p> zhdnfICfv_3&%*q3%-yZes9%!4rP%)ho&+%)$F}}T{Tg!&^RuM$$kyk?tkVgNcIPehbC_ z@1W%GKcM9I_fYcx2lycFe?7_Qrj5`d-4hF8;-QZ0j6j9%iYxeHdqtY@I7+U2o9Xgui{E1^0tz!~NlEcmP~J z{Xk9s&=B^WY(H4|ph?4iAHWnKo{`0sa9V4qu#hgmEPDp2rN0 zU%>@X+Rq!Iw3~(SY3vu_Px9RXC7&_uAIILL9H&u^i!tAX`6zfTJQ`jOkAYj@v2YX~ z2h;F)7>6gov*C$wHCzI_;hW&e@FaLFJQ*&8Z-$4!Q{X&!D%=e&g)?9${Cf-YKl~Hy zf-k^s_$*uwpMpK`F}MOg3{Qji!(MndJRRN+SHj!iD)Bsa6foHoC7yP z83*46WgN7qj~419j#P;r^FMN)pY|Q&d$_+i z?NOn2|E}*Y=0D^AG2G9X`MB|Y_($V$;|K66%s=$~KjHhwO#A3x?nftaK)>dr0r0vGGTiTv%dm`E{!4pmTsuEv=e_6;eg*fA(R`|4D|L9KKQA8zCvOefF?(~t&Pt9t z5|T*qDZ^8FzR7)uYh{yhXR}VBYH#cwM631`f2DG<3kh?`aSN_jJEl@|YTPAvsf5iE zNe(pkhOVdfJ$`D zwZ(WkmFUe5I1(S9rSeru*TnT5Hl04*9#+_H!Acimxpc}cAY%C|$yuAX2kg9^r9{k7 zSiG1{+l5p%?pQR0Kp3)?H7Cz&tQjkn_JwsfCuhx>o&96kMCYKL4f80Xym~6SdDD%j zvgUx5%IDJ7Sn@F38rDY-KG)(?gzz~=z9v!bT|;(aIOn8-WHgzd)mGM7XAe?W`LXh1 zR?_bbvwzGj*qKrvU+Z=Mp1hT@N1gmIO;q|(jlVJv(l6`g|Lla5w3iiA=>m-~SxnGp z;M3MeIMi)-lIcc#m-Cko>+;!5$g58m`3PZZbc6bBTftBI?E^Ti{P{E3) zz0QxH-T19eH&!aD?R7m4S$SK{ESb}(IDc>Fmru*xYTt+%$wl&!RAeM#MG6rcv;38Z znTQjKLPE7^-Q$Xaw?Uxx+A*8RqY4!n%O^$uP+y zqZtyus|9fe1#!CMI8jkz<@uiT8rH)TME~eyqMuqWPcYh|iw#|y*~lPO{MxmwTZroB z@~G6QQfrOIoBHE(!qTlE95QYYIn@6(Q%rp#GDKsc7exALwyS)KE}Im+o;X-B!^(K) z#cTIw3wAzhrAx!L7qyO7>oZm9>$VD3XQCh)oeZpA3Qws?UseCF-yTr=R;J2l#3tuy z3b4PJ%Q^W#R+H%&NhNK^4V&lG^oCT<36zk|=E}z_#Do>7AI+x68XU~qgQ(y^dYaU) zsIMM}5!|c#sq0r`PO(so+p%QMFZ0uyD<@yhK%iliYOqQD#w&N%>w{(4R6Wh5ud2_4 z63=W-UdkD!+w`vK^OWbjl^aSW+#V~FN>}P*M zE#OES8e(_>iCvK(7TuSxwrW!fr<5{T5t+orIG4>Z|ac+S;`Vx+s zWcaKXK4|u;t6{jt<7nPWrh>s?MU5Ok&%wI3EYoE}ai5iw@ecJ{54ok{Xm&nLJA;F% z>|iKo>8_-!LH(@X6**yb73{Q~8*;K^#X>5bD$u54EX>m^J*mAgl}gplXOk+wvPKef zWgrULLv4GSl)Oxks5dv4U&h1rz2*68QqKC`%4x9K^>1f_^{|^_hecLD;V{$eywT<4 z?LJ4(^PaFK^}c=u_0~h5owrg3&@`)?c!%VA&{}GZw5{1}wn& zES0Z{ele-~8n(wOw=DI(beZC?IhTl~tztGYl#DS}6xevP0-af+Y_k3KY5lR&b!~ql zlzruJ%%xe{bWqvPmq_>=!f(TITg!6Q8RB`@%R%qsGd`40VtR`?=%`KV4fW*eoo3O$ zCy^hiiH)pu)Aq))BHOsZVMo5--_LPRr}Ue!{j&GUAydlA#)|P2XGw)ILXD*4Oh@A9BkS^p^~26Wur<@}Z!wtb zePJfs`8q-M^odE8Z+WK5a^a<`VfmB|>}A75g3{4@7=f@R_Z>uz?lZ4~9IME(DUc)Q zdtv<~(oQj%bXe7~8?0+Z#<5+lk1i3@jTqBEf;97TJ{ZPB&#gSBQ=jd}6M%l2*RU$>bc@j+J&rNZPvQ(&z18$gmt+W)E2-DJQ>1pQ{Ag z+xZa@tXj^FnA;6=FT=d-AEi|kRW$qRX%%&+_6c^7yHN%T{C1)`6i^ks^PCiFLbhDX znTnDVXeOe2y-Gh0+JM?q6brkqUe`VM@9@-xqjm}?^bj(lHaLA1|n zUv<`5lNx7}cE;&Im*Hr5Fle&6!9MKk!CyDbS%$gwAJu5{DmvVJqZREm!5Lo$wKv<~ zh@(LP(?DH97j(nr_$cC(jKl9V3X%N32q?d107W4G`WxK z4LWX`<05y+84X%b(|VvaGEnzeMIB8V>*_;Z`%9fEO7TW^stS20ZHDE2Xyb5ei}}P5 z7pB|^_w(w?_o54<3G=;G3X^tyVZ(O)DsCpERn)E?K}kT9>tL51r|e+a68w$GYEbTL zhq!FjUtnRJaYZ+3wjBjqVKp;T?fFL4JlDsaB(t+vaC*2rHncn|msD7!@7pllJPT;( zZg$)8;vinsqw+<4KHRWA8;?^HC@ki?6*EHZfqZ@MW!pu}PW8eq*Vkq?F~8K65WPq; za;$tcT5qoOcVNs_vWzbsdWM{W+dn7!LUDW=ac ztz#Ck5d|($sd1{~No?Kr8=OzotgnMDDDOViBEpC3Cx1US7Otn+OfOg|X1fmV9c~^| zM^yL^{gu|;r2u&3Bk~)juTSqxwFiqWFIC?DaG0*@bzSLtrK((K2CKScjLBXO%<9BH z(Yh`Op_8pP`|BKTYdvI`#~bDc|3M9+fmT#m_0219uf7(4v|)Cz+R$p{LSsR6;V!6_ zuZ@y>pReTJy9+6)*1!H~N-j;X_S~v!UZ}q>#DxvZ+g1&Bk-g@uzU#5&ktsCe%66lN z=r)Ee|Eg7+-a;?3FQ3*+4sRTjHFA=5wbb$`f6L~&h0R2_wHh>k^C9%yIo#TMfV{lR z&(9^VZhq)ur3~?RqtsmFr)G;zNju+l$2m{G(t3o9ZLg%SiM}C<#{9y&wQaBJ{N+TUwYR;9aw%@6AnRD-#H#QcL{-fNgw8Ff{V293P3 zV(Nx2R}E#+KEN*(9NkhsvN7tsh*l%|jNF-&ThF2cjbfjV3{NhY6jp8`uV*1G9_i8X z$kU>3i-i=KDM?`gbRLR4iez1c-`Ly#}S$@8MZ=5S#DV$<2y{J!Ge4 z`?t&=2m3s7n^p3c=Z%n)d0olO(>SpZGauPU_T*da&n?#Xn!>sW*3(=twmUM;h#hn7 ztiECqrYl#-Z1(jy>L;elCrSB@@Lp%Wq8MchAh&Sw5^F&A?Q>=3=>GbBU>INUL@`$g z_A_LB=hHI3T&^$FH4orD(30q0yh0Rzp`6-u=k0`@8nN}g5T%bL`}D%Shv$LvuwYQ0 zVae7wlLcp{>bMGdb>>rjv$>;4h>nB~0@$UO#LDOO^3}VhlPe-=cImn8AUmW=zsm~j zWjBCmd>JY^oQ%!8DRaP#dv%0ck@h3)IpHfbA?V(JJ zgZ$Fr{>B6yLB8Eyqoms6}OoTA-rsWr<=jsOQnJ;Jr0|aQ}DE+8pybk#`@9 zcvccmy-ie$)XV;&SIBaxD0!1rx{TkO`IcNd`o^7%LU})@y4{5Fr{wat9kVvme`!H} zyRXm>^2My_j=9`imyGWxUp4NQo8Fj`D~zgD-1*45x7MHNb4h13%Uy6^v8(Sd)4jTX zo$cm$obDIA==)_2mS+NPUUW>^H>|Xm=LfQF=)XS@cRsp5*Q8rc5ej-7*Y#iFF8ZQ> zgU>7_S6%IiYuTpECCWTbPVDMckF20%(IQLZ&E{h7L1#3^L&Fv-wDv)1fySA`K211z z3o3{6$w-GZ?2L*gIXL0Lr@2{09f{FJD*Z}k$2X9kusSQBQ_Ch2nzY<6@>{Q84if~B ztm${^p?mqeVV(0O74g-X4_rMsv&$Sj_bz|6>(|$CS5MitS7&xi23lX;)UhbFw=hfx z9{kH(zI#=B@ZN#pRu#@$)X2LoKipozP_F0B0YX){@coq^t|~r%)m8KV2pYZf(UPkA zU)B2(U#|(%=f4+G-v1w{eg9G2{=;H-{r47r`nBE@%FPsfdwCySRvzSQeXm$m+3WWX zVz2vAC`Tr=()$H*mve$pX->;6n?o*3IT38OReD6)iF8{N#BAjf6dTpipKAP{p zsvIir|A?2W^p)zXDqO|=0|{5v-@N`_x(DFxBbDXPyKg|as&TOVykEq6|L-F#m$LI{ z?X35K%H-Cz5C6)b+{-N!6X;*z|3R2wJoWz_N_GDU-)DNssQ&*a)$cB=^XZq5en+V# zXgxVhpjVHVPA`{PG9wV4}G6gHGXeh@c`Qtv6cQS(=6|w z%}Of?BKwAXT2N|_p4_C~;ZN!dnbiID2U-b7uG!(3l}!3GuIyWd#TTr{hPh&7r(-N6 Qd0wBiI}*8KhAYnh57tadaR2}S literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/EscrowSecurityAlert.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/EscrowSecurityAlert.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..dd490b7af64a9dac76a565a1dfe20afeee1baedf GIT binary patch literal 5373 zcmbW5X>c4z702Iol)XAL2*oM%ds)>AtG#oO=4zedUuDNogR8- zR+1AO9OEQ7hY43g2uC==ZH{moFlPv-E#M1OQ9w~tK~<{wz)^gP_`jan-C0St1GBaB zQ@?)wy8HF(*S#Y86`e;XXMBD}-_x=O=mEL|-%KMRNe;b{ZlgEQUfM&iqutY5z82-l zwrmG&)1MubeWv%rnx(dOr}j$7E}@ItHIuN}{aJy!PCr@8Wo>;fbM2CXgtBMJW9Cvw zX{n(#=w(F9=@ik5N6b?!KR=iEA2rzmEjj{TO4NThcp1p@%OO8tUcvQC#?6&Qdk4=& zX%&&-m?!Dw;BA?m-aVj2)VmwB!BKD!+zDPqbneaI)hIJpgImmN=vvs{Xs%)E@q)c; z&Fg4L_xlQ_mV>?5q22Z1Ah;GRfj59xfa}2J;48t!;EiBExE{O!+yKr4H-f$3Fld0A zz~_ufx(W0Cx3QVF5Z%)Yzk&VF8n2?QME7zT?ENeBUJd>kyczrh2>;Ca9k`w7@Eqvv z0MDVF+HWU}5qeENeh}+0Nw;8L$Bj|^#q;7dr2ePSeizXN$1-~ddmvAUG;bwZY|!hu z-2VjXTk_NKcC<5TpVohL7X32pO-;GvL674AG>$?~=ynyVq91MtqTd?%C?7!?H0}f6 z1Rgd{Q5`%42H-)+8{h#j1n&e}hr{ct~1j|bHAe-PyPKLj2EkAjE6cYy4-htbc} z)H~^2x!*zU_jhZ*zlYw7akJk+4D}IupYG>TrtSwcRvVAe<68cHrj~=om1y??a5?xv zkp1%^a54B{Z~%M)TnK&yoDY5!oCkhP_cuu&NB`%c{3J-=CqQ10PeSiG`V<}0>+os% zOx`c3Z z@bBQ)L5`78~APTFW`5;KY=H}KZ4%{e-9#F^nUt2(SqO7 z59o*ad_k0dL{I1Q1{eH>o}nLW`7`vB+z%l1e#&;V|62Bbjxw+BFF@W$zXUlBPLe@$ zh#v!=j2g7gc-VN{c+z;<__gs5qhc;&u`3&v6GegGcPVy4uPnzcB^<9bru;-e1@1nR z9=(L??MV4eClR(tT)QUYB+h!bi7uK^9}Cs=T@iBy(R_Y&wU3lcq$`6=;li2qP8^SU zGyAP7nMOEsFn4=&B2GlZ-sYE;qbBT;Y4}Z0A0#76dZ~-K^3$jFH;JYQWF!=y6b1Lj!cF1O2}_K-B1(K2S``?JEvFpI zAWcLma*|r+c^L*12)FL``O=7S7)qRSz)Pc__55!8uQ1Ne+(ktw5yIoPwIz^cCm2y} zkrf4gjBH3R!gsnq*mO3pG*)(8bCkfHhV{4{_{i$CK$nYt^2&DNH^hD!@*r=RQJ?#< zHNIgPR{UzJ9QF!as{LY*q~*YOw}uso_WZ2p*O}%y?6@^du@lnU^?Gd)apD9?d!9F) z%}&8N1!Ltj2t?wCW$7rdZ49=MHu>qfgBF^$8JWuT&8F#?i78O#zZAF~4Dqc(>Y2;T z5lDqu!Iv4DF5WTp8m2VMun?eZLnt9ca9!#|N6 z6Dp8ZD{#`#t$CN9tzE$%tlGUFJMo5_3F4v{2h-Mho2GKivhl)p8C!q_T*kxuF0=25c;BGTYn^%Lezsz#B1#R} z6jm%kkDGMH6(tQ^W3FK#;?vUc=^=)irfn}F1ZZMTn9-`iA*X^6LOgZKeFHi#clv7` z4N-#Bq@PPN^eidb&5g$PA{rPR>bnrxpY=L+W{z74SNKh#*A=Qg*OGlT%^v#*cHTuE zc8D~`?Go{@?Y>ns7tUJ2QTaNTZIjv&lyjCK2G6Ow( z$%YG-l09ELcC$H(<{dDIKnmSW(he!BB{h&UxjB9v$S?_Xu}?7zrBt6 zZX~m0?6z>Tx2EAVw{~~ShRF@$<8Cn?h0|OVTCgB zEBVy-xo|AUIzKPvSH}TPwW>rFR|6fKsJghjKFb9d3%nVf?mT3ovQHM;^AoFX2ho>&L4d`>Xy^|x-uq z#Js&*HZoT$Ydmt%W}v%Wc8FE;O9WJ=tyA~Cz;hA@(`x#jP~Fp^rLfy^gP)`!=AK|w z>2VtI zIc>QSR@0l-4nxV>>GkhA_f;C&2pcrwuJ|6?ecs|6xAV(~9ZR>)3Pks3=s8UG5ZP;< z-w`mF9|0DQfF7MMr(eJlB((^~Nq}UR>WfwlNv(v_$!<`ehl|v}pk*Y)DB0sLExjns!X7p`L)!U;a` yx(}f1|IdC}zxVWh3PoZCept60&&%`r$}YRDbG$B8C;|%?5Ty|GB{xbr%Ki(W43SL$ literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/IMDPersistenceAgent.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/IMDPersistenceAgent.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..5d8170a6beafb124e9468d2536c0b4db149ba8f7 GIT binary patch literal 6325 zcmbW5Ym^*C702)Nm?c>Sc^Hxq*u)To7^izfB(ek~%i_j_L>4wgglO#Pu9<1KUsm_b z?k4z1G(kmt1mXixqp0{mMMXhTqftRc@r@wHB#TFnhYy^C4?g4^*Z-~VnV!e)CZ^}i z{I;rY-Kx5E>(=chdWz=I;f~Lr>9?xxcDkK*$~$Dbd*)hnWiADNScRJqI;|Ss#DLY?M|IesgWyHr1K=v~ zKJXPpC*2EPj54ziyhpo)E`|QPwbe|eAMDzvT}GFyabL+)^TI0)9jwV(uF4UT~8z!JC~w7{#tt>6Z53%C(>*rdINt|r=j66_An zTdxh#HAFXa8SEN_+_hjoI1F9}!Va@82CpO9)djiD;4FGA*Y}*GT~Dt|*8^f7C+G&$ zFVJqpU%XEC0Xl6i`oA9IoeaJK<=Khe9nVAib|OWS=$srCxjgS^ZlY0NZ*ONA{qj^% z^3P5oKLUM|lP-CX(=ZD#_YcVVs$W1M#^HV-#(gtMl>dq{n4172@KEju#o$4(3OGl>0Rl3L6qN3??IXE1}gu(1>A@7d%-)vTOl_Kc6cAi_IN+)Z$teD zRQn$KppxH%IK$`THl`XERO{Xg^143+9t1xO9s)lCvb{bEy_1u7(8p4HgUa4_DtmvN zK7skMy+JJXlk_Py&OW9Z2h5G-K24ud^>;B6cI zoCV$wo(?_$^8S4r?Wg9xL;KafJxJe8=MSoL@jcWp(7w;-0qfe&#JE48AEoU-RQ(Qc zS*;t)b?1Ie52x)vQSA?LS+#??E{ywAFbDn&WPkiQ_90J)=@F36*Dp~2UySxk@F@5w z_#F5v@SotX!DqqWfX{$9*Xlg}j%fbV^n3b4x?T|F$LNpgy21H>qbKNbRsRJ2DYXL# zxhGkVvRhr>L6q4~{sQtjJOr{o9i|-3B7SoCBvhcCxw~>t=l+u;ZK<|GyGDCNOX?Rh ztiaRFFmwg~79!KPi@}&Kg=rT?r4tK?!0a>0(dpc7gwm;*u`onz8I>T4qhuBa(cF&q zNXVLF34{iI&g7q#{-F%wzzW<%;Ec|8Gm1v-&T-2!sD`)$VFP1$Jc@;9Y;cOwl;g%w zGQB}*dSWz?BT&uj>X2&^zzvD^`nqbSG`yhbxWc&J3T$yj)p6q?8Q4_|Yvrd~$zLgI z!VN+pX*J53c_U#}VbF11j9DU#oxs;iP!{QCF$&yjEDE6+R}#wyzRO{-wST%bVhoC6 zv*_~HsAmoTPBqVL?V=>4@L_R7U+V@%(;bqHDm`?aD29p`;@fTyR-LS?8c8Fnm{QPe zCC6pgDdO+>s@!ZRyJ*CYC$tZE1U5aqYi0?p7uO=^x-(@ZVa1j_uE z1UG^{zGc+f+G1@8wL&Z5%k(u1zY*j-EzpY4;G%4xHb9Mzejz?wr_V85>K24bu5i#P zUZz6dN}k1W*e47|g@hOCu37c1ihcgE`Zd{uMO))!7O#*&@RQ#=qa9k;w*d<%!UAlg zajbVbt4v`B^z>lK2)~iCAqtIR~O5c^@~8~;z7Om3)C(ZAJ?V=qMAqK^7B ze%Jkbc;hfc_|2xRf1BKfpd1+x-sqHZ76N3p>RENHe$)7UIxOB*@ffzK89rPX>3pMX z$I`S!MYw#8G|6of5{K^j4LONBA@E+%DC4Md1()$~+)nhHBHG%k?#0Z`X}s1Wvm^>$ zP!oD2e4D#u^9o~cjQGuspS-U8$A+)hG{fj29Hbb|5ialTGfQxFY-(2SUa0Q%Y`l7E z5yrUM)Uz}}zNcAlsx&grriHzI-De~MaG3R^%;dn@@co> z+krM_6o{v7bT6klFxC>D52CIslK3=;>v^3Yi!xu^*CA&aa2?^t{07@JpDFy+2}Yc_ zP(_b|rMdvfSXezj^Y}-NbCnn$=7`*+98DZFLf4E-f%FQ<$`EZ;1mSCp;Rm&01i`{w6t33#lRpr#%9tiHe}ST&J$8Te)7xEqbWYZ_7xQ~Eksw2#vElM zXw+4dO!6J#^}-b^p6&;+Q%aY<)q>&qEb#Lp{>cnrmdjF@GWkd)_|v;da?U#BIn7HvN%?8kjuR>*XF6Df z43H~FjT)@g7Z$hi6!`t3X&!b}#3Oz%iq*p`x(T@&0tV5^t#WRZuDiFjp6ySLTdAY8ts9OVrFpRx zVmIx!ewa#PXccE$@-A8R4Y&K>lq$(+ejoA_UgtMbq73RgeZ)7%o!!W zPi6Zx{Wd4lPVbv(Ib&5 zMlKN%!2?B9P*GIyKt)jw0YOm|MG-_r1VKeX5m4}e-}_Z{PaiY8*$n)7p8w?8c~jL@ z)zx);_0?C^HA=lHv8UQQ5&gGE;`ed!YmK+Y=ksl@e$SR zpM}T3Kf^b}r{EI!IBbWH!lm#L*a07col4ETAIkIG2bbe7_gMk&fyY9*-%2RYdmOwI z_wn#HxC-73SHqj&8h9gI3%?AzpydAqcs=fQQ1a0YuY>EM3z71XoZFnB+fm>h-o(qe_QEpk zg9X?RGcW^t;pwmk4!}(?3*QQJ@FbXr>tO+Q!6IA*&w$b%N>JKE8A^MoKxq$EDD7bo zN_!ZB(jGQLX%E9t+QXSp>isMz_5F4z_5BVg^?f#!`aTC93*QN)p0`lXOW?cQ`aT!` zqi~-G51)3v^o!Yxrd<&1A6w?&dN=KTw`qGPE>fy>XTrY+&VU!=KLx&5sg~{GC2%r) zAN~{Ir7#ZP4_}$8+t(K9N0+<(XnsOX_&5F^RBHT-@Iy*nFq?k)VWln^EE{&4)~iT8Qm7Tn8m z-wKz)+u$+qc6bE*E<6n00T;nLVH>;)E`Z;I^WfcZ4!j4>g5QTb!5_e>@Lo6x{t!-p zKY|H(AADuX{KSvpOYkS~d3Zm37XB3e1^x{F2|fUyfIo-7gTH`}zz5+k;4k4%;Y09; z@L_m2{1vZm!aR1hAH;;1tM%=%HH^9f>=i%?+weWFx4SWJ#1^)oA zfKS2?z^CA)@Q?64@K5l3_-A+yd>Wnw{{jc$UttkG15by~!W8@)JPrOGo(P|V>)=1& zYWO@{G35pIPukm(DK83jdxPVT=K8!GFU8;D6wJ_+K~&{txZ~UxCx% zt8fxjG3pD(U>wHbtJ}{{B;bGGcJL)Q4!#J-!{^`x_*Xa){t>poCtxdl6i$K#_;I)^{3x6S zKLmG!m&4uRC2$Y;Za5pB2Pw?)?}T&V+u@#Y814lJ;oh(a=fTtAe3*uBf^UQSz*FG9 za3fp*yWoCsHQXN_3lD(HU>jTllkiAr!9(FfxDXx)_lJw%KJXwo4;~EnfQP`D@K87d z9tJ1F!(j_t3={AO_{wC)e<dw1$Hvr!;)dgYM7Wjk9(WwQ9Uc$A4Uxa+&m!E~m>PEj z?lm!W{;tM-{w}HueNfH5c=8FcburVv;Vi}V?wFc=;pFw`lHxD=pPGIy@i)fQ^mE{e z@a^ym({2}+bI(7~2O}HWMPsKh>_#L<}#QmArwOn7yb%^`3 zvFmUjiTiVK5yXxE=VM>Qy&vu`z&#;u{I8FF3HPqJZ-CPvZp!b=x;~`*yyyNZ*T><$ z5x&yO_z$H#zYbr({SBSoO|fsf*M(2x|1J0!ycs?OzYQON-+@vOx4<9bzE#J+Eq1$m zU3e${--WlpJ9uuH7u|{bK-_o11@L=tFL*cH1KtC7g5QVJ;SY#6jd=Isez}G5AHD#8 z1fPNT!KdJl;qT#3;KT5K_yGJV@uw31XSi?1{Q&MMxPOlOgSdYI-v=Lr7r|e`bKyg@ zzq8=OxHq@_D)t*!ZajkAxOnof#XU#nXK>5*)cir*3>iu~r_5Om6|6=T)?scKm`@i73NarQuPbB`! zxKG3VZ`>1b{|EOGxc>{2@PBZhiLb;|T+Q4Y_p6lOY=}EHb7CyM9sbjC$Kz`Dq=^Y} z>+*xK1pedVYRh=i9gq9T35@@Qm-rL$ABTSn{`cUI{EB@SPIBFop_DI^Y+c?{pp^eq zDCIqk_)^}}oRD{h&`&%!+! z_ij+?X?G~~LZZ4}W<#m3IZ*0nE|mJ%6UK?R7kqg<&jF=A=0T~C`B3WXO;GA(A1L*( zFZ>(f7r>|Beo*RVfAS;sascjMDw6)+8tg{Q)m@C0}qTmg@VN5NI_ zu<@(oYe?@P+%UEuTnnXLbwO!QC%}35uOpm1cQ=&wwI2UjxHrJ*a3kd>{rW`QzaGc< z4}S*V0)GHchPS~};LY%@@JsMi_!)Q_yb^AL?}u-L7eE`H4SV1qOu-yX!!&f@$*>om z0Q=yvupcgg8F(l>9qtDQ;GQrGcY!%L1?J&6Sb(o=$M_Hb3D1Dfz!Lm3EW;;Y1)fSf zuEK|K55k|oA$Skm3~z4V3ZdQ}7R@_i5rQ;(rFWj7!%-8IL{-Wjy*El=0{~ zDEiswp^QskfOio8i|}@MJ-ij(0KW~tM7#b5{4%@&eg(=n_EoNbF>z!3oAlRVn^K4Um)r3l-OCP$M~<^GZVYumi_~YKP$1T_Mes54S(rRka)XGy=r~L ztKZqUrG3tUGQXJ%rTy*+rTy*&rCslxV8W{8gW}{;L*1QtYTS+!7EahQ;YSmmnXr7~ z=@T!R_~67hwH(vpv|QP8dy8s4taat2fl1d)`s$?TCjEEP<&!@-`Nqk=oV;@CFQz^{ zb?&sIr<-)<3Q~n!(k>RWPBLGvma=81T+S5o>14^V(}jF?m>|1{!<|vhqz1Bu!ay*L z1lcVdF6X2(cG)QnIwh0bo?E%zHdM+~99iSw6U|qpP_p}+q_er=PBQGeYomxt2z_v2*p@o)QTp)>F-9ok}L(Q?O|OUSg!RD}N22Z?&`-rA&EM%O$JalgV4X zcBWL!+QaF2BgON|WjP_c2r2pHbC7(E;rToIozy_FkjcA`+_|-Qjh}aooiD6&`Y5x~ zaPV=JwELLVJzTChxmq1|nP#@UWapfrLTP}eBJH>?Tp)n-i-zTPQmT-4mR2*_3XLIM zP0?oM)2hRFI)hHOP;^S_NZfv1mz`9V{x(dPN;ySoNlD#~l6FtIkgZmnwxV6>*FC7s z2!cJr@!c-wY$lf|f3wcQ#%e8#4cw1+yUE@}~7%#;$@xizquf!eP^1l*X4fFi<;hT=njd$Ve#C!P@ z=Hn^8%Y@6t3-KOO$l|u}E#Q+RUXg#|mu#^LsaD{`t|CqkH*E_+xETSp+~I*m9*o+K8@I#Y-!|h2XX0;>i zGbt@POfykaYW~j3e8nl{?X28U&D8$2_EQ&gj=mnOuWX^OY;~0Ea{oG~SSXQ}q;rgX zh5BJJATUfj35hhq)&xr631T`OrIy#F7m<&R%VU*Y&8PaiUC|v#_t@sr8!l8U)gGtU z>%p}YS2UMinIX>UVO$+>9J*^QIn~}|dWC8}EhXutw5qvuf|ZeGWRxE1B`GPY<6d*R zZDq-;*IM7)TzZ)^P!K#BE=e?5ZYhV+w34y2-a|H7pIWP`40^hPmzq*bn|nUHudn3v zQ32jy+GIJo!>OO2W}h#WqSh*9r@|oL=T#oh)}+1=k{f>RlsdY(@@h|`7X;I3a$Gl} zN#sVbQF;WdCE}?5-ANSaVBfeRKK96b3Stf8@44KzlbV~d&T}j zez;o6WHS}oRFdgfmZ>VW=jZbE81Ivz@xH!2jq==nesf-?nj9aHpBq*NpR37qHmsCp z5t!dLDbL$e%%95{X8JNK3#8Yiyy`%mTwTx;JCj(G?X;W8TBw~KPWu{FE_Foh3L936 z5U7@y+A<+HY@6e+OcnBFovJkL`f+^ha-cGlsnCCe#oIt%8GCxYc1r8)!368;f9&aH zGx-6mAo*Z=_4A#vr&rG8?I9=AQwStjKMxptdfuRp)c~mwQ2MABW9JCY2P6G>c>#4% zsV3)J%W{R&GhGd4hV|n@7&m#;_t59Y0*Bw&U0&nb)S4WPF9Tr}U6cws9&Lb@(iiuWhgY0cSXD z;;irgW2*N&_QN90yF8pv)pQ=olD3Bj8t&#|Dw);BjC2xvK?Q@OT@3W^Ci}x`ZTxL7 zGodqyiCx>R` zEk0)`G~z})cRot=$TIEx>G@GgPWLz z?MY{-dAk!&Gnh#`wV}FM`xWWvHtrS0Ye>hgGHvqGsn@&4B-iZ0-iBrhy{_ojPbyoe zrqcyxiP%|mt%w}k=KAQ6WI9R4a+fl#lB`Sm_o3&8mj_jNUBhb>vSt}-9=r<{%}v~($cBlSA&M60V`6laAw=L6~ zLerFH?V6?$Wr_uF&}%YZL80I^S!zrvGhdO;TU+0#SxNlmHEW%nwo4s_T(MAgk~OP7 z@wezy6mK-WL5ogV)#^kSoyfyF$;W7NGN3R9)P+vFVw<^Ta;ejA4`vFbwR*kJ)7}q` z>jz|Kp!JEEH7;hI_eMQvRkh}$4?0>IkG{IrSV3&Ku%{KmA(jm@tiG|(=dbU*mgPN9 z7nN1VrZZ!`KNfFm;k)&s*z1+C4piS%yq_nPWzTLDV_D=Z<5Qpv#IM2PXSj^4{o>aA zc)V>VRPxrn;|us}QqN6e`fjUVHBgEj?ebwKy!Ah2ZF!>_VM(54 zJDr|tpEM-i2$WCauGdhcBXncyy{ciCX&gKxUK++*ruQP8PAxS|q4jKekb~uGH2HtL zI}^25$@HVP0O0M1;f+xFB(8n^%cJ2#Nta0TNH+gc{1fR@#%;D-WN3)PTEJEDk=+%k zu((r)lG%ps!dw5Sn-_RfakH`E0OI?4pKF&&`ttzPtBRe;JEb=EYi%A@`-H;#;cD}R zS_A^}k@QE+pP3%c^^`<+yM?xs`T2_KqqXg55&hWHM$<_;k1QNCxc^A{s24+LTb(Qz ztsT{sYeSV(FN6%**_2p&OK38Sv(E^SVN9Cyv#l;vIU6jtqxl zj4C22OEgZ|Eo9Ljh0<)<{KNl6#&>90n#YyGWhCnuhEP{*j=6l2ej{mE0kttyO5GH_ zE}2{0^110XluuY=Xf#k{;_Dgqq!7w_P?18DZB#39ZJ;1m#h23W`^KbOe2tOM`kHEK zy;c_k53t--!!}tmz%WKD_4M4`T>WCFnDw65P&5rC^azg`9IrFF zWu?PHuK5(!MsV^dd=tf;NpzdP8R#Ij&uZV{SuElQTpVC~9D_p}Yk7P8kd zy>fp}slBCLk1DrJ{#K7M+!&tY^g^|^9ZoHA=SfGztq;enS#Mk`lHGu>`(!2D!<(BE z>>RVEGh5M$>r~#>oEjT@dw#tX=gVS7alUjL?j7Bi`Nk^FBkFNR-}R-w>0Mf~Z<193 zBiGgcBl+HfxOR8GwjkHbNQ@GCnM_oS-X;?W*|RD&H^l#?S=#uFZT@&8GJYqup!F;2 zO!FL^EHn1j60Nat>uoeXg*uH@bnh;<-nslW)Y}5{4bjy^-fS(LOh{&r9Y7;q2UQWoD+=bBk z{q2$GZfuvei)@W_*KzfIw_?}8KAq98_ADAHf06d<_dOF;_T4pnu3EfC?-h+A2mN?j zFHCMNecew&+kEwNpQFDOCx|uQVz;HU^di+{EURb^#gp#Dtp2?u>#>CO<%D%+!a5;g z?U1k@id$F3t)aMeY}}d|x1NnzcgHZ1TTaYc60;`7tVfh}vlwx=y454x-w~R1Fa2OT zO&ej{`o+dpz7g#OBSkRwuY#U~iHSI5`W-n^h6XAx9@+8XkpuNHI?K$vk6>b;NRJ%U zd#|a2l~^)Ss%^q4j}%F)cJeBe%o@d#mmN8vnN-${ej^2x^%fcU+QwQABTQaLNCy^ymVS*W9FBhwv}O2e^;>G5eRi!J>ii zvI0VqI3j1mawsyM>T#sKQ*>`_^NH9UUPF9sXP7&d`x9oX`-Ml&XUMLw)%ET=dsopZ zVjK*-1ne!PNX|#LyEM|9Eu%&oG4Iwx3`eqB0D_XO&Sc1?k0^x#*|K@m=bXe`-bY;LD25GvU|h2RZDF~X4&sB>hp}2 z4pFzN&-#jGFavtgN%|wNlt>O#{d*pfe%vq}v#v6h{CDS3p;;XC)>W?4cU6f`y#_t< zjj;q7h4UcE?`V2nw>`+qIU#|`HhM?)U5*;h)UTT1+Pk+$ReB9YvMs80`$(f{SnYb< z^~HvI+y>Snj%Q4Z&hfVT9z~P=g(Nh}e%x&yhqjWQr!tLs-NmH0C-6n9x9(lGd!4piVbDpIoxHYO_~luwT*>&9sfS{&sB0#PG->2=g>5q2O9%mS<6q6s=OX0 z=c+8{PYyolljATpuw%L-n_>5*ZYTcz8rU!Oo1AS`Vzi}n6u|Bl_p!~nF#0}g+Shb0 zU%x7lwuISTzE-Yn-`Fm@Y$XRJd7UT{%AAX#!@0BYEW1nnTq?DrmkviYu;n{+O)k~$ zvr%>zk9;59AtgVqkc%edrqkIqw)}Q>jh^4mt`YJp_H>??>zT3~{4!FG-TZcTjgVhm zF6($fqO*`=9XR?p{Hg;VD%jo3pXNjsr?kmCL}uk$Uh50R*nP&|Jr3eGOl7qonH!*^GEa{7%luE=>CUU+%w&Pj*wr0*ZPk3V)|E}IZwj<>|Ci_flm1=#ninm!CF(--qEVp*cEwm90d21`{ za3Xm-_8fNUtwwd}1?jaF;b=u2xMx3YMmR%6rES> z*ujG5zzHX9-fEI>HY3R@jCmg>5Ki8IO3D|fT(Ch<4pGuEQ4El3o+t72J^;UB%~3OY zdY0_YaE7o>H_wxrjmU#~X_5>Gxe`{D;!UUzb-`mBY3i^D_OiL6Yp^zyp(>mKT0JUB(@S z;&5{9`gRE+dPgAtU4VHWE2IO3-hIM>8Zr)^F_kaYNHdvqWiFQAp= zb!OfZC>8W;VVrg5mV|`YaySq^oiWcP?_CA*)nlgy%nN$~nZe4SU6%brXh*tei6ZZf zG>pf7x70u;FY81Nub1^vUm}v&=PbvDNI<0`_2}nApZ`^4=r^G$DA%H3;_30ie=e#2 zQi?~5)Q9-zWXEhWRn+}!u0#*VGuK66+OnZGt+S@>b6X3SEx4iU`k#N_Av!u|=akcC z+}7iGqjdFKPG?k|s*$*n_MqGMaIUA|t)-Y+tm_}ObK$gH^Y2sh_g*A&+yo-!m}U8m zS1Ie-S`9B0)6sNFk^32=MzX-^dx+3L|BIBr8?NlGMpyM}v?MqyTu-JE zBzv+|r^1-nuh%03^%%XLM4sD~ig^}EDpH?~!WT0|rxsyB5`Ov0D*i~&Xkwg@zUob`t>v9aH?Oq$cs${(=npg8I_Wz63q2TJNH_d zY}##9A9iKXY@9J~l+_+HIxh9f%3P^1lr)0^r+GOUW-UFm^CTsuG2VO_oDVM7Gyligf6KTi6aQVWJ%nS%Y+Zo+@DXR z-HQfdhQD$#BiAG47`Tp>)lcg#RP|hRt_1e$#SiD|RG!Gv^94U#Uy)ZEb8I(f4`fOt zb)?=?gSoPFj;P*J9?lgjg{s3wf`9ObzEdXO~h~ z<6Jw1Uw-bprfCiqHuVu{Ki>7oJgpoUeq^dpE%(@^a%DK{V7n@nWUqqUj88;AY#h;O zb2>_-znF7-{9DxId}MsDX5_psITW{A(l7XX`kY?J@}C#WkEfpo6iYqZ32Stbd<5b- zn~ND=gBVd?TwkcB`a7Mh*eiy+bdT^yDW%_24zy!m&$ROy(}xz;zCzWkbH!kE8uFBZp6+%50V-FsYeP zL&TB$@rme@q5AgkS{F`_^G2PiDcU-{i2UeiUx#VJDbZi$Gk{;^51`}#n9P_>Pf-#Ky-jed5YN*%W#R)f=o}3j2Fdh zmDhx%?G^`g&yLKS-E$xrB>VE5b1mnynUas_W3HYf$A1_B5os^J{-3Hch01Xr15@oZ zR!Z|&(RpF`Tnaht6x|ZDZFIgB4p*s^=Sq5hd7HBdv@P-knM>5_Euzmdx{LgBWp(>W zOPT*Il?wDC=yKbzvb}r#nt(~9gNAAzAtFD+>Gj#0leHdW9yp?BtjF%B&-6i2-<&}d zc$30Nefi-^X+7hPv>X3Ai=L$lhc3Gvaz?mZYT@*JxI0zK6nPNuVF^1o9NsO*4MtVN zj^_!&NPF?meP7>S&GqD&sh72085zfd{ZdLs4mIbL%3`tXcG8Ic6R5{-Gtfx>_(a>G z=yQ?==gI5q5q;Zlhju!bLD?Mny0qoG@goplt|Kb@9MooG%9I;M>eUaQvWqe{xWi<$ zz1N3x6{<)%_~8&k`Z#j^ly&-|A5O$f$;{y;XhdEG!{uxy0d;znXD@Iqp{8s{ncwSq zI~|Y{5;DviBJB?CCdv9z#);IM$f>Rp7rdNC^unGD$HP~crFip$$n~suaEqz+Iy;ZV z*Co|y%8OqZ-qoxJhu&zYVn-d2)!-Jr>rM74g*H01v{*-})j}>R zl8T?Mzwv~PBI{WpEn_Jyl#(m3mzpD|^x8Y*fEP8>y5sJxtTnn?e(?B?k^3Bni$7=fhOW$Y$>7{K^e)Dn^nTS-*4b zk2TFLtlvfYSsFXe025ZMN1V0FWD|n{3yn(Y^&G!`ut&*V>+Isvk3G?u%$BSC-%G>Q z$Xydhv_0s>%|7?X9B62fdJ6wOgBU=0EZs}PkE7?Ael|m|{JD!NCf^O)t2U~d`FBL$ zO7-f~&L|NvPLM=YUVGO)<3XgKR8nFD4xq>e5oR}nU2JxBuuX{0Z9O z+lxi9!bisAfc(*xg*0!W=+W^6T`HUp*f_sr*1XSU7O!L3o)3h=NjjJ}2GWJ0Ja!A-MVHSc{msuXyKEdU#~gi~Q!Zl2b2Zn9Jrg@uxrDhm zYQJ&qU-DYMd(N?YAFaQI@+Z&XzVTtzvZpRK;S=X8Yq7Ep;Y~F&e1)4Cl_uvPruC~> zo2`YqjajWp-kMHO(e=NEQDHH#h`;O~mzRI#02qF1LKYHpsx?gm-ECpg+N@d&a!1)* z%sQs*$`O6nZ=NHI3HLFhax@e{!bJ3eHG$tr(Mc@k+rOV@1`7NxiC79)1`}~%er6{4 zt0Z-Hhw$$_)Zf2D8)CXWEmuYRW58~xvlo57(7EdpBJzC5pDflPZCum|MDz*wQaK%w z|C~>5?ibO2=>6_tbLMhXKdIUCBKpZ_=Zx!=BJwtJzIB~lS_VdKnbmfj`tzrw{lc#< zCYCYyT>K;Rr}p4HPp(JoL!+K=E#V{O-odzQ z&QF$$d?NOH*`lG#BVw0mbbhOjAF+RVhn3WgU$ygb++i&8oI$&Q9>^l&YWSQ+?i?xa zw5@YfXMYtvL(j#c?KyCMpN<)6&k|413?k*gp1rzr>~#Ey-WNER&SWfd|Day01I&|e zzn#cy0H*Gv=bM@2qWz_2e>ozQ%-H3Q`!i)xye5cf-Y z?(d$|)o18M0ZBR{*Yxj_h`%o1fsW-}enqwChY|PQ!nXwC6Va=qzdIBizXHiMjK3^$ zj&^kYu)dz%Nn1odnt7p|+h}g1+im#wrSwlmIqNsd%9#5*R_M`es#-KQC8y0*a`s2b zarL+Up=7mcHg@Ro6YYy5o$>=o_Kvs)N3s9;;=$YZg#je*WRu<^LR*UEEzGn32b}p8 A+W-In literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MTLCompilerService.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MTLCompilerService.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..053fd5fa6f743a563d6dd38728c69a9ab1512ba1 GIT binary patch literal 5213 zcmbW5e~=VM702JqhD$h2G=^{>2nZyIxHFd!h!<4uARMA#E?^=i8tk3v-JRU*^w=}A zcLy)s>!9bH7H=Y4)nKQgl8beyK}mutk-qC<2W-AcF6>**lfM6aFG zazDzmUD;lGmHF(Y{4=*7)~t55d$liyY(1^(*380Y|7R`gdi~@r*L3x{%(bgZ63U-d zC+yXb(rU|S(DR92NN0%F9<$G|{E|XGbi`&0w6YCeK{OPBSAs0x0Qv3qi@1K3Z*MHy zJ9;5Xn~1D^_Gx+vxF@$WFb+CI13N$$+zt+d+rX=cF1!}J8fE5YaI<|4ZH0Zu-oiBF z1qU|R*V2gT_oYlD2M5-n-F4tfa2vQBd>Oa|d^vbA_zG|_xE-v3qu_t6SsDYM0(XG_ z0C!@ZPg>X0E}|0y@Dn)nxHV3@iSFVuIPe(sUJ3pg+ynj*gg+Mj9(*;?@kP+v3tm9` zjGsw*p z_cKjDptaTdAl+x=A7UCgXjRef!{B=GBj6hFqu@&LV<7wGesCH1ad0X432+JcN$^te zQ{YA5r%nH}^cjq&g7Rm(X?+PTczh2r z5w|bX*NXbDn08;~vKc>U{gb{<-z@4+n)+{W+0=v9-(lrj;FI7fkk`$(;ZI)w-vKWG zzYF;jsQ(`LH}L!5`GP3_jDB9s8(j7W zdW3#q#BnJ3T}?#f*VMG5rSPj$I!Gl{;O?i>qvvtG8|$DgQt8UnbDJtj zle~AA=<<2>iPY`DlL=Q4E#+5V`&g?~c`D2mE}LI3l4Q!C-)}>!EXG-axw{8ul2o?b zy+KV2J>yQ~!yDJ4C8w00glV4FJiU^_m8QNkueQ)`OVxrM)i#qL!#IOJy|{X*2h{ib75&{q2j; z$Y~f#MJ?pem}ivVUH_HF*_*qpOD!XK+;w(`swTn--4!`;7$nGY^c?)n^#_~I=anVe zO`1YW+*MeQ%VB_QP0LKV>?gnGra?;{R#A8TbjQc*qa_d@)G+Et6D) zY1dD?&S$6O+>)_c7KSnnqM8!g?;3-xqim0;a)g%Kt{vOj4(zrq?9`Sh^EVCd10(!3 zAocAv_5`HTuH%mx*&f~r^jfyEYp@Wa>_Vy_anLTthh@%UH>5#H5V9aZqjaO$qMLaX z&%i&invyzH4JQ;?b=WAE;2dnn)=iYi9LS28H(MjU&lkh&bd+xmYw1v~#tdCyI z{+E50XSl^|-1TMKjSwPSd%9&m)xwia8S-|fp59@pv8bNa)zjFUs`cz{8B37`T*kxu zC$}$Ta%kA(r`~vrb?qdgE~_oomQErgpPTghi__LL(KRf@I&sW8@e#|m?YgT73njH@ z?0D1gh^Ql!h-fw%{1GDxc#T2wvL1VGAR^Zf9lk3*5xm2Oq}3=BMzK};oH_@%JW zd^>r(<49lDvIZjOcM`J54ODI=7cN*$?o#8}ar*!^arJT(Zm`GlFW7rbBvLv0KDpcP|ZYC%fw2Ot#04N(K*b7dTq^scb}x(*A~Tn`X~@$PS!M zI7=k3=$KuepDUD~`AM_oL@EvH#ncaZa4fHNewOg77jV&NXxYFKZx$!2*7eu#m$B06 zPA!tAb0BDC@T@c?({0aAQ$!83uXJIE*LAOYfjG91m#d*tlUeM9$`fHV!YOXfD>SVv zCU+72>ntxF^PG2Gl4X18Rv#G^Fp94;cqH6h38;$IU5YTF#lLABaYT zi%{Sd^E7#~H&Gv_t`2HA`TaxX7$l=twM{DK{Z<-BVlFi24i|C$oUe}@+Q=hn)=RH{ z>;$R##Ka`D!rdV0N-)<*dR)gQ`94*$>t`~ZjMNln54Si1dTne>qKo_W!lan@aKGGB zT6QjgPMGla?AXX%t)1x@zy4@Nf4lt9Zxn|yROZB~|9tgDDln~f;7i><9a;^$JvRht z7GdrwM#YXWmssw2-o3X^kw?h)o{}N29^+D#z#|RLPDIPkQSS@cV$WXEU!Qu#LYXsf z?9?QSd2cyhjA;6E+F>ZUqfPw#&TpMXE|v`%aaVkw>_6Xee!9gW?k38^PiB7Z&QUo| z?g+VCo>>YXE>gII6kaj;Ztg`UMN*1!9E3<#nYpkuk(8=9UECH8`nZs+74_*!bDRU(V5ht48{&7sxl}n(J3NocXo6d@IMlo!H3a&hgT< zW-OZF1FQc4x$gh$r}MkZ?59YkP8dX!j_~~=FK_I#+c}3PrH*9i-~ypF7Jb!=GhSu? E1&`%d(EtDd literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MailCompositionService.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MailCompositionService.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..744e8be297989f3f70203b8ce8973305a8f7f8ec GIT binary patch literal 30901 zcmd6w37i~7xxl-7bM1sA0zx=qSR@JvI~_o7#cVbtuDO=oEFcK6XQp?z*_r8~duBI_ z0-~HMqN1Xpf{J*-Qw~uS1OY)5Lp*sZ9#0g(8x_xoy#H6-J>AnYdt?*+z0Pm9?VH9DZL5*~_ci0)>fTNIP5L(DMm>1$>95s$^^N*EeXaf~y+>cIpBO%g z!XJfuTRpbrdRF~gt}oX+`H6f*6rXRbr+!}juNr?X*AA+?w-IOKzXN#|rz7#bNIRhJ zU)=I^f9@;|?`pv{e^+grv7e^R@6bAUqAf6R!=<|}dZD=Y(*yTDnzl@P#L!;2aM2_3 zd{M{nHsi&bwrD?ydtvBrNoLVD<6uo&G6%i{>hKWw?80rvq44jp6Fvj8nzs12(8T=| zB%UQtEPSbU81Bd6;qWK$2>2L06913l4=(xk!lSgKLpNOV2=|Xs{m&23bWv~xk2>YRw<0kk9+yn6S@MJg+ zPk~imfxm;}+20CJ@7(!7rY4G0WZeiXW=Edg_pvc7hI;j zMbnnvxZuq~)qmiek1lwt_BQS>Sa`Wm-G_5NM7S&9)$r}`D)}bMP8?CVW3U6@CEr!w0Iz}?PKsD_=)g7q#Qn_eG)E%H-`7&oEMP4o8aE?zu+G5 z({NY#8Mq6)8P0{bz&3a*{MRnqjN9N5xIYVzg15ut;pgBA_<6Vr-T`~y7vKi?Mc5DT zgr~y0;F<7CFbD63gYX`B5d1Rig!jT_@IH7mydVC9e0&A|89o4i4?`AK)SIY4{@e zN7w=X1ed@+!^QBKu)qF={wMwSuVKIa8_##=`QPC}_z#$Y|Ae#Q|3VEu3;#KPoAEFB zSNI(K6V!BV&hMZOpMnN_9Jaxqz*+DIa5nr7oCCMQx$r?a58eyg;TK^B-VW!(o8d0- zQ}Y+-i*#-2_45}Bl^lR`KE(6q!4JS);ni?Acop0oUJ0KM-wgMF7s5T^xo|NYhkL9}pPq^K*4a)y}TKGSS_?~;NPw&T{=x0#B9DkcsxB>lS z(vfhGbWhPw#eFGmsGkpC4aeYVum(?uUgixZCmfX52rXx6OD9d=$PFO8s08zk&O0D*P4t+r#I=`?&uO zcqe=(ycJ#vZ-noHQm^lZAHn?|75*yyz2S4=)!cs{d^fzBe9R*s*Wh+>zaKjA1JH&a zgr~!6;ih@l=^v(?dU1aUu7$YuRr5Zg-+=oB+}BfH$ISbvxK(*UeL43(Mmlpz=i|6{ z!~Kac{3p3Thx?!6zSIN#MzyD#aQ}WT<3D^7ei}XoKLaH{H^cAEy+yx`c)rQ~Tj4h# zZu0qA{d2e_pSOqU;HKStUjG8m@1J{zaPd9(7x$`pU(~;ZTk?OW%Ku&BR{4ke?fAPJ z-URP~*TXNvYv8@`9q>MQ>D>GEuMp20aYKC!J^)?#Ahh9E;py-pxCwp@z7l>No&X<) zN5F5u?A)#TBgFR-+)&>iZi7;u--J?*--7#c|J(SJ_x}!*digH*cg6iZI1fGwpPj?_ z5B~(e4}S%J0DlU92!9A4gWKSb-~;f-@J{#>cnka~{5bp{cpdy1d@p<)UIBj&FNVK> zuZK@SAN~@a1)qdD_!K-9{tB*xzlPoLH}E+4Teuwl4ju@94?Ex=;9l@)xCs6c&WC@3 zv*DlNCfd<6@b9y?8Gljr{x|)vsvrDK|2yqX=zgv;q#^H`F`S7&!K)A>F*B*;0xhecmU(wY{D}TFCpA4?GWQo-bd!`!fR%A8Ya)Lnw1r* z`|yG`ZMkt+=!W#m!;K?CH>7{Q)HpJ9L;C4a#?hf0(qE4;jt$+AetVp8eCUSyxw9Dm zRXU9SxU0BNfG&Im9EK~P$f+(Ua$zMrll$Fp0Iq`4?@ok$xK|UOte338eJJi%!jBQY zhx;;4yvh){w9Z%y4Y;2B(mtVn0RA`NmU`KU`>{6W|F}iZISKc9xclHJ?1$2RH;F&$ zV*rZ$IT=d(JO!5VcPg~utD%fHr$HHSPKPoMy#~s-a|V=g=1eH#%w{O#%WI*GFBX(> zCkJJm$wL`e3Q**V4NoVXLD&a}U=JLIE1(09hG#(;hen``KSe0xPYEvPc^S$$AgCc)@cp(0(P~=1nikujQA}7Y+{%u>0EpRCuhgZ=)&w--nybg+<^Lki; z=Ryyj2Squ_Tg;dZkYkQ*Ys96`!x^~v1v;H=BpLx}JPtIG>{+f2T{d?_yZ{H^~ zkhvmrb>{lapEBC~-RB=Ye|Y{GyF9$$p9_{q@Vr~fT9r!C&YoR!@*_pp9m#sORdCD2 z@gRC_|3-f$yWm*9?Ty-AL3!;Q^PH-!X&sIJ%6`o&`nK;oZaMH6#<_2!zoz(J-1t0* zr|Npvke#)+RPD0F*qOKT!z9YZ@RocJ-lo&H%7vV}MP)CYuk`aM``T_2k6H1YQLAd3 zb~SGfyMEOVO54=5J(`|NDL8rCmj{}*r~GONU-8_kn|F(Whuxc>TfRS5Xij&?b88jt zW%$?Y@r_!ZS#onu(KgpPInVOO&2G0m=nU07t4e|NdhQ?(eY3ZgD?0g}@}Mi}ajlSF zlg1-O>6>v=Sg+DqWBXOBSj|?7j$b8;ApbSrGyR-XHU}-os}!yA!ZMysn$Okv?8T?# zgR5J9O_rZt&mOcryG+R@GNsyyXP4Zn9c1Z94Y?R#%?3>}OZn!`7(ddK)X!W23h8HbWxT+AcNBAL!-* zx_P0tH|lN$mBvABu~21f-13(P*TXVDL)0C{hwS zkE>*430L8t+{?C`H7!%txG6Ur0#y&*W74D>qg+Rr9EnP{#z|tLjI>Bvy@X_~TV<=l zZ=cwz{J6Yazj~QbT=FuB{Ow5g`pINaI)#5%R?UZXqqCjgnXl+OE8E?aZys$qsMLN{ z^%Y8Mn3Afhir&HUH7_*G^9`eO56v($=Nbp|quQf(qG0>wbO90F>D$$+Qyz+%xQdXK z0lC_Kq?`Nd<^_|sw4K<Gls=1fx$G*9zPS2zG zpRZ5W^C$0q{WO$O;uV?D74~xJKq5baZq-4@sw(#c5@CC~WjiksC76g7C25B89$g4M z!-_^}P3w`?(yINf7Y)=rS+pP}N6i5gu{Czt#%&ks_j|3XNcnmjWT#86wr@|`@+L3j zRTOX}m-_g7h@wSq1`_c2&d%k>cAaJxw9F~gCR28i)b0e*CXz?7KWS?v!Z?Hy3Erw> zZ^BQRgd2n}jfYG0NWDIy_0j#RZW-lthI&e#aon@&qqwH6kwjY6N2HIo)|&!7#V?{h z`NQs59O2XWud8ywjDqL!T)-No zW7^eVrl)3bSOmz`cGaZs(b$jHE5YQ@xJ6G0#x9pNG7(OV_k0m7XDfvSy$4;$9M{ZI z&FEz1#xjaD^^7kr839YdpJ&l0YIH%-ii+F{FKJ&b+iOt&y~9k-L^(74@v@pPg;ky< z*u>>y#^E*%*Gjpv<%ILQ3Fm9+^!iE9Ty5p;u41lMO2wjShfX*B^>!6qwQ9+Ga_z^D zZuXD+Rl8Id1KpPAIkwlavQ{oII~0HKX_Mbt+uPgB`wa6i!+bzDeck-CW?nvNjqb#j zd7hRTOSeoJ`9vm)IJJ?3W}}S5Evk^mKZoZYquferz07zg+AQ+Y{I1rX*(!op2EEv0 zLVu+7%zS{ID)~)%duF{pjpTRiEx$-Iw*~4Y%EQ0)jb3cDXZACcCc86|iq+UwBbzj@ zX-)~uyA8wKLpwNgmof9|oYqi&U|VLNHmY<-hw?1z{zb%8PDE5|g@Bq2u2q8VA7?jM zWw*~BLWlCkKiO1zQ$eQK-}+XSVECb5?%DF4QXZWVC^unGP$! zV@@Spag>NP?N#z?``=@eU9>C1Zh3s5>J%v%JDQlxu)b)B{k2NP^`f=J8On`b+hs+p zm&JeEiwlugoZ5&B_o_+{#dUs+EzYKoY9*~1 ztIXy|p(8l~3%awJT~l;(Rx$CUUM0sh#Zzgy@V>#W%6e{pl^XS{yki){Vbcs>4#L;V zyLmp9OgE6*4O<(DO#sg-IME{f4CkZkt%|I_vmKz8fa}GfO*mhST%aer71gs*#+j)#VJ!CB_~k zuYURVlv^Agc{9+He6JbCGtkqxEi+U37p(O=?9_>N6K$UHZZnkg-L7Y^cM~J&4BKfx zN>4*O4faEl`cA68!u_+js0VsP2-N(QmdE=X&CjHAttos@o?Q=hSE{;sJV-RHa2`96 z9AHqE#l2+lwy3Y^$2Z7qJSThKiTY|D|E3>b(J7;qII;4>`>vLkZWw2#AD{1(tufol zxrq#}+kyDP@zh8AMy5wSSR#z{+)3KSYL?^}sAi}io>+3va(d&Drv66F<3g%ECITho zZ{ltc)r9NDt>kaqxa0L_zd^0in#*}w`RXZGYSs13jG8hS6myGld|L62*yD{;gywcS zt$51J7b{eQtbWzUX33hezep7DmP$Tbv})!2a3M<{sWQQ|66*F$_w&~)BZDrrxTt!a z*iST6hfTv2Ta>W8UI-_ZH!3b)J4yUE^s{M|M@e=S=oezK5()2MmJ!N?8S4G5;#C$E zqIXW?eWWHfD@pGR4-HUGX0N>HoMU_HuDn0ja(*U_zaa`UEWH`){iBkh z$ReiRsmVjL+?!T?^jBg_QaF>fkEU_UsmfM_j}4MtFtKXt z^lY_8k(}KI{U&a|MP;PpSmkUj=U`h^9VgVNBeqMDK35k%lh%(cH8_D0L`OK)GY7)R z%pvTcBtxyn(P@=$@}&}`JL7p(p3Ep4nJ6-Oze&qEAs7?lM&eO@W+%jB)tD|s@iglj z(<&!xbg<=gHnmTpRw)WDvm*@SR4vPRw%zsHEsGtih{g;}=S)xR<>GdQBxp2mORbAV zjZ94L8k$>+b)+l_)k=1`+828DJ5N4r`Es+@_6B-Zoi?-j>)P1A0d;jSY`GIJ)f_QZ z`J~ph%#D;RW@IzefAhgkNYolMjgyyhwcWP^djb>KyqIs*TJGMq_MX_FzzU$%+W3j= zhq#zXJFSRyi|ToCfC-6nuEDchKu^bLS&csDG5(`e01lRN6VKIlZpbbWbrT0 zKiR|)E1g|Or zMijCj(IWkc`g;^2$oCB8r0hfn>QkgG2GMCEzZ&bQTB?|8Q&iQ^vZm)Lxy%f|yXaJ+ z^68k!zlzfAw+5N$;^$d@xZ3`@^V_refM#CNx~tB#i;t^K>?&KDIeNk%`gD@+Lt@q1ZZXV1=;q0~ z`SG3KQCki?+p*K!IONQHvsr8h;_dH$hZSd^Zen~8SaGh^56-OJ4pYMajFIE7LnFth zwj*Z^W^U}m|GzPEq~X3-HD9gmojcHM8{0)I)o(i*tNAvJU&Jipttw|z>Vu(vggm!b zyI#pktpi>WzTag#@P4gF!`7yaK1Qoz+#@EjIR-Sb;VCqBK$Rm-X3N!fyKXMi&G-F> za#tchVxE!>MM~Ocy+MhexuDpd0_$b$cSCFbUZo(9aK~#bvYBUP=eEsTu#A$n`5FCr zR9@q_iay9av7d|e-tDmu2@ar5*xm!ZFpfG{`N(p>WMs3fev+O@SdDMD zO_7goGR@ZV4E`ov^U574jqMR)UC7gk=l(M9#~^e^%r>_tGXosQUrUnJoh3up z(bhTOLF?~EFkAdJ%t?Kl4kNQVF?5w9UENIJHt=_q{-I`j#%3yW%5|=$^^JH*C)ya0 zrVvi2+J<(ZMyF*gsm?vr%@{SAcTU<4gZyjl${&_pW*HMWP208ZF0j*-w}wL)Ztg6of?Pe6?=cO9WN0!Vghb%wV8l)O% zWU)K5uR5O`k8jZt=}I+P|C4nXuC}Ggc*972bBVU^@?$f*W1S@a;&__#?b&(T8MW1T zF7X|unTH2f*-b|f=?`*5rl9n_EoP@C*)}tWV92cn?MI{(<_~i2c{M+BaC1n^M&-y4 zi$bhj%a=YA`DvjyC`+x*8X-FKDhOb=mtg8zD8G9)irq#LYgKl!)X4#5M;hJ74x!4~ zbM-*A&(ME=Emu;O2s~Mwh)0Yq>_Q@wJX?@>9;72TG%cBan2x$H_NY<%>G&igF9@E8 zg(C-8bG1PZPB*3+o{#U@*kAL+%0a!RoRo5-^4l$lCw$&dtLt-yhO6qFh^ET_RlO&! zS%txHW8CU})pHh>W&Of#OgSu%Fy20PjvJrLc*Ozo>L7EEPAlH)lI+Np<)=kEi|mG@ z23+8^hv+c{TZPgzD`4B{nn}~!Pc!#a4SF?`$MrHn-kWczbOnFNSp%7vk8q$w)DlFs zJRhP(R*lZ%DtxuY~Y#2@yvK)dd581=D995cpF8iw@qOsv&i%>Br(A}H;6>4_1uz%zIU_PR( zypgEt`xjYEMC6;#4e9u`p&`B?!G1*W2OHldWv3c8(_lT3dg!K|wp#fJ7PA|7hqCmC z;LKQZ�h^NPT}JF4r-7M>d(FdcR~jBD>jELRzU zqL(jZox<5Qn?o0NDaY&#>vXGD9d0U*d`X$wV5o~7bIPlvpskQ!asFG_angkOqDoNa z1&edm<*eMwTNO)LtOWMMYTSt98LF_wTcR3R*Un4FRq{T5o*ymw{X`n{i}-%Y^73d| z!MTV;zQVR#$d-Lo?dkZU=PCJ}JPs)$q~_-=&##UbZFC*ZsBt<}662D2buv9PjOZL? z955^e@w#85|GDQ~k5%i2b&F9Hc*aVtz@z#)FiSf^i>h zk&i?;drQR$&MJ$)&c^)80fxY!Ym-~c53jO|GSH6qy4Ze4Ov^V^_DIko63I^dc3mD%oZ_zr3>@13f0L{ zdQ9F}Vsx)aT2~#`TeNICx%lN9?lP=Sn@V8!!Z|BAkabhF9TMsoz@L3DG#+u;N!k zza5b!lXmrC1e+xcS^D#$&m^?Bn=jKcM>20rl}p`VLD`$e=_dMhAS#f$QbS^0sB)s_ zU$Or+{r%l2s7>{ZErJ{wLK6!AigbZg_`F&jZ4RFw3=ghk>wl@SJ6&J(r`axs{goai z?y35cbM%S&NPfpG@%6HB-Wb16;E%Ot8FD0w)OZ~or%9KmKVGU--I8BO)pM=>KqBKx z^?y<>1=ELYzE)AAPN2`FZQFzzpt$l`nlx+xRb_?u+eXz50L%KywUmH+3elpmIjp_wa-+!vmnIeVUX|94F^-7RJpTSCA$)+Ya@Pk%+AR%2IUBo zOZR)caL^VJ6g^M%%V;81NXZ+*Ib}8=luj%~l^VAj^quf4ec~;xSA^rlK%e@Q8|xB* z^bNi{ktlz)YZG|N2Fk9Atx4ZY`g44*RxXS26IV*EB>k1$G0}kV7|MR}pVDj8{4Mz2 zTtRh+RDbSYDa#qjAxa|QN{u5j^9LDwOkz4Z8CTdb@;JQ`q@eay;(TBnDvAyR(m>xj>{ZG>Gj`X@ zu3_FT+C!wSrsEBE-2yY&R^^${ANqq1p>o&MkCXbLjP&xc#Bw1qNTk{`9WTpzs$-|d z+1SolSuOK|>cq0^HOa@w9ywfbikeKS+~fH0Z!rj@+Dq~|e@CNsQ@fA-p|+~e7KY_8 zVZNCE$s8t{;Hh=@xW3}}B7b4&rsi3(Kcy=&r5LhNJA$P`$%1@0Cea>K{wI50C^-nq zlsr-WD=5oA5~ccUptmCQqK`Mme+K?j<3iBf3xTK&KZ=>fauZ=!KQJzD5PZioE+4j2 zLj^h%h^ca6wp8_;9A6|TY)-DZ`6~_^RYTe`i8PKcP+BHlo=eMz(0?!ykfCj|8-OF#1QP*jCfJvFX(iPb2trL@?_*HLmZ&Sv9rh2ZNI^43lAtHGma zDyi`_Kd4SUQ6i#L6F%Lpqvz3}vrrO=GlF42P++P4FA^v`IF_$an}t+3vJ!+#^-r`@ z>5$=(BbmPhn-sx0Cf3K+MtV1E!^!nx*-aFC>0l9CK28_drpRA5-?y%+Rb*Ew;<8JG zVTf8MOTBMuejbir4R#6)s(d8L=cS}5)cDr)TvlnS>IIcv(Da<)Yoy?gm05?%k4QAy zT=hHDBbxk|(CPYYzk(7RjwoU`lBfstVBcfeQQ1K^-dCR=l@%JgF7x6r9W{SzNJs3D z!;@`hJzMfWamm$ok!BvNnMY1<>uPzpb(Ll7s*MV3{(ff_bKVN~i&Uc6>WVpF!RVBY zfs&Rf@HwP?muJl_TE>+WeRd<*myq35(J$lXH*xn-x#m|&&TdG27e;wGwjsVq-AjCj zMON_a0#@(QXL!{qyw33R%|UsObgxdBt8|seyW+L6Fe52Fs3GIxB{ffp*OkNYDLLHw zJ0RirIV4DWomQzDQ+_w3sr@v6rz6Zys$A*s_3u(BA1S?~KL1ROYmW1rkp_o^~G%lC*YLmK4c3)Jq>2g>4PJ^%yyrsvd#&eJONtI{AI-Eq2s<(m_#+%aH zr#_bzhD*IyVjdKDNXcQ^16J@nO4U=)pXK}1VZ5p5@pq@g=c#y=RxYwz?VHEt%=esw z0IB#8K;a?DFuqiOtk0j8$@4fq+3gA1X!`riVLYkwZ}`5gcuA#GZzrj6$$6J5l2ktr z%B%jJOifFbNANvP(o5A(Vm=gPI3=f&`jGO_!SDF>Q+AH(>xNS5P46Z8psJHp{K@l? z6NOWAyHq*V=MSlJqCLgm50VIv<0sDV^vA34za>b|L(|`F=or{Q#|pBWmT5tc5{p5Kh+D!zHM%;wp!nh>PiH`jVp<1&|s64G%0Rfxbml+n}=8{ z__!A`XU>_Kdo}^iA!zp96CC3Rhd97K_R_nH26j+K4O`em6&t8PVGXNvu3#BUeF^<} zgX|281Nw!yQ$i8*nEjX*F!NCl=KQ6D_l^>T4p$t4|KYDaL?XJjKO=o~cgY z^vuv!Ju^^2qEDr z+GgZgk1f^ptz<2{X&o^13e|wBL6lhHiz|kh(&253&ALnGNlWfIdsY>!Oi-COFq$92 zBt0Do#E~9VA@z!1mpw(dDG{BPJknjBsx*{~d<$YsRSflvysuyEGS!kNhVsuz_NhZv Nf459IU1p8T0PhMPhpPYp literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileCal.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileCal.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..08871df684f1b8e695fd465c3cb2f191370dd0d7 GIT binary patch literal 21909 zcmd^{d3+pY-N2vOG)=SIlu`<{lvDe**(oAt6`H0eZD?rPa)^}4?j+e}cW2qzO_QRP zDu}3vD2kwff+C=JAfn=h7l(IM6e-bH5iedZP*Fkf`+H_)XZFZ8-Soph@8*;J=6UA1 z&)@U=JrkvVZXBj|8r45PH9oBU9#xO3G2>A`#Ans5>b>e(b&YzLdZ)TtylRI8HT>7{M_NMh3aKx_ZXone_qP7Fs7t?j5?|uUflBZ2z=)F zzRLUTbpZ7_T&cb0s<}K-`^0d=Id{g76!+nV=RQ=aqt#=EI`WSAWAc2zxr1ZIu}bZC zIK;iLA8z)o@iAkbQnPP{{{wG?^Wk-H0lWrwz^h?GshL+m6ZfT%bY^dlzd{{{dmDT? z+zO9}Ti^+VFAxsS&c#nuC;4tTdo%tg>+oa7DR2PysW1r_!AQP4N5iw=9Jmf13VY#9xE>w^H^2knMz}XT8@9u9;8b`njKTBZbM0fstKq-k z`S2g`HSj5T0sJ%E1fPT#!rwv*O275NU*S%|oiGI-hBlP`?1$2y15o;N5dMJYY5L_s zxY_UDA^g9AI|J`)&&s%(b8mYtI=;3aiYu>_aZ9_5Rn>MA;R{N=X%^$pRqAqKQK`18 z@F)Idhu|Jjs`U-Hw{ee_{Jpb+PisFJ%0V8Lw4p&iU=H<1g{o`5bT# z@n5gh0qfx<@GQ6;cEdNomGF&lDZCUehL^!t!8gHE;pOl|_-1%KyaFzSZ-E`~t+c~2 z@NKx~Ldw5=2Kj$hdAv%gml*0D3ir(EJP-WGka~{}AFmVsI?{XLh3nP(2sfSD zLc<{3`*pk<)Q#jL@gVu$q&|TAxoKktH2w`g2%nkum~k`wJG=!xjsJ(>U*Lz~pI}hF zkC0AG-KK6Q{R7EQcmS)#9oqk+>SKhzpYU+|{`lXi{Xecgf&Y#8L*jo@eG2!rxFPPl z)Tar*AL&8dcdO6vd@Ii(<-SMPU&oROSsR3 zU&g(9+E>)q{PA%g%y;8U7MVJN^pZjr(!9dD;`|*DwWtLw?epQ0Mbocn9Hr2XBPGhu6SA zz&FDu;l=R(;6?C{Z~*=ZUI70L*TcWSweYWSC434lhEKzj;NRf!@bBd$>(7Pl&#M>wc7=L9UscMFCu;J~4!q>FUG-mPq+}1;cdVhr5Th*b)VZIw0 zr?t*Dm^Au1G)`!pV^B!#hQ@-{xyBK`8yZKo9%&rqyP+|w^=RW5-wloZDgUuLpE2X5 zxZ7~Q494I*`0Nz+e<dG7TG;<_uV`Cktidhw z_YB6vqPErI*5d)v?(F|?0X!2P1=qq^um}FFZXA4U~1{0x0XpCU`mi7ZOhDZ9%DLAO73$ zPtuMe-=%P`#BIaVU_U$o4#4?v5FQKD@G!U;9sq}68_dA}#Kw#)d>ZE9lhA>W!#sQx zUIcf*0(=0v@XN3WKLbnfPB;v2fm`6Ua0JTyAB8f%w!$m%zZhN$Ukhbjc^#B>WgC=r z<@N9qo?imDLMqGp&i)T`xZel|;H6O3(aUHLktg1S`!xJ7hbPB&8gGUtz$@Untvijk zK-o9n3T5AX8~i)G5M7xrt&yneTF zE#vCm_V)<&xPr#~*n5rZwf}WO?GKG3Dc}3xEckvX`}Pgw*Mj_UBb)+n!vA2Ne*jL0 zAB6kCo8eyY78r*gf^BdoUi``~?1U_%vX55ay%u{&CKaD$#kNR%NJpP#R zaUE{VxKqa)^WAqDpTPaJahLH)_-FVj{roQD)BZSw%&WVN&ujmCjL*R5jeEqc=hpZ`{<*P#d{A>PmasPqv z-+-~${l+)7|NX`TgqM91vfn&tJcR!fgcCk*e9QPY&t+eNxW8k3SBGQ&*Y58b-^VTc z6C~Xo#t*dr4&#UT%YFqZ$B&I4Y5yPV{rue4hlQ;BKhc!)P|zQbke`gFpFxrL9)&XQ zb{d9iRr0~Zr-oV<>up&u<@Hk@nzFLhYQ3iQ*{LsSyP)mUZQp78W1E_`ecCP4zCZ03 z(^}g1Z9k-apuO0BdHXf(x3w!ZSE47KY{JUtGj<~9mI@iycHOj-OC<`nm2z^KQG(2_ z40ll}ogB(I&QLUr1UalST-HvdE!Qp#+XXMVBX;q;V@n}jw3RxxGMrbgqEoO2?1Vj1 zv~yCzj--_wBrqSg{b)U?O^0jcQhm;dE@5>&tDgtisskk*Ghav#TSeQni%E0Paf`0k z+NM%7YMx8&(n*`6jeHK4uZsBjf>U&oPR0u`z4p1~x?57U`3@AEQeM51@J2bkVXI(f zoxXI&HrJ&43RYp%>~eDb>48$gD$*c51*e~fuGv%S%cPU5a{Z3v$7iv8HB3jE(lx`O z(5>@XVY@{uQ%vMDX}3rc%XXDcPr>fD3wDkci6qun%4FA)XLmlLvwkWwB#$II6Q>en@BCx`M*I_FnuFK-&Pv>N6%H7jPu z^07iJ9UG2Wv0}`|Eq@hYH_Y)nfNv@`H`ar%9qZ>;n2RO(b_th_Ik7%c$lx~db?`|L zFVBzoCE86##RnCh;*lm&ao&uESyv{xhB$p>D#aQli=`wwjGq)>9lrx!n%>hz9UTi# z={(Q;m5M*C2)u#-POO*jLOGIaDuWWl%=q(4p~-37?p@wESz$Z9(Sg5ySM6VaT%?_$ zbTP4Ntv}cbR(>#@beCJ%bY?UZ?;ZOCC$~Z%PH91jtpqOaHltyPVXQSA~z7$@MO|y zxUTy1JKP60tm-XV#geEv9Us#IaAd{wN|k)dTao_ED9=_2zbtPDxj z_SeMI>$j42pU5x``+wr;WzxAJ2n8A{uQX-c%92d(SVk)�$0>$LhIeKtg|^CnabrF)vm)6O0OoVRn3*lTOci@ z0k@RTJB9LEP}|NED%Yx9zEtdXQg%%NrF?wO^5u=y|3Bo7Gqu#@j3X`eBEX2`WX6JU zOSQaYA;RReG?hSN$!Lknf^}ssL>E4b=SY4V&QG0|tFSmV(+>Ka z#`+N5#Pks&sA`jPL%nqMNkZhs3Die=Vv|0aZi+P7ri~6Ku0a0W=p?O7daGT~zEXca z3;AuBenk?d-+J}-lL__buoNgb2?lK@<)~f%CzM`q-nNE%5$d#18%eN9c`If4X<(^r zJU(jn|8%jGV_0zZwo@kBfsTUhIvM25vTPzr%Df53Z$=+Z(^f7~>Pw?5D2@_qI4x&( z3CyRH--i9ui9RBo)Ti3Hz24evZtxQ`2RQ#rfjqrLm~S%Ulu{`t=_XJ(=-gy~+3kF~ zB$=foWBRHPvmknnFrRAm0cN6#=Rsvf=TT8@HNU1j2{I~W?Obu4AJpyGc-+E;W{+Li zuxhC%uSsLrtNg=4`BbyKU}fzsPGQJ3*I6m6(B)+Fj%z3S1Ap>b$8Qts;!>+L1)Ij`m45 zwoLR4Kba$Zun&r6VNwM$-)qD=+WC%OZS1MSby3q~Y!H=!s5g4G5+u*xgKW!1?N>+1 zQQKDLi81rISgb=U8qCH@)k;qzl^Y()#)+q!fjxr*@`)9au&jH<{i8eRN z#-!IVa|7G;3Oi@xwo_&Q9!rjx6k)h( ziMd{1tk->J$0}5Zp4=>Y=TJ|!j_Fi%*zVP7QtRE9r<3eRg+SJjB%0KZd5eIXNvCXg z(Ag67u9BN%_4jkHf79zlSlNW;u2^s~W>}x28prD?6_SG(D%^4PEOpcOvJ0~b%h}|) z*2VIW8;Bf9YV{=(S|6iATUaRCK;*7w`W0bon9eAxA|{cJJ`)6mnnXHQ2{mkxPLu6q z4fl&SQ!fcYQqn?V7M4%T#SQ2E9u#XbDsETrAQWI0zjftTJszv&Uu#&O9QDDmLtE}{ zkXlfWYa7<1ay#hOOMjZx+C&`j_IU?8gDm%zey%L)7ilvF))Hhub5xnbD%KI(LdXnD zOxzWhNDEo-&&{kwC9DrQ34oXXk$GKrTzd1aXAmQr2&JYwn$vbIzqiJrEFCyN-dz+$v^=19yu zMoZDB8|IVBys}|W?ZFYZO~toVkGMt_u*yMFv6nDV*3hrWAN(Z(qgc9f$PXB)%-{GD z$*&t$ta0kqX`bp^tWM@Sgb1ahY4-Q$`6!}GOwzrgVA6XkG` z0HXh>yAGU_L>s)Ml+F|}&ZkOAQKIvS>+nnMVLRjG?Sfi_JJc_@cCy4hh*324Nn4-0 z6WXqyu==#_#qP*k#lgrjU!{Ktu0Gf!BviEeGH6P?&tkzu<+{X*jMHajB3)D7Bljbj z>h_SNy?SYTKBgyIP1E7TjZTQa57F-6eudm;NcEY;bk^RA*vYfS{8pB)+sbk2BQ-Zt zir@}JgYwnt$?_5VZrIXi+C|Zzh>45Af$iC^;c+$Ps2@M)#V_A!ID&YFxhs8*Qmbpy zpO9SV1w!AM2-?gqaFcRWn4W)rYO-9E$VQARaK;+Qabc$1kWHTNbIez1aM|t4Z7WT- zskwGbYt0~&D3{8PrVwS5HpzM#?wnKXvyxcuN)g3=lXm#}`OqL+(s{c)d8k8^`twHD1a*P5E#FOyzsVO5%3 z7c$sXL`_nzhwM+4>+*#9YsIp)URjnj7oUaHSN{7|dPvgYJoEKQ$S?I(E2jB2g$P)4 zUuztVY(zXnrCBfDGOYyNjNDl_!}vC-$SdTl(SE$zw@{jE#LQK`$Q0ar`>4dHJwCkW z+oNu!L`9jRN)|s!enfxPDr`UaIfWhT#J1P%42EQv}^Q`HyEG3S#JDs~-P6c}C2<*)WeZ%(uU210uZd zC=$1#-{ih3nhx(eL2!G*8>Z?$k1h93Vt7`L488QWGg$l^w(T75U9Douz+in6qeY5- zmmb~1-*TzM!bcPq^%n2wIMBn|ya(<43^gx)x2}O+yjgcg_G~>^Ez1?*@7hun{ZbVC z_T1(E;oI}ko!QHsLe{Ff_a*k_hWn2nKXTvKEDn^?+=fYuE&nR794%K&q8;jPkK^=< z>(5*MxhaJd5g58B+W6TPeR3vw8ePpB(P%yQ9DH zUU(UI9((%eFlo=SlR!Wp+9aoA@|Djq{Dy&w$z)<^eOH%%MXEEE;?j=0guAXfFkd1U zRo0_Qp0A3-e>!NqPDIr+VL`k^|>bkm_(E8&SKEX5;6WkK@JJ5h?CJr?@nPh#8$;tlV!1TE!wqyy5?S7coYjRB1*$v zEMK&5X%dYaUEbt9AF-avn>~5f)B+`!l~l|u%egEdmp`^>|Do6>?owp^{0AnH|HSVr zcy|aSOI{^p{GnMhbG+)szsD%MQ{0$M+JkmR)ZCG9T-fC0w7tsV3cRl8WcMz+d8JJ} z#LY+a%3k^w_WgxgZyzo*!8y>i`t6RaGt6RxI#Qy9<;oYcBmQ}t{z>TeNzs18n1JRe zno*9f`S}Y^vHE4b&qv(x!}NQ7VSa&rJzosY;YUkmq&p{?uAiuD&Q^ylJS9Gzw+AI$ zm`-iE3wF{@58HY_k@QYf=F8<;NIe-cTjUBL|24D_nn zlB>i%5ctb&4Bpw)5A?Y3!}pf@vigk!Csd#9_`_Ld6rHi>Qqxl!Z< z?R%h?j{m%uQMoQXFjx%g>-(?cW_e}GV)s|Nd}s75Td@>_RAt_BZHgBqi~Y#-9agv- zNHqC~UA)dX3+zh408UY@0cK1pFc4WfwrY8`G8uY@EAwDIpqFD~?UqCItk_zvgy}y- zj+G<&5C(oZPGS9(=L3w$Vyt74ymx4AHP@*4>0ALYHzK#nymI5clEr|ZkEP6$i4@#2 zv$4;1vqUfDcdltFR%$MrF?q}dDt?q6;c|VT7(aqY(UX$CVZfT6!ZAy>B`AK z8j6qZPiZHXhQVwCoqt*By(!5=khMuZTF=S6J7L^HEr=9qo{G?7O+NMJwygT1SMwTKE(J>6M2?sBe}r$TrK4ZslvNDbTGv#Mn=t>h zCwf^U%wI;3-wqXW0`jZrzu{oINR?hYywyX?Wy(B7nI}wa30mkcK?#X1)^TY}-3Z7J~LpnIC;wi2p9JVlFj;OdJIl5Gk@g=)VrF>iYIkanxDdV__)rx=;}oZEo1PybJQB^zb`-3wLBsgcjiWALi=Ky z&c&0%BN;WcA4wE#mkbM5KYWc{tLFXvT04?o9=$Gx=~viWBuG`e=^4c!m-ota3e)8~ zjPE~kQwLT0(-6L1U&r#_0}tbs?GJk05B;$xcoD?j9?7TCd&D|I)x4;B|JIjR!hHOD z2g>_@0JV1J>i>rj4g=SJKh`Uz((+80Zq{ohjl&I3?l7O`92L{s@k*S{T)f7s^3!nzNq!{ zk#u)$KlRI_<-@REsN=?Yzrqh+RlbV*?h>SWo(1=ytKwDI(IsBhJn+uv<$JcCej`#p z?>;Z_s`@2zPgPQ_Sr?-BPxbS;e23Mq(og7Ha-K+8Rj*`l@3eZ|iQL=N>DP&;?}yg$ z*JDQX4v_-Yjw9a`F84^na!-68@c)fTbw7FSjUi9VBVodI?oa4yd2&k_t{gwS|KWwJ zYM-dxT?eS@zsR=a#XnRK=2QK?t|xzU*#%QuZYW`)Q1ar`a1#7{=|C M-I2_fvb_5BU-DxDuQ?;t`~TqcyWja9;}MDva&9M7r45ssO!3Ti;BCN{rz86byXkJGt+~7-+tTk zb^qqw_j~{Mf3HfZHD;GuZPxysVE*0^y915IMmN8{`$Ote>iz0{>OJb+>K64b^>%f0 zP1x69?ykgkoqDEIbR2!Ly+Q&&B@>@CWh#O!ch54Dr`( zo(G=?&xaSo3*au;3nkrka69aSo8fvW>282hzKw7b+ywjJh0uZhFbgk&F5C<+fLq`* z;Q%}fZiT18ZBXiI5L$3M?1nqwNpJ`r2X{iL$6ZkBaX0LO&xR}DbKnv1Vt6RL1Re}8 zg^S^HVF!F3TmYXB4Y&vXt+U&F0sITJ;UC~I{4GquU%@o|1$5v~;Ruv=9ECr`JO&?z z8TcT)4BijN;e9X*zYKHm^DqxT16}wjSb!ggm&1?1BK#2ap!Aaxlzvi%(oZI!^pi;_ z{bMiuApWOl=UdBeP4E!- zW_Tcc3rxVb!iDf{)WiNnw|Nuhzd-W8Z#n5dqxI5IHq$A-V>3&Gvh50*}p>aR_F#H1i2>zE5 z{-c;biTPvj?!?LF-SDIE^EZ%@%I(=Rm|%#L(E@O_u>CA(t()& zNqrsnlW>Qa?^oZzd@SaFhDSoo*#C?ACgwvhKL8g(%+$++x_+fz!t#6z_y6wbHopyj z4Zi~)h2MqW>v&jw4?YMVp+4`&9vWYQ--q|Ye}(tJAHa{nAHom8f5ZR#;J;&jPsfkc zPlEpXWBThkosWuH&;M}Wp_K2Za0&JDGyJdWSZ)3XT;6fA`Ewn<+x$=555eCrbU7YV z|E0_MnEEC52V)O)zJ7)IAk4qUe9NM4^EdEj_**Fb;CJv1n18Rs|3N(-xC>u_{U6~~ z@K3~ZAo2Ve^AP4Ip!A==z<$jCt;7G1`fK1WJRkeN!PDV>!Y?MgGL*4&kzuqMYS|L( zO}H3hHrf|0FcxCozp&eEH`K}}79JpGT`$o1E%u8HwXc(SIxs(kIT3{K#6E$&j63Pi z2jYGg?ktwZ`{BXx9qpy%Pu7SUVJ@8SOgpWWAJ^?GrLC)*G7w_YFGSMltL5hsH||xX{=fxc6)Ki^Qzmp>Y-IZ-G;A z0J?B19D&>DA04DSh*`$dcDVY0-Np{s1&82Ka3?$z?!x~fwcB_$9PJ}z76wb@D?}@-wdVV{XShf%z1|Phwtxc`xQ4EnxkJ55p^<%qK5|GM~H%$~0M;mz=B_;y%^?|?E+ z-wE@W-vx)^E$}(;-EaWD2VS_~R^z?Iw;nSz&V}!TGXK3F%Dndhcn0<##GjP+HYnx0 z9s4zy@1TC#sGmDA|FNyx{1AK$-UT0pABGRZkHBxikHY)l$Kbv2Zg@BRIJ^yh0=^4= z621j~3ceoR1FwVs2(N~phGqB}n1!E(DR?iu6n+kFho6TV;1{6GBVU9vPQL`t#s16i zRQMGr^VC3GEdzHleqsAJPCdsE~kIr4_9FRXSfu81IqmWFVu(ZyB@&&7}DoA z;m=qt9)yp=hv4JwtIcmgk$1igMc(-i{3!e`yc>QGik$Q?{b>LGM~v?iugG6e%U}PB z`6%@R6?}LSIp~7W&RDG z2ls1tWg4d6Pa)&YG#8qZ-U71?4nWNQ`p^D>^p$_VUvQAQ1osOU94yrChXn3oJ{$js!tLha=3(0YaC0gCMUI24Ye$&Nus

mVfFW6YJ>{ur|hds!DD`B-HhtL;}wz0>cG z6SBS>uPN(I*d9;EUHaRJP~`iQp!CbtrlH!Ed}xS(8fwhE*8II`EO>0ex$RT!KWYDK z``QCOweb53S1h_@(H)C^zo@h0Js}naT?n(S0@$Uo|kd+>15Hd({4V??oX|#_IG(XlN!&u?s(jfcsaV-U(QKq zY|kl9I7L6YV`p&hnJi{Xj#5vr_UGrT;h7I&M!X!9rpL4M z>0x)T&Y|jR?j9zq4i$e^p_rMlOOEA~Qr4L3l{~-JEv1&$xl8FXDaR8BrH+uFs_=!P zTXIuw*7tB&y}Rvslj-_&M~iN`pzaa>O0|7V9c5Z(!7Q2?bHcRElIdWU|B5hYy5=x0 zS#7(8|Aw&_w<%ov^nVi4!KTYxXO_*pnby8N)3RQmIuaKvGfAL|gY|l4O{&#P72*5w zJwgge($5l$XO>nc%D7lJsiW5>6K{~PS)Do8yv(`_7o1lo?jYl*@ii*-F<}?2oI9M! zI@XrVaM3PKS$%e~m~o0->&p3b*72-ubd{_<#R?^#wmS@Konif&D%BM*M1e@2g5=29 zTnoCLf?gygN>$ZJyj)BFj`jQi$=^4d)`oT8Iw#8}b1lk$5(vXISqD5aEoCg0}$#?6mpM$1LJ#6&PybVuk^o;6q= z&Sp~m`4Kc=`g4K&Hp@?+Od;{C4Cwy3$?-~dwp7W`hMD4NT(04AHtUo!`C->)0<4ry zDSsX)dqv9|&g88TJ5wys?bFATPSbL4#OEMBB|m&*e9fkOePd2)yx?Z?L6JIx@zriv zS2gV*0}Pcs-%-X~n#p63Da2tqkg3GMCB-k3NX-goqZ>}fO31%b7zz)8n{>r{bZBl4#g+@oio*c<9?BG$1|m5|F)pB745=UCgp9kbD8W^yql<#X3E$4 zOiD(8%_QpKSJo$^GP%|`;)dqEroR+o19E7}D>=Eo_|S?C(xRQtxSpTAO?C0q%m@p82o&#r!HhS+@6;{4W|VjlN0tmv6iRmWY| zTKW3iqBG!1hYm8=;(9VP#(>C=MkPFp{LE&2M@!PK{-KgxDtqhfB4M8~=kWb0H}C0L zL#krE{8X(&v94t`A9tn6Oo{Ol6^5wl+iUjmjo2w?SY-F6?LYhYvYGria(>ukQc|^1 zep)QAm&x0cPG;DRWpK+p;o1&&nmvUsQO#Wmp?(;NCRHEP;iTtxuCwDXO*x1e4$(#aMMm*1|@%d zwg>XY=Kmk^##Svgxzk8XBHxSTWSODA^;%xC5n=LLno1(EWU(72o^0b-5MB6OAU|{O zm*dV+p)ENZy}Y;+U0y|ES+SoD0wAhluGYyBuC7upA2Z>y4UlZpvTF6Ihu3n zmJS0{^bS%kKCAdP9iKWbPi+^^bFT-jpJ0B7FJgKN5f-&YxuH?KdTS%{;w;J|EwM+d zWcI|WY|m~NO+zSu?sijlHgknj)V5N7K5O|ljlU`iE2zCj^YyISbEx3h<3k8xS_lm* zjXbm{AEoUej;&IdX6+fs<5Azql*)OU5gn0}w$Nhr6dljaA{SO<35inrc@!qAl@J*_ zpDYh&&}o&X2sM!r-I93b)62JMefFX^%cS%!v}?$pORZf&WY#EpD#?(qKa0{$W!-W* z?WVjW+76wXtOs*Wr%$3;Pc&Abva^b!e~Z$oQ-i6eRk??S72RA_u~m0nev%|q&N=zg zj=-zev-^~_Ypp@2xT}ACi|g5#n{&LltX3~4&8i>j@#eQ?l^Cj8ltcYQGX*!?wEOa- zG`7juNxudJ6nRlE7JO5~rs-TZWFg$9ZQQ&bWKmdThV zVLpn4a5WbFMhn@nUS^m*9sDM)^fh5wUlB2%EQ!W8Wsae)5Y@_%R=`M!#}Elh+OA2x zSVx-HVW!!mRU1pp)d@~N8tfNlHLlW5&h24MMujyRb~)YQ-WJGnZ#1kwDQn+T)#-{V zG2VKo6Dcc&jyp%i=4Y-*I+%yg5`Q9>jhdeIJ6|Q9_)XISH&@3G(YO=DE84W)KtCpG zEK%xb$YCD)A^s1Q{7ss=gA9g|#eyIiPP;D{kP{hew=8^m9bS|T49_k?% zMkO^Q$NKVVdtuXY^&~3cvnt`#&Y)!AD83ElPd#7M%CGi>-l^%0T8};DSk2#6&EJHZqiAh$- zod54-jP)|w{=9g=D)^i#Y&8D-d2w)z!&(u#EE&0Sjuf=kwC4l0;dYLdbHjN%6P))> zdyZ8bZiw`(jcDe2v%}?FO)N^SA=}fpj}_&6z$qbvmh7Os+#r%q+bxFm=l?V7bf2E5 zWd)RVSI%ri42mCHTbw&v-&KikuvCO+JwH>4hoiHei&#UqnOo;0g>4}lEc%>tUt(~G zE(hw;!Q`;1fKyTWBEQmk{XFWUasC(C!Y_m5K849&*X7{3?p!PsXSF(~)$`M=J33mW z?{0CP+RD1M!x=?QTCCnj9ZM%N0zGwQ<1^@AlZf^|{ymI3e=!fT|8CfipOZp+xUQVZ zmN?8!ms6s2<&)6<*E*Q2zxA9{nfoGBXm(SM-WMhHIdIY*)_Z@ar(l=H zV$)R3{x`fL;_M}&l0BSdr|y3)5Hy-6!g~wxbvn5z>kix5m{nztKbUB0>qDaU%cakM z+5S3ek@hEMcCq|_q&A25P~_f3de|yua?TZqCAb}=-K+Ma*fi1y4%m4v&7`|xxeM=L zG|6|p{-zLVv11$5txidHzH(GTr{N4UDETRpnX3A096s-dugFN#%B_v+JyLX34itC0 z*%Bw@PS^k~>hDZBZ^^iLe}ZmDLnA&D06MKn%_n~am0LRCj@aemwx-n-aUxp(1DY?riF zFTLA_wsP!05@^z=uaXw~!=U3b-3@YSH9jej*A~w^5k+KyKpW18%-5ZMwA|0Koau;K zrqa(u-f5wqZQ8KS@AfUuGYA${(}O&TC!e-2&S8JI1+h1N54Eu>$Fg3f8p_3uy;muH z8;0AU@1k8s;tgX+TqOlLU4EL4-_5}ZskKFp*(w*Q!h3hONqFkx)+fI{8Wu`amT8J) z^OxdJG{c^*U%B-w+u|v$4=+>WVop_S$JLo+wxQe|%2jpeY2gvEFNe$iGZMD~xipEa z$|YVoKVujmccDe>;lA_UDRp9%|HxnEoUIZ7k9?-x--h`caOK)?S9k~&Zs=uS66K3& zzv|j|FUAV`u*;?WJBf{c|5?MdBQ$e zlNB`}wKK!w`0rq@@U#j(3qyHDjyKax zbW+=s{4bZ>Y-~iq+i2wrx|el3Yu8eqDf*!9=1S>@MCkANc}&99eXUvQmj$Vh%`7(t z>m_Fh&PKPGvnwm2pK-ZI(tMuqpGS#3XJC~^%NcIrW#mrMYyD{2UNMhy&t-UfG^ac{ zCdc2yx~+<|R+SL0bF{WiqwVB2>&2$^IJZ3KF$ku~ptZrU7~wxsJYr_?&{>lftIlCV zpPNv;4LzYL4 z#CI?T57ayfhb+^yb;Bl;a~79YkTx0An;faLA{9}2r0B^x@A_i_M?N{b<&fz~mdrV!tHTtQcfg!x;eOh(;HU5J6OcaLVzl(2E|A9x5hno5e+fB~g%!?~$`v;+M|}d?Qb#R4O^Xv#&3>BHNoza|zU2hiIrh^CSDxrunJ~ zGo!o~KURq{;#Z_3mCWH#n8T~Wwy1>Ab?vEesTT#EvkQ;Jo}L4_7CTz`sSXJ z`!u1wXpeapjCRodKJY(O9?t0}W^q{-^DhqtJLy;^aXT>P?x!Ob)#(T6XnVPr6Q*Aq zpJYU*r|X9UB&{T`PEVe{A$(AI@_@*2d4wbVYG1+oZ2Gqim5cJUuC4~Tq3wqCd#E2z z;66mJ+>sd_D~06^?04|wUUkfJ&(m+eiv~ArTF(Wp>a=A|=0y~x5p)+l9H)e;L0# zp=CeZqt!!P!4vmUdSuD$Ial86U|(TvQHk@p@@eg6125ysOAJX8hEUt4P&_^XZV#v>^&(4g3P`0(dW42>x^kLwI-IS)hfYDvn!ce8H~HA;<=9y zdt`Cc-kbCXk^dYd>1-yQM*5LDJ%uituL*F>z0|Oj($z1?kXek)wJxddH&OZ-e`{m! zW&F~Ef_kWukvwy69U5i|!eo7{s;Oc}< zC6EK6go67}b@_|mZ_*+4d>Dn}zLFo|;eyCMRk?@cJNxg&iri!Oi+m4yUX0wU?)!+3 zntIbCicT)i?du2*liw(O;N+!cKOeJidhbQN>U~%gPh5sP7j=6tc;8A;E-jx%`ONvfLizGQWUt?kB0;pA5ZUYZ zorrx+Ka_>F^8ONWujx-s-!CKnYuY1ve~CEq(Q-+Y4-pyUxvgoX^`4Wb!m1V(-iI2k zuj%)`@}}|}l~SU|jn$L?ycSknRn|57N&VD@Kf%__Z>jJ(sG53+KSxB&b>m&a>F1Ri z#HZ`9CcgL?xsFfneMi+g`}HY!ZDVb}iuz@EwNa;1m+y+dN;@>T?<_%U=dpnSKSH?= zAIo^4g|2%aW!*jTn)-;}6VwscjHB4H>!-WCI^Ej$y(rOx$MRJ_&Vs9sHS>tyzvTII rKN-K=T({xMRen5aquBNxR#!zI%H!N}%sbg+cyqZYRVe3prNRFKx)S2G literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileSMS.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileSMS.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..7a039ff72037316c7e2620702232b3ec5dd9eda1 GIT binary patch literal 19669 zcmc(n34k0`nSfu_By%*z2r-1qFabmdn63mN7$TTtCW%8b$&g6`0vc+%Yi641?rOTK zCo_O(l%NQTs2CLR<`NMQM8yLHg@N^8mt|L1QC4)h1Ub!k;6?e*z zf5p^B)v*3Isz#N=x9DD^gp5MlCI21#6<4n;$w8{+zpubAiYe*6Tpe8sFS7V9!DVsi zs)Ek}2dXLKNTm+wRGs*!c_uPkd~L^3A|Gi4@?lCHqaHQXQSa?|RQ%_6j!qfJDmDK| zi2UL(+!62Um@>MQI^qg=9NZ0$hr8ejN-dg%-N@sRc$yY+9(gIu!ewv_o(Mu7vC0Yv3Aq8ay4I4p+d}Ldo|kcrsiKm%%kK z4tro1?1fUUwNT2n4jv2F!=vEq;1RG79sWn&zYAYaJwE}@3G4e@+`ox@9-L}_gS6}7 zhuYs*-oCpILpon62yqU#u=6+yb5ojkSb(la6<(dNa?Fc#!A5MeRafg$#|;;alO# z_D7Ak!4>c_cna>j;Ysjvcp@z3?;WILsw>nxN&g_82a&H-R}t19r=3PZ*99leI#s$8)=8p_797!$2T-?Z2Oq{DBJ@-PP}V~2Y0=g_W1;yN4`Ia z|5)3j#!YY-|C^x=Z-M8*TcJGvHh3%i6!Bg}K5p0fy+eIkm*Wog8Qc%R9U8|G?oQ+w z@?FRex8AMp;rS1=P8pwt_d{gkp4NNS=aKI~{v7$grS(3Mb^f985!}BJhW{ezb&%fu zxW5JWFTqP%A2Gg+dpqu5L3VJbA5)JHs0WEB^$3x_rXE6;{s#@4a1X`=?r9J;nyMI%CE0m#b*Kce0@2Dq28S3`^d+q)Y>d8KNjlxg}PmT0#6{FpAxT)bp8!_KJvfAR`@gcm$_5M&*5+2FW|HAm+(jM zKj72wSMdArKjC-buiaaj;eWx0;BTSy-{0Z?;N1UKf71Q-f7I{8e8IzHUiky= z$@V|;m*n?PLi*ox>VHH3KkImZ5m}c98u!ort1^rr{`1-&Fq z55u|e#T=Bl=1N*DC1=wl<~u&X9MJjV^d9Tmo0ZMesFn9y|@U!qee%Ev*0WH*gjFDO?So zX<1|RklqiFq46Z_g)(2Qg)-l)gWtk^J>jI>uY*#~KHR^K`x(?*3-z`E`Q6AH;bpKN zUJN(E3*ly%h6B)sXTr1K7T6C5VGrC2SHNv>8Qc!L;90N}o(&hl*TZ@695@G_3;%4g z{=?tFH^866H^Qgk4k+XAd?@|fhEL)?1RsY9_%KYuFF^->77oMDz!7*W9ED@lPYT|E zd;z=`j=`(VM~pPQ3TB|p$5|-rsS9O2&A}D$LbwvnG$zU4n_&*V1&+X7q$7IpTamkv z-v(v9xD0pEb9W=R<9@k*-jwlnWEscrfT9mvL4I3UH{S{8z$w?h6YwecN$r1= zadX(uA>;NI=$ftm`{)ztgxwyMM;`taiUsNIG{3dCrt^ zw@!!kpLBlEa*uHz{?D}BE7bm<3;jiYg7BZ$@)wLR5>D0=NIvd2zC?UkPayJ_jjtff zx&o=62aK<3_XmszahG)l67FlF7wGvL>iT~eS^DAEq3Dm_fYM(dF$^_V$p?p!8tPZZ zf#y>4gDrdJ{9?{Ya}RI5pmlfan~PzI{vkdF^idCGA(Y z-_U+nJL-5oy(=2_=Sa3Vl3^tWAVIWC*5p%GDuz>UKuXqBvZEMSjSBTn3z@SUueaIVPmSBYV>y1p8g)J23tGccN(ZX&ms(0C98V%Db+G(Y_~-Jj?`fZ@l3xfR=~%)K^?v{9($j}P3y*U%?qr%@WHz)b_W@M65;Y93jH{by1x8T>b25a8?|@+exC?> zL9y2>^_so*8#g4YX_TKHnbK;9;CjdN z?X+LY(AvGFQ@>n8g>>5SQ`sTcWv+;T#)ZpLU1rbeT^nZ>QFz zldC%sZ*u&dZhmagr+;}qWeihTHpBSYAbzRMdm6?Yob-Gr(^KB1%NB*aolLo52G-Z4 zGqZKY&TXLKXnrT3wbP~QP}`bI&v(*JZq&_A7W`B?<%`^~8QnPR3+Yc4-$IYZm}%FEScI@|iB8Or8?Cg+va3G@apg+`I`D+b=0 z=E~RO=AC|524tAICg<_NQ3iB&Bq|}6_{Q^D&HTHqPX=AVTVv;md&)k??@PE@Pp2wX z(JMa{^M6^_vKo&&e`m^PyhMc|soM6Md3wWk!Wj}BzG3^%JiT-(JBGerY%(dSS|>kE zme)&V?VV0)$Sup@##y9iClU-@-(v&8tWX@mlAuzuFKN8axx`fJbrQIuJTn^aYcuWz zsex!_FO{fv9-dKpHA!)@(@egC3DRa2_6oV2n=j1;we>useD!5>1;5`-IyD)T{PDqp zB%hWIhIMH}MX(>0ILmhg-8#u8VSufIgW4}!1_z%6zibw&wqgmk1sPOL8|_~<2aXx< zuv`@zl`TQETbPXw+DoG2>^dX^TlkIyJCI=Sx3ar?>5A3oSU*;=r$n>fq)XvWlY7yt zr6f_fUY&oNB(u77adSPTkj(&7ZHJ?@Tv+w6Q)yRBQ`UEm6qVLY2Jkk<7w8>>hS(WYB?qVqz3=Ia`-GrS^UF77o ztCXM5Qoaq-uSmiQYp>pVGNW-nE*UCXFp701`KX=$XO!Mx&auY^QR=i(UY1~!`c~2o z)7T`LYSce!*8h}W$kHvaJvm7WD^z#h@!T|eW=S`ZBxT%0{WqJ!XoTnngNxfo)1L9kE|V?UP8mg=ErY7ln04w~EYT``jKq zl1wkjSe{HAZq~|+{WE$_jTutCtir$8Da1Bf(LL1hHTjA2phCvU`dh-FUibE8OP5*$ zPJUZoZ=lyor*ZniO;u_4x-M^L9N9g3))qTy=X=~t&h?!5aM7J-ZQb22oF+SMvk5>_pzn%2#R)nQndy-=%uLB+EBZ`H56^lHmpjlyB}>jgWo z4i6#?mg^p~Q9X+Kf@nmu%8+%PVRm=$8@nd3mW5{2*jY!n8L9M*y_eV<*c@@tmUS)%rv{j(i^kPF22%%YWF!an&*;E#_dLzz~nVj?2?k4x--;6Z{v*D zuy(yroieXtW6gI;(GC;X#4}WKc3&!$4(Jib=bvbnBc^BlB`~JPo@-e2h6f!qvW+Sn z=;y0Ljaw9BIW9?&*DQMbAb%H+PiE8sI>>4<*|Nx5%WZmnLZM{KC;OamuRHC2sb5a4 ztnIRZ>v_!DhFY`U$vVhRvgAHs%T~NJ&B+ZH`LsMai|U-w&LXK|XYG%jMZLDzs@u$| zJjV$37jmu?*+aK5oO~CxsM&FuwX<%H?XWkQO_XesQi0rjY-Sxwu)^hwI-Vraq+K$Y zRJ=5*j5q4;EcTYB^(=dQSgeJ*D@BQszZ3b^)i;9vm)a^y=MF5ee%?)6QGFlXINm@Z zpBUx9)tlB{RyY0NanWO*Ua^x5!bJkcqdJ-11_BO?{| zzFK?RjMj}!^v^BM2y;fh!kih}i2^%aNx>Qjj(H#ofLVI2*Tv-6wFVt=SvlCcP z))Z1{pF^Z%At6R5J~17>*BN)xZqCW8mB^8v={bo4=jM}Gwi1rkzvBA*DQ*wxy^7PF zv;9%MpY9G0>nrup;!(LXK|;PglxAlUd{zk>?U%~;0}akO=95fyeMr(lx%9acrdmgF z)qrp!vxnmEL$q8xN0)Q!--gGjue0E>ZtE+yvN}$~n;}Yx-PbYw_G;Tj|^*Sm4$)S1)WJ!p&xwxpSIK zXY=4D%=g3L4tDyg-6iR>ZeHAQ-Q17Hz_f}v)fyNXXmXwya9nm=16+owvdho(95maaq}3=CMvk6(;(iV)1|A|52ao) zoqwJCBocJNG~sLaxmELX)qRXbHRkBnx=Nwj*KT*~S3{Y(ovmEG zcx$!o{sMLibyJ94Dn&U-ej4;sYeQ(kwl<0xv~*BkypJH`BbxTZbtE3y=Qy16?G)O5 zH}|V1CUw7#!bjmscDzyq$yhM{>b6_4zfCj#mJm03PPLt=bRA9KyNkjVtwhN zt)|DE`SUmG)-K(c{C_YcEN2*0j+>fwr|KS7@u)0VK_3i;QOo_a7&DbUK~Iq#42kgM zvIFyphp{Km7!c!4Fh<0vlBCN@3-07^IUKZc5u01RNw&roY28O-E#x-jy}AT?l4Tv7 z*uUjq#Fh%e-?h2$!(7On3i)*Mt=k^K`Zgf@L#g?_?SCblY#jV#FKLZJ($0D;8Uwqs?Ky`t~7TJ)|dQ z#o+i^4%+25?mBLXzE+Hd`Xl;jv>y41M0{*(PfvIhxjLETaLil7osuAQpeNRC*W&tE z6-T#9qxHUgzZqpD7`$==%!zwB$4ScVuk!uXOUO`VKKx7$H@VjtC9^O4=-{IIH9&>rVfryQ)6PGh+a<{TxZY}8MK`cVtQ zbB1|_^`2Q&$-Z=v)pUyKl`2uFxUoK)lb(Ia%rYR=&!)xLP~ zL7E^VKlHbeSyb-K?e4`{P^k`is)gmq%5tSzsRK)Lk{dD!XVgiHnXW7x7c{s8en2T) zp4U^{%!^7gSI5OcWIkdS3(~i-125Hf$7s+N_c5M5>~v?`aV9+{tFOvL`O5j3iEw?R ze&V`*lFSw3%;}324I*lG?)arE>|s&ha%FPtaQ*&C^t_^dFy|NdRmVvFNOy60x?!T8 zbp-EWtcWe(7PW+n(y7gN-bpyAaYxU?lHPJi6I7ZUA9*1ZXW4g`>&FEqU(%i;@CV(#=0E|E*VJQm5qYu^O=_;)!&M#|8Jcc+Li%Q?Ko9axZ(tppr#Pk+KE)iepY7ODSD_Gf#Rs zE21u`wqr%lPX#K1Jt23Mq>Q>AD&}$Y0xP`nW_hfNK?PhH0DFoFrRvTiqg&a zp}U;tl$Be*k04G}?)v=#aj)us!JVP-eF5>;_T=a}4d3UG@Kx;+y)Pi1eDr!8r5C;j z!2eD`JR|pd_mw3?@cw2LuDJQHe!n%kR}kKx){{;YFR=dU+m$-m>Uz(}ZG(zQF$kv5 zy~^@gc^{H6RrOhM|5B2uYPV##j#ZEI@_T^#$qVE+%D>#}(|N4puJ6~?ao6_%wSEw# zBU|$N_r&y5Ysyn`Z%2YuJ*QOfRrOGDuR!8ejhkSfSUTTVO7?~2<<<8HaH^UQ%g^y8 zM)3Y_RKBwFZtY#2-=H6G_8|9H%c2$akLcWXnt3#QExI~i<>ycO!BzdQY`P8db(kQ^ zK=peG+P+feU)w*!qr7>N4lk8qO3#kPZ8rYmpi~#%DEXqk$LUzsNykxCdAT;}bSH9! I3|C?Q2FA66d< zg&j5JUop1b>KgrTx7w}V&$nn_r1&iRes9VBJ^Xd5I<92)Vh#Qti(5IQ#P>#ZbjiP% z#q~&R=KHqF`%FJjjhYLTn%=5faZv}DnBn|6Go&8W0>d*Orqn`prKyfOc*d3DKC`ud z)I3J1nF}E18NR>6XU!Nj7b$gk3w#sYA07{z;0f@x14hj@_-7b}e}Wc#2`+}eg(t#a z!IR*#@MNXtJOxj|{1ZrehyM_shFQX$4key5;Nx%!{2n|LJ_^r*55c8S!k-Nvgl~pl zhv&fi;JHxpy$nh@mcx6oZ-@854tO^_58eq^z&j2&U#*03UA`IOK5DLkx5KsY4!BPH8#OP0AHuvIUJJY7F1P{igd5>ia1$Jb7ecA$x5BNM zFM@;cV(7xR!8E)C%5%6B4q$#e?1P)34KIV2LK|KTd*FpI1~xi@N_r;Plico!4y0Jrr{!(fyclsJQ`jO=ffO447zX*%)^6V0nUPhP~>R{ ziaZTNk)IJL^0O6+{9FO2!)Ra zI>JyNRoKsQF&Ev(;>QR-Pkmhb-%`W>ZN&H2zy6*2B>oN~b!gc5yIqI-l=?L3NH|Ek zcc{-`z63Kgy5VQxDtISc2JeFBz|X;@EmxX%!!zOM;ThO}0iFu~9-a(~`Tip2Hq2il z9aDW--Anp&$q&T*74;9e&&C~YKNKx>pSJ(1`Wp7HP9HVl_Bq&pUEANU9>D%#>>=U* zQ9X$H0n8BdH`F)re+cnI%nzw=;eIRbka9k(>r2X6%-^?h{}Arqf!D!D2|t_gk73SZ z{wJ7$--U7bJ=_n*{hu+Pg8BRKc=$Lx68-@9gK+;B%u_Hw0bh-bnm^R?@FVpk?r*>y z&iM`YKgRv}$WPS2`ttHq)TynX@qVEzwX56`OSe0SlE*#DC7v&hHum{()|73P`5_iM~2Mz)#1fr}znnlHeG zxc?R|fG@(s;P0T++wbA?nE#XTGl=gcUC)11f6(dvQT++~1F(m>e*X(|3+DgEyrX&4 zd>M|yKSPnb|ABeT|Et5lqF(jggjU8MeR(G~smk%Cr`PPIAu6(?-n$;2$7nu&DhVu{wD0vFIukWV!i?MVNjmS zJa{$c!|^{2{|K?J$N4agJ&758uoZ5GN5W0;DA)y$h9VaWp~%G>p~%ZIP~_uSDDrR| zY{&m1cqV)kTnvwg$H5ce0@wy;!zgTl7Bt{u`11br|L}M4B={UW89oJ1flt6w;bZVL z_)T~^ybqoMKM$9{Pr)_;s6#X&?@5Vd? zKMjYWJckh|?QSdFGxZANO3HBy?%Uu;AZFU*sPRtB(jMOdr9EOkf+{nv!hQGDcM0e0 z!oQebnD%aCCuV7NUo-#Iucf zp>a9f4HNJ>xEWp#H^L9VHSh+w9DWd<0Y3!W;D_OHQ*SgrLVOD`Lt`HNC=|VM6BK=M zGn|e6E%=l2-wLI?AH#k+=8r=YegeL{->A6ngYeVv zUU&z*3w{RP20sgLf_K6Xz`Nkp@N@8;@NPH=KMzyz3os7<9$o_Pf$QNH;R^UADDC{q zQ1rsRa4Gg*fhWU%fTG9lgQCa23Pq274O+N=9WH|R3z6#w;1QVr5gq~`gfrkb5Q6=Y z({Ez_@RV)lL-2a|Ex2pSsQEAyeftQMe(c*&`nB&s>E|AW(yu)RMbG^c@rmC3E@shB z--Du`{uxUBe;>Y=cpt~#RQ&w_a}VZ!fzmHNfxYyLKh*O1r12x&FFk4e7<=g#p>YxZ ze}Z{G%s<6^Am*Q8o`U&bG2hcPYCZ)&3;zwuIOXS1^#9XP)Wa{J=;8l> z(!V|nrGI@6O27L{DE;j7Q2NzhLFre24W+;Q4V3ZU3sCym-$LnEUxd<+{tk+K{T_aT zeElc95xxXPKmP$O=w-&gdOkctyfV++3T3`}1(bHM%{0`0NUF9)2A<;e&zH}PJe9rel7D`VlC;GD_X8?xw+-; zmanyZzeQp?Tz+DiRMgI9lTP&VLLxSh%wz_lImeD?(n(e(^yf(VE&EG3@r3OU~k zeiG%wur8QCO4H`r>3C0OSZ6PsudsVD`>b~APt#6ityXhs=vgyoCU|f*57WUcf8}5b zA?U#+scqXarSV~7lg36w!LmA4b7Z+%G1T1^B!1eZicOl!869i`qNe^}XEV$jYz zmXnWJ{TVm!dQxF2r9D=-%hO539G0TwbBO#@xMy>jd?uDjdL9m{cDG%3C|;dzUoKO~ zs;`QFrJBCfc-hcWQc9^_sjyb`Sb@rm>nfG%yNv3)NTGCl$`01`${La?q^yO)ZO z@{p3m;+pwIkpeE(Eo$E4XygV7o77J*V{Wm&fD6uxBCO^pMrbCuiqItoBU0H_=zf*?APix?H9gN7q_c z=t(AGo$20;e(Xw}E36xjs20~MtGq6q&PvD4+sS-1n@qTQqBw87c-G~dUMJ_IX^DZz zdJ4&;lTW03GBygd7#VSS?XckHEVn0-wtDSEE}OJR;tO%BTkaM3T!&A|51+YwYx?gJ z&F$&^a@p)b8oQJCG`ZH$x9V6_(~W!4zPo5PaoV9x3s`6N(=zjXJ1~o44BENPw6e=} zqou7`?^f1`vIZ67tRZ|Rk*SC)CYM-J-k)2Dsz9SkiwCUy&q=~s&rz4tTGx+~>#*~- z<&LEF^Y<$|O0co(ClGE!e<9VAwiCXd98>2;HywZe`$%aT2XR45juPMB!=T~6MP zQvfL^pOfXMR(VVE@5ya@zY`nCW)f*%RNp*axY}|$n20+WHz1%5#&e<5vno+;HA*dS zEI)Q%U(V^H3oJGocChN#N9}TrWD5C0kJFp8Q_fH(H&80!8ANAT%VaRrna(@8w4E%e zmK87X1MS9lZ?qm89d>^6O-bg7ORZMF(3 zl9rCN+{aF)4;w2ZHIlXtH7Z6~uGSZEopVtxL%~cjAdpTsg)4)nNW`dDJC$R%a4#>t zqgO-mG3%{XcApq0yVk>o+1AW&csOL}9LP}c98MAl_Q6+>rw54T&3Kvru}(Z%w> zYh`?gS-+mG?WVQOG}~m*71?So;#*PKIb^fJelYH&GHvucbcKCIQP+ab3XGQb=L~Cs zVQqiCggvJs1C0xN2T~cMml7$I*}zy8K5HCFL9kt-$n#I86Md#@O*iNiss3i8qU!%x zw_?VVbDPR1c*(Mht+bgit4C$!#CyI<_Gvohae`lqKb<)UtEEWW&xbh7=K^hhC}NG9^sL6l{L zq}TnHV^`|@#^MiDPSnlNT@*XuGaHL9Rh(;{-B@_$s~bCm?IZA-E0BquVn%rz;}@?HBT##_FlNp9YccE7z1af37iZD7K^a@VeT@&hEUOFSyI? z9CQ9gCr3BXZ zCKF#Wkse_6uK38Lq-uryG+16Yk+z4NL{BD=!PS$9&yK}tx_Ork8V2RX7Az4ebtK=q z&viwHkV;M@hsrY{eRp0evn3Hwg{2Zz>){E-R~6Nm^NONe2SNl?d3k=~7P8q)uBet& zbv;igU!Cb}A>WmWJAvd%WtFNsSAHtwVM6f^I3txy(baM~p?K1EI+LZNlhxMZ5}o8o z>HWMw#SCX-(WG5S$NJ+@+DP8b(>Di7(%^IJ(u?%V^kTMdb+YdjSmzc8*V_@)*-}S= zx^k)Ga@7UmeedfvC9CbU3)ulJDsR0NQ7meM{bj9q^^Sy$lO|9ec@mrTmha|3m2KXX zVaKpI?%I@z*~!FKC#P+t{CpPkts8$u6qa9mwe;wOo$d5_URT=t;0wpC2LAU_$o7#WNpSN2&XKWNAAQ(`z8D-JVXeHu{lSeeA1ChQj+p zv1FzYk7r_TlnsBKnzYZoPN!X>=^z@*KN4W&C$ zgkv)^gnTZOw3g-avP(gptH(DJlKVC2<@HV<-EyvC_~`e`p>>;e-Z6vneusCy!tlpW zrS+YF2a(g7_4(Eqz18wUBAI71HeQHHC(kFM{dYKnPBN2qa(Z4_mIK#`6*x~a!bl?K z=zWl=-p7sFJ-UrJZCN|tAK0!8$w~3(hciq>dAlcxM0=l^I^D|hii?*Yz3f$q*L_B&-wGZO4 z3oPFh<7u#-f`fx%RPsa{-8c6-i9|M2Y=8~QnT+pa?3w3^-NbfWq&x-yyRv6BH6 zS&FF9_1Ug2FNy}+PnVu|b$4|aGt!`ZdG(XxxQ!o?oVS^9y_5$KsT5KaNL&6 z^dUTf^{oc$CrPW3k$tiGH9C%Cz~Q=b2DZlzWQr>4YOJ0*Q$*HoXY+-eQyR?$E3UzM z<4I&$`zXiMpdPdbdu26P*IhX>%GzMQii56_Xf)Vf?3llj(_pz$DR*;*8AT37P*JW1 z*FE|(2u5%%w$XgadWAR3teht_m@nO@<~Zb$_ltRMm7I3jX=E_o8qj9NGo5wxT=jfC z8`xhdD}ptSo;k@9Gm{_oe*D@#u__<6!>7IQrFPrkx)}QjD{2bzcF70(+gH3^yV*$< zal*UVWS~KL@wTvJ#V9nM<4Ah#`Cy&-i&Vsd`r$g9oT@5(SE^Sj z*F@?ym_G?J?*8S(%2lf0@0b#+YWk*Wy=qu*H>|t%eM7C)@mRMi-JKS%-tEny@ZFQh zVq+((*N$^M)>>s)D>xOdkM?#Li+E)Rh4yrZ9AjU)7bpBCdieOoaq>h*9X@>gEC0aZ zFDrBR_+I2LdU+_)z7AhzGp#@!miE zY5MTKEhj=#DySK?c8-_JtNdK*je9TIO;{UEr3FJ{>-Rd12K!J?ms;^j*G$S+Txh`2EH!hV{PJsi<-f zN>0=V6l-Nc8^0p`_OHh?h(e2S_9?i4YxvKIV9&&ia5i?eHgH zQTKArLOR8<>pqN6kF~}eXVuA{G~hAUVe5n&qg^$s zPhRan{DFR|u3YJIw&yr(vEGq`m`={>NZ5U8_Vg1m?N}OHNWoS$6XB z!OQ*LW}(C~fptBdw6~blE!%?KvMtC1@PeyTMOpG3EW^5a5|5%g(A_Vm+T?l+!%piu zrR!SM^KxHJ_u(YHfhjN(jk{-v2Z2lYM>m`<`t%XM2 z%taBDELoGqM!5l(4dm%nzxq@+e@x^#2HHG}iRnJ?M2>8!up=UyWHC9nZe3_6lUbVs zOJlB67xfZ*p^^vLr>dL292p9q$4jhE^g8QEbhRxT?34EPylhT3bDn}}0Xv}eVu^!q{{#+LsbA8+E7t7V}oqV7L#0ECYDPmo0Z#}lI z9t^ifKip#;o4z%PdfOLs)h~}TBdR%9MWBO2xQ|hmlchZM_6fS}K{nGWq>8;SN7fPR zhV$xA?eg`_4#S#dST{_f*7io)mQl{J_Yh?N0FD1Ty>@_?m38t0G|?&*)1k&^3Ble> zR)%Z$gY7H?uc3|Qi>t=wX8N{q_qlz!FE^m_)==>vw>c zJ4reA8t}(K`waiBLCIf^*Oz5dEhRIrG!hFj^NGlhj^E~-@Zz!8t@nD~ArVht+*x-W zegfx2C$!!i-cKv;^SO4f)0W}@MbvfDy2{J-oz16){c#ua9@TOpGu%OjJM$IIOSUGn z$1h%D_sS?H8!$)a>G!0S+fwlyaW-GvXVr2*yz_(c`jNWU;kNGdHIzCQOvI;Sb?B)JJ*YkDuQR*+Getltb!QEQx;iUpsYi5MXcbGdY7zY z&o$TbG70^M4AQ-szYN^c#LgXj5lINjLF=?Bi|Y3Fb`Q-O1L+CxbGg6FKXyS`6Zj=$b}4z&MJ zyAQn|psHS2fY8TKy!Vb)pTi5kH?}P1u77{uE2h%pmvTN+ezmHZ;$F6AG_X-G;fCz> z{dw^kYOl+JS1QFl)Gq42uR#2V(T3|?%S}Zm;(62el>+Hh-h0GPs6H$1SxOY4=N9+- zeSIz|5byZ+Mg07P%BAz|oeT9mgycPV|3Q0b<+og&p>^iK%3VkwmF|bsu-ErAYS`<% z$+#?#pf_5@DkL|aUXyzj;-62*z5KpH&smT60`Yq9SHvx(e|TSt7a$ZL^LqcDj~`zs z|16t$=gjpuwOnDc73#H_@cRY*ctY|}@m@CZ5=y5ex1n$q_rE1v=(z^ZbBl9W4yotz zIazU+bH3$bOuV1BIKY0I0q7Of>^8FU=TGbC$-z)L`h2*8Q1RT=4p1hRqfB5ka zw66$kV=POL@R&mb_K?1>cYj9b=rH*$S6ul02zuQv;9jjq{HtG~b{oj1SMX3e;e2^= o%^_-zW~K+CHXA}-xJ4D&E6$HNJ(YHn(c;PYwpg~1;%f8%0Udf;yZ`_I literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/PasteBoard.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/PasteBoard.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..ee2920bb8a32bd9c1f69c62f139f3dc7594bc577 GIT binary patch literal 3525 zcmbW3S#T9a6o$`Cq)M(UMJZ7rEV3B!PDcbJAQ~VLBa2Z)P*j+uZ!%`?%-A#cCIJ_s zf{HsXh#LXRD$57UDjt0D!Sc};U#+q%AAI%I*Z7~Fxp!_BmU3>*d^x92pYA?=PIrjD zra3e*#XalXMb#xDPP3w7q_}B24NyWFJZ;&ku>xOoM z%FwT-Rrs!;JG4#VBl~OlEIpS(SNzy-M~h6^({a&Q0xc~u^vHBO(K0$uwEPF-JnL`F z_2bt-T0x|_lE^q`ut!>OCgY;h;GK|9ft|VjE}}&zjWul7aoo6@*%)WM4Uz>vzA-@p zl$jsxe|J94TB5}U-Aj-c96@_Se<^N6Ka;w({efBR?}xw1$u0B%?08+Eu@`m^>V7@6 z72|L}5aVv6?U4H+gGL|N3-%%|JHTz=POu01K5z^85V#p^%TyB6J{RQmdEhosg1uk`#RJs- zzJ$#C_7%wae-7mRogjne5I+Wf88x67Fb)}^@olE2rL1{<*~>GnA5 zDC)Kn)yVM!DGs`kC%4u7ARSPVS94Q1!*dJXIIz=7q^f0JgYVj@ABDORpAud}^vb#n zqF5@N@~z8Aq+7!R$1FMO%9#6E6%3YGwv$9bEtTciPKUBcL}7q*Ts*aZ9x6EsN2%=u z94h_v@K?;Tjv_X)B9#nXnFy;dh#Wf@P)(JEg(RpFx(V;}c(LnjUA07sWXM*MuGMxd z2fl;9+qK*}zUPS4ugarQ$dkkg3cs!Gd7K;b+a84#f3T)>G!b$g7co$C5aIr?f=bs< z4}UM~$99LX#3IG^=>6=INoogabDcY`Z`MuQOic-y|5D%{FvL3ut!FMZ2cVT^1uru+U3?SRRn5qB;30r4ppBrh&@aZ1 zb=F)FP)QP$tnkq(?c~(NormWt;uA+BQU%eV71*`V9r9LRsb5Px*mV9S?7N}A{60_L zpZ)#2eC&&kDDlnSay;buVm0fgaaMTJsSTE^C{dmV9?q{~&ztsFQD@nSb2Iu+op)M| zp__}BgeU7F#MTqdYsy}#Y*!A+fXlqa?x<8q*6W&f3N;&5uW!moaaOR5hwCcyZ_DIx zmp<2ubu`y+S0q+jmxx4&%d~a8IIZIPTE|M{pQZE9LypuNn3`i|yr!$$t{_E_ zFNIuMNVlR>Fmr^H$Q8eqGW6_BSOz zRV@_BSb|*SCO+?`wqqYeo}?m)++j8#!p+D}+X)igB-YdHWrDikg7Z*JkvS^5h$A3M z7R@cS&044_3N41O0R3vZAcxSqj8%#%l{^&O!Y)gUQYqpQ6L@vaVXnNDm`t($smFw8 zr*^EOy6-Rt2|NZax-v3`py~{XS-D@;{?lP{>VNa+h)Q9m3e5%~C%GRH(%BsuxR>P|(DdW_ysKsB#zfN^>jSjgce@`MV&MEw!ua2*!7g}PE zC1gnys>0`x1!~+_s?;IN)G}h!p(ZrA7$f7LEUGl<32O@K8c^dY-rp# zQK|V$LFi{k>5h4D?zpjBsbf9{z5x6%xI(GL?*UJNeiumkW9|Vn5p98YLazjG15X9t z3ce70BX}Bk6L>m!19%2_9e5_V4?GLp1D*};23LW*z;nP6a5Z=Z_##l`dofr9&js_~ zd7uNH5B7s=z*mB6L8(U3hL!b8Nca}F`znr*)eXsQmJc>q+eg9)U|@!mFoB&;pE?U1awxZwy!|8<>~adPLRF=zo(xbQ9DVukWxWoKj}twzA?3nawH!}xmT)JLthIG8vDS%0rz&? zXY2;A0$&5}Cj2V!N^lQ223F;JEqqLMwb}>&=Te^F0%pTCI{aF79qBJ7J-FvNgkP`2 zU#D&${3OCb^6yu#Cw@NpLFgORO~j{(2cd6PZ-8!t1~vaT5^ktB>2?tLtMc4Reg4!w zZoHZFzi)qwdVAClZ>1kT(D62*^}Gd%A2;3szh~1Qw}FQu-|d7y-hQ8P2lxo_cM|?A zdG?^4+WMBRowwXzV86IP^T|cR?T3{%-Xi|!;4SWQAg7%v?_v?bX{XpYB@_z%o9sDME3-~SYX7JnKjo^2{ z{os?}_275GtHAG3P6y?FpZ44V{R6Nc{2?gg>qn%!yzR&8r+QrdtNKY)E_js8`+p<+ zy&eC~KauCBf{eGHssD)Lf3EZWLTD{7Xk6CzpX$G&_+RSyUkR<_L1P=`{~Ej){0+Ds z{BQ7F@F`Hn^Zy{XjOX7%%e?&^DD(Dz!K=Xk1NVZz2W7thfp&fR=|8GJkx$kOP_Gw% zhCWO^4Hd2zAnjooDZP%Gf?6)nIK6F-(XPYW1a&xQtU#^~@HlWTcqBLvKJAo~hW^f+ zapMqB#`CiXm;OH#`V)k+Y3lZ$5B)*t=RnUPegU-1%jbeO5WWzUem)G8eqIDhKOYWC zdn_iO%-19Id^yTE5;WCO#?ge!d-xEeeYd^LC$=z(X0 zL*OdV2G0Svf~&y|;ETZX!54$8Q|B7z!S5_+(8z%2gR-uz0cBlU3!Y4P7wM$_>p-dR z1%xkw?gkfu>uE>Pe_jIpeUtqk{5p6c_$asmdeJb z?9}N-jWP1cJOGdQq_NAmGNM7|$*YasIvxAJ&Nm*>dyUsXf85w>Tm?P=(wXqxYrHn< zZ;)|(wQ;=;zsA@HK5ASev>w;j>T!LY&`V_;gyH***Xi&ZjGJ`$enI%WUXXIejTGA;=HHskHkvW|n) z<2K_RI{Y@{cEV*{2MNE^xI>5EDf?`7zt!#jPH0&-?*>J$x(Af?^d1Kk99oU z@kGauJAT)J+A7(zZZTt*%LONMMJ1mdF1YS+#&hhPTPlo&?A6ir>55J+Z~Kln;&?fo z^w=rlJ9m2dz)|YN`gA3~;uZYB_3S|>4o2~e%H4?8>YPCAjw9K;UnR#=>w9UYDpyi(j7ERaeC#Il7 zH}bEaaETi;twqA%x$&W*&-x2CWi$sYx!wm@kY)oQ1K%)@P2jYOi(qtTc@6<#m@ye;T#MY=|VTi*MYYQtxu2 z!TZMiz$tdQrGfll#nUaG=mgKseiX@3!H*e z9&$@#l^|cp2ed(k1);zYWR%3*mAY_d{1c6n@!d)(7gb-KGc$h0s!%VUS^i6%{;fU9 zdd-l})*k7GXfBB;7tBnaHCg7VpJxW=gSvq`!}-H^hV}4aPM* z8$K=PQI{VuxH7P6?ytm9 zwOY^P0XysT%ih|u|EJHdkS`6h4_CWPYO1>Br*7SvK0iNSvUfW9em5cD##!*QvstEY z;Ipx_DpY5%FjPwPg_h%@+a;$`FOkG`^_kXscR|tJk>4Dzu(cXBufx;g*Tf1B<4oiV z7f8DlWc<4AOf|RjwB+h3l`BE7n{%236#00tWaLS0Fs$7zRhnMZmlEGWRGOT*%-oDJ ztH$p9}!>+ z-@%Y)sB5k6>|D8O&1Ke)RQl@*=`PZ>a3_(z5A{rH5~o|I<+ov3(zVN&>k(R%I~$y^ z4X6yy`SNq%<8s&;>vwH*=IRpAyq-*}-%EDMm5J?-m9jB2MAG_oLU$M~XEO!6QpyhH zGORs;AE5KpN}otCnO6C|T7O#O`%bi*iM|@EjSO>#2`@H;v=h&9d|S?U&C6F8OX34> zS8b25-Xu50N`E1rtyXo0ddNh4wIVF~=QQdgJ+WPzR@)Ozwtbt6rr#GS{M*p63;A7+ zr$eRwJS+LOt(kJpkrNpqn#&mKP)@G;Y_-+BcwWjL`OPM$E_$_FoC~ucCmHs?7aWF=% zk-S)wl9)&A#FqVo#lrB@s{FFZbg{NZ%&bA|ToGs@{bXA0o2*o#bwjyYwohWCNGuas zgc-@_oZ8l}?ci4JJUJgdXR1QYf{$In?5Xl;*5jttPWH%vSP!}zs;qSXiQgmc?`*-X zy8TALkjYtOn+@0LO6^h8Eq%{uM&?4q;N^@e?Gi=DH*F1J{AeJ3+e z4X3Ovd}lC@*4cp_+9sK`&X7HlcfCzznQB$-FJlU0l{(q9-fmba!@9bqYH$#>l8Q=~ z4xUyrp=y9)F@ZuP8W1W))*R+vLMxh$QdHGsL|2=kDAs<%?3~AMdY^Hy#OgwA%9=xH zX`(9jX@#=P{~_uh=&&i;$2!5ZmYQbgB9yuG^UURZ^>~@U?wZ#8&pAc66I~?0D6I}b z%@B{OJgM6a>krD>^GppwPo;-vJ_toy&6*W7Zqdl6)u8mOPwIe==(vNXZ~a!G!qU7? zwXAe&rM!=h9)Yh|3Tq|3Cr7<6Rv{>Ur_t*lNSpF9KCV}Pz@DwP<*Vz#ngS(mGM>6gju?2jX?Hz;do*g9qp zsRwAY#2UUlU12I&x2dC7X3}qxyai^1N1`3p2W65~)bjNEk^MBjE%k{m+ryRYEnADa zQotd$i4j+@#~z5*srMV!TEqGkU85U7)_>Vn9M%HM+(?xY2N32|6}^~>UWjyh!p1F< ztk-Ndr>TnnGR1#kI>pbfmS-9B(ksKQjfIajZ^kD&Q#R<`6!nf|QEG<%(`+~js;ib# zFPd`PBo7TXd+q>-I=;188^1lJ0XLjCQ~N8L?55uEh{RzTE!39LneM~=l|sQ`6RvlD zAlnSvso)L{*7=!dxV~S6A7zU($X?;qxzQv4Wa!VWDbAb2aSCqP@$`9HY(Mx;w!%5;7#`KEqxI^H?(dA< zuWeeVvup=L;mK%t;8|~9RF6)bQ5Xewe*p_LeD;Kpy0YagIf&|bL8YBWO$Zsz7dfW8 z|76w|+Oq{$KUKcXn=fJ1;zg2#N}VDN^xHm$Qw>(hp{ z(y%^s@W;%A9WUl(j&8U4Wci48>}wTMZoK4CJIAyRTtVp+I-AspXQO6KIL@9qr;6yU zv-4g&XjmV`tD?>82aM(E2aM_KoCn9aKg|q{`%}&7m)vMRJY&W^L;Os>_4A`?9d5WE zP(4BmcZ`E&7smarm%@1rh3G_c9#)@^LFh5o#g!7y1#xlY7@E>+JNYk%hBhJM_nK%i z6=SVxZHr;J2)pop>OQKcxk`DnnA`Q^cB;~Gg6h%>y5w(0<$qOKduJiSUwP&xeHo8M zzKk#GnoVgJG}%36r<`FEiEm=nbV^}3<$f3O!x8RuyI#?5xc6{V)ZW)WV~t(b9uIN- z_3JU}F-q$;e=X6bNUoj(kgE%R;)V>5&&8)AUX*UE`}3p^^z$5k>*se+EE6VnZM<(D zh+Pw2Bt1^Jx6(VpewbPhjryyvWS9LR&c}r>&v*!_yAGf|{u=9O)Xdty)UrML>=BHV zx>HGP3TI*DUpmyVZk|O|4`lwYVS$`nsSt&N#qya_Bevqz+n{xt`Z+PBU!rNgkZPqI_Ps+7&&WKgQ^`q2+8lB??O4b>23gX^Kq~ihv&Zm`}6Zo|AR*BaU7#h2NRVdSU1~Z8r4e3`MjOS?5Qs&S)Q8!Fn9tH!m0L zV1PZT6LY3|H$jAyC&PCFIja7qY6Wvne`Sys%~c&ow$80mFIN_#EmhXxy29O@{`86> ze5ARF10wxLR3K5Xhs{o{E-|Dfeh`TRvvalFI8x^~U*=cRVD3x~i(|uBeHnOR| zt*o=jR6TQYaO3wfh1c<2W?71v%+V8#Yn`If$Lkhw(cOadv1F>LbnJgJhvec~7LUH{ zkaE?{mz^4&7z!%A@bYBi9*|3Ux|CsO2iXEFsjA z@Lp7+;p?w34ceobY#~o^;k_uz*+4lHX?U_Kh>aFDvh2!Iw{U-U%u#5mrK@k!$td@t znjR^Yh&w(nm%5#dJt}vBq>j2B>h@XoZ!5Y{X8D}@2m>W=+RBsKr>s@VI%9f6bY(O| zGYrub6>EOsBA}DXgcs;MIjj*iJ!f`G2NzX3hXav=7i(0dT`AG0f{ZWGJ;YxXSF7Ir z%ykeOZ-U%+iF%ROEk*iCGDwtuA0v)W`i&)8t>PO;PoU3ecViAOM)fs|q?a~&4`;Zm zJK?@sQyNQb*SZv?4i$_G;=PJ6;;{N~GDeqqkI36{CXdV`4)pHe7;~DuJ7qfP(!%BcQ4@${T$v^ ziSE%$y!J1~{93-}An6<0J-$aTkvw|ei}^+O<9Y2?BIEFh?(s^B@I9h9UDfz)d><=5 z?~d*jH`KH4zNqlk%UsMi^n&SIgc95IURd)z$S|4qmnZ5`fA5bp4RX}oGZYpL{hEvR zlg9a$yziz<)_&bse!0Jf-y>_7zsY-HlkwB{;q*QpmoxeOCe5X(zIFFcBuRsO zwSH@mFM01kb8cwIx^r?#Aa+)wAHwr^g5;bb7JvHdQuMlB<2XqyPf}ob{*@@8@!q}m ziznin$5E!Nk1F-L#$g4n-_mf#&gG(&c{ydo@>lhvVcueL3KJ}_)Z;wA(L#xUI*5O4#UEDIZh*|4xCV$j5%?wXl)db-={ z?%4;vB8CVEiikoCAfkw(LB$6?@QorqlFd2t!E^K+{on`A@f`ht=jfO9f2(_Dy7!U9 zp0oX%x^?ST)vc;qcb4b`_0q8gpWo8YlNjsv#*Li{3-;rgzcJw3psNd*-!# zJIb>i*)H0tKD#LW%YD$Av5uHcJiPk@%A7}aUOy2*fK1&x6t$7H9TyX>V0Lm8;_1^=&9%Q|Zkl&@h zf%OIs>6`NQ51ffonMe!uV`P9{YOluy2Z?$FxEZW~mw@}gONq|d3%(I$=4Id>{c?H} z?BAeY!Bpc1d#=-m=t|Y^7N(MeJ)>xM6}T0AGk6vF7VrviD>w*l11|=L!42Tm;5u*w zTmxPMt^lvaJkQccX*h$08RmT}$n*aw zsdr?h9ZKWi^)eR`s&@^uV5Xc|@+dV=5O$nu>^Fl9(#Ips;| z#sVsE`^og^HC%6o(rsC>Fhy*e^&pC)bQC7hiUswNkS*61IFkIF!>>a7PzG^e2VSah z_QHBAiYA?f{nliVgt&X)19M_Jibd1h=~kpAr_J$nc%#y4ipfAWV4CN(Krg4TLDjeC z)v~173@WZC%$w}M5mzU!7mv%pNo>rOpFX93jc5rk2!-UEBj?^o*a;juZHOsbgs~g= zMis^)!>UAqm&BqRT5&z~eBgW2*mlMC+0uw97>ccm$4jH0ZT#-|FE`Ha+(lJL;ltym zvE2(QmNzatA|v$N2vLz&VAJWml1Q3S-I9XNRC-+Y+zP(0ROP&%oQfH{O)(Sr zo&D1pAMcN*g|(4JsFsm$veO@bcfU@=*riR^ukH3{+;Ae@Qk}`bByMWVCqJ%i{n~yR z3H+*COQglCfu&UIVU8yi&$V~>)qux^XB)pxYR9tcaBX*JV``sl7g20^ac4-^p2|*c zQF6vAiRX#f^(%oTosKcsLOAEAbPJuUn|i2A-PK#VrN_EJnZHSJ4D|6=gVfR2>En&}-^}UV#M5(Di*d{}1mnjZBDf{+C+8pRvc(Y};NaT@*!gGnL1 zpk{bh;@frSqEofY`GZx9aiF`;akKDKdhn!vD9&#uCQyL~*hkZt?^0e_#1HxeJj}kc z;2{?ttm(V)p27DJb?ny`zO!F*u7am{KX&)X{}T_=Nc<|aFYf2K8A7(MV0Y1D0S&@$ z5Te@iu5ZoSPvBFJ*Lsk`A z5AN=k`&O%aq}yNnDhp$TQuSPrqBM}Vn;DJFHMDwgsPAmtR;<^xvvAx}*urfIwVqHd zT~6jDwD_69A>q^KV6O%GlvySow%NCddf}|~Jf2~`d((I^itAv9AB!4a6T5Loj(D!{ zWB#R*8_y#9#tj;7Tu#uUY^x>!LMxl+hYxA!S#dRx%`)HhuB{@Ts>I8{-y-vE-&bu% zI--))uyRiO;;~W#rJKow3)Yf(j&kfM4#AjSUV*~(`f&OMu>y{;^@d(X>QZ-To(3c*ilBUP^EBVz-)2eZLLI@?PiXwfyQjz^c`xs3Db6n-f*%7wc~nVIboXX+?Eo z!fht-tWYJ@ZP!lS@@wi`$;=S%>u&WT>)6CSQuczNk%Wd9*p^rJk*%nE8BI&QWG9fx9A|%i4WezETk7iI^OhS&q!PEKmy7xr)yKtBOIK9wmu~+!2}1G> zk4eY?IZ)J*V6MKfxsFY8-k2MQlZd$C2a}jR++tYJYvEuLomJHHqHNxSMY$bFfu2>O zYj_bK&$f-!)zX*>ZM0ckY?me}wJdpn%DiXN%}=~y1f>wyfrns~s06Eypj5`~Vm7JIK?1dU&@iW{FW?>{L_@?y z&ZI8HV7lwI^fIea<2COb6dJJ35dOOM7Kt}1op;K-oaxVl{I3uE`;Cn>Mn-dK*swp% z7gq5C;eD3tXvqX*OF`}Q$J72Ds?MD+V#9O&hG98Q7QZ(Z?6&XghLFDS3?v#-;&7Dh IFyYkD2#X@1h@b{BL|sw$FR}uQc;JBui>wFhUp#Ra6g+T6m;d+os;aBHx@R&>^0($Q z^PP9rt9Sg~@4fe{QtH#@>(y2>{d1Rjq4vAgxYgKZ-eLsdIiug`H5M6fHcmB8F-|rX z8YhGyQTlnfx7Bl-YaFb9<{ER2E`Fm}5hdou^}BDZ|5xU}W7LuSou>}x@3y9&!?bUd zkMK}67r*#N@;(@!*`coru3h(3+srvi?b@Zf2vIXl+;DdLZf_9x93yZapwuDi9#g%c zZMSe)5OqfejFYLzXOklkHR+*{}JNBgC3fBf?625A@R1EC&I75 zli+>uWcWpR3cMGd3O@ti4DW`gLAh@a+yWQDJ7F)p9WI7a{v}YJXDR$JTn2B3r^ENd zJGR7ek}Bd)Wav# z$Kf$>OXv^VkEDEe!NcGu;aqq(oC7}v4}e?YKJXs6C)@^Sz)!;-_!+nueikl={|r~b z&%r);FI*2l56^>NfHwRh9EAS@i}3%z3j7kR!u#L?_+@w!ydNF|{}nz6zXGSj2cQWb zgn!?4oB0s@3;Z|u2lz020e%(!7Cr)h4Zj9|4!;hcf!}~Xgx`cu!AIfu;J4s6;kV(# z@H_B+_+9t~_!#^Q{2ts2ABS7u_u-xJ33xkv5`Gx|JG>b_1#g5ufY-sN;k)2}z|HW7 z@E!0+@KX3=xDoyYR^c;@ll>VV|A~7T_fKIS{$KcZ_%nDOd={>UKZk4JFW}kmmv9CA z6+9jO8ur59z*FFJa3TCHJQn^J%)%%e((=) zZ}>;J8~hXOgnx#+z?Y!`{{sJ(*=GI^d>Q@~z6f7|&%?jL-@w1aXW{?CpTJk)Q&1VI z{c&i(N1+KHfo!0vkW!M$?RwBZ>X#Hqg~;w zw`LA74m8v?;)d<(iFXj}gRh5Y!r5>sZ=TznJ`9eRYYklz4md+|YQ4c*}IU(~afaN76y=dxmi)?)z~= z<6gJ|ZiOr1-EbA$(s_@07W_C|4e!MNY`u9ga5utBa3=0D;g3zf z$8>dm+sq37GYG#>-`_VpT`u3K;=e2Y(70nd^FQtk?or$;aBqZ5;3g>bJO)p~eUVOo zv2jTlE<76lOW_glGI%h&93BAQ0i}JefP3P;Qm22Xaa9;DoR0ry*aokr9G#To8r;ux zF#p4+;kEEd_-^D=c7xZi>MrZD{n@$bO@X8g~`pZ>4g`&QiN;{Fgk2Ywi?gSWwc_z`#pyq)yz zr2i=S9f$i4coe)7N;`jyct>=6+_+n}?1O@Xv}{heM-_`+p7|2=9e^!q3C$@C#7-)fXxEF7%&&!TpPN z=70DM{1W^=ybnsfe;Ize{eI&sJkQth|5x}h#7%oVU_69d+T%ee?ScFChWa<-tAyXz z{;+V?7l|+KdpjO6zJXiX>1&kxu8yyZTbCOe_Ym)!@MG{%cq{xCya9e2UJbtkFKz#> z@fi7R#0`xi{2t81$Kko~`*1aU0xpM7!c*YC!(-u7@NoD8IJf<2<3Gr64sK}d3x5cu z-~0$lfB7-o1OJ~8PoDo7D9`(!__yQ!Dg65`%>VEu_%rw$_$>S>{5gCI{sKM@e+j<^ ze+BP{zlNWKzk#2G&%uwt-@=>Vf5GeEf5WTb^YCK$0=y9Z4i3ZL!wv97xE{U)SHeHQ z9{5Kn{q|2#`oo{$oA7@bX5nApVeo(89QaqbFMI{=1^)(Tz`w)C7{C7u74BEz%hTw+ z^xxk>1O5t{@EO>~yfTe(G7b0Ww5{eY@Iu%QFPOHg*#T`h9i9t2VL!}}u1)P~&M<>@ zs_?{VGtJ!zUodSqp98KXYL=m zA^q(D^T5yzwR|`TNv2CD_fb6G95@$tLFo?%!!F!!AfD_8%*FlJwr%Dia5m%b zQ2a$sztNQOa=3XIG~qn_MNUKGMdBZUTjql!aeof?QMg54=*E3M?krpfEhut*K3swO zXei_27%1&>ER=RR4obTm4@KTDfFkeT1Z5sL0gBvT2u04H2u04H1Vz4|3`M@50!8kh z3PsMp8H!v#4N8CSfr}`|BDfIt!ufD9JPa;@v*A)G^T0AF^8a)w@_#v;Mfe#|=7BSz z$b}V97PjoSZu^L_9!^LlXy^FQ^={4Z`@zk&Zv z=KHn(2h3Zv|4l;j`Jj;dF#qd(*q0=qIqkQaw-G+K{X;?>{^2lO++QUAN3{EP^P|KQ zeE?F9JIp)vb20yG_s7hS;}(4Y@*G>tPiX%w(mq;0h}!9sp6DbEf>dvXzJj` zcqJ!auzklHb-cWe+P%>$R2`+d8snAynpgB4-!Hi3AYz#3fsOH+@_S=rc#u!k_3R-h z>ujnzWy!HSXXl2wDHm!~@;P{#Zr?8F2i#4%cy(Ay2;uS{is$)6ToHgwF zRX?b8OR0UD!lf1pImed(rS_FS4e2YMTXl18F^I5tbGYsM8}rTg9rD~-MV(B1qn_WW z?O7#vpip$I6@>xM_QtGUw>(%Fs(E&m3R&&Bg9Q54>e@iDkXv3Jbme|rr^%lQ^O36b zt+*?!)c0BD_*J`D%~py9ze*NMwwKRp&lz+)r%a6`G8?EBi%zvr9&l|sOq3aU1@%$$ zJgCVcLt#9U2GDGyh#{F&(aT9-@rJI^V(RVOIbvD?e1H>juH zVJA0IaSP?JYEIo=y4Lp}E#w{7PgKYh^I7iS?K4E9doSsb@ynPT<$DdPE2=FIOF} zY!~Z8Y-x0N-|DmTw%6;HDz5Kj>!l)X-_)LOv0b%$a*P!}yT}=~M+>fZRz*f~)F;rq zq)U$)b#sZ3enDINt9Rp;$9;jJ69TtS)vZYsqZ;}+u;q{Xe# z!W`1}qXjwqRFh@cks|a{ke~+gJ5n6$1BTh%$=}R%#?C5QFZGnu&nu17ubZ$!oe$G6 zqP4YbqI5l3^G)kW)9l_ynO0_=Igj5d%j-NMvDCX%A8^hm3{_IVMVg!$f%W;dmlkC)F% z(FCn^qK#;|WvxXaTIQ4;+)lpkzuK;fRIT?VPFCb*IHb|B+LH z#5t+Ed;Y?nbFI9}tf$3TB8p^m#~JyNY>4AYpDB?>T7J9%xJI{@!*Vns?C2m|qR$!i z8KjS4RCUWJiBp{4bIgC9otUte$xU8+y9V>SUqtQjhuw{FhWqRCMtW~T&(!V9u`}VZ zZfK9vL7Zx!`D=}ylTf+ZZhj5zxl#{;0+lTDLm=y1_6DTmH~RU~!7tPk5%V2$pf#qf zQN{kpMq(DJ@{BJok(j06-wSA)8eKtV!y;bcb&Rl8y#@Vv^)Sl1Ov;u&R@VA+SVdWq zwbVz`>DCO_N&{uP5bFEm>hI}v{oK!5YUiAu;y|sG%0;Q8CVT&tP8A)cYRhwS&EeOu z`p5jLQ>u5zUfc5uj@PvaO^DTk#5+>QYtjDobw*q_5^@jEC z37dZ>P6!vPOm*rLLc@Ti_f1NYyr42a+ZmE1%Qjb$-Z>yWv$Z@5RV|T9BG4Qpk<}<= zaEsF5@lzn&W6oGae=jqui2jDevOa2bW^OTvC{s%uac60C+q?a2vokZxoW$*S>?t>M zo6AhCh%rTn6*r!GJn_W5y(juTw|XvlD+a)6G74JBlW5$uUiYyM=^u8GpwUuzit}{Q z&FN`3T4t$}rdFP1OU??4GR5^C3#a~CrQ&+g6RnwAISTFw%h=^-g_{qaT^TOq{H1oO zP#mk*m1KQ5zb)l)RPT!mInhUK1f2*tnUv%CI2B0PY5X>}<4U{CW>dZ^*?__HX=Rrc z-2uCp2&tFt#HM^IEjL6~IaOKD_E%{>zsfU)IUGI7^yMIZz1^GlKa%$i$6Jm;b#Y(#(`wwh~=%sVLI@H>x=LzdDYNtdcCW=&bicV$NEsxczg<_#f8)i{6 zi-B4i=dRQlQ_DY5Iayye1fu$HZof&Dw-ojJQ>IoP*A4K5LgZZUaqqzb@F5 zD6rF5s5T6|Dawal*K=07G9bf;eDl=msehOOT^@>SD%iJ~P;W`?Ypz``gRbT;vOUW1 zCVnTBBjJ8utots{u{)!E6D1I2SYTnnHe13yyj{~xI zA5AJdm|w9_9$|GCHJLoAS}K30_`H6hY;SZ518$;#D|R41JC|eVR(%cxkfG5CmJF3X zub8l1m%5}>YKr@kOG@qqg@ov;KT)$Bo|OD(%4*#8_QY~CUbp)V)3Iu<=Sh`odAU-n zu5|NGQvri&ZZU68D&G-jtnnzIx!+GJpR!$cWq`THSLFwQ1b zA0^q1VO+?GTO_>oQBd@#Q=Bhb<*QGGM9-VV^GHi<;Lxq;Y)DkuhIK9{XZ_&;+B$UE zV&Njk)4uZjT=V&zF#m=utg!Z4$4KQI?;>jOv=$L_a>EJf5ov!`cY=IGMdP6 zih4#q+5=i8g_@{;G|gLuYK;vjpEFb^Z*eNy?K!?%M8B%f$&#gvo4EfL^&w-yE@x{4 z1GgzY0oDurN?(iJWdthHfg))42oQlM7z=%ng5`A~`4o$|hC zj>70OxhS(KuFE7JJ!W=7K6VZDJj$n8-nv)PW9upEzqw!+F6s?R@uq`ZZQq)3<89)7kJoTEXMI*#?^A3?#m9%iCV4S=6vi$L zTTVHCWDhntagl?(`Z-GGa)qtd8je4rjrSgXWJy$l zIz_kQczT~F9#6iLt6_gLh9;bI^!agC+ks^50WIU5?uuO}6<7^_Msy$Fd zA_vzM0opE}uz&5ujoqTkIO&aD%5a*LW1{&kIgTgTpV^&k((NKy2lcD%P*`F*YPyam zZstJ#-%q=f>&*OsRV|d9i#XOH>^Oc~mM_@nkDDr(v9fI3jcgFDRnl?srjuN4U!Aa? zljE*=LwKBVY`s_Mk(fH+Z@u%J9L9{|R%ee(^zgrcedm@p%v>f9GH!iD>z6ab6@axu z)V}(LTx8F~n{INoZQ1$t(ek0>XgJR!*`eT)Ep%TW>xq#>0ns(4tER@by|{CY6{QwX z*p}ltdfp~|ELs8u<6F*m;!YCwvuvz?vFT8?3!JKUV^6keOdZw`KaN+|)9ML`$TjZy zQB=N_dL`2pO{PJqf^~FUuJpWJH=9f85z(xj&vJ+?0=dQg$D6mK6hXPCD8JJ5@^+OAk`rLWeYkr}Qg!>UxWXN>o2x?UWK zJ8n^SfMM-}wVO71+S{0y+1r?WrR+STtD6m3P*|CpUc=p2=(#(#Km3OpUD1)|@;l*p z?Pa5$W330I*U|63v;*C(v8}br)=Be+ww#^XfJsbYifA;EUL$5^c@F2Ll{WIf7$n&E zjA!bU>ZaBgXpnu>yv)5p`PC%>+eUZpb1+xcAB6wYrSQU1RJN~ghWZ!tg|pQ4N_OhJ z;QFxq*X}_1ThF$wZ8v?IM@%=wtZ+cry+`dQY%{bKnNrt=<$C8os9dQUZYt3&VR>%+ z2bE{SZG>d$5D{`UpP#4Z$(5L9Sv|F?yOftZhL@COv73+Vzmw~`RJtbpoe74$P3_Hn z_u#j2yrWm*C-z^l{`^|j>A?#%+toY5a`l((3Ko6gZh=x;xi44SCw8En{!ubhTJBgW z?L_PQetQ&SjE3E0j&U8)Cnro7)Q@_PArV#EX2aUUu-?A|wengv&-Tl3$@fL3pLPV&R>|>8|yEL7w6MlZqLa% zg;7Uoc_LBPkt**x>Hyup!ub8Qfs(cyA!Jq}z8J?i`9vWJ)313p z+(!~L-aovL_LqIms9fp%q#$xmLwHy@@?z9LZIBoK8t)pukGcG;{+cINDf%(xjQ}^Q zzrBKd!tj22OV)~Qb8ox}PF^X=oLzcF0q z8eTB04x$5g+ws|?+*U5J^KQ{kqW$$~qdd=J57FcE(MGwgQ>(VODruT#XNdc zj$IznNM*Oj7fnln7>qROCrIS&t>s^*Lgz z+Uwc=aJIits?j4H?b44OcYtA=7dJ$nds?amax4yRG44yeAKEQ%P;*4cCcj8ZXT{!J*WWQCej+4;O^%_mSfQ z^B~n)frFsv&Dp&rS{%;#Qn^~Gl`68oobWFN#;|NE$1fXa*@>1@CS5bHOU2j1vxKfK z{#@D~C%#XhTuXSigi!*9wzWcJcA?`REPq?ZkD_HU>1paWLB32!?7G(9Uz4nkXv{A( zpOvG+oXvq5j~y7)hGtW0USoWp8KXQDnk;#)wy!CVVy?nQvo?m%^_Xl2WR$dmmZ$M^ z3{kgEiEVNA^>WgowH%DYbE74{AA6Xfzr_9}+smOn1m{qRdhr8$$b7c!>*`477lo(f zTJmvZXx01y+w-eqMTa?@cSCqPNN&cJ>Ibb8Cft#+|t8Iy*I$|dj1v`lB03v4b>!tOzN3BKF*2KX?7r}dOp z_sJK0dEp(!Dft-z)iqxJ!v%Uz9QT06cm+5M5XH&oYH08Hu1)a|z;>4`ouOKodCw*?3xPNa?A5*>K)vHp@V-n$^{j$yL zN;Tl@TrPQu9gl*@A*SROWjTV$UDca7z9L@=1DQHJDIRa<0+- zY{YRY$Qaa8eQuSgr^a~Is^29K7ne7%8R`+sp|fjFEgn)Sxz=bZ*mKSz`u`&NMnlv< zx*pap@9AHYw1?@f&-{m`?%QB`IAm|i)<={?Y^wh?=(pO&G+V@omm!SM)`Kin|8YDo zuV=PYd&l8yf_PPo7(xM-n&0a2wEo?n^9mIPXY{a?FV(K`_fXHv zi0N3M5T)kBfdZessJbIgWH*-zuOHwBy&}}l+6bdg`H^=F7dRM$TeQq$EpR@J<&>2{VrP`|=nq`Y`c#%hqd%C^k z{nfUJ^<|%xtm|c$v7Qy} zAyQY<`36>Kfw^z1`b_8#{lS3HrE40;N&Qe}diiKoIiHv$QvI2Mmt~)@;H2et-CkN- zU-N)`VW+^8G|9)vt~%U_iMmXx-edb~;@eCDss54-=l^KdZtC}OJk(bGxu>um#x0jD zCt1Tp3p~A_7`IoPUlcE_-PAfOj;D1+mJ~w{^IfooCPmQuWUcbm@h1w;mkJEtlswVn zE2zsr5~ap#ptmCQqK{t1{|521QmD8*6Ydv;*3^rw31kVrus*| z=2S-zbnKS!PBBUlTMld}hx@Z}d5eDd+^P9b`hzr&=v~>OU*rEMk5IA%YC?LQ5VYG+ z_z^c$g;YB=ewR(G=6Ecv#Wp^UmXmQY8(+H!te>T}n&ekQMA1}I^J#8Szr96`Xl<^! z-$volq_dmcBrZrbmkTN^HU32cg)hM6Dzs)km5!nW=~CmfaXlpKmtgZgcpr=XyE7xb zn?2LyKB}C4$r)d;xhp2`vZpFm7IF@@iNCVD>S{$?PCvYGhcz{hQ|t3^{%SZEWm4ti zBt8!%RiWp%rf}J<3Kp1JFK7y9`Wnf*8_VoN-whnC3Lzz$FH#O63!@c z-koR%^kCo1;gyoJp?)l8py7M&;eGV_t>HdmhZ(-1XVr_P-V?-c+pMgG$~s=YzoC~s zsp^-{ABjPWm{M%A=7(Qt%Bs#x8x7X{y|gOkj1~Ngq?0!k#8fJ8cFTr&NoDdFpdUCt zYi&{)SMKPOEBp0w`X~Bj-2KKMKH+1gj~>2uxdf&B_5PChr}V;}`mM>ts1v)AfA=12M7WteZO9pmp_2K*iBt;R;54s@$Rn={is4pM1Yj=iefoUemPj*L^2d z5A>J#JE4-{i4EnQyc`Zci=5s!B7gn;pY*yc{au0d{#Nt&43+8Bcu0tQT^;HBq`#{g z+(&=^G&)nUqB6=!OWkpDkX;*x+{a9AGVTs1<0F}j!*POEz^g6gk*uB12iq6=ye;kz Wk$naWx3W{rMu$?}IgZcRdiZ~alQ0+n literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/accessoryd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/accessoryd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..71a62edbaad5aed9df37fcc5b1606410ec7a196e GIT binary patch literal 4141 zcmb7HTZ|mV6}{bS6FdnJFxUozZH##=X1W$IgyreQ#*V>;O-vku0n^i6v(s#MSEssX zcE{#rz>we&OfZjx_anhTlC>i~!Us~M@WBTX5)wj)FNB1I_#q$pK!TWat9zzryldE0 zYx?ZHb?erxQ@3vQ68(dYq^W7o>-2)rjng>Yj9+fCg*MYww3bF_HC;iM(lL^vIOAC1fv! zmX=y(W;%)JRN7Cp{2OaO>yIw1;2`8rAfJu? zkAN!+yK|ubz^d}NCGS}dV`tu-M?e~a-+x+DbT06X+~3?O;Q2(m<|4jTz&Uh*8Nb)M zkbY8(2O{nRbP@dSv4-&%`(-Zkc()XIDbXnwT}F@>?uOrv{&09D#tqOKV}H*K_Uqv9 z;KB9uQ`p&<4QRDtx513Nny$e-JPwF?H_|4^8DyZPf!6{Rc)ku80Y`!3(EkkB0R9|U z2X^AS-uU^2iHH4k^uL7PTOi*6`>ocm=%#{?8^On3Yb(o!XW-6aKM~I@w5^B-2>DiW zAu}&P!+#C992b-}syHSiwbSHOFLUjpyL{9gcf0Y3%a4`kjSK>sK7 z8+yp_{abplm=|dBayRsQtlwb-$MX;)_UZTZNYVeW8MlXJ6ED#EnEpVI75$Hz{=F=l zexUUsygUwkANT~2^W;hJH-NnVBXADzPtd=I{-=QN0-pxH1AGSfHt<>Czk$yI{{?&= z_*T!kd68(*oAeUBT&x=i`Ooy1V*S8HZ_qw^#pw6Zs|6oG*u4f%Ie$P?H~tEl_xW!? zJ|}+%az0Ff{<)?eVH*lGK!euR)(-1_>nUrW^_KNtYZ&nUwz{ftup1QFgM_N59xQ)bi$uL@0eE21htss+}utx8HtTSO}n}+M)R=OX*ZG+ zN{_=euXmbVkHHzHfBJgG4W9DlmCYc`Mz!*r9@fgOV(iz-mJC%QHEyVOI6s+WHoWKM!q8|4%Sui>)#IiqU2*47?3-U9l6i z)%^M{zSg*215}lvY%+PiUZ$BFX5E;s`aVBBB=YqCIf_~Elc)))LpA1vZZq~8{+Zu5u7?jc?LXIL-p-DP{`GCd z0%~A@Icj6Qhht?19x#$w@q39dJp33j_UBs`;kGq-Smwt6bFTABJC7GHeAyB)Qi15$ zuIy*p^<+baTt29@+b%Vd_lI3Ojas0hA9ZD2<$OsN;j;i=j@$+ulaD@frezC(kKYVW+fG&v4ZC%u49F|x%3@Q`%lSH2 zO_HIcnYJQ_fhE0u3#X|#nHCQXSLWl^V7t=K^tiS3WYCi4en~<%t1BH<`Hl-bQvvd6 zh@6@Ibn0;@Kws9HV_?MZ6jry0b1R7pNh~F?zy!R`-i$+7JpsaX_DKE*&JL2uv&Zc! z&XU66Ou2syS(Vw&ZA4D2vY=ipeVZrajB|+FLVop~XWfiN+D>tHxr^_a{(j`S zC=Rtqm4{DJZulbOHn5AtFo_Fj=CXnixj^|ij>?`CL&Pf;6^G_k1`L0P7PbtFOyDcT zxTYy!4UDcL3q(W}9|dahkRv9kqIkv>Ucob0s?!lnnIHXS)ps)&UlFaq@32ttaF_wS zu;D&`Gn{L4{rT0Tdw2HU*7!G#os6$p*Hh+3;`Ye2gglz<$~gF*V-5Zf?p4oz{?7N? z@$AIh%V{l$h3nzIPnB-x-ivz}`-fycZ+4qkEjDi@Hjn5i_8-g434?gtaecqYuR*BG Z<#f*JxYV%>9TXU?u?tl%X+|ohZvjdZ_%#3k literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/afcd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/afcd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..08dceab73c0a604f3efa5bdd84fd336795e144af GIT binary patch literal 6637 zcmb_geY6!-72h)#p1g-hg7`ob5RpW>GfxfU`H{fmBLb2@%rv68Gw0qny}2{fnYs79 z2Z_82rOdLjq%SHfB{C}0%u0)*BGSI>!-~?>a&iL&)|8O)2wqhdgp^Shc2l1oPf;c&usKH=1E4*s`GQ3duL=Qlsq#Q=4OIQ zGd0CQ=MbGw$BAYy$Q@_;87aLzpJNGh?!~|hffoYj61ATPd?}FoF9Lm9ZXWZ^n4G&f zD|cW#S}!Bg{-YnGJkdZK<}=WKURQEkjsZJ}T8;oO0X_%36!;AAGNRKC0bhG%YY9%u;l>8T?O0+yc+lz@Rh(vfY$&Y04@UV1uh2e z1}*{K1MC9s0xkvK4O|Ai3%DG3CvXMucHpakJAf-;k8S#^X%*3}tym|py{fOKHAJ^@ z8`vVj_ZnascrDNc!fs<7;A@Gtj|1O2;Aym8*>k0S9c@V01H?X^pzE>DW%}#zi`U6} zOzl@={OgI%T$sokXaT(s_GWwo(Rmte55r%CyptzO)D6Bd zm>sB11D~tLy_tG2503+4UXRLXpM^G1n*{WM6ZPX104D%L;CRsA0vrdFz!qRlzZi0K zs!$bl4Rj#n_A32YZjG;B(YMfM#lMB#3Vm|W57>T0J3%)Cp9XG)oI~0z^tRNV+hEU? z`T)0;-v9@6jKjWQo_EmpRDU4ax6*BBvmJrTk9VYcy;IHmF1kH!Gakfz?*{G%-T~YP zd=KzZ;Cq1&1MdVr1biRHkHx(2S8`6!2SDEo`dz^N+K1?az=Ob@%Fpj+RQdw7`@#2N z;2z*dfcF7E3fu+!7}mq*`Qy-g2im)U+kl?{vOPWtzOCA)=w4-qd+5`tT%hu|&nSQU zEF|!J_cFqM_tBoTf43U>?=z-`qJ)MCv0MPLB@60isOWnf7= zP7eUtAHD))e|Qi$0r(JbBJis~_M?Ykr;{hYMvq{9?1w<*hhIl~EPaE%iS@A`008iaa_%ukr3X;ksC}Ehqv-n>6&;irda`^mxAMYu@ zboMi#^0R~BKL`9j0!{@!4x9pf0yqiyV<7wYPcS|QFZ(HQ4De^5PelLEfu{qX1dap# z0yqZvOJEN8DkpXz)+MKtx_^c(su+U&PLrN{3;{}&yi--Dn10f_b==xOw`9{|yQ zhW>~)`vY+5-|1QUlcGOM&we?dW4x+R9)igeoK^)kDmoQ8o+HXZsuQPPsk_;*#ovHXMku*KGAo_%D zT1DF-)F?bphR$s~t^6_|kaLUbKy+f)}>ZF9t^FxeeS65S7S^8ld@XV7fI_@<3mD}y40N9Ni}!E#M?0~$?_%vkk!L7tr z!ApV+cn0vrliMz;C3j-~y;1l7)I>4_PZi0EnD8a|HlL5U9D>I2DdV^Q zgWo5anAh1Dj~r#lAV9`=5Oh4by{C4at&I%PiewV$6-0Lr$Vnwa#1BAq5bc-ZS1*2h zKnoO3IU~pXJ*lO3(`?pyv~!X8WtwjtQ8j&pMqInpIBq+!v~1BWJPs=vzRf}+n2)dX zNyLbtocJ4$LoQ|l_v7L7LMGEK5pC*Fak63O)IW{LDvEqLs0t$zKB|N4d|_PfBfdHF zlQYylIIvSyH_aJ@tQ{jQhVwf*ts?R&l5C^hHeJ;-jrnRNSQsPJsb@|CxfxlxsnEzg zm!@}gwoOKMV7`W&p?XVU3%4qiAA&V^IhmJYGlt!(2s_EUTfm<7nR#Nh&9?c}3S+5# zTg)|MlJ}M)jjlu@DsdR!fLg7~bCH$!AB2oP!^C+v=yBtG1tapd8UjG2mMk~PccEv+ z#Xy$xT%)?SDxqrqMw9&ddTZyZW=KaADkbckQ%ek1A|Q7YnJ~djGS60qU9PW3MV05e z=URPn@&kns3}Nd%dS1DANsqX{1k1#F{>qNd#Wz};&DGR)4e5FFdeUt+RMfVfr$8yo z5B{r});LP2u_9DPT!7iAfw;8ek}ZNnLlwSBexsx&kGji-AH;4kUHT>)hGk#pN5$91 zhFhhQ6eX0@$~n=00W&rF*NHHYahJ5BZezV$uE4TFwbZl?zHZAesdFV$LG0I!?qT+^ zjQo-Jf}p1o8eU*qUfxGFL7cDfr^m+u(-sC<|0k7DT-Q298UvU?vbx}j3$?ZfgT(U%f?C_in?j}s^)*I`(M3~-H!>J+Ti7dH2?NUkR{dN>sk_xM3CRu8in z7Wk?N2t*T_`MfAycSkeb4y34E^b9ZJuuzkcm|7ax3XGZFJTAE;l+xlGEQ9u`xt?~c z*ut`^t|Mgga)|w>VFov@_*gscvAmnfWtAr$avyGDWDU6v&j_-MA+CfGEK=gANHlGP ze#a7Jw(J?r{jr@o%Aj>4LPV92&$MBO*iC29IH-~sTJ3*Ro|P5fgxg>cPqm6)IH${0 z7#!)cDUttuWDCyn91xu}>vR6#n;z3#-A6Ft`n)->qy90|qSB0TESZ7$pF4hX+sW)C zbHR&CMIC7>GLVXL!zvsjxQ0qmOR3E2IeH#h(kxS(g93eehhg?nTfj3$$#M|3`5*Vp zwvFsIN^86ZovWq+%+rZ)!=HwUo2oo_^6VbTKL*)b4*uq6Aw6BoGv)4Lzn>Ftb0Qpc zzEBwQK%y(~{eR}K{qLjX`XV+w*Y7bb$4T?fye7G|yxSwBFFXSUl9V`Hc{{AIH~$w< Cn#F+t literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/apsd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/apsd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..be7692ec9b2d9288e5b098e8f1a8f13180cf9710 GIT binary patch literal 7029 zcmcIpYm^*C6~0}aNOl5*S4e;mmN#pdsSpTe1Db4>1S7k!W=VJ?CiHaI>~yxLd+hF+ z>;^;wgs8y>;tNF(6-5LMiti_)h(bVtuzK{5{?H#DJsc16Lw>B^t?t>L+1V@$f!Z_k zP2IY6>(;GXw{F!E{gIBM18skQpr2`)M;?vglW=UMtLa^|p4QP?x`cXZHLaS|a}3;L z6SQu6oBr#j7DH4nA3i8P)=WNb8f zBwEm);G*@wB}9wX0?!4m2IkSe0$51-B}lCEGmNkFz5+1?f{<+ybb68_W%{}7GMc_-T)lZ^)d~o_H|+3m&A6i z>vaU~dJE)XUA5j7AnWY|_X7jqGr%g4=lfphF+Ltrgnn!x?Mm-+T=n*^V22H=7QPY9O3dnySPy%lRo&$V8uoL(J-~!+-;4#3PfOCL1>v6{D z7Sv6#n{LJUMrV^1eSoG0v3Uv2J-rR2DlmZ&jL3A?*wiDeh%0N z{5+7??=B#(-xq+qes@DY@8f$=zYu(11YQ8V7q|@gC7=X;8F&`(E137G!25tF0KW?4 z_5T{$7Z~@`Lweo6P7kE^2I~Fx4bWc{4`L)I>w*$4me-HLG;Z@%U&I0}b^dq6y4}o)mKLQ>G{4vl3{sbt1KLw6MivyTH z$FH9gEqsN3L63sY>keG_GCfAW)bz*bSK#Bg0bKZ3`ZYbC)`95v8+ro$*iJyye@nkh z?F2;qNqQ=^7Z7rvru~}!G(D5rkMUIF_pHytzclIfEadWjcn-+%;&~wNn*(IfY~o_z zFF_6T4_aw>#vbE-<1(>D+$kOwe-?iiuZTJ3apod(tJ%qHc2Fr;)vBioepCy+NJWtw z_)Z~ImJ|3Mb`MUODfr?bw1!kcjl|059(mic%ZLRi*qK~RpH2``R7EIUQ5Tkog+iTw zg}{mkL=i2XruN}i5p-@FMQbm9*`kcL2sInL6;S}Kia+j={Embpx08_bsVi5eP98Oz z4`!8*EZ->xBYHOZ9ibbuhH%5__~;mJm(|d%Td|TVwq-ep;wZ7MB%0sW9;vYI+6tkG z%klix(!Ux8abO2t!fc%7IXoRH%GdN)|5lf}-U$kqTAMjo5eQ z;bX|b(I{3Gnf7JT$-HV&D5J6!Dw?DDxbC?{{9dT*jdkPkouZ80irN|YtRx~a7xU&f z)-O9Ux9os-DtK@NZ;rIT`}k(>_3@|hD@F@y+J(-BGOg>{Z~53%PG^%<(zRyAkK?a~ zL7I)pbd=NiYoh(&vf#p##!daHu})KTWzp={t@>W3M(wiY`ib8q{@W0ewH@Bl5BrIQ zp`?yuZqw^Ah<%^ftb!fi9uET8Rf$1u-#V;l;}^$<=6;)WD_b8nmRqPJw~@NEt$Dn5 z|EOjTiFS?)ll@Mv3$2RU5ro4LGUh4T2a+(+#KtEL7xR%r^s^8%cJ+)p#TrqA2RS7T>!Pt9cbX3w0;qo<$cN~0rpzM&V; z7eiRpLpw~TGw6L7>h3pgsF|JHCyM0UUMNqILr<*JMp@SV*_{Y*CnT4 zAErG~q~b&t$GL169L*|@^m)kgQBK2W+WnwqMR*55dF}JMN)^`y*h!W?n;VBBL~(qd zcHG_|7Im9&Q@X9thP4QA@7P?%;93Tf{XdK0^9i>Zh-VFQuNq?uY zk{6@jtIX3cxkI&3TL`I-&R^s}t?0S-dcPF#xG1anYdZV)a>^Pt%_MP!OH~wGUg``G z@jBPBSo1s;yM8gS!il-DO1M67F|VI?OZOwV`S=Xs1aL&B7(hf+i0PbPD6}-rzt%i@ zicGmfdX!Tf?>Ti&jskrq{x8+zC6c#Jt4iw-?MHK4s{Z;?qC*RCGmAPeB5?C<;oq1$ z`&s72uO%-|ZW2eKf2*Iy6}(#Ldq^vN(s|hz3~|PEZd?CJd_8mI)!Q_4celG2K z-+%hDVSo-4&ANHKQ6V?Ce+%B$Vz9!%Hhfkbb* zK0&i~2>SP7>>)jJFSNAqt1LD^(<wt zRhK@tKGD$=bteujTa}f^*RdwPohn4InmfT4;%*gGIA12oauDK}z;zV9|0HxvMcbC@ zd^Gdl^xjj5tdh!Cg1Rb1%6GU+rdKttj1bMV$1$K~}2gW|9|@JcZ=(TH$rLO7x37 zCt6pCp5zB#NI1F;i@bJUxDdAw!HZ*&zi4T9&$ZT0*+;omB=T|-37hQ}2gGuNgL?IVa#8)$x)c3h7OS@7t8T$wcK!!4G1$lumt{t^AmMh|9bL%np*X z>A&M0+CM5{XzE0l9^5a9wMM<^HYh!Ld1zAzh|34JoZ zXgxlW4Ow_ask=^N_IM^^{SVTCo4Q+?r-<+R8NtbCSxxh+2mTGgLWX2lVq*b}yBaPm@BaakZ6J zHA1A|^AN?vrdT#JXUM0{umsM4e;09YBy$DN^@j_V_BBS|#x5|IgXNd;kCd literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cloudphotod.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cloudphotod.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..7ed9adec6dfc141d250a2fc5179a8eb914d35887 GIT binary patch literal 264 zcmZQzP-I|Wkf$nCpsHygw<(}Oc?LOxcA&cg=uHsdV+5Kd&%nsQ3g$9`Nd^W0{<98F literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.AssetCacheLocatorService.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.AssetCacheLocatorService.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..79d096a37d424ffb540c054c1375bf462013b5a9 GIT binary patch literal 7461 zcmb`M378y36~|w9?}qF~kcc_R4TK}a>0SsBLpZY8umRbGHNy=Wdb(?7+U@CX`k37f zf`(H81(8D$jRzj6U=$S(P`nTiJTNLEig=--c%p*f`hV3u(=)T11V8Qhc79#gt9q|q zRlS-e>Q-ius&sz-O@ENN+i5#(!(Uo{J-v}$ORu3<(*?AJ#;Hz8N81qTuBJ4XUL`*+ zrJv4TxaO)32`lL+(vf#C9n>u8g3R{Mfo=Vyat~^mnTuPrAGpS2iOf+K& zEkOzGsUi(7+NSN#>BUN#o=3ElG==uRMbo%^uPlGg^_r}|;2Q7{q6Jri%ZTP&3?2${ z`Eul6q`idYEgI7bt#Y^aB4rRMrlu-=M7`&t{$b!*;Ni$W6LYz|G*z;CbLppb1_FmcVO33-fq|YLg(kd^-FAoO7XCrV7y&oCc?j zqh1w^K?e*#%un|SI6`#U9;oMn)2PPtzi3$X$j|Hv!oRwd0CpZy&&M0vnSGXKo{07l z`db6WL^D^Xa^<{VPwBjm5-n6{jF6sl6v`XZU>^@E9iAdFGd`Z~pM~}yf1Rj{TSSutz-1_PI_0S2Z;2$={-oZJwdtNZUygw-1mZaf$sx(obQ+8 z_yFCOrNM>W7|#b~ewXqg8UZeKoAlUxQuXOtyZ>KUr7 zUaAgiWsPVF7h8T!H-o?x{9TAl&o236dMHf0Fd90sKov~auIhEl@uDPjBN0W8@7Yq4 z@44d;aZtOQv|j9oW<}^?EEXQOC|IUdPK;uYG)A5np7T% zulk263~9AuNcMgC>Awi$SH+pIBpE5 z!y63Eni%!N5r}4cO{&*Yf$g9)$5l5&qvn?!R~TnnzAe@!jvEh$zMWXmm7iW&f1Ric z*AGNUh!9$)EfQ9Oi5iCqEfK^ppv7t3N_d|u(~bG({_Tx$U%O1>F3ZN{Ru@)wbI0qv_AYM_Ryqt;bZja7j(zlGoi z(8FH^xwg7Q9Y(HD%lKn@s)g?e^=hiGmLS1J+CZ+493AZfd^k_sNHwOgyVoqusbmJGARJ1O-a40NZFB z`VQdDQmdIQrqEvPhr$ucAOv~s2HYyk(ldhjGeU5B?(yt|-@9QLCB zhvjx;mU}SOkM?Ko-oJ34myeeG5BA_0tw>Drm;0~2B-1x zIY9=?H$}9$PoBfMUuEZm9+_oPsQGoFN5ZqYNj|P1u8k2L!I|(IUE0Zp9(C0)@Eb#n z&$t>a?^|V-v9zIdp6;D5ZAX?#ixtz)4 z4uvJ0x=81}pJTFgKOMwzev%i93Lo>QA;uYS9pS}vWShJx)|catIB_9Ci-IMa0ElqX z;Ue7R7unCrV!VihM6?J;5pQyVYsO_itQ9y$ba33@#NcN9==hsLpGG{=FqADyNd+@w zHv$V&wkGWyGL9l+F&VR^;RdmhY)}ickT?aqj(ovh3um;{5w#$f8(fsjD_C{0T3Fq; zs{d?ri!nsK$CFwxPAApk`HOms+yz2Jezaw1(XyXQ-{w8u!fC*#2cHTNBr#QN4<5O`^8u|d76(FBTJBeQzG+#0;>D4zXKytborRt4Eezb5qPH$ow}YZPWPR>|MX(g z7Tf8Kt(SWw8L#ZResLfRayJS1l!;pj-z>QCuG_8KSZwQ$qWZ zG>v#wM$rm!H)~Kw3$6GPzIYPtcQ7pa z*r~&Ni1utBuN!50cg(ki0|-6K3%u?|d~7vjWHXa43!2|9FTFHXvP%b+M#nt0-y>`@ zHlbGCu|?Rf4&grwE$-^X2|Od>W04IZe}v$UC;cAMR*_dG-&S zQf`}~#;5CE?d7qRIZB7#IH95>;4?+H0?ek}(GEjN4K3p=$mDw=9u0@?;RrRSj9DX` zlpN)j5Z{d%1>)n>=v_{Hc*uC6EglUM&wx9ja~8Y@f8m)SPZ<0>$B9YxYuGC`i70@7 zWd|w8`7QRst{;Wi{-|^RPWN3Mm&@$_&F%2W^SZ4c+!KuKvSmcRHIml5Dus3#8LP-R z^7)ydFEfD-6KFC{>AY~pxG)AVrwh|1Fdkp0Y_))>&!|zajf>;_KHV6jUY~o6U|7U6 ze1qhDD_?dychhv(lg_EO23%)Vo4m%h)$+TL{F%irf^E>-Jg7|lpT)*c(p2qKva^HYA=&s|9=%#IFao4goxs5m)r@kj#9T$Kw#NsYk ILBgx)KZYIT$p8QV literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.GSSCred.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.GSSCred.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..434f37a1f452e9d88354be0ff366c450f46b2052 GIT binary patch literal 5197 zcmbW5Ymgm9701ual8spukr*}*OhQP&7-nVz1Y91n%Z7xQjagZP5!7|=Oy7HlojX10 znYp_gL|9FN;sYP}#s@w@jT)c$RunY}WtC-FR$-NXu(b4xWm#ou>4*3~J#+8O-OUno zZr%CaK7IOh_vzE8dza`*dKMjD^m&55qh&|v2+iV~YaF16UPn{(YPy4Nr&rN!v~NMn zTTwpQm5tL&^=F*&&%%CK)9PxMwJ(BfBVE$1ISHG+pAD!h`^j6b@9J}zYu8pJls{_^ znd=~>b%xfU3yChK6GR*4%@Zs?r;rcMnQVbBO2JJ;gCTe+$nwh|Z<;UU`n5H4bJgDb za+J0Z8N1EnbUC;)x6{8Jw2AshKnJ`590G^ItwhVWfmfi+yb|1MUPV{K{^jO2rXDZY zzsbCYhIPL$W@L~;qu@Wmo4~(; zW0>ckjqP+Z(UE@m2^{>Lv4eIJ-N$9H|0(F*0{$A@1^yC*KbAcS?j}0C40_|>S+qy{ z>6q~{+FOhlgx^on1mH<8d+uHA1n+@-AL{P~_k#1_E#Mn<`4GKH*B`>Z z=lDL%)ct~bUiX1KuQ!7Sz_)-2ct6Pgcq{rjb?R;O_QIc__UAjaKOdlXVtnjR5M95E z-lO|@H&gcm8kX@Oy-&;E%hYnv*ob!T2iJff0ND>81P8$nfvdm|gDb&@z;nTmfXl&; z>i$mB$I!ot^2fn{!ygZW?DtPV?_cyudPMvCQ}pSgUr@*EXCOand=@QuJdZH3PLI+T ziu%v#cAw|69xrJ8osQC%i~29>`Y&-=*Mr7iVdWV37w{_}$H`aWKaTgWfoFkVhx|{d z{|5L6@SEW8!N2IZ21H!weezwR)xVT4roPMO` zkJFC}KY-Bt3ER>B>)87#%Dlcm19^Y^9OO7SP6jO_ehhqaYS1;tJ;wdUgT`aV6UHBn z33EM*J=wC|I1UBBt;CJ|nw+(jaD8h=1*w1v-2HTVbRO3`u?pI5Djbn|PE#gnlJ}1E zx@u8jrMkW|uePh4maGM#aQ1uB7dK@=m`*6^XCCIt&w$q7 zF4`iLu~3}(EACB%m%*WPwwU!qoCY$o>oAtsZY_~vmI^C&(`N2@8HIBQx8C-}(ui3Y zO5Iw>OQW9=es}#>8D}|nQ5Q-?@VH~|3}wv?CsbEt$6=79F!5Y`7y5%u=kv-EwNoUi8>ZcP-h3uI73Wlp)v_=YX%N+p{8Pb_DI3T49%-7NB&{$*!sSMdj{_U^|r z-mFD-5C=^Wv@A~vUqor(hE|eFgMUZAzuyL7@E8z)VEM5;heOHrn z1)V-N5sVz=J|b9}vyMePY-eB#t$?#OaO+V%Yw~@$1L<#9l!^wY#eFyv#=-zmLffEL zj^{M%9?0n+wKBA@JlzDqiNNOh8RVDlXSbM}?-9Zjqw2qwfwc~e~li2*$Dirpbqxlc)Svblw zr%elcSRyGTT;G7_Qq#I_Xn6E?_nXsIk%DNu_Kd#N$vtiDnEUj(V~(U;QOY| z6&|t*XCclm2`t(=JLKmH@q7`A&6XX>G^iI-pYq^%-V6LZpI_wyxQ&Jq4IJ${cu{pp zZ~d(zmMR@nZql?TgH{I53SH9OmUfzM)X@7*6^1zO%j(mta|`+03Zp9&awE4Pe6M;q*|?eT>4f~RPbb}S z!94xIZA7>L1zs^vonOm|`Z#S>P{WDuPgU0-8QI#_DV+CXWgLmV$Sl2FdAyhQ3wS+GvM=d$mnE~eEEe4%=$ zL+fC-bVHD45$4Y6fgPbQuiWvX`)-dSkC5*>6+>P<#$_sjM;e^Hh%Q*7-giZdJ$p`X zed-l~vS8lWsYw>|-m<+ItLZOjhoR(-*7>gI{8U-wAPmrmyW)Ff@4W!$t5Y2QP9nW& zRv`XMk)OW9<;<_k)!R7! z&BR8g$97b%L!;3gA2huO$hH4xKb^m~^nQv&YKK8IZM(i-7o)sUng9R* literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Databases.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Databases.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..035656728b77404832f18401b1d77bef4c79ad15 GIT binary patch literal 4901 zcmbVQX^b346@J}ouj9ppK;o>EO?HiQ8Z+IS!-37|%_eJ1*74$vlaQD!HQhBc&Gd9N z)!nnZHjo%_V!)i?3THUO5g-r(#9jmv{6Gpn5JDg!BqWfK5aJIg5XCp**p979oqzI z7m;z@U90NK;gCjr}xD7ZCJP&vk(WY~NSA%A}2Drt(mac>TP4;d^vtQsK z*{`7qv+ipd4Ieo8Z)=&Z2R;wH0r(H#jljPHZvy@Wcr)-%z*~TS0PX?)7B~s~HSkv8 zbHFLs`7`S_x}E6ZLHG$c{H!%idx;)l8aVh2tU7B7=7mU2M@kOb$-s3ETjDKhOex0QfKX`GaP?W%>~2 z{S)+ufqw&j1jv4P6moy1kJ4kt{*Teei*J_7-vB-b{3h@hK*Y)9?YD@w{hYo{-zn?`f_{p=Ti6ZU_7i%VzGwJP)AtKM z03r7b>oNZ8==&jPj_;3voUhLUIp0o^MH@|@v+x%``J3oU>j5jU66;axaqFknE_*u< zdaC7!I1VMhD~X8ws#t#V;!_bDqWd+ZbKz$lCSF$ZCy2< zNZk%RneYJ7`TQ!)kF`pbr@~y|+|}bENf!Lo>(;f(V)Sy@?9MGEscgA3K~)RAq}-kJqrI;)kRd9anAAtQgAY|Bu^ zQga9Hb8jNO3=Um#@}tA>HMFRCfb=VuSU zUdYZV;Wc1lFQxaJcJF#!#jao%T{(38bZ)6xC$Hx^J09M z=WKRE8j=JiGXhLXcbXF8yzkk*ZaLFAkSphP+QKPh;?$e}zvOG)DK5nP4i zyG#427M^U#kjsL4az~^_a9`4u)5vkv+R~+w63k#459eX7U&v&B+|+q*zeWBziKxj+ zOSPqw$jIj@z4hX>h2!#CW+GmWiI)$bwr$rPB?K(Bm+W}g_=KpzrSNZ$9vU%ys<&RJ zRmLew)jXHxFfiJ$w@{k67tzT0#L&6uhAh|9vwGiJdNOEB6Ay?ETu1KJw015a_?%Tf zGDg{pZiRT;?$9pU3}@}&{Y-Li&+A|s?Pgz;$~w29L+HU%VIZTFc9-_EM%)9{4AM%5 z85Pe=0iXl3dVVWG}*X>1}_FmOM) zaKRY4=NrdP+jA(U%2p5u?8*EO)Bqge*-g8GnouaRgvaafOlntd7@wHDPaJV)Xy_KQ zEAHK7d+exWXpWb_5yj8IPR!`5Gx)Y)YR^NJa#eG+CeY}ZYRmgGvAsyOM$3s*8q^BY z=RG)XLz!iJdKx0Co4V44 zBF^jH@EUP!p+8narJ7mngvt|PCBkWF`aY%(Y$kUjJ%5H%$2>2Z7ybI`=2*!U7V|mo zeH&_tNYth8^*4J5Cp~w2^i$LA&CC^c`hloNxKIRMVdoWPy*^Ga9aM3G`t$uUNcLRS zzJ^7)-um{Dn2W*s;iBO+a_xo;nS zCevo57GOQx;t0sKQJ6$8Ez5;TVfT2M?c$+ie0fI%w>=lUUh#g3Gxp4{?Mn$tHrpS zB=AU`yA#m`>x}zCw%D_0m&a4DNR${_k4&c+tWgwD1Ab?^a$YQZ%I) z$3ci@m6?k}15K%d)5UGkkdKSO$hhM!(vad66LdrLMZO_ihRyWiwSJh*uJKw?2c-!t zGl6eU-x~eKTo?Tchcmx^_TO&t-zTi3IW^sP-I|P+_`oV3AlLt&>vVpV!em gbcF90eR*d|Z|59tN*&42!39EVBz?t;GtRRA0P!O2i~s-t literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Networking.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Networking.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..5101ea3aa08be91951cba10406e49c2629d40061 GIT binary patch literal 6869 zcmb7|36vZ~8OOiw$+e3Ck-!EMHp@+n)4d@QT@J}+!^XfSth*90sIjNJW~SY~>|=H} zpb!uc@c=L40V<*>A}V;Iq9TfbA|8mMpdt#ItUlkvr@qH~@&8r#O!v%g66|@?zp1aj z`s(_s>Z?)d@6=7ZXMLWg-$>am+C?+?rW)7LJL#?T7TQ76G)0pXQ`Aw?M|!3uv#BOO zHl?4=dRX&iE$uwF4B3fvLMvwmHrqePBd=LclgGC7*%C{S#u!p?$);3;4UTniHT za_~8IhF(Fm@IT-H(#%uAXVuf_4AlP*^>n7}54hkN^_8?vw(Cr$l!FVNLb*Zkad18O z7&rtz0&V~w0?z^;0EfYQ!HwYE;H$v9z)j$t;Mw5q;5p!};0Sm#xEZ_w+yY(?o(o@b%yr z_y+J?a632xz7g}bK{cpCbmbzoggP0Ul4vYLoVc9s)t`Z?(Ca%=zNq9Km~j=>iw@WLm|@7g0Qo5KHk@5 zOo)zBsKM!;r;*>3?~50q+&sEi>OV1u{w1)tckiXN6M7}I22>t_-et1f<@7ex!{tEK zdj(yI^utJl%0u8);DgE@dOLVOcr|z*$CCufE?Eka$5Q=*mD!~Fit%;Dj%W`!!EB+P`M8BkAPQ$ z9|bQ3ZvZa_Zv=OM9|NbrkAn&L3D5y=f*qc(Pr~k2q;CedfS&@nU7v>Dh;j?vCfoBF z`fS!7P|owMa-KiO^NV)g#za3pPhZUPZE-By5RMsfpq;F+uP|nM@L7tbp!TZ7QfDeM-1$jQd z2YY+>-b3F<|Jffv=@0iJJ&%4sKZHH@2N2_PAKj03t||S9DccDuE0qW6$5Q?vQ_4Z5 z59NLW_J9w;4$s?9W&396VaVA}eunx>n9ZMq^T1y~z6A1Lf`@{SfQ!LjfnDIE;3DwX z;C!&TULJ$pt;%odcSK7Ga^`dNI6VP9o@Ws0-_swY-V77zKhl#(^E`t~|4mQPpQQXL z`ZMG_@64N&zi>TE|B3Nw*7pqT^7#D~QSeDAK^H2!lslA1l_!-w z$`bWxbx=LJ#5pJM%k*8%2m(iFUX+AR6#Jo36PlQcg%{brS2hi^E?ATL_?7FUR5>y{ ztKv^-p)joSWN62%3AfyzUZXg7>l=pr`tx*x?++B+O) zhtJB7MA)!R5pf355&UW^AB2AFo4%7O95y@Oh@wercD=RGPXam}`bx`Q!w7ZPuh@>z zN9;;ygwy(v?^W$u5*jhOG8+0-WJdaEQgLi^lUMb*K0NFAwO>0tm_u}b1NBDTGXZ-iFM7;G)ZSJ4OI47Mq|kd5PNDR0h0 zq2K6lY}lR%BYl11Sr~~zVL~Lt_Qt29Sh%e*8cnBjI5b=_>4y`jgZ*WeUO|EVbk1?V z!1OJ#KCzt`gKZ@ye1o5EslP!qgyRPyq|=bj$1)OT0!N*Oi<=_gnbPDuX+|aTog^0J zz=-RqN2iW>RD1c%<;4^X#YV+R7YB59;)|zr5gn=OYM_Rytu|Ccja7j({|dp)poeb_ zQcLYqM1^his2MQEtfb1W;*AEO{e3VM4=wljZn}csmE!@uHg4lnJ)T^RncSH6+3*7 z2WuU^?d{uac-VBTzCtUSYimF4J9UCqf!mL#>KkXCI#ls|@Wq9ZQ*ST$`>tx^gt!<8*KY_d5}w87@^%HWJ4LuP%BQ5sak9{lhN|nm zgzm%`gkV+wfKkN~M5ps~_cD17<@Gg>%pm47j-TUFlzNMHGouk)Y+3(6_hC5gSTDCT zyWOEMh20R+AD~)VOZv&|pL6UTm?_?cEX<*=PU&UhX6xOnh`sh0ZV&I|B0YD8ag1&9 zVo~F5^E{lfLyj%Hm~V)M_RQgTwm)IVrEN8lj}#*wvz z^T&KY-r&19X4*56#hYE=7;)7P-7=O{^Vs5I{Al>jF<#C6zc~?>s3bMayw%*u4OyB> z7m|)4TtWH~a$<(nacth@!;v@_F_ip)Jr@IMsuOA%d$3#roL|Gp#%lSr{(-@5#twai zy3ZuFtZyaNVxN6 z>(vdfCf8+{8RB)3XV2jWF5;Q8S?EnA%J2<_+@AD3C3c`${g~I6giU@?c1R&*g?``iU1umX`f;<>?fr`%x(|s|_Y`eSPRph;WbD2|p93&~pzw=}(n<@09QM$N-T%{H_4o!H(V3qe?DR}g7i z+lzZwv~G1nPU&&&`jNaq?0cI_&yl?TOyBWqwR9(x`)r<%6G(&{_oEY`kGoOSlAy1i zFgcH#&@paSBH{_ppG5Bwt73DA?FPIly*Cxc&55#pcg(+u1Fm^N)trcr#iosHrqX3X z94{8^rI*ZFcKO3n>G0q7`*spWEs|oUS`Y;+b_zk9>0?)w?D|=?c;ZNI&KIg=+m-sHP!QE6KQ|^P(9ecnA>o zIS48ed7-Q$cqk)^)LrVfaA925ujy0N?Q@M0q87w2d~@V|CtoJ}cB{16v(BHk0<1I8 zW^azTKwclMa(?S7-nz5#o){V)&2M#s-ZTe{S+tWigztfQyPtnO&HtY=X*fkW zL=ZecK}AJSRKx>OR6I}=MNv=z4^RXJ>R;49D*nCu|Nh?0?##|^LmK=z?d~`4`pr9k z@4er9n^M0q=BQ_l zo>9Nj|DI9LsHgcP-y$)yb>Fk=f1S=>i_|OY?k&h{{C6N>wf6+vU+r6uFYgiGz42KP z`l{fWIa_Tp7AiHfTXhqnc1+=h3&uM45%)qPaKA#S{nT@Y+Q;vFPQqt(4{tFJP-@mf zhy96E$kAzF$QSeZ>6lUPj@Kx{_DET@TO1_SR2g2jwzVHON7d#Q}0ej)@ za2cEf`{2&7AI^j)!5MHlY=bvZj7#BP;AQXycsYC?UICwlZ-P(5E8#ETo8iykRq#=GHGBxZ1%4M^ z13lzl3-8DMR`@meHux3zc6bkb2mBno4&Di`hj+kt!rS1x;4Sb5coV!4-T>bXuY>P_ z*TVOP?R-<%&hNwjD*WFMFNYt1Z-6($3*iUhIJ^Z`;jOR&KLkhMhhYKU26ONu@ND=| zcqaT99E7*SweaKc6nF>hho6AQ!%xB^;iurC@YC>Mcqcpneg^Ih?}GEEe^%X1KiYNr z=Y+Z+!H(I4e;)1#zW}@77hwmy2P*g___vNN#+Tur;8)=D@T>3{crSbsehoejzYZUR z_rV{*Z@`D(H{pZue)s_V7W^jsHoO-;0Plg{fp^32!q315;T`aM@FVd1@D}(Gd_Q~` zz8n4kUJri=-wuBSuYr%iE8(N?Qur9W82%Vu0Dl6<;ZM;U=XU%|Jx+ViqW{CWg^nlG z&uMpY!;T#BegV&hPr}pTFX4Ll6kG$*50~vk{AZME@5TLVr7qhsa9_5AdRG0Gc39Z) zoZ1q$1AK)d{5SZ|@Ax17lJ@znkoa2O?77JKol>*sz~952;UC}*@PFZS_yTN$e}r4x zw-|qd|Ac>re}gZ=7vW#vAL0MOKfu4j=i%Qd@2}zCaX$$u$0ak-kN;Haja`sTY4^XC z+RIQ|C6jX>AYRRXTbxF^PSq~)=HA;P{tQFywRLN!(M7x&louLz6K|$Yw}Y``m=5yZ zos3zy?<5==pMpEXJKCQ!X2aXzF7TuH&w(F?yTV&xEq}WsC#B{Z^N>HC_X#_grT4(U zopQcHhtD_mB;5t1gO{`u&dd3~K$k<_Uz68O_%!6~O}>u7e;?8v)xNKBfDyFoek5Ah zvA?)U!u(IX!-#hv>DrL{O5)EW-v`0j?XNO=2%ky#!K7<%UnFjw4jTWO#{3_?FN6C< z+>1kbhu|;kkVEl*WZGfUesdot{O~Xww{FKJgiHM#38j9Hg15t^@D6x1lzKge@^0OF ztZ^K2rCp$Im*a7FsuPS8kt^*9FELcF(WmFvWkQ`_Xnb~Bzp-5VpCr`&(D*p{S^;l? zC&Qbj4HzqtcLVNI;B^o;M%+?= zgS!4Uh+DrG8W$4pG@aiq#_70y+-JZMcqYukSHm;lYv9^xXBn?W-T-cB91qWiOW-EB z2)+*P15G#|X5lQDgY7U6|K7&@4_|B>G789h0XHUqa)E)JKhvhv6U7;kS!hheP8K-hT&N1U~`y zfuDq;*FME~XhUy(8cu_E;=hpa&%iz5U2q=!EZh}-4$gsh!=2%?^dr&pU%)-P{fov| z4K;6O>PyBwa5}`T$J3X|S9|+c#I5rc__@?&%x)3?{3FoyT{~KBk^FMN4 zXuIEdfbbXFz9rP*-wwmY{cmdPJKFtS<3Zv}|A*w`d&c*1%Q%4K?;+#i&>ipx#t-rT zE9oKa_9NpF+<(F?oSu5rc#QW-yF%PQHh!YxG5>4#PmQ19mUf27f5LcN`#)j)T>N=2 zB;8ZSFW~Qur;I0I8}47inUH$a`K#6EuXvy6(O*NE&z^yzZ=W>`)vn~hBcz79we73Z z9-r3T-q(I+`(^Fdw|}Ai8|~k3|8e^P9fx%+?NTr(Mg;_l&u=ZzQIU$J3P} z6gfQ7-bQ9{-1DtcOolG*a@Q99JI~(&|=Q{an zj=GcQ7(P+Q#)R!_zBhl36nbb`Ga(}zuKZAOr9 zW{W{*BF-#6$$aCby0m}Qb2Hws=~{}ePdsrK?JR%K)9zZkOL_9yjBl5$^PI8>57PHr zqgK(WSgu-zU)0XA@=x3@LF3sKCm*)TNmG+^x|Ln-RLgl&*IlfEmrqUJDzjS74G)H0 zIo4zPrY291PuD6rz7+`Totm7YlhZ}4RhRBZQ>gb9C#?`CtTL0>|bJF&vYirdbdda8{=tLl4 zC-P~mx7B7DrJV1ME09pPq*oN3tXYhO)O*CyO>!!&6_DkNCK>c;KF_C&p@c&wnZ6vP zueW=1Ka9UO&}V&4dB`qQUEO11%Fs3Qwi9MxMbrByrB7Fzm6bG{UG^=vY!>U)p-z~Z zyrNSm*yTbb=fv%iGeP@o+#WfRLiVkqRT*~5<5k}-+CF_M%|f8a)I{q=xm4dPt_8GtN>Q&9{HFQFGpU{E|0MOF306H&*ziRpJ$iN zG0V<6F@c+rQwLwtngRE}?t zc%_t+$|9kNJAo4ZeuR$V zCmC4Jrx3^tLXYX`S-iCO)tRSN*Q1KaYji1`ZRCCsfl`tvUcb)2iO8}pT{^XbOiKw( z*s=~N49|)3wf+5a#2U{!CVS|>+l0o~kUz>7gZ>WOC`J`>IZT9&6ymB`y) zuX_K0zKKtY)ojtu)rvaBbx13@dUq`A`AL*VT4Iwnm28St*{0JREC99L(`oEkiuQSy zt9_;XJd62ED8E5OCagWxVt$%be;Snx)hrXWI+J`f&nJ_TH(0UEkwF%TdeadTIK}l_ z-V9}|kxWh0KbqDPwqGsNEwCwB`3zR59@o+~12H1hMqw~+qW;SsA7hDamebX&jg844 zC)KDewkUZ&kL*t;Y#(-jbU(ed=nl7nnT?^aOaZ%=WT@5pWK#7TFI21)LB1xepV&kZ zQxiEdGiv9p`qV$g{kO=`W2Tm=mm$ZjvJI=rXYrDqV>cCWCdA?bU zwmMUs=d#se(emwbQBzc1R&r582E-m6wQsG}@@Yyh8+Nsb z@Wy_$t#+%WAOR0I669&SZ^H6TymD%}d`V?8SF2X*w$`hi_%d#{*6B{tYr=C_L$!Qi z*F{p0!{uwDezY=N8D&<OZYU_W3oRd_mQ=wR$xz-c8J<3+;^lSJp&1iG9?y z!RyZmQSrDo69)vMa7 zFQal-(ccSto7kuKr(SAU??@~7yLvk<8|l8(a<-us?lJ8@lG?)KBE@ny=4KqxaR0a4UXo-q=s_huj5mxuH-mv!|NBcxl%hPH81x zB&Rvwu9dUwQ7f?DBX244S{Og*9Txso`a?A4;|7=50JiTUUY?!gYhbO|n~R)gvP(QveDt|#&7Y;D&sn_=(ETfnKUmF{v;~!rxss^n zFDI(`SSAVDF%}-YM?4zeAHGNX%lYfJu8T@4loMoz7McM0T#;e+(<^>$&{ua!6SUytRbQSu&=PUr8GbtkRp z=l($ByQP~{il#rroZrLrS=&oWGI`Q`TJ+c2IeBd$~V2^0~wW;3V5469Y%tlf@+9rnTlkfsP(ogjqBX&3Qyv!=qb%ILuWKLso zC>_-68kAQQ!uOaea}B-6?98bDErJhhR!=-eYvy7o|`@Jd0KoA`#kK8NZX**(@ znOYRf)IqANJC>;hO6@ACqlz~R1=lLDHq%OtpoNX$71O4x2Ua@yW|1$qV*>k5Ope&| z((;8gY~^wZL#IS>GvsQXq}#Vq{(4K!nEPDQ8%__}r7Atf(k@*sQ9g&wazX2RH_WK4 z$D`mDdZEO6x<_u-R4ZvYRWJ6G86?5Dr~W!srd_?bRaB9FUQ*A*wyvGDL%I+@?v(MUcW{#DYa>u&OX)jDU)a)Xn1+3Kfd z*Wo(MImU~+3gZmYE6V~iliT)aoXM1k7T$W8NkG3mE z?~BJPJ7Z|7aUzNVF&t=eA1Kzrv`r|u-;qyalMeJ_Brm$R;Z=&kE5#=aSzEx&ZS{xyTl%+XB>NuljkFY&&0>(YYH081txfTU(1d_?+=bS>BJ3o33N%SY$o8^m~Z`V_Zpr-jMetxOL6ZI+EnLfvHx!n+q z^u&B$k$I6zQ5+92{^WKP_cU6}E0tmuGpzLS%81qgiS+=BEa?SIj)gM!cIDn#&_ap% zH8AE$Z}tO4lF;Lg=Vv39RpCgF?PBsCa$`K-_qwI@(KrasJbLBi;2Ehf!@IlYhp{`K00VHlJ=iSUcua)u8$On*tFi-z--6d$irb8;D*+qRX8REr#~ zCe~xIb{-5SAjv;Zvfst-*XwY-Z;Z+rowu3!lFg!S+u_o8o92~RdI?8`7A%&-!4_9u zm>73a{G3^lIU}4tlk3*zc;P}TQ4di()KkUbzN9W?(>?zvo~R!eO%}#W=&^XblF8ye zF;1iKaEBar+ho6p;^|XSD!k%&HjC>-zhq&N#;#>siFOnH#i5!c4sx1UFJ^7-fcWe_ zYU}Vsc>Ta3T($&un5f+)y{>`&pdQ+eXFscLNS)EPxs#o=of;8KRHwc|V_}jM1C?95 zP}A9&IaYNYf&D8{uKGb%V%;B`Z-OZ-*2Q&B(()bUGgwyTgC$sa(>Bcsi<~xcZ$+Or z>U4?yYNU|E3P`Mnn7w`1&T{iVzbU@g_f9-y^e_>)pL|962r|2Evp`aBh4F)lMMQ0T zJw$2b+DUz-)3_c=^uK)7@<-S(QF`uDv-$JwQ4DsW{VU3E(F@C+SQksbtf`cA(W~-z zO-8ta4Ym)-c_)~^3gMwF6J?^E8qZnznSe>Lbnk5}j$YqI*=)Rq5c~*6YAdvxZ6l)0 z(~0$TZb;u|qDJ(ty;+ad!fTt?o#Z8vd_R{9DlDN7qFTg71QO5N3SEB;+5E=t+%`i>-SI}$+=ss{;-~SuIwul z`nhIRk(E9}j`fkG{EJk6Rp03w#u(TmhQyNU%5zXZe{njqS#>$`Mvn^5rAFjbMAkh~x7l{L z53=24?`cRNaT0oeP3(76TEtSmqxZG2v+17~;mj87h>U zn0M-Sp2WN}(eGfiq{R41{QjcJjwp&{!Xk(_s;{a~nu6XlHW19ewR^t0f6rZ-r-%8L{FN%zABWvz49)ZZKL zBN8W(kA{7jh)A?+-VEg?#(R7M)G-qMxxS8U;ji}q33>7RYTJ^hSENT18dd+~^-B2j z+~j(;!!V;146O?f13=JVmgUG}q4{%hy0EZECdF@mBuD}u*b-Br_5Om|mP zRXwu$x~u0{dNjYJ z=ePaucVFLo?|a{StJH1Aa&?Q5{d<*hsrKtNdX1l|-X#2C^+okD^-=X9b)Wj6`aAWv z>h4V1_u@X#%FQQPowQ@otrGsE z#Q*pU79B92snqdX;HhvUJPn=)SHpGiba)ONgl9n$n$Uu$!8J-PI|-hFdnF|Q<5$45 z68E#<(YVisN5E&p0eB9~!*k(p`wtjv;jiIy;4k1h_%rxi_!Ia%DCIpLK8pK1_yf2e zeh&`8N8kqdEjSDxh8v-@a}$(yZidp%El}F|0x0d=3Zc|D;eq~_sFx|V^40w>73%SXeb@ExQ#Sth^}k%G{bAo#q$|Mvun6nWfi>tt z4~{_>mf$`(4ljZp+zT&(JKzM|1k3O|Sb^ulDm)AN(1JC1I=mE~0t0w54B;vm!4gGd?Or(e+(UX2iyn$1YQjP z6z+v@g1h0H;ZFEx@CESC;V^s)a=EVWt?Dn7dgU?HA1*ti?@skL+9Ph*H%Pp{gwKR; zhbKeixAz424yA5*GV$ICk5=!}a^2H+m-_2O&fp3~_`8um)%PBLiTr8#Uix_N0po9! zTKa4FKKK}XKjr@zegO9mA>~|i6!9NcG4E08sfM~&;a>I)!W;gx@x!EBsy?FQKR84D z`^oR%!H=s?5bsE82aQh??~^*+r_`q@N76yc{fzo7?)z~=9%@I$?~8lQ(BgkOO7 z;{W&XZukIvKWxzN9rgWW9KOpq^z?mC+NllKz9Zf36bFI68;~s2LBUY0)GP? z_+OMG{rR{~_gnSfi5ot(7ypCWAL--orNlR2ttW5f;3VwT>v4}z_X{-k5U&qj0Q;fz z(;_JSzZh=De*kWPOW=9%FnBgR9Il3Jp2msr2)G;`36FqFVIMpSKAt~d91VXCp9~*` z$H4EvW8v4}GWdD89DWQw1>Ox;z`NjaP~_lv_%_^huJI4$gg3yG z;C1k6@M?H6oPtj`)Up6R16~48fg(@OBz!!7s$tS!J$7kzOYx2$I#_0F>{UjlpJ z1pePnn^a@P9q|3*Tj2Xl_x#RMu=db8_u;=wBtt zihjkkYqhd#R>OKw4&5;H{HkLHuI>2MGTM;3TH+~{zf3(PXXR?SAm`;Kb9OGuxwz$5 z04q5^S0JRUeYf$efWL%I6FSVVVs4zU5Lc17m7IxRjXy~tzeD~!{zd$*^6glYDrX&| zP8~pZ2C7}`~*;P2P9RjcL>ADjxj$R*CL5|8%W^m}d3P)B=4X=gxxd93CmmO4PP=lN`fO@d5t^X$Nz^eEKuk2de zyh30H)7D7fj=6zbWkjrW+_!AnY1YbK7@4Fun&UG=`e6};(AwhqqpbtWP9~rHng4Ic zK~{@^KTnIqs@#TL9kFoqO2PVJJ)#y5JS@XrNCT`R4C|LlcYbawvBwykR=F5>jA5}> z7{{$K2bLNHmGx5Q=Pt2Kg8_Stb!N5hxjoW*bM^bop4^sSR52g5pwelQe@xU4x^cs>;TF@FX zUyI&CQFpW!rLYinBTq$JOF=3+`?|}=E0+DbV~%-Mr!wuhvH>_|tzIa5MYHNh1-m%m zI`vvw&fec;IqXPNUd>H&SL*!k^55f@-P*Wco!%RHWiRsFFv)a7cliy~YNPd9%@3j^ zpNqT9XXoe+Kk~-Bq8+h8&)&5gyUTyX^-<48JccP~?MAh!yZkP63!8mbmZY|_(?~{` zZ`1wziUn+IBDv7Tx3{3SJpNETeS()z(lq--5-Rup_Y`` zuPtWD6e>-FgSa~mKw3*7{z7-)xu>I?xSM;{z^=Gc zelWoiLC#|x@meCtd1l7>^P-~fxEtzTIbt$6^&)2$`3&gz8{J8_?AP2t>(8mIhiaFl~&Iq(=LR5xgNQLH9H#DC&9t^;QCbZYe}CR72W-06xoGxe25~>dj8Eh z?^^Xeb4%GT*yR?l=2SU?Y_k0!S;y_Fhk+H2+kvYV>3HHUdj)8}00J9!~mb+)?0_O0B|28;84VXUIxXEw${@UG`Ve58R6Dcy^Lx?@B>oweUeEoa zT~1c@*uG{oH_##JB5O~*%HYNO-K_ehtT6immjQAla+h+V$Ce@XqvZ6}<+_=f?Xmr$ zegDX;n~9!U^QW*|_$9M!*Q>>G=jqZ}bLqDuBYW8WnJp4gsnz_OQGaOI&xYd@a>Gt? ziX@sd|8#qjs7KEde_4lrP_J6ybVyqy=#7SatNd#XYl&gqKBpc!x4m&T!{-d9PK=~t zZj7zvBWP>I+=RA{wODF?ziQ$P`l;2QoR)fx?lt21&x`Y)+72Z3;POYQXUXWyBnR7N zwQI4odQrWK6`|}GC-#NY)uN>1BXXMRjZv{^PV5;TPIiMK#|gM2*}&0HN9If9ZcaJP zq}eVBXR2RAu3Ocxv?B2&6AOrIhBeo9XiT|v9lBrgMK14KfJDwP7>hZXB-b>Hv7UvP zTmy`!A<`EgSbS}pwQ?Jg&nbSFq0Q0eiQM$ulN|r=rUATUkWc<||Hs=gzgT`MY1Jom zgU*%jxyHTIo^M5^y62b$uS!yp%em#Op}9ywN{L+}6`v<^eu{6(rgSbUf9V3oq08g0 zF8RWoMt)bW`^9CJ71laEXZ_Z&?lG+E4C{QuT54DiDeEr9s@i!oIqx{P-ZOCdGgBUR zGFO_nn*(n?#E4{GU^>Oiy~E_IJ&~j`7fbpc3%mCdNhs4?X1&j3kDf@vh$ONzRcA}o zG&f}1MN8w`Ke=wJ=^G7awoE1|CB8?EwCzIL$nENE(WeNM3v0Q6mPq;|^Ks7kw9PMt z)^K2l|d=&F)I9GfExVQSYcy!|x=i&;09) zx?JM1zSb8|?{r=d)Bhsf<2ku8O$0`|8PnEqZgXx2za#bq5u}OSK3eg+=(j_oa9d=?8WZa}OmrcRy#Hr-AX*hP2TEsNPnrSUFv1B|mvn(+c`NPgw8rW=#4c!-;i z*m>goZ8zMvM%&TS^*6Ean4vx94p#h0HgUJ=NRqU?T2$Ge=r4?qsmI5m|0cP)T&d{B zNM^?BHEZoLx#*NR(r^zPr|FWK3sQG6r>&*BHuXF7Tkqx=IEinH3t-<(yc3?HPeu=zt3sZKt>nqdE zn8mkNBex`GzP-Fv7%qEmHBx7{)n|r%Oy9f?)=4o~)JXu=g}Av&Jz0M2_Wfw1U$MPv zOU`i&u@kDsy{)!i7V2YM%x5F&bAhh!1@81H4>R2M7$Ru3vK@{2L1mEFDO|8=i+@~- zQgWX^L%%lcnvDT-+(NyCggD7DNZD})`4=mTu0BCo$Layx%-e(Qxj|9-cjkuTAMy4g zd&Qtu!>}|3UaDZ)z1Ih7RcE6})ptyAPq zU0(mlQ;m=u8}?$|f6`t=db}ccip|TgeMJUP=9GN&IHVn5mr8+K;^~T>1cb|ZxTS;Q zHCHdc=BQVx)3dI2=?R_YGj3N)dj1AUMxy_x!86E9g?AH!Wi)thJyHJc@?aIKwi5d- zpZsEF^{QVU6cN>*dF8J)zmhf&#~CK+PY|XRs@Y!PI&$7{O!>y=G^I;vaWVrapGDh}|U$9n-h#(Rk>Us_}@e z%B0se9&N_hRd?&I9Efzp<7bUG8owr!a6ZS$S4%w`+UhUZ^CXK*{nC6yO2(;$U)KfdcUx&b+Rh^t za+3+5^?)?IX@;ql_t$s}pzVyZSBj9o3>{*BA8JWX6iG=>^Cd=Mj@W~ zC$^WfVb8WrT8f70*TCn}F)*b%YL~=g{$0TOb4WTg+L6SQw}NhNKi{%C`T7Ny?3zKc zLg{@z?T;;^qr*s6vj3<4MSYu#f2RM6W61@C+5DviC%axXL(L%sX+wY!KNu1T%gAT^ z&N6=2*YcW==jzh>v_5U`F(pX9yK4zgu0^u*Kb)@ABEJ$knf12b43NzDWae9Ap>#6i zMTwPo88?gdn$NB_9gmmXTeZ};C7vG6Sl>wN8(%0g=;>X!*-*J8C;cv}CBK>Cj}9l7 zNxNOvaGTe3aw8~-=PqaCj?uP)C55&x&XaCrWF(c+%=$c2{gT?rrG8Lp%zHVv&r?oO z_e!#VW!|}BqKcQ%#+=Ho>r+mgFe7K$+O<2j|2j5gsnnm$I@21@3o&(yg<2wJ*1^_z zReuUiXIiY&ja{JQeXd@YV*9hB1xD|$={QyFpon(eG2dj%V~q_ZjoJFPG1Kmn>&NZR z^w-b^vD6pr(B0@4nP%DfobGqYuSUP>`^dC@p2OTlyc$cLV|vb|b(hQ3%#LxgG$Kt` ztc=NmJ@v}>`*^XP;;GIAd`!-+*Hd2C|x zqE~Lo8xOvu(7`xOY+OKKi(u~ zR|B)_ToOOtm?S@~ho;~>z3#a69_7;=Wg4yi8sk` zDs{L-PV+A(YEf4I5vmpX8h<|GVYjnZ4qT9&aTsAa!rrA7w=+9W%a8@cw^DX%sUL? zv7lu10#S>Si{@gD(ah?fR3%QQ&kJpK3hWnFa!F)`SmWb%-5eu-gR<5t>+C~2Vy;P! zm?lTeJc>l;e^`h(%+&BNbI6fr#qv1D$qjP)wJK`B;i(T#gsuH*z?Tw36bjB$Vnt}b z7npq*<7#*8=WPij&RYJZ$?zL)y#RSMGw@$Sv{etUuX0O@z?jjS-HsG>t^cHdQYnh%;-UF_pTBlQ{R?-Ca!Nr z-;;$!?`WBM&pZ1#erBJW>m9dFkXavReqWosdzA#)edW;J<93{DI^Vy>)z6-*5rE`f zYZ89CFcq|+dEcuh=`!Qc_HI<7WX7@eovO}3-Up?{9=d!t{+~`J|JHXDI{(aiKg+wE zj`fY*qxGH5?B`N5Sr ovx!;usuQNo#bjL2scrqe(G22^+E+qM}3+F(hKLc_0!bXhe)r5)6?TNdk!&2#E$UBteZ5i6$nS@7${H>aOXX zeE`<{rvH8JQ~i= z)Gw<$)Cbl3)%!a7UT@q69di(lx2hfb?^YH6rK7~(q~&E94pMUoWtKX#RWlCH&c8D{ z#*sd!s*_sng%;i?QqrH4s`xqhaMrU#se=d905$3m6B_LQe(zGDml!d<^n1PI#>q+@ zuhc2(216}&wzu_(r!8UGvRp1@q5cqy@wNeM&1`b0Dt^s%Uu2t)l>c6FT zL{Q5IoHx_^7WG!jAL_kaP?v-A8uVKadf*0d3fu@zfSbT^@Cxu+a1`7Ez74zr+zhS< z$G|na0a{^yb*i&P|r>3 zW~JVJ7hN_j-yMfg|FBXTZ&&KghWdbl zKIS6oo8^1LJL$Jj{fchCyi5DL;J17CN7S#;?qFsE8mH6lZr$(K)o(D4^aC09qv{^$ zlb}K4MDSx^f6ooZZ-R@#-vW=Pd>42O_}k!7U~_)I3m;Scp1POvMU;ckA6K7%o)3K= zxH~s)KvRCd`hDmhL4(i_s82$_0uAoy!>c@~%l|-qit^_ue+YaEgr@zc)gLD9LFWG% zEeDx@b3UJ?{&Ctr0>1^U|8vm0p#KQ`F!*`!1K=N1KcD(9Xg-gsFKYgesz0IpAj&~w zW$sVamyplJw0{gdAA~l}0{@J5^Jw?D?*C===eqxw)f1HWQVts5HOGy=0AB>Z0zL=+ zCHOS>Rq(6eleF)l{a-;p0{z$EXTZN*axWX;5hhQ@JjG| zpy=&CXfJyEKD6lV2cYQf70TsY`cEzISJe--ykAxSMY-q;G%kbBkHGW6AA@=DzroYY z|55+Tx|Tx!1ndW)(eMB98S8g9<)U9`<0$G4un#mrv6mcZLid28|6W7wkaKOGA$B<5 zI0!Vs1(b{aLE~jkmp)MJ;9yYfU?C`Wa0n=Nz~QLvU=jVq4i1ABJ2)H^J2(P-2|h=H z-v-|VehWMb{3dub_;v6Y*6}oWEcg}hI8f~8cI2e0c{Y%p1^FYtKrTm6)8 z?O8$(DIXAI+!KwHllrB)-$_F2exUJ~af)$zQh%zhKTT*|4;o*D%QEnD;2EI!i!+f= z4!?I6*aPM%f0+6L_-W7r9|Q-%`@!YlC&078dqM15`^$3;b?h$VeB(Uu9`FLn#V){O zKVn>HtVn2(`iqQ<=`Z#MBA-i)ODVq-ejswb%vcG1JG9^~W0f&Pe~}AF{c2-a^Wpr5 z-fpZh)y3?+d&UMq!=b;>_ZXXuE1*S> zAoQs5wnUF0^k!o$(I?1wTZ}7p`4;1ATaBxA`Bv=*5`UoObq)Mw-(L&LIdB~) z{^5Fq15U|9L4q1s#w*5J^DgsI^HuYZ+(_<*+$VD{FQ| zst4}09XZyt9auHL=vEzTgIf&jV8$A%*Q;*Hj$Gdx7;Dt)eh^v1RliYQy-hE%~*AO?#(Mk``rJ6sDa(TAb2ZU)9`Q+bcAR?zH52@ujG4??RpNe5YK>or0u=15mXalmJ5Mnmwm5F z^poWqw_|B`#VI)3Bi4z?@+G@8$zpkM2km^(Mn1H?a?#(exn{@B*5|hcZX}$J5I!xt zaH5hm>4#AmTbZR4OU~4XPB87396~&Kj+T#({`J6*{E}ad8yq>i-VVcU<=Nv_0>4pL zC(_=q#%99EskLl#G&b9jz^*yl{9p>!vi@1^+8T(Sy4uy&l3#XKH{5D88u;Z#iM7hp zr`xY_rk$!^M|T%Pr)mqGQUig_po)@HmpxLLVDp3pyBPY_M&#t{b~LFapN|##=Fa|! zYMkvbitJ)FRw8Xy@t?}C%f1{9oCzmzJS1)v)>ZwYU2Q8WuxUf0Y_*90tUQEuyskzV zSmC72MwzeM361IU{a8)6`-O7RirkuWqwmQim(Qxt_>E!Tn{X?QKzj~Es^y|oZ2c-% zeGU6@n4MWNC)t1OJ-+$u#R6q@{$vLi*queQY)vZJn#=kon5*b*pXHe4o_M}5=RimPe&x{BOH zc7GIb^o^S1MVphRVg9P+gM-$n6KuJB%_`b=%5|gd;hf3?ZPwU4Q|7SKi)Qhuw;6c4 zvQ17TJAEv|uENOWfQc<#?6Gqm-TQlS|CaD%kMQKYH`E^GYzeT)cP17&smLH?=9}3+ z?cz(9j|&P}H`?Gh@tl%&InBK;EY}_w->aSCh~MzadbhTW6JBc$jGvAI>{1DyQ9C<* zu6OEbpVpnQ3R`-Uebd#CH{+JB{>K_^6p3ao_a=N<7tbpBXq{7C{OqtCt)Z2wV55$Y z);VEhSJSl}pxld%YSoEcujt#I8+wP#3%k5&PP^QQ*Yo(V;PuMpfH{hlIpzfaf*!sx z_K}_OO&5>3z^bY~N8vifg}OM_Xqi6ZPht{#k+VPLI-%$zmC^p3i*dwp*sO7)TAi}9 zW|e2`C055k(@DjrHglmL&l?)|6_C&w3^J#DHu#k=4Vcx6y|o{jE8bR;soa`1Wg1lAhYu6RUmZYeVvc&*$Uzr_BV2U*)jXvO%jP~yMml*69+$XP~CNI$s;=Ct=t zJI==GUE+cTX;`p;{SXov1Q>Xz_eF@I`;?Z6A|$Hc#`h{{Q!;mCabM!c?^R?z)4P))eNpx`waUj+16|_@e!6W?7sqfg-=CZ@)+nUHv$M>oK$i^?N z*AlguwrRU&^inS1jVrEK>EbW;6u&fk=;6sh>L>T$YY^;D!~U9)#QljO+!xPV-D1S^ zztON38rB`JVHNvh9%;-i5xE#pgFO^=8q9&ec<;|t62ZJ)LwC_-WS7>8{`Oq!c<+I6Y|oxG8>%_t=Sbvj<*yO`cEEj<1l%rQzFeD{~cM1iqK z+gG_1Qs>iE@SzhC&Q(G!?O5bmB9dpDQ?Fh8C2v?suum|X1pDXh6Q6E9^)%E?G2|Mr zhkoW%&agRRZbA(a=c*`e${a`3OZPVaI8IQcnC6yOmwhB%F5O$dE^_XSkA#6z1^Jk3 zAI|0@J@otYoc%I!&;sdXm7QtJ<5hs`#TH$T0=wi)I#ujUskGgVPQc5{!L4=yIV8Wf zutk${kpiK4B+nD`x1Df&Fmui(`JF;&PdNFSKkXDk$16*hbi8_0+pg5PQb?Rr&~{Ts zuhZ<$eua7?lBD%B2Upk=yfUyuQ@Za2od-;}OfwZ(k0iG#&&e_5`rG*?Ohaq2I$>}{ z-;rb+rCrKr_Phh91VHY)6TD= z)4DOkq`%IOrxO|(TRV+ZLLC>kO>}IvnA4^<=_UQOUef+pq!UOIsjM$<5=j#pM^2hx zlCI0-Bkia2kDN;JjmAbNvPm7;YqyK+Fy_RMrR}R^ZnoEXDVO|v8=r{)9&z#`)VY0B z&y3QGgp3}!Dk@Ehv{B`oqR|AZB7tpA|-XnsqIC9kAIasL)-ZA zJ1j*}s{t>`!J#G3Xd`Pa5~B)l=mFpTYvfI#jg+Umuv4Eugi zc0HYP%i446{;0`6Gr!i0k3KI_Ijl?{i{98uu zt=hs+BbrGyBE9n{G>>lKq|T9# zx!aEoC&}&24nD=^7FKSS_TF#Jrm>EJrAHix%st-d=&0;qwnfzm2KPQrGCN702DR8~ zuZ2?>*D?mRqT{WPPV~&Z|taK5&cN1eV9! z&$4jU@@Z`nCwI1wo#392y*O@2$4}bFf)Q4G_V28QyTY*L@mXu~P9gm=`$Bx*l;>|_ z_1xtYaO&D$T>uG22%R3s%PS5&*3At9{FpIsU zQpX9Kbf8kRzHB=+`7J}nPNPyO7Fg!IkYg|YaYdn2N1NqLKc*7*)A3QqdkJ}Rt76;(!h=aDTp$$A>9|lrwDuoNL|nDj39G9Fb&~3lYuK`x zCrY$VyGecK z+-mu+j6LX_xwMzOdphjC%c1!@kIa7NzFW8^zu!n1>xev=jIP)HIHe0!*PANXPZw?MLG!Wjf?-h8RvklphCOzSlH literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.cloudd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.cloudd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..b36415443b250f84c870827ec8bab28903fe4162 GIT binary patch literal 14557 zcmchd3!EKQdBD%yySpJbKn#!s5(wcfguN5ML;?tGb_s?gWXUENKwRg}%-$V#?wy;N zx%&Vsq5@SBD}~lqAK2DMwYE~Lw7wOokK+5)qV+{vt@YVjwN>f=J2Usry|Xu)P3q6t z-|m0Une#s1cg}adGfK@FtJSoT{|OCO$1O8T#y8Zm^!@wQ!|Kn~o7EfCpQ%4pf1>_a z{b4TeYY5M_OS@m)r(VJD{rud^Z@v~uxno}Jv@uNFpgO1hW|lI$f6nGzR!>sy8SV5E zmba%7vo4KQ$+K*Qnl(;UYT0_Vo;T{40%5pr)soXCe5#RzPd|RitZ}ANYm_=m%@~UC zjHEj@eSh+D-al2TlaGey!X@xL*atT#wfYwWv&Q*^e+J2?Stk4=!Y2G4+z7u7FM!{G z7sAKkMevL8Y4Fo<6O{Tk!^a3e9ZJ0yL#cNQlzK0LALIR{@KJaf{4jh5d>_1=cD)l` zk+$zj;vX6ql76py>%i8|{@<~R(1=pT0|V2>Rq&PM+on|M9(Xl;34A8;FNWKdTKXb* z4dL4%pcqg2NcfknWjr>gY|F(LGQg^LHU*Kx1|E20>O5H7CIB+xR z?t%N^%i(npx#-^s?^mk-YWO=)!mm{7&J)OYAK@*8f0yv_gh_Yjaq0mrpX>U6PyK#6 z&v1?6{i~S&HT|#VKbe2gd9`8{`CqHliWTs6v}-B+1Hyff`tMjlx<69tg-;>Z`&ANt zP^nW4^?F5k^%H$reCvIlZzSJx^(LME@gC{lLU~U<`BwE8q&t>+pz&GKy-nx)OZ8XO zBl#fpzFj>;_%XuJ_yqiG_|d)@;~nr(_&4wo;@=5B2;T+Y4_oc}TgoY@zf$^zT+6`f3L3ReY(9;Pb=RCNOvFM55l|Phe&@k=|4>PI>L{@tKdiA74T8sFXR2+ z6F!CTN8u{?G2%;FdyYyF4Df#O%x<8TUom3%Jw z;3-As{hwhU{2J{UP+#Xi)u;H2+!*7e`zHBrhTnoWz$f5X@n6-yz)|>Zz25wrP}c{U zzwfAjPv;L3{;v8D!Xigdubbb~`Dcyq>+)ueA3&L(A3~Y0ACa%1eysj04gY8QUc$R* z$4{V)$A81^@TYJa{2Be|XS{w+_+rBU12@6{g%`kIz%u+L+yH+C&xKFIv!UYW3}`@^ zrvf|$7U3$`2Ty?ga0MJN)G1Qm5-9uTQN)*sUkZ`wP~`P!DDrv?d=#>IBGWpIR-{;}4DR6;3kN>i9K6 z9S@Bs3bV$^@NvkbAQz_^>);ezPq`u&P|N>m@H3=4UDq>foI&^_gwKTUfoH*o;MwpE z@ErJR_*8f=JQs@ooJam5{n$WQ^yhpi`ZEZpNLPjxXu=!dMkso90r_M+FC;8_brBT3 zdK&SfSDOfnUTr2Udi8X|GG7-H7QNa+SoG==D0+1%6ur6(ie5d#P%jj_<#NI%^HTqEoK^~A5~e-=4pp7#q` z4{k7?oxZ-W(37^PV75m7jY-l;e;{GcxFzimBs^vKX}{o!?>6d2O~==bAnhk)%WcShbmHxlb3mud z_NR#QMQ>s#deVfle@vsO{YoApQfjC>jm?GKg_*)n3zrtH;{C;ki(f82Q9PsX=DyeT zeZKE&ec$Q(Mc-Nd7xrJ?KiU790j18CY<5s9TaAYAmg`Y7^rJWkt*TpgXJfY>c|m>9 zw(Ln)SMa8!y5j2%bGc#8s*}t$s$doxg|OfirVCafF1Uo{zYx|6L7~DMU&rp`zY6j4 zZjQIZ{AU*?c^B!BPwHmDDeNF!Trk&eESpoRRG|X-cUqNdY9%$^^Z%(aDAXz2qJ}#4 zhElT>{yA0pxD-3WD|u}e4y&=!tTPO9Ep8x&>1fYp+-Q`pqZnzCYm}ay{@XB0RVn;1 znCT@H zg*!_@u~qRCAt%k1{Hk8<%=+$5xS?CO-N-Co?FSXh9}U}4<%aJ?F-0urH$NUybkeV8 z6q?bb6}svuole5OSKC@UmeX~<&hd3B=7<}M0y|?~wQj}D(2dl_ zUg>I1WY*j$Lir;za>vKg;oX(Sk>|XF<%<&0pokGKbZwT9xw2DHo93ktn|0IitZF@o zV$XI=XU=!V^&mLodYu`cy?FEZ=BG(Ur7n>_J;x!D#o?en;Z>WVC6mv5wZ|!)f#Y=k z)_AzFZB9~e)MI{kS#|pDtnZk`mTWFCze)RA<%>Lbw4r0Ju61M4kg=GCO24DDeHV1K z@8J3CNq(m#SXk!r6yK}Nx-u_RC$T(~3wv48YOFy)dy(C)7vx$YG6&VUD_P-68`88R zq_SCVYvhr&Xb+rbS&aCV)hQ|r7OpQ`P}o@5XnJYh>fz_5lnU#qQy5&kaf|toD!o~m z52wX(jM=sSNEU3_CdP<~l3pz>Om!z%sfMJy#p-RQN;R*Vh)`>M zhmWkBMl)m^tu!5HE-7j6k(J{GQ(j!&zI&Hm9Ip)C$Lbl5!VPHoO{ zr#;(6)tVLGv&;1$u2}Yz>ogl#Rr`LO^{^t%cnvozU8!r1to*&M?=~ib`rN+Q^S#(( zD@;ab>yec=)M$(~8;u~0({gS+!g6+xT^q#SglFr8`rt!5a%AO?x&eAO>M>1W=P;_v zD6glz(b~tmHV{k?Z9kZ!dg`~=C-Bhe=SumzkX#MR4jXl>_^Il;QEd6G(NpTGLzUCH z{bcJ?rRn=_?A0rQ6}I;PDe4aS!#;4^g8IJ;MXd8%MG>9CdK5Y2zX^VYbyPDk!Mn}% z9!k8_^i|1KXtQXwUI*A!cyOOEKJ2eTo{QwqBF3u`%($T+RLj2AtlN{$u{s}O=eyhM zu^ZMcUt+X<)V2c%pD&SZyP##Ln0v!!6t5q1W5%i)nL|#^>s}wu)%iO2Yq3WX<7LX7 zvnMT&X1MlL*$L`cgU6G;TYj*oJiFO59^*&sxOTt!_vp^B*t-(u5xcORPTRp4OFSp? zJFmXjtGT!8=H$wYYYoZ7^A!2hHQvd)-4c&{Y**%aoKaRUbaaZvc3?VBGA}=9vShZE zIz~!ukN?h~nwaZqt&Z;;-_*WO^)0c-TFSR09q~wyb9eibeCHgZJkB6(lTVVa>Pj#6 zo*&pKAR{PmQaR1$A(7i`99Qd9s<=YylW2fw2z#TJa=8QQJb%QtU7p%IJUr%xvSkc8 z4z_i)H3+7XVib2*`T6V~4@9&p&o0T>HIKRU9sTWCY?4H>^1J1z;kphMw%@rBihOj- zRnli!AG2lVaL!Z7$x-az?s9YOowqI~E(V5)t=s8wUg?=%T}VAV#q;&NENtnXlbV+@ zSEBC=wogRY+*k1qG&x7M&Kn1pUsI=NpNKI&TxVF!hOyLN!ZN0wv8einLo1rxS5)a! zQfYoR7xdAIq@2EZx7T5nop`|_qjXE^1$(|xY8vS>tnG^h^?KgAqb+=A1Jk^id|I)0 zcriCi@)SR-%qIg6dAa%NogoTw-@)%ENrBA_Qo zyZ?I0!7dlmrepfOxLN0vE5b7#&DC4ykJsu_RPljd$0RQ}!$+`@p?Zh(FKIiY+fEp5 zJ3lzIrp}K|($8Mw)H1PkIlXcw1GH4<$KzqvIb!m8L_6%np=G<1uFt&jSx-CuRyX8O zysRA#@u3H`cm>9TTC`>>z0alcr9+UeS)$)7ld!tHof{T`p zD)a#BbDC}s8E&!fN_)dLSB04tZI+Y{2!*jaXc{S&=(DY1O%T(do2bCrg(&X3Fg=rSza(_PvUS zb8dWE-=C2449T74OU_n$`7DolwI-6_>X06$ES=P>*SRpMUavFR>mKr3!(tiqIpO0C z)~5(^W$n*q!Tf7_jb(->D;i%b_OYtwrX%?)NqdhYE|+BPt(g zTCDka+}uH817C71?@k}sQA4*h*Pj_2?!k1eK>(hjHT z#!jyN!$W)6NZhd9{*$}gGqzQhi%yqxQmtO+JH}y{@}&&j&(2P#!>;r?l(n+M< z?rs`WI*ImQW$zs>FG8=v&9pP#shiQ2`=&3FCg}Y)OK&4+p3HHso^B@!`Ltgx%h$Rt zO#EtDd^A^U#6c}`PLRs7_-6Zs#Pj6FxupnBPM#>CmMkk}yV(d>W#`JX4UDkdd~~GK zuk+*F<1)A0GCg#A^x$Oe?UjCPI9-PJxag?GE+t*P`)tm$hIs*v;7A?iU#x#CU*PWvgcdN6&HMYg7IufxRunZ0*d zVw1bgAX)hJKAydAyWbl=^McExiXO@g<@K)-B@M{cKeV;Ah>rwv=bzXKS^1W22hDmM zIViXOuhmYyZfEH{ht-Jbl9fPo%_)1%fu_qh1a7T@HZ=A2%=DI=ZXWEn{A1G0R{VV=)R z^raYrmK)dZdoGb)x;2e-gx%dyr_!ga*yIo>->u2DZE~oPUeEiksVkw#d48Rmkk2$vs#0o~9)Ea_h2Ht%hzD z<0V!9y!@y3QRi0DW#;AgjWm6t=+d?Meowg%vm$@ot2dglS|W*fw4K*=&XjaD*3La{ z)Ik1H!&2WvW&L6wib6S)=l0)pe<~vf>Gv?YmUN$+R}amm$&y6d4_)uM$1u~&Lo*T= zl73#6pm?V;wT_b2cOR5;cHF-0_(Y}toV~%-slJ-duXhp3Sg$6pBwOCDXn%K;`wn%X?_YE| zS{}0j=;d3|>2mg0@9#X)?=K`neqYjF<3oNIGEctee}|!4qf}168SwP`iu8T%{4;dO z?b%7 literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.datadetectors.AddToRecentsService.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.datadetectors.AddToRecentsService.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..85fe3e11cd2ae4e660590d877c30c033d5094915 GIT binary patch literal 6357 zcmcJTe~=tS702K9CLviRXkxgKz+EJP7~{?y;pY)Gxx08VAu$(@U<_)Uo$1>hZgysz zAA5H}(I^27ilX9=ApQVUR1lRPqN1Xx5!8T!$yud;_(!Txi%O*mau>4mP^LvInTB2xe`iJ z`+{NzN~xouBxn)QYv~Zt+4G8rxO{F}-c~BI20C*Fcn(P5x!{XpjFy8hfUhHJI|8l% zS^o7X|A$z~?b;8EH{|=-JsUZVsBl0WBprML?I1U6KX@Ma7`O_26g(e%1iXOgl!w6! zk!M~6J|HfpF6h5cT*6fI0B7ATE~PiBepfS9IXLSsw0jeHJNRaBAGij*6v_S=bG zy(rPQdj`s5BE_qS&MMG5Ip20F>YL@qqk(osswnvxQ^-r`J9cc4s*n@t9W4C2Fh(`i z&Zeu;54Qu+?+`i2{|ohC;d!tQ9xWUq7d!%b;BzSV!M}s=1)l|*;|rCZNR5Z}G|L;1 zJ6ss1U8!A0l)XkduhtuE`wQe@M~vfr^!{`lAoADJ2asobfXe?q2p)p`ZtxlKL*N1M z!;qhed0q$deD|PyKgzFH^*7QDO8!Qi3+(3~VXFQ?HLsgMp4UggBjCrtqu|XT+vDTV zd+gXJ=$6!;pt9#Dl|4U2pT;=Zp5X2R-AbQT{d|V0`T+~~6h24$RQczbsvIob3H`T$ z`@k=Nw}7`p5Bt#uGR2iOhX30?x;rTQPEuOhD_|21$a_;s)Y zyc;|V{06uf{3f^%{1$i`cn{`L0`CO{_-&Ba=RVX^;XCx8TEFko_tNo$i+G&(qkOq| z0Ka%%4>Gat577_O`tPfD4|8748^k<*NIy>Nf28Uk;k>E`3ok;;Prw(zpMvafk76B) z@Rpx}ynlX<^5;?i7tufS)){or8`ex~-@<3tPpN>9*l()ohO|CWB2 z&Kq3#XL^zjsPZT2sniZ2=aLnqXwDVD{j}bUJ^vwD$uq@=VW31m;h!H^Ok(n%r+S@M0f# z7HpsojE0e{>znLKU<9Lje=@wjz^Kb%FBpPqp4TL~oIpv{uagbwc)kp1HS(FcLTSb@ z(5NOyOzB6q=W2ttBSX!ogq{;evg{jCEwQBMI-_u-*7m8X

l-M#W)MtF)HC$L-ND z0=@24pgK1fIVc0^!h*WC-tj7i(;ti%X})8J5mcOp&&2t$>SSJV80cZm2qeu`a-4VU z3VttC`R00Z|5inh?7H0Lxje{i_?+FM_Uf!O!GpgE{hp{Jmu*s)E67drLZb5wcWPU$-JdTwOct_(uG zCw8so%AR{X`R%4>$)4DDqW-|MViS9Z(_AIb{mKn)Bm>vLor!e5Dxad?rmy!JL14>Z zNz!?!Z)wQDF-GrCj)mgA1-+-BAHfpR8A2BWVpN185>nKW+azpJ5rHu98AZNV{R&Vj zQL;qzh*-G75)SgA(Dkh}r?inEXtoGy!iR{>idQU9-S}v3iw2~)D_#8xz`F3zp{*3Y z{O+GZ_m7`Q_y5~0FD}d}bruBA$`#fB>x}L|SGVQ6;)wKQ_Jf&tLAJ9H@xqU%^Bd0{ zw5xHToE)yG&NIC~uE6m(xPu;#18FUPO{>Q+YdD&+t-o2FU+ZNU8BTLo5l7C`>&YEz zIc1gDab#q>70(E)Y<4P)VU5LWruDbY@IV)zD!kBwL-)fkr5MDA>B5hdV^8o)6JA=! z`Wx^7_G~G%Il4n7Ny;fQSH}Q&f1Zead~X>0(yMBY5xZv1TK-b)a`s@+`Nxr8iSp^! zx%GTtzsT0=<=ksYgz&0K{Y7;|?|3^S>6UEhE|v_>k@3701%@eW(&1}0C$~!maI#m7 z%LTY2z4|N1^KeZr;5-uFV~Ku4hC4gey`Rk^^>ZyW24%VKHKZ0w*WxDGxcsP&XTk+s z2*1&k-&k1N1`f7%!a)_`4D?rab{T`%^H}&SUs|lQ!2npxB<*n<@?U zGih;WS7|)6tb_(h!?&lLV(dqZ|qj?toQswM!gaaPZX<2~Oo zqCqdHmyPV&RF(MB@R?%1&3LM5NK01YDpt;F21Z7rpm-JOFhK|Drz^wu;Rf3*%6!Xg z5#7lTzRwJ7sZG*U3NTg zDE2kSGYzNgB05%aBbpZHkUo?Cd5m30rI+-JyuPXmOB01@`*vnFAkzyF#Ij*RM9GTD zz&ZYGk*n7e^Jyc#i7NJ=Tz%bejjFWF{N<(L1;Mu$?gw>yaf{>~lJ$?^v+ClZVw952CKU1@S1tK|1iZX8xDqaoKD#_VAh&46438=Q#a*qodbrt|J>E$4MulM%t@V+aI?9B3W5el7~jNkXNfXyDZNf53xUq!PE8-7lE*!UI8|}J;@IT> z0O!nj{AEstjel?OkIe2Z4Y;bSrFx2UOFdhyGB0QH49>r@`QOn1YUi@EEjY+4N)f>i+^pZ=9+C literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.discoveryd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.discoveryd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..ca7b0325eef5ab48bde4df2aa2c702e560443a16 GIT binary patch literal 7181 zcmb7|378y3702K7`p*% z)qo13h!=PvDhi4UiU)`yiWe%Ls3?k}QBaXApZO3!zxDsBd#1Z*CnWTI)4!>zSFfsG zy{dXOC3=?T&@TcGT)K>w(y??jejP@Kc1k9pv-mj#Wm!9k-hqxhr@6F0Cq>EAe|dQka%oXX zO3=Zr@+7^2=pdqlX**u6@^&uYJ1w7gDaw&v=zxcV4e$t}d6$4kf?U2B`4^RsV!8hF z%S-b5C-y+9LR4B&euh+{zLOxYfhT~2$Uhc522{aiL=&?izcgh#JxMg{5R@MeE&@*g z7lJ2(^TFjrv-by2LYjFpxKH^MIt~5VvwSL3ju)IYqr8Gv$$qY6%6xDZq26lnKguKx zfjhu8;CAqI@F{RDxD8wfJ`SD%J_?=*J_5cHd>DKc_z<`rd=T6KJ^-Et-Upry-UAMU zcZ27EcY+(iJHQd}cJN&AR`5LVX7GIQM)1|(4d5p5TJSaCR`3FF0=y8s0=x*^0=^a; z124vWdCF$Ggy^bSn167dP;{yiUCn85mJT@sya+VGO(5oV<_K6L+By?*b#MkXIKTfy z#iG}xb_C%^lQfF_Wr~eoY+v?8+IJB3UGQko1CIoKv_Ak|iu3{y`sDmymog%Hd5K~| zdfr@=xAS+#EvQ$f%cT5XJ>;)|zNx7z=?#!m&?~Ss19B6x-W%ynXou^8X!p&u73rzc zB(wBC@G9{6(ssHUd=7jIxC8lb1)l}q25tx2{kvA`dAsZn>uKk|19DH7-bpv4_PSo$ z@m-vj{s_+726@;6{df<(H|+==T z{140Wo9QD`{$}iJyk0-bl5Gy68h9RfA9xPYQBKRPvf#1Qnjsm|69t?gD)6x!L>7ddt=vQg^FJ<{7oR;NaX)fCRHMlSM8<73(QOrvj zUh`XU2KYPV?~VM&z&*j=gR{XufMxJ;Pyzo4PN7%r_4fqP{QuIQ=`ZPcL8Q0QU(<1e z^LNmb^f#IRBt4bd0fgM&S&y_^Ti-vCX1{qFlG=5)gseUr3H##^stHSWP_= znurXo;e}C{^g<&#U|M-7f~IANkPC?B@~cqa54^}TJUbECZ+f{NhGXXRcI$x``+Ne! z#YS3TBphwMRSoo@r41+DTN~((81sTrsOE7^lgkMlF3a2FYU+XJcvZ_5+9ty@#p>9y zqv60aV*_L5r%%eS5lvxxz6ki_%$YY7Mht_tR55M{Ke9YmtwC9+>ebM*<49C|J!&MD z_guRLw=339r$&rJQKVOGo*MbADD5SSaRdaji;xMti!|Jm|Z9(|d}mv26>?UDeZr&e&Mh1i#?tmq`corTaADSP|SwQ}|Z^ZU9|;>&P{gft`4< z2B%~{x1>vIz1(z;W>cRa_$&LZ#Y<$dbkwEXi`}q~&+FCp>Z+~BuF)`$*j2rpJy^7O zer5YJ&vRz`7jr%&C-Xk2U-Xm6@sT$NU(!s`)Lcvft^=L483no_8p7t|DJQo@1aO)? zJ8}We8qZ1A7wf@3$QfLYhtGpVzb?YfgYvx1#*yx;YN*#l#lgm`hQc+uO4ctwa>j{o zsQi>w=?5m}xrxoJpWq0*oA^rxm+Li573M8V_brg|Le^e8Wbq>$nesU_LAgJ#H&q&H z3u(dN^1l5Lm9Sin&i72h8AXvZyWLz|)+*DaR6uuWkLxCPP)Dg>xVOb$lavn3ehVItox(iZ8?Dtu5 z4?l6RFIQ~O8;yO{_6*&wxQJS1e1@v!Ii$^`e^1Sk>kt{c^t-&ix(xpkg{aGq+@EqC zYB@NXozU#EM;x{bl4{fHrH*29JeV6GG&_lz)p6fI(b8gh5~vr>G<9SsJybUe*g{9t z&5`r2>tSsa6mg9t9?8bntG(gjVbqHP4@Xuoxa)S(-tl1@IPFDr*skjtGOSGfpzB`c zico|h!c9j;$U$2((uSIbD}N1pSU9no$SSXJEA%+2{dBwTq+Q@V85 zxI%dW-T8Jy@}83EPvsG4)RP@a?sr)^P6`q5bp(S5Jly5NP7cQE3WLjdU|sWL!Y@W$ zZw#Zyy-U?0*TiZf+N)?+J50yj<^P5kz%!EzyK0Age6@9?UX`xvu6as=)_NLDV(E9y zQ!zd?^+?CCnwBYo;&5mY`k9%*iejvkFhZ}`5b{q49>}!+DGGwT^K|b^H4f)PSftLU zH_?HtBx}fMmz%n9*s^;U%OfLol&*2(qzPl6&j!`-F`H&rJ#-~8G{=8<$~ZKSB}BZv zuUH%fn}~2dWn8NeABS4s65`E2x##BZu|e!=a3eIziu?Ihh;O-^1B{I#^x;S8!N+lA zZrs>s!hrW_d2i3`k?ub#E(hs7hwI_t|0#;?AP&{iU|9=21Ak%jb4`NsR??P}cHHg_ zc`zNaiXoR}T+w}Dh;aD(FrST}AeOh{1`Jj~l&3k=XCm-lFsN$d)aP-FAqhF|8Gxf@6n;Px$DC!x5a^HF;MF|m$Usa z?I_<{vu^HwKidEI$$bH{t=g75s_Leh#z%__dfV~xs0dtPtNag4fW=!e{FqnE{{gCK B#UB6w literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.homed.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.homed.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..001a6fa4efa619c26f11a770d80c02098dacab67 GIT binary patch literal 13605 zcmchd51brTeZb%B-W}v1gn$tKhVWnh?9PP{AR&-kE+hn!aO9GR;ZK~MncEv~cW0TI zz2t&X1LUyMP%Tx9r9iD+5O&|_ulXQ-h03I@Ap=zyN$W(E+hN*9>dn}URSTHzvmOje_ef1eOCRZ`jmP? zeNz2~dQ5#HllM`=6D?^Es|WSp!z%vEmLe(FXCz3P)x5hvy|ooHfy~aob34kBJZGyj zTj?b%vQOvD!sM-rpCjh03F9=Sj##7?5u@hj2*ZUB^_(H$(~LNLl2T`>eTF*Yfu4O5 zKX1{XiMEc+Cq5PY^D^J75v+fhHV-eXtG} z!%=tM4OW<~RDclAxgF|o`9E8i^26#CXy;i_=@Cx)>39n4_T*>>( zdsaz(7cTATZ?E^>BMA*CWi0Hu%UGjS?}_BQ3LX#F@_s&Cr_`LI;njqXgvjZc1Fuo4 zryE`ib8rKEy?esgsMKMv!A*pP*TGl22i0b!7QWnly->G1?0KnsNNwf)(w;3s{T}wb zNWN|G`|xe>d+-MM9r$+mEw~+i1KtR~0&jv}fH%XZ;4ScTa0h%Gz5_lAE%*>D!H+;2 zeh517KIp=G;V^t3EW^9u2;2)jxCh<}cfwIvhZT4$tU?>s;7!nn+h84ThPT0uFo4&< z5Uzz09DohD3XZ`Qa3{PJ?t&M=aae%6;rZ}(crJV=JPYoDr^9!_Q{lVeiSRw}IJg%c z1Mh%y;hpesco*z~`{02tMj(6*-VI-Y?}a~xKLcNa?}IPGd*BQ3XW{d3Km0Dd7k(T5 z9Q-DHKYSJWAAnyY{PXau@ILrO_zUnU_(Aw2{1E&M{4jR>Sl2JA`<0qFg7FF$JlypW z^-D_KEn(R60O=lpABMjS?}ONB_r35TrS|ob?qN7b{fZt3Vb@31uO{{e8UGW;$FM`c z>k2+?DZQ@;a=Os}n}nYt{4Mw?_^0p_`DfLiq4y(%zYQOTgpK?2f3E(L z@O^~;g8tZ_|Bi(9ya0^}-hUUldF1{T;ehaSunND&dzs(=n*7@cKdIVt`gZf9p(!Ws8gD=4qr2i*)3H)a$ z?ei~C+Us9+`~670oP>Xz#7nr3^#2Agg#QlDhW`Pj{a?}fURD2@gyE^()a$?W`w8Q} zdB2eKufa?5|EvB7u7Iyozok7t5$gIu-R}pW^tN#P$ZY zz4Z`2OdVz%PP>S`!M%o>V;rH^kzS!L2O9bOkp_z-<!;isJpx7Oq#S}MT zER=MFQAXR{BKY3i>Bbq9dl%`UaXUN{2JkHC!Ly+S&w<&#M@!&i(I#udo<5n*V&2(N@PURFXGC##^0lYaOD@vCVk z87~8be?WK*d>&o}pMz`Rvv3`9pMh7yFT?dv#@98(f62Jk7)0-|YlE>d(Hov5?Z1il ze%E#6kopV?(c^k!OA^0X=Npo+t}iq`Z)`PgNaDBY__s+|$3x>uq`Vz|7H)?!kKIW7 z<{7;=!7g|+?>|laE%1|Y2Yd{^13n5Z_y{b)k3z<~p2r@b&wOF$y0vDiYTHSViys`I>~a-tqgusO$H)84dkD5F#fOQV#3Cmc#n5 zIcDr6Uitwdf0r?ieCY>Bc(-voVd)QuetV2}>i2t$cky2ONBE5KZmHi1_mHkxPX@6b z_jf>9SMG!|Kip-oU@Ccdkx)bJ&&|!>l5gan&L7{^-?gD@Ti5QcySqN#b!JZ-zer&F z)uL6eSKMMPYy_3i4MWebImN)W9KTi>CrKt9sSBZ1b4va$ovN@i@FJIVC-Z5OS9KlF z3f*AL4PtSpA0)mh2s3P#lPymjBk^WE@W!mjHQmTINBl4fY z%U4JKdf-RC?N{Oi$4-v7!f>ZEx!iK#H|k32Wtc$J~lvcLQ}f z;j}wL*KW`;<3)Fu?bahYwK$BhuxOP+ztV`@Lfwi+;vS4U`qa++Nf*1j5ENOZigdAl zR>^m({o3?Q>+TM_fm@@+&EmR>U$QELLF-kqUh%>R5%c(D+e1Xh^=gEH8ID+is}9%c zBwX=I{C|QDx3`m1G9$0*?)Gb<3rlA5Vg z_@vEgSNw+K_;y%i0@J-bK>Qo--vJS`1~FzbwVHv36q)vZOFlcZr`+v2`HbI=X8u3xi?^qu{;(W+Tx*ICqVP|2J#!?;~ONlrZ--E9WB z$&F;@8;WS^F!E^0c;qiW#Qe25f6JIZ5 z6BTG-B4&^`0SP@mQb3LG0aDcXb8|K!PlrtY_bIeU5q18g*dh|;ottxHt=}MOzw!B! zB{Re>87=g1&9(Is*<71MGSmif3*V(Kr}{HSEvqps7ar*^RQ z%`AtV&`z)JrqY$VW_I$oxD~fP;@8HvMqb5>Jhl#T>&$W-vHB&8ULt4v?DXotZfKJq zdBe#{I(^g5a(x(deYV4c9^DkQH=|mCzB7)a0cHxX+z9m2!d6Z1x6DD^_3LZHzSNgz zm3+-)uLG7n!qzDr)A5jB=Z2A0Nd`S4t~!{U_Gvv8R%%o#ZsgTUzQxA8&EWTnJf-rt z&p7@!G7xKg$};?Nix|iO{|)mI))=m?jQ`9$F~uOBV^&nJs~F8Ps`Wf@p5D4I5iJg( zed_*BH(*vRR;)(N9&s)_SiZO!7d02jco&_VTV^Ql?1RZ29NfY#oN+D*l{#0xW{}6( zptTv6q{mK^Udm0oEwb(6=$3(jq4+G*?>GUwz16-yD%s_ca%Z&9OrDLB=@9j7Gsdc3 ze`IEGi(%b$9gcaGb~}=BlIs0N&LQzhvMPFEhvgaV@DSG_EOjS#Y9=hCO9zHmVHqiF zo09_Lb6oqmBCcxdOs7u>N*ztw&UTKfb>7`6LeP89Poej8qiKrq(@~Sw5TZ5(l<3qi zQ;(}T>2%ChT5l!eC+)YS9g69>hh;LdyqX&nI4|!S*Y=jCPt&!|N39I0{2BF{W_(J& zq~&Dy%T2FAcK_boEjvYKP1$(q`gN8+-F~^5Bi8$%>(r$AddjVZSBn_BR>hXtJsvN` zif@m~4cg4(aMto;{Z|>9`Q?WB#7|+G>DG=(`~PKYH~Veq8yQBj6ZMmwjog3AQ zS=+i4PZ5XOPsP+&r!)li=PbYFQ1^ap0=k1PmhY+N zJx^@#%b__CSmDTKSDX)SASc6Q6U>B=Y=W0gr$_UgrR7YOGgjpG82QGVVQe#6+CXk? zZWEmqF~`f{Vl=mdt~%?G^tX08v7TyXEH5TR?dsVIJ{kDO2QIZn&dQuQP2X5<3cup*8Fls{R;@s$0{lrRCM5 z>Mo_UeXzb1b-Oy$dyI3|LPhl>4qx>P`j%P4Y@x8_G~9c#_IIY`HC?y$NPN5U==MVH z!gjfd(9k?Zo!qyq_gK8Dk}j3gTpv=s1J`!FF<0-CNt(YznHMQm-l^8EQ12og&W?U= zmswDvw%L1unnPpBc~yz8%#9a>wYV+UGkKQ9ow*fX?m)%k)TYEvQ+=k`XL$ao7Zn=h zDA+m+;CL+J@geb>wFxH*Q&RPc6%G4AwZO8|^xa7|d5V0}@>}iE^t(12 z+Hp&bGCk`g+e2mP+$w*gGHIgIlzF^v__evA+{RqtI0Dz@`s07(Y;5TnsSs~ga-qbR z+0jI~!sUI-`nOxV%?+w|rOFk|Z7OF=Lx#OWQUtDWdGhCxqy6wK2XZ-3+w9uqlrOvY z5Q#;pFpv13l++hf9I48gwRPCqVbkz37UX%0e5DOwmCJ!!#wFhzS7&y{$8(OJeu_h0 zwL#0eI;4wD<&0RhvL1IqB1r5$jh>>PtE{Mn3Oiv=)vTyirBK7`uKmko&CgM0w|eD( zn3jGHYB%lj%G!M$3rzCsc1;x$hf5&N14mz^B*#*=5RuCUD4A0wtLz)wDiS*wd8N-6 zsXV0NaV(Z94L9)CGSaA)YL-_C`|(Cca$nJwKVEfWt+g`Ze{72n83DC&e5w>Dhg^=}X06wyLUQ|( z(L46#_KQb%D86+Pc|7`lCe^$B9!bZaDBo$k_^D(6vgK4gobl7gi=QhwpG}!x;=L*^ zQL689jQ6#r>-lJ^^tM%x8l1us?PZ@jrC!Z+ej|`GVx}EZ{h9acKHEf*!!vCV_p#iQ&lJz}( zZ)5tNywCRYaN>Y2+Rgv4401a*TYn#V2m@Y`w$rYCZC+p_6IHMk_+(@MQY0IiWg}?4(+ar~9JasQavbZvN2TwmVkX$BgcA4ufZbjv0^Wgc`Y#Qn) zSaRrllQ#XQ(r<8ZkbF_#<0=dK4qi^8ojCb|s&@a8Co`{4RSpXTtrDBDz8`MWi_5%t zVyWs|nn0b`sR!e#7SRmN>D4K^)e_zqyv-JdsN(f6wVSFH*xCh|8K<#xKwlfgie$z? z%gt7=(7$qv!RjPEof(f-J&f~b){XwvYb@@M`6&R7H4%j{j@cSKkw* z`cJN}=iJtC18%rG>z%PbyE-g~Bt3SsNu@>AD)~ywiJE@zM$7NbmV#eK#H*NNxmE7c zN2C5s|USxEfB}#fek6i04GS!p#c-DLMYVLRvm&y>bmVzGo+Pq5X;N@nIBr zC2sJY9qoIwaMj{5J(M!_5A_cdrr*ZJ``}c5l0NQe(Qo?w4z*!j4_iAR>e{y7$;>AX z`}EHtv;R%j`OH3-RWuA_>zZ8;<8@5jbIJX%$mh}LkB)NiubPRI-wefNrk{Ia zh-0>kOM3pBe}Vd`93w{>CGxud(yh!kwMZd>yX!6rrUncqkkUb;EiowC$#^X zCu#4|fwgVd4gIz8{z(Vf%zDsnuUgg2exbF$oZ`LS(`V$h|K4Icd3uML*|*5V8UKn% z=bAK6aIYUnWcGP7af!P(JFmvhg#P#pAUU-?ryVwxuTB?`nSZCg-%ajaB|~=II<))X zN#kSk{j1hy(z%-sP3~2bczq9+*6ZN+rAfX_zqQ|k>J-cQPQ@O&JvM(II8UUc0+QR5 rq+gjOxN4}47A-Eeba8sWlO}KaSJ++G+)5EgSrD)#DA@G|>#_PjZ@^e; literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nehelper.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nehelper.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..7bdb7037d057541af172f12b7ffcbc11edf90f0a GIT binary patch literal 9165 zcmc(l3!EKSS-`)UyLs$Qo2H~`9-AhyFA3?LN$CU9R7kpQYHZTRtbJIpadu|*?zs2P zTxRC(Zqil_wUmcwRYZhV5VR;#5vWC;A}ESlm5LSxRFrDbib#2=6yyIpGxxdMP0jD; z&)MI-|9j5)&UeoF&Ud~!=OiMVtuth!HT<{EvP|BGo(`{Ms#7$S%2vUl+*v-I6hM4*s1d=gOFM zZdXDzZyQLd?k(hWdLzZNB_G*Ju57ia4>yT?hitOs+?S1P()0tXi~QAP`TE;NjNIm1 z;e{fbZ-n0|vi=}^F4XevjV)&J`s)=_^H6K3y5Jz6-f; z!WWVL2Be?MpDOtkxL0KPlkh6|B{&WrhgXZN_yW9!v~nN(eC1l%FS6w`mG4#>JHq9k zs(gLJOU&5gK!dh@TG7P-U59%0Rwmg z4B-Jd1^2@`yarCgJurg1;Sa&f;S9V4HlPEWa0iU>m-8x#v_xL93O|GEH&$LIsmMK= zhRfF>m%%kKho?d2YuO4oD{^-gxj8s0^Tywvw2#WM(%x{BP<}h}@PvH_zjPjS4ak{a zw8yL;roGR>9}zk8F^FE{H*YTe=H(*iSaO$;UjHcNo&0CwE2+0qUS;GzxrqFaqwmCt z*UC>Iw}Re4>!Zm1q^WnW{1okIJxIGhEk8s0gQTJLe)u~0u)WFpS@;lqJ$w)OKL_6h z-vA$ko&LQMy~|n6Z$h6f_sRW~zkzay{$DWtRQ(rUi; z2_A#LOuth2fJwhy-cj25SFrPw_OEK%_&Yp4LVfH?d+(G7%ke(neq?F`;Ghuh|{|MKBzSPfyQ1R zhH9^mz=z;(!-wHVq1yR((0k&<$K>PmU*`#$dHP+_E9Lj(6ZBi>2_CP=@5?7mJAa@w z?Lce9{zLg=lmACblMk(L;eC(5ufjipYS%wSk4-y&M!S|gDxWgrdQ|?Ld>tpWK8yUP zO?zY3Uyy!`^k2eH!^gX}Fs6D={q+kCgUoFeOV(R_7rj5Ozb%XVke4{M?nkoOfrcF7tuA}{L!hP^Rp!)xR zV!sOO{J-D`{1*A+ls^skz;DAV;eW#y!V~ZXQ24tPcH)3-$p*)&SR=#*ogcViyS3a} z1}}gskk|Qx*kh$NO8z$LD=)CB)+)-?Zjkh8*6BuWOi6mRbp~m*A4Kn&)*6$4ru7{1 z)t-?2v#hly|18rl?MJ77XQN;Jbv@KLvH_}JZ?p)Iq7NA*4dh0YTLD6Zr^Wz z%zngv%9hHu%C{>Qk4%k-Y*R5mX*yo3)d-z9Yp0DY%(5tn11Al=Ac-4C5n(#}<&dsr zUK~s&^G0e|&v1EdE{$^DB68uNo}#@xNxgdLg!6eAYs)p?^QTo>*ehXU zcj9Q4hfViDG?{woQTI^My?v?I4Cj(`2Gwe>1#*1?Y6q*^uURj3o5^I<2;E!!BnYo+ zM~(bYngng1vFcMb@>hqmVIygUsq7}*o3jr@}OhvAFA8+ejw8#-X&E<+K`6 zmZRbfKEw7<)y25lS?XrfUK+|uBd6&`#BM}3m~?0Uwf$hy&7)>`EQz&~d-x3Y@1Pgs zOu@FkUUY1`ME|Z>pr_Rvh1;|A^!vVL6D4?2b+;^M<4dX~Vat?U1BCr}MG;hf;)t zA|7|+hsMRGM@&kcmI+^SjaKfKpJd(k-23Kma$kb^jMX|ms;UD0!hW|cX+IrE!hl@+ z09KeZE|}t=F0NUQ%Q&qXgfU{t7T>9RtJv;3*F>jt8+;%%_fZ0(%=vcd;ep;*$whj*LgT#+`<|bkuD~H5^#%+s!NU679!Q z{xM$Ir{dJGk*AnTd4I_yDpzmA5SEj?Z?iW|l@-$mMHe zlvSOXS91gE3%q<=u*zNgYF6_c5)J5)qp$bjNO@lwDc@N1Q?@Aw*74xD%qm9Yc9mmX z?Ip)G7*B>{_yPJ=H@zA+kv$`ZA7&IS@>BEn(~Ziwy^oDX|GV)B5l7$S;s)WY8xtD2 ze(9!zJoWr=I&A2+womR@m=erab>&j_s7X`z356bB0h*y{9^FS4`CgbE*=gpx=SStd zJDE2X)|$y|=wxARUTM94wese?$fc?WJ2}Qq0ppmpU3ZHxyqp(VYsb!A-V`B}LHE+t zF>}u7wbwZswQ@Z>>2rR83OBOYsMK33&D_m0wsTi?EvFfk>*-n8?=6}+Oh6=*TcAc3CItLHW)RxLi#JybH zt>T_-47ZQ{?m@ezA^Qe0dHG~$bj;h6YX+^Ql|gv{gj+HSbjKcC22mMdfBuy5jERbHZ&>IY){X$7uU_Y zNlQiQx4q&;=DA5Es5J<4?UvI>e6LZ9Ijx#=8C5Hz;x3b~pBOdkh>Vl^O~1anIrbF_ zbv!&~efK(a?Zm`*s)IIu+spTSpY3Lz1y1>^X-;qHaDCsz=Y{qCsq#SObboR9!|#Xe z+AVeVw)5$$(qtw~_p0D#?QE|<{r3@lw-Dtz7?vyVNmPZoFX$^Tk9o!Zrq+l#`s@&g<)v81Kc6>TZmtEQxbFBK7cjG7>6cl%r7L=YACv(w zIDb&jI01H|yufmN5}n(uvRh*I-@W-Mx)T&#FAqfyH(YuuGF67=Wl4FbWlmArqvBqz z*G>?5^_Yvd$S*rG)Q^D6kTja)rYShm9}BZR7tb1(8X9M2F3_GiY!>gGUi+my2a$Ra zSxwyTmGj05Q$6W(*h&-bqOxudwuwW(xCL0Su7Y-$&&0_b*5b~HAjH(+&BeL9Z~hxu zIqo6<>z^X0k?Cu+qoeecVwuX=;5-+H(Rz8%(pO4P_wz55z|FBR_-hs%lb-cjrEEQnLNgSWSi;3gU|7b|b$ zB;E3%`JsI$YO#Ij2n_oLYI$qch%dz!XJ}tC)kx-Q0pX93XCAXp8n6TBF}J)-aC;N= znnJvCx465+z3kad(av&;9HxkW{$W~mtJZ&enzM;(k>6ly+f1%rtp$1uy31`!HQ*jV zFGT01nrMp|6VE6AQ0v_~_utl+{xCDX zukU(gZ+uiY=G`k!(-pH{?{$3OK2HU%IK_T+{{7~lX+`)y5Nygfn&WBSf1fbwo+H(> zd42TCqOMfLTuFHNVx?DD*!Tq-*E^ literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nesessionmanager.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nesessionmanager.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..25bdde682ddafcd66210e852ba5363ea83ff6c50 GIT binary patch literal 7637 zcmcJUd7K8ey)7cJ7zP2sRrAufr9Z4$wI+zyVJ)h=5U$@U(?m++pS@E};}hT?xYfBMyN`K+tJLx^T=1s5X! z67bbY`6A?RDIUu5J?9t8%vO7wry-?5-*E8->Ln@}sCO86Hh4Jl&j61AH-N7J*MUot zek@MdN{7EMo4}3Wjo{hfb)XJj3sy0IS1JaXL>KM?{{W|7st6h)x`@-@)C(b312==i z;CUeCcgiUECZa7nL#_@^C0ow_S&Bn$VownMHclSwe466pFSaxLD7|Vu>IdK{V2E~C zgAvjzKq>oZgGHg7j5r_c5g3C*|Hx*Ch7*0PJ~|ay6%=--3ll zAqTsmzaOLzCH)1FzK*U(n(YS4_4Q%!VaVSAJ_vpUa#PUWM?r4)M&#d*{Ex}L(-&krpJ&Q;z{0k|7wHa}|0Sl(2Maf&pI-*A2k!*00`HP~#_20avt7OlUIE?> zUJiZ@ybSz07lt??IaV^_xfwq`w883Em5?2fqytg5Lov;CI0ru-?B1@;u%L zu0j6&(8G58KGG*5{R40n_yBl3_(Sj*@JAT;67a{M20jS#eE$UH<-$Ysh@9u2($A9d zf^t3m9Qmgy52FRP!y`Vf8XRm&FIsfK5Yff01`Il;icv%O zk>$DS5R`?gUJX6F5s9*|N5iq@J=Y$C`{nB=QzJ&9DAKDoPmO$*^1E%nOh41Hiy;vR z7Z%sl6Kt=l+m)c5rTVrNMo_UkzMb}9)$zC*VW5S>dLX2?6*NxU7EV)|A?s!BWLCAv za>ORjY>P$4{-Kr3+<1MC?I>ksiTtmJucvyp8J<6>p*a z6ixA!K(UmjqAQUikmkRFBwr{)$P4gw6$9@O`G(>tj-o=!$Hzvlic*2vBPa=!I{qG& zx?IRx$aA$#q+LVW#gvE|sHn=y7DS?bIG@$Js1|^BX;Yk~BYRj8Nb++SzjF5LK5jQ2 zx7l(Sxi7Tq@w_@Z)?A?aa(U8jP}}wsc3W--&rE)`>#@HE4Oa_v!^4{JEpyd`^286i z`ExogN%zEPB;1gfSIe&vA$RwymOl8`kX360m`~5el9uaIt2C;%Wvq6GJnj#krTohE zyQ5$Ix-pC;mUd~a+%HZLVWitpyFbTIrYGyRsj_Orwnb#QRZkDvbHJ)L^9z1=?hgHK zEj-J`w+25ll{rd9`rkx9bl@me_!oO%SFfC=*;EqjNbIK4(-z7t{s`{H%dn5{jflYZ zYO1X_Tw~Zgc(QsKd$4H!JV^Ju=_t$ZAE{q)J@$jtod3&y9G`^!tORyGc87Kjlm_g~ z>mQ$)y?xr@R9YBY%Ti3X6z`XLJHZ&dC#oQd6nStG?xNaxJ8X)#m~LCipfbkmA7zfx zFW3JN=Bb8`1#o~U-aOF74RC@1r987&)jTQ<<)(C>|7*+Ld!F$qcBuTh!SftB>A7Kw zrsiTv;QA!($!RmfE+U47&Bt$YzHt5~5nvJT+LjA&mU<5FPo!}jP?1EGfI53=clMjQ<|8LrlM&*gc*o1L;j-P zK79xd0Y^#GrI|7wO51CNWPXH@KtA(h6nnCI6Q!Xxi{Nyny%2S=T&ibczXM?it10jc z3!Y^h1IGK+N`xh=-AL3pTv?A;t>3nU8{s#btiCSm$MWh{RBoU~*^pHL90jbNpS}6D z&hw%bo`d5&qnQg3{_;!q<0LUQ7O#l zHSDO7Qa-x3Z`tYkCT$Isjw7Y4Z6L+q`3*~h+yuurc!~>ABYVn+IE(q@HxL!H7Dfn- zDi0VB$AQG-g{uuas_RA8P%`w51}27mogZo6)Bt*|7Kj=`a_O8XpT|OJ`8wfyLDV1U z;jlVrISp7=$dqh0l^fRGnp{^wqKN%EE$-q64$i@{?RoVEZ)t{Zmt92NGQLFB;xy8x z&@hUz&BIuo5KIt6?kAc(Lqz;ncl+B^yw9il6M4iwwRk6!`(#><6GQ|YnPU)vhdXT8&cRq+VQ?9D zp~GLzhKTB}H-gdQE~x5|Yr;#2UXkyw9VX-MnAhwUq1s^sy=du3W*~O|_&$^NH@+0q zlAs?;pu;coalENVI)>G>OcCUVL$lG(RIL>?-~k~Yi);w_V+#*t!tXOVL0*BK>vM>& zcOfhiZyU59D@hwNTIHrL9JcH$^W~9|IEuW-rS)(^g$*106dagf+L$&1cq9vVy++|Xlid#tQBkf4)etkk@&KEHgmn=^i)q05| z1g)gfv{F&V9UKB=e>jK`9Qe>>qaI%^`08$Q)ZV8#R5B5@a{xa|C68MSp%w87-!pi> zNvCJ~ZWnhuiNCf}fo1w~`nsI^^5-G5oc?-{{WUAGcfEgQ<~p~`9piv6AIMGE_vHE5 zzSr}Az%t`{`Tc19o+P_@ojM1!U6e=r#0ex|nv-g|uT_&kIl< ztJiIzP3mt8rGMkcVM)C%-Dq8ky2W%_y=4qKTmMc)TVovVxri3l<+;qQT}?HVK3yl| z7NC|EXi9=kA$lPlCR)^Rros_kAYB^P&_fIiKrxSHP37!FR{fmg^{Y@-k z`L4&rnaz6lO-Jd)MB2mR5aq##&<}EL4}u1GKiCc42QCBe0hbdUe;2p{W#&u3JH$$Q zDfHhiRx#DQ!M0n)%jhgMZVyw{gKamX-)is%@NDpU@Eq`3@a5nEa1D4hxE8z$>;*3e z&jt5_ec%Y#4<_I`*jo|nX#>#}$HQ-6rzKuN8;P#uGT62Ya_50N!B>JiK-fENE4Z0x ze;eesfYa!FuJ2kU254(GZxHJ+M%z%oTnyqD+rw)}ooAx|cB1DkPWA0O4)qa{;zdOB zHF_17J7=T4RzDSAi+(xUrQ~N!B42>MBS$QEsQ19fKp*@QSexhTmA+8Ti}ls&W5^wZTmn7R6K|evGv?pt4-i`W8z&pV=V1BoOm#Xp`XD+|zP<{)4)SjW4}fojzxe#T9rDw_cc^)e(L2$;7wuPr zqu{&15PY{PAE5WB_5+AFe4gIRRPzIs|K10(|K1Ni4t@Z90{kGze!mvu969nKx-MHk zP_5sG)%tyeuE)H2{Xm%fQMy5m^D(9x2h=XqZlq7B`j0bJJ*aJg{!fDIz)yi|w43PD z(03NfH-oD{l;OwE(5)!5A8!HKk0`74`z*-o_c@T)_46RF;}<|)w=aUcZnuHU!P~)Z z@JpZ$ei>W}eg#|vepT5qMt5MG`6z!4oCV$q^16Q=ax=BN=w7wnchfgAd%#opynPe( z%f&tT#dhAy#Q5K$?_}-YR{iedvho9{ov3}6zL&M%ui78rvT6slc8vRd@Hp^6koWly zur4|5rXPZQejh@;hWa0Y|H7z02LA#61biBN7<>wR1pGUQeW=d+&xmIKm3~f-X7++8 z|AKy**$vMAGaaN~srrNT>&y=zch_eupyeo8NVIRgbaR8=C79iLFmW6<-4iC%!%!06b;)G z$1R3_65wux?Z)6}6w8XS$ti?pIBE=}(_0^!6*=sOWvFJmCdf4joUYnyc2&*LsQ3lP zmBvMuZ_9HN$BhR<-%c#p%1?)q@0V5S`hg7jMr(3!B&`Gv9o6NCC4<=UJ$(quBHb)R zzMI4{ADD3|^}O%7qu6$>{j;T!BTy8Z1(%mbJ!|>9?!TsaHf)zeGL#-XZs;3azhJrp zVZBNZTqi=*rWyE*_Xn#^?MkB1h)QNCX}Xf*vg;J^d$uY!`^hdCu~U(Ie2*tN7oVxO z*?2ocS#=_K$A&A?U+Au$rTErb?9}^xE2&5?-j<0*`5nu;yNv-EZr|8{_5}HC{c3*c z^SvRbn1m*;29{E-hcS>8T*unz4f*M?w3gX2?sz?>Rf209Hf~n?WP^-i(~ax?U3V-! zO^ec`tdO{_j2*Awo1tA-23`ADA5rcSnj;Jmh)_79Dohazi8B8R!OftDPZ71YSSSWi zE5#5#Oix(&jv!YNz9>M0i?V@QA2mAq1^DASz1?uBLlP>v!a=8ai8|UVcoxsVKY>3i zL)S0ru99+rq&l z2>dWM`dmM;v5g}mk`eEF;tc%gdeZH+u(tWr=)>;>M>}Wra8C1Due@*7st%+lm7jE+XvSG1{<5E&7 zc&6h&{g3Toh2!^ocK_&+ zIVAHHzbf@edUzRXwj+ouBgAj0{N!{MFKnFSsxXW$!eNfZs0fyJ_n1QnZHRM?a>rbi zr!?*F>^=@+T-EA1Ek&-YS#PE^GUn0T?w*dB$c9+1p=aW}LupB;D%E*{Xl@l5%Q^B) z5|a_NIJ(=2+`bqw^2F0NI+jv97GV+3htGyg1IBu!8yme?7C8;sjvTDdb#Qmm%9i;| za&8^J?8Ny5J@S_70w4op_55%E3|uoF^216VS!6B7sYZP1_)KDNEg!1ooVF|^MXa1% zOKi+kLGEHQ;DQBYoU9zXUJT+=%g;jLe9@c!z+D7KSfVWQxSM=jb_mOJ02>YY)f~Xh zJ;o;LSVJOj>>y#WqoR&M9s(&UKe;97(RAOzw|dU>1v^EFx7_n-fi^wzhARd@=NeW>nG#ok{}FN>x(B zHuRKCuc*#zm?`3Y-DsX<9V^IF@-9MR66mgPnQq=gHmveKbj`JsF^!%&!dpi@$J`gq z`id&8OciGR)qUNVP~)QE_C|fh^vt5Pt>$D*#~T1=W5{<@Hl{R=v)^{iqK6j^$I9$i z`9wpnjjT3w3dpSOUCnC~tzA}K!3y~tHq9eaFAP&JBXv$HkA$X}uC&@mjq!0pWXPE% zj0kLY=LKAe{~jhiMb#Vl!s2%p=g_SQVqHe(ZJRUKP~t>(~zmTpd*c(6Uj ztk@CiC6N_Rc&}^`Z;Di9_l&($4d8rmv;VZ@u{UG%G3ht#3;Id%aP< z$g=3l?RYrP`ftXm{a-_!Cr`$@>v(0|wCyZjFKN+RyPwN4^rWjJu?RzK`n(k+yvzO# D-S@d` literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.rtcreportingd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.rtcreportingd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..ebe9222755b581e6cba52ddd6d949964a58d95cf GIT binary patch literal 8965 zcmds-eVi3l8ONWQyS(gz2m%5N0wPKq-I+xcUGW82SV93;R?(!yxie?)jyrc|oSD1J zVlPm>m8O;UYFS#ES(;_}l9id6rj%)>W~G@~R%&UPSsMMGGjs3Ux%&cQe>MBL^PThd zoO7P@oaej%(M)A8ny%FUO;HpXcN=|+uBO|P9GB50bPkEsesVA0uKs7&yS@!;jnVrN^{EVAK z&B`32adT-dQfMy~VQ}`QhIt&Gqr~BPr!+Jx^NE^?4x||hAv}ZgO-Ryborv@|5lveQ zwh+x)10sFaDsW*EehbL?^56 z36V0ff%`_=$02+;#cU%QI|g!4Zgc~d6;sB8qn|{%)!<{`Tfs-bHQ11w^^j?VRv zO>}M(>;;^5NbU^kB|4A8;OJK5bHIgQ30weTd`8U!J)(0OkuD-T-p@zb5m2 zoo-CR;C`b}-#27@v+_;Ew;Q(3g`l;;S1N0!`d0ar{ape1%tgl&l2;qki z{yDeFhFd<47|d=%ty`~`Ru!jGXG&zoN&d@;hmLi>3h{2Jl&5q=!p20j7ygTDbo z@JaAY@VB4`J_S19??4lL8gfnpe-Ca1{{XVxJcINTl|Rz+(q8^Ve@^-j%K7^&;&Zv@ z&?45$^Gvk&FZ5!P{#RM<1rAHSfy#R2Z}g8O{qHjUB@WAUP&pR$zYMMd{|WMZc?EjR z!9V;9Yykg__!UTh6+8xf4O|NT2Rsbi2`&K%e~ZD2|4`v%@=8u=fIs1J0;jhqqmWIQrmIJ(7ppg_kE&0p z6LK?iOLJozrZ&Xsa~Y;r(hT2s1i$m4;aUZ6ixvpO%J&C$B#@;ppBt6~Clq05d#)vO zdag5od>HPLh1x8V5VoM}kmY6pUvxjRX+J|4dAJ~0HByXUm(YMkJRabpAP;IqOHPlEI2=i9}mQ+tIAjOffYw=Y;Jf{sHbuChhYKSjG?N_ZT z^GJ_W6K?^@o($Qli@cVqK^96){hw6Z4$%f0(4%gssY)PLmoX6<%#Glt4d0~Ajrw?{ zX_PXR#!G$I=#9g8up_S)2%9YU}I%?14v4vL0m__h>&D!Y* z?aG)y+?JKEr+nJ4T1jcAAZyj0$vasTI=r%L!TRB2Dw7+s0+vUVbKZcpw8KJ7Scs5@ zI;<7wJ*4VWsimnK6&`@!kbbl>-tC^(Ym4y6UFUPV?P58QJ%j6&{!{NP7aZGM<92%} z&(AV`4du71_3_db)_9C{(yy-;VPrT_Rb_jq|3cYu1Uy5*GlGnLZRd7D|7VS;|8>x? zi(gUBw7F`hoO9g>@!WHv{aE)|XJWz)l;92wxCmc57_Cuvs7VkaIl{((MJ;kEUd*l7 z4gL6DzX%+!s5wU2HG8ZDyDC@X&N*v#-A>n~X@lehWmgXeLe#}ci&TD7ZlS8*uIN(~ zecOl%%PQjk*Q@TMG>wB--SY)z7)#QxRA5wt%x72^Ut>>GY1mv=)1}IuH+6U2%mOub zGY7KCu>VNi>g(BW#XIPUD4+FHQOQRfPPY8yu73l%&vri%>c=-P^#)>ii!i+By*BZ@*U%Df^+@x4tyc{7_P_{xHptzK2=oo`T!FB- zB+cX3Nafq5AEmQ6AM{gx1NuofKO^lz+SLwqJ@gYnAG{IjRX4+hADc4!`tzid|O3;#bR7FUx2-}SBm#5EC)*rM{qhG-v7q(4H0f`mFJ7p&XRqv z78>0mU-J5d77AA?Fm0C~m2mxa2+M(uD~u=@nf&g9E%Ps+aI z8L@RF_OYDLr1ARMf#b{?HxflY=A48xUb|xpH^L2hZM{RxOB>67lrN)1-jqcEobcjq z;rfCHA6rcc@+JIyKLp_;_`B{DHLam2u?#SxtKE3#41ny6jRJniVo6 zt4-zf7;aI{uOJb`_MIjVG0r9Ui@bx)UfI_i&orF8i_^F~ccN&nk@QjY(#}RX-w?4& zyQ!5|l*igwAjff(zQvymc|>ViS2R}T3Yf|lBd(4zPu@SspxB6d9yn? zFlyB=9ByIvb$YF)YRk(}&x*k76~S`OIEx#bwx{;KrRJ6;nFsaxlKUMNA@4(K(vxFs zybnv`!-0|?d8N>*vx{;yfra6b`?s2M$%L`^ex;_p$We;TO*6~BhuJrvZSl?cUSQ~a zGCB5Jsr>lDh7WkvJ-$|P-CQFr=GVyiyV{e({{{hDGjLnOH!iy_w{m?~reZEZ3wK?v zv$GTBqQJwJKWN=`{-kw$SP4oMCw1Vi%b8Lu$vmsOzjH-$$yc%4I{U0{<9!Eu#~!;V z0y#i+<6FsRO~|&#=(pmE>+~2`XT?oR4rLl{?)X%ObB{cgv84F^FC90_Hi|AT2yHXz zk33h@riW2r7jPqHZLalc;j%@2(gfyb+lPY#F8YRdfARW}%1`pgieORF|EB3!c?52D z_|g=;!JS!HjX_^sVR9OmtD6T_Swy|A*N@)gZVS#Nvio3tM0;`ORK61?{jReY6AN4A zVpMZNUJffVl97$470t}bi!UjP$>9}4TsKbH^C+$b40NjxmnlKEJ2WTLOgk#WvO->N zSrPJbmn$B0f1Jt4Gn?-NYx-+;^EDg0SLqdrW(<>V8KT6RosdnB%*0UY`i+$@Ec<*5 zrG_^vvG4f(v5g&LO>x^h0;As@9|`4OQjjKBN8?F~VlRN3$I?v5ZFYHH@X^ zvAfet)MVkHKeJWSw@{PEHHPQ__9J}aXaAC#-|*%TH+#@JlPSP?+A{KnSm)(6v6WA6 zS8H#z@!tkmNN;;b&2_9 K^QK?s+3{b~jaRk+ literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.sandboxd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.sandboxd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..4cc78448bcf6572968fd2c2022cfbb03aa2278ac GIT binary patch literal 1666 zcmb7DOK;Rx6#nK;5|ojs$O5&H@-EPj#y3exXn3bdnM75E07dGi3Lg8;j1|AIJ=25@ zsw&h4o36TG$&v+IHvESErhdoQByoU<-Yfg_Ip;f%dwgyK>o|h;2m7Z=vj)2@<1X&t z2CicXKj0b`v4E=wJin*BwyT@RT)F3A_rW~EoZ4lJ^)fEuBF@!x60yG9I77x>9vk;` z&Fi2QcAfvX^ureo;#pX11AmOs`#jKiOT0jNl=g2Zzb0O$JVO1Y3g64$Qf}IKWB(AZ z0Aqg>r-?6!-x2>J&Jh13I>3=z%ddmWp_RUbogD?ap zc4fcFT+j4Pn3`-q@2SZW$fN+vX&Rbel1>nsdwka8!t}DB*xATUwh{&=E^tbCuJD|^ zA31SS1l_=Miy(1<`nzkvh0*+H#~xzI3jwgOP%zvOP#Nrs*jv7z)K>h z%CVCdCURDT%y>nT?L0EsFz}2M2Av@8CY!@K;d6Z@uRTAnn`Wk)`;Oa_s(}-qu=}ow zk{Fn*+oQ4xJ(Cx1SUB6M_jTRwC7H>0qD~T4hxf(K#T&N2j@;J&$u`-!+N-;Gimyy+QC9VfFjjqw(6QoL(( zmJMR<=HX@#r-MRnmaOKjkJk6TE=T>&Ki%Pfc6k>z)GBA(nVfa>b+qOrpPj2(9?r84 z-9ha2eVr%XmQD1+Li0KF67<679ci{YlEWi44=prgfdgJXk7MeqnaSBD9iip(@=3MZ bXeE*{XA?cOC3PQ_dSX*>BI7N`_5JKW=HWJO literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.snhelper.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.snhelper.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..e469b127b6020ed5eeb3110eb2e0a96def0fcd57 GIT binary patch literal 5157 zcmbW5e~=tS702JqlEbV@G(avPa0wxRXWW?!7~}$)Tn;YA({UQj_CLF0y@3u^921w%Z|}8n!z{IxRXM98y%vz&_TML-b}aAtqWRC zqkOh2o20$^GfCNJVLz;Cb+s$qUoXe6&2&Y#d=@tQKbuh3>nF3jv8&Hzt{o~!D0_zP zHa9>@8w{;Mmk?b}XNWf4Wu9UA1-X1MG1&rLD#0s>2J7HeAj_|Y+%;du^+R`(K57a5Z=%xC(qVSO#AMmcSk0ym6Lxg3p3u;J?6K;6K1| z@EPzX%=a(G%``!Dd;tCe2cI@}(`$+D=Q23(6!i9hPlB%l&w%jDiYLH*M8{S@ZxTF@ zUa$Ri%D9E5^6`T3|5I>6<@ z6R7XVm*X91XVP1>{=G}+JFquDUnLiMy#Amu2R%=>6I4S#+zv#)b!woTpbQ!c^g(Hy zp|^uAun9IH55NZ40&8Grd{Wzq^my1#N3Njf8ZotVza;R>DI?{wUSDwVAoSs1jANGO z@^OGDAEqNHvp+x`cXvU~{(lE(g71X<0P61s_k;If+d>`Gb>+i#U=eT|sQ}+w% z`5Xs%KKFwy@ZF#U-vhEA-ivBN45MTOf3hEtI_Ub;1Kw6@DlJLa1Hng@FMV&;A-$w;41Lb-~jlr?(Zyp2K^f- ze-?Ze{`efo{`@@j{zG4&N3_4cNMFkP1$BI$g#4uOWwhY&Ji^2}eTBZ3*PqhuzRG1i zUeNd_eVx9Q*MCFTf0N6)9yI z{t)~l_#^NS;E%zlLBxgLA3r5p`xO0*9?RzoqWp9EMLutE?UVF4{Zh*xr(flM0HOD5 zwxj*mvG*I4d3}Ei^1k>T$Z>F*3|c|_82Dt=pzX#H$;@dbf!#UQ{0o)%INx za|O{Fe)YAFluV>6gG}MV#q~}c&v=Xbtt**EI6E+RdwMQTM9bdiSCymY?5S*c6Uu3c z8L65u>BMS5UZ0*LUXCc9h+cRX-5+0atorSLz4Jl#*WRVy^s@wf;?_Edm({#Tmcg z-dMOP96D!-Syx1fFGH&aW3lB_V;Q80s6f4KSoxgRroIS2b<33mBz}B8;%mVo3I|21HX#j zYjwHkC$DNJeoGvdVJChJdx>$4J8lC(fD;k+itTehcg8<1!5bhnZDUJ9WyZn%KS@#lVFH%9a7KSXih;Y%o@JT&~)*Rq1Q5{S%rlFWgAin ziG_9%J}k3V+5wdXLC69hjgn!#1+V2%JP-dwaz>~?)~&!vL$~4KW_9j%1%I$=|9 zdrP)n)GZ^_SiogG9RHbpN5qFlbbjg0Bad4vc50&1l5JtdBE%)7*k6>iW{Gc({FE#m z2Oid{ZQAw_ArKOC&WyHC=C_u=0;=tQd&PU zTD}ljnDu&g7LQvASNLtA_ajtG*O7eL!Lh&rdgTao+617Cy*ZR;D)67k^6rk_+&w5Yhc34qMc=K0~EjshpCN!6L+DDpEPR)kZzm6T9O;Q_TF1(HorLOS21*CXh6^^3y+%8B!koq?tz3-4E#_GE z1A7aOaLuM!!CsTtyfN3;;hDs&+%PgacDr-f-bdvfWLE6k$aL9Jae11%z|qK0X&5aE z`xm}#=soRX_j9)3ED*z@rFU_5E>L!6$BmX1%EYhbQ$OUwu^j9CT*R-Q1DtwYi8_vG z9h|7TqQ8E>h@?u!l@m9tX}^`ivqG12w>>)zC#>szrE)_Y*S+c`*0F`WTM49WrjZp$ z*9j^iPGNoCplN9(*(>PZ^Bg+*dCs^f+N;8O&7 zTAw1i<$`&7zEclzk@4Mpo;nZqChFnTRDKmFw|A(x2Jz0VZJla)zZJ$2>kG;9%SD4r z>LU@?vlZ3x((4~PK`1^EF$pDcw#Quw<{Ao@>)0gUhYI8HQjs)6IfL25EtUhlHZ~^F zi~IG0IG^`Ozuc8dbS`jK5cBrz*vMS1tl0>Et2YMp$)LxbAz9xA?BW7RO|?S3FVF#-CO$r?cW$dRv=L4)#zWwH zV*k00bJ5NZZ#$N5lNE?gWGEdYdz9>L&o8x)Clv X&iULFDinc*i-l6y3>7y@Ir{z!Z=OVJ literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.tccd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.tccd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..307dab2c7bdd1a4cdd6d0bd3059a35ef71d094c8 GIT binary patch literal 1607 zcmb_b%}>-o9DO@08aMG^B2j{Z--<|QK|ujgzG9;B;{e=D%xv3Tn(bHG?h1*QJrEBh z9z1dI;K7SmFaCSJX?JOC*lOLN4!V;NSq|@5bqNs z;uLU3pKEaJ5to5IL97EqDjT1Fmtn8M)kW(1ANYj#e9Lo}h%XE0KLZYsjw^h9-74u9 zSjQ%s_<>*jF>kJ0bsQtY6oK%BA(RN&U19S-;jAf);fw~ISyW^gIbD_5va2HL1r5iw zuxb&BG)zYr$`zPP8b5WEtNC#3=)2B=Hg-jjbh%OzH&}OEjgPez) v{kPJn_e;ZIX;e=X>QZ2bMP<^~mY5o?&r1(A3z^y-)B+tbX2F@FP2Il%c4z702IJpxW@mbLhn<}s zdS+HfNWdYsIl>X{aD>|dbB6m21PIuo-~&`a!G}~q6;<$oDyV{@;EVXbp4r_QNsa@v zwe#D4{rYwH>({SaBKkQ!gHEpa{Di)vWk=~K&EcDAC<^J-G()eTLv$CtoNl9Am$keF z<;AXSl3t=elazgy_rsc%u6D2Xa>y>B?cJJ1*erjxp|00Y)^clCpUYf3RFF{i4BcaH zft0owT7xzbJ(o@qZCfx;vHYA|KB!E#Ko_^b9YliyycA^lWsp1O^SFNKkh!yH@9^;EO;4uLu8QEYc|W4{!|p8+Zfw7jPW& z{DZNNZX`O|4?lr}zcnUkKhZHRgZ;mT-iyIsf(O7w5dK*E1o%>-BWs~I39g}o+D|8p zo9O0zydeC(NK=@{apPt9#q;1bqrr#Kewygn4`uca_d%|RG;fDLAAtN0qURWNC(8$q zq1>rI9bbv|CcR4Q-@A&w1A9wLRdS)n>kk?!^gP{8P!0WXI}rWWsey8YGH8UL4>pZc z^cv6yn_wOC0QA5XSOq)dlPL2%B5m)rdR%O;Qy-&##z<&3_frZ#oiN&5*6R%p-T{61 z8{?U$g?v09%6HT2P-ee?I{xl~oY&)C&;(x(`K_pb19%g77~Buur_1-#8+HBt*!LXY zN0_=_P|xca$n$y==!0(to8VhO_QzY%&(hKZ^tRlep!Vn6wLjlM@5K1npCGz^klwBP zc^6an0~%Kt@1gf;`FojK4jS9h?)~5<@B`om@FDO5@Ppv_;D^9-!4HG|;74>ni}W!1 zHBkO2_;2{(V<7wS5gg zm-RS7Q&D9G{g75I(g{j1;_@N1C&3H4tG{|J5q zd=mU7_4_UsKS-vO^imgdB1(K2S~VDpEvFjGAWcLia*{^oc^L-t2)AWT)Vqg0X5E1S0Xns&tgsH3nNqm;ChIO&6KA z8JWuT&9>>7i78O#UkW@3hWOSY^~|m26r{qe;mZt77w;H)EmN9RSO`$IA(fC=Xcytb zGHab3(10KaS>U5lvQuxdt9TSo!#|On6)KQ*D{#`#ZFrZRsa?SztXkfWy?Enw?)mk_>%AMZ3At*uI!H504D2N0w#1 zo}HEBR>Bp2ThKPPSBjIuezgPXVzXfP>U|5%zP)7crqyE+!N*bUA!4ODXIF@)XAkV6 zb#SWgXN=F5Y#&Y_-5m%MQRg&x8_t07z!zacdrIS8C2oA#^pi@878O@F0dNBFH2C4* zj{+yDN!6D!4Gg?$d+HuTX73T5Kg@~O|ba4hc$elFlw zFEE^XU5Pr5Y8}L=+Fq`|MMP31HUR@t+nZdk0uX|xYEhlv9!gGs< zjfI;ApEk(n`n1t4m(A1joqC81jqm33)cLYEQ4go5@~b$(y_w<~#G_ZXbxP)aSr|vG zFD9p7E*e}_9|^mjt*DNdUjNt$Lh;FoNhpakKJH2|*HE}z$0qq+R2YYsiliCJSp6*oX|;V%sPc4Z3+(pX;3sK_xhEJEJ3?PZx#Jc0*ODTSknb-ALvAg?YSa3 zE;>!U=ZF@2_MCEk;^u*}Y~I+ZaT@X7vfK!(=`CxAp=6HM>tD*xDh+Lf4H|J*d@n5L zZ=92Mewf>_bepU|{1+cTeMiV1A$!l$OX0(L3b&BL`*glrexXT_lp-7l0g_d!FD?xv zr3y|VyF~*YE+(6YEqjgzB=;C28zL|A4P^%g(_638FS8ysUd#4DsR8SZ;M=peO1{z8 zRjbMICkoe_v2dObtnvYJ&Hvd?=kF)IpF)vXfgd(4$Mf>Myt8Dt Xb6z)v3PoVyqM;OmzT!qHN7;V?0i-|u literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.ubd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.ubd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..2f7864195b6d995feb163534108acd5c25b37f76 GIT binary patch literal 11741 zcmeI2d3+pY8ONWQ%@(o+3f9tMOGpc)mbx=(IJ5%NG$pmRh1gI~Jj(3Mo6VTnne7}o zS_PvV0^XwFh1LTR6~zN@yz7DYeJiMlD4yVr_4m9pyR$plZrbF7e>wSNzx!U#yvOrC z@B2RQ5}m3XO+8BX?=i};GHxGzmU@+aNsjl@o9UHw9leZRN-v=o)3tO>rtDP+_tvFN z(Pi>)isHZQTR7*&j0Dbe7UFbz3_eex)lyP8A3sUi$^-JV~;;S-cNyyE@&UgadBM-i>0wF<4cEx(rYE$ABQRaOx# zSOOw^RFZ#c0ZN}jB)Nu2c>~HLec9{4BGKaOK#geG%aV9WggJdJ_+qdZyaqfKyaGH8 zd>(i@cqw=WI0-%$@^*obOXRLYd?o*Qu76iKe`aGlrjA1BY}98k-=jQ%sIUd)&H`!ps;{16ui1>2;e5Q;C=Pg9JCxb_T+rdt72Zt!C8XW-MoAA(N@zXLu4{08_;@J?_i_*w80@D9)bKM0n<_kbpN3uu8i zfdbqM4udy>W$-oN2zWhcgV%x20$&P_g4co$cqLc?r$86H6!gG7U=^GIcY(V=A7niU zKo{W<90enA7#ssj;5fJwoWS^B)G`B9!FijJ?>XQ`@KSI+ zh;hxI2|kzTiX)J33Y<^Rlls%$@qD^G86Ob(->Y1Kaa-1LCBE^v@eHS9mZ1C#@V=wL ztBH=8AIp{c|K4OCypZU4g?FNtb{4vP=_!Dp! z!aoIv!Ji?22kP~6*}r$wU9x}gre7eQ`xlh``%8p#2>*)9L(V-Q_w%no9dhmkSAxF* zmxK3#-2cA?x&MEM^1Qy>k1&tJ??E1iKY%~REczq(P4G|Po#3Cr&wzgcKLS1g-VQzp zIlRvN72%r@{u}rf@bBPW@E_m};6Kr?uK@oAUJL#^8SjUXezo!+%3*!z?%0n|+@GMF z-wNWFb*L!8@i`{y*`XYkq~~S1c^sDG04mQ{4p-(U>76pYz+ssVDwjdZ5#Vm{NRa0h z7R%#vupbM+4)AEik0bpUFa#d~R>6g!13nVueqIFH2tyyGeOau~5=%KwSpr@HJ__+{ zr@$p!l%>kDBn&DWl;f2y#Gi%oOiSrjP)U^QR+b~3^#eq|tx!%x{9}=id5Ln8vJ&as zzaYXVE30Hatp76nXk|6R+|MB7u2D{r@oTuAa-P-dTZ9~*7aGX+N(XuV^q}MO#1A48 zO3;&)o0VTFJ?bX)Hucl$)ww%!f6XZ!t2$2WxS(T4{_Xj0&SrWQ&8Su#p}9fiJAnuS z+jA|=7l!4z&Lpy|Y|iJ{CExIE!_}gay(_ZA$)YdDY%azbiTd!b=vChyGeV({8NOce zO12~Pt+M2#-iP z$Xii0#8vUfB{VfceoG%ARbND_3&VIP)W5Nw=*?naxK_!VkiAIV?bD0nz8!K49>MwQ z{U$&Q;RHY?&S@XD9B|Wq&Vz=jV zr>w_+bAN0zTueHvyP?&!Io+l|9zRV^wV@-^kv&g@tWiTDEJ6_4W{~tKPBfW%v@Y+) z<*nL4Y@AjuV}BZ(kyb-mLBlk?$PH_vSdz47&HZt3@?udzyLh8N96bU$kC z$U2&+rHzoQ26GXZ&WwI(=L1;x?dXCkMEi1W;8kHGUS(hgxrhzqi%m5x$u{3scVRBs zNSoC6DV>E+C{2?Jda{(2rEZ6(+mRZB8&4EV|2Jckjjw^c6@7C~MRTX)nTy3R+MExRe!EFLo#e**eg8?!cxr!+#SFm|r| z`7Ua2CL`l|S0(iQd{iVMz>NAB7v5p6d!zE`hbRhee({JGmE$(g19pB~`A`@SQa~ zc_rJgn>?04vy@Y*)K>y2M(zh@(Qi>HsSekpdELv{@uta#t%=-U=z~!SyVcF^Fgz~u zS2Zq(Q^%-6r?Ho0?|ttjDVqIgSWzx8xbk9X%y$N4Y)!tI6b0L1ZTr>hM5L zRwVcPoIaG(f3520sQO+-A5`=QNuOw2x%Qj$x{-n{XuHXo{r>;|%j!WMl+v+iw^|(9 zvUy)bT6_XN8s(eqb6BY&?s3!NGj_Y3KLKS2W-7ncD+hYNZv-RT z1v?{zuWz)CvWwHVZOX)&cLI`N`sK%=`8T-8#WR(gwr;ds@@*Ft95Wp0_=wkQ&GF1p z+VQZ-XTfyP^0ib6S~egMA(pRlAZs00UCM{2nxEXQb66r;OsGz*7K!_&6Pv{VyLcZ5 z3_djR(J4M+@QIlZOykJmfCe_2?L9!ZBzwA>ac7v-+l+qpd)}xmg0s1G?e+~b>LCjt z()i=h< z=vN2S^PmqQ#-C4xqv}o^QcmKxx2vZdFJs)|e0VzfL$}13?qZ9E>#Ta%3Vp*ABf`Oa zXw0`;_}Em=ujljOqw*?8)WbLjas-F*upcRwZ-`)LkMz?uOtsiSrv=8aC|0~Np#{Q~ zRZHtt4J#8wr?DLLt0w!ET>@jOu6GfdkHf86UDLD97{<8>vnCA}mP$Wk`o5Zrvl_CG zm>=0+klWQLHxU}>%V=rOy23(uGdW)>C$Xaq_4b7+>@gAR3EOrN@1FtaX$nN>LdjW7QmwhAd6Fr;&aJ=_inWtn9b}bqJoE zBA-joSNq~G?2=%|^eDVMY@Xoi{-`$v9VjtO{2WBbo<5vQI?;h_#>?l3_)Dc z%zXf>Emi>EvR!$^mh-lu+@Lou{Mf@yymi^u0~@SS{LD za~D&lAA`wCHS{WhmC@&@p1{KJWXmNJ-CE9xX+7|*5>FG&jH({2#-uh;HHp~&-a4O5 zj_qhFr-frst1TrgiB9E@_W6hU6DRw2fjMH}HjZynW-hn!yrCwi2$!HWGnX4297H)* zV@LQsGv`lg$4(Z%Qd7;9Gnd0$fx9%G7TJ3^7uqi`Gb{4;!q4hw;_8QgKKXWld{v&G zj#tK38{>m7W#P+#%+AkhGCwo@8jH2!swSRY4L5Y`U4myydY8DR@jYKUj#m8$lC*DC zbAMQH2KsghH(%DyM%x^$UpppM;-u#MfxOT=uo;in!Sww}{-x z3pZutnVz)+!+agU>L{%w(Qzy!t-o1Iw+vC?yY`I!g{B!RioAzN%V7l%;!AeTtYS2+ zOgU5~E+_XvP5WIxa&@Qy3UO7s_+wf+A3ZH^+|>d;gYt8j{5(+p3T(=D5mcc!$p(VY z{SEDeeGYt>Ny^&)_?l0{6-aVVn7l{sQ<~}pzk%);k!y}vdc9isrKx;!SCGDr^wV*E zYw6Gkut{>U4Ju)uHKF$q@1*pCMxBM6+@JAQsqu#eAvRG}$Z}9FlD82fC|$&ESFcdP zf`fEvj|RVI!Q(dukcxdAgv#Glq{DPz^-G$Wou5qwIL|u#r}A3tkL2~URZMT48gI*! z{vPcgXt;jpb0>LY+_YVYe{Yb!NbV356Dq5kSs&|mR_ae$u9a^Yc!6|1kQO-3`&cuFV_Gpgnj%tQwCHr$ZA4kTuD6(bESK}pVf7H$^ V*mb$W(Qt6|eHgu>S&i7r{1=Z=Hx&Q? literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.xpcd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.xpcd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..925d75d3005b3175b268bd7aa00dde5f6c17da29 GIT binary patch literal 5469 zcmb7|e~=tS702JqB^Pok8Up!YLJ|@nUc$~CAs|PBh-CV_*KA13NKJJY*6-t6?) zGqZOWP&^=@Ac!c$2;z?j{z3&6f8cNYfr=W<#j?us5396F|FE=5%i<5Mir?2WyE}V7 zOq{Kq&-Lrque)Er?tXg){f5q<<1;?Lq#tV8opdLq_+}cC0(uL*nfB8g=@z<~-ay0C zT3(OxiI!{+?be??lzpc6!{<1s zxf)VhZD7YFZeoe9e5RZF1QU`4i124f!i_99&?bc zCc3*D{sEVgxr25R-NR+D`#;7B+6BG@UIYFUgg@s04SYS(q506;1J0wp+D}u)KDss^ zF9?61pzAP?W5y8v;(72|(b5;t{sy8&&u8`~yC9cDnl}=iYtT(xUivKRoASAM0PReA zlh%J~7X1;}J9+Z0T2dLxiAmr@-TR{`N4e~os{|@jr@SR`^-mc4&^e$aLiT%y-d3Ap7Cn=;!3g_t3q$A3^QM`?Me5OZQ`Z>_>2t=mC0A_wzoc?gupX8}FwN zX!%1-EeDP3(e8ubHQ>YG4)76h5IhWC34RE?96SPU0zVA)fscY0fscV3z>k3I!N3B2X#X|s9YdMp z=T{)_yI+GGXUEB)`NWTbPeu*$j3vyK9A(#K8Kw(k7ZssI2#?v;u0WQZU`Vw@RuuR#PC0rdzSHN!rhBwJjg=kO z93_yeupXBKAEz}f)8*#+asOV~PW-w!C_^6PB78f?r=&!OIxbq{=5?<-@VT-gy*#vH zMmyNGJW)=oBjb_ly#n=yJ%HfzU56c-$3r&Wt3^WuG7<{cC+jsAav=45X%7WywX{2H zu|U^n>&;zWpv%SiD}T=Pi#;9AQ@89 zOI_&lGf(To&$>i(rY`e*#qJP(3Y|dLY}N8v#@p;4CE~;hl2#n;IF+43@D+@e(;yIuAC{$~yp}Q8nq+%K zUANM5(>5cVJigg59WyZn%KVoC_kkh4RY*N^jX4CVFe~^nL(|1OhF;y2W*HU&lx;{Q zBo^95_^`}cXb03I2tpS4Xq5EoBj^$y#cB8_l4C*zvT6lR8oD)a{i)g&{K2Y==g{YM zZu|cKIZv{a_*H0cbc{c#N02Sl{duBchggE4D905w5%4xD=p7UaLG!X!JB71J z)?eN#Bh*;HWjwqe$!2?wh)4SL`P!aG9=BHPR79yR8^Vf3=y8+wxT2&!PPCbYhyzQ< zfrqtfn6|x&5D1AmVMZJK`ke}v3hUM`_pH$OL%YA`6%{2oV)b)=hOSjbySdTWUP&wZ z`g<1R7Gk}&otfiS!WDi)aK_J1*JWgHqS<2%LB-MPArhrIZkLFMZTD=Xg>V+1C#1J| zw!e1bEawehnH0t|OFZ~;)K5w&T9jPf1i;bC=K0~EjshpCNL4T4 z_HG`dx)Lu7-&y9{yvLf3)CV$F&TC#sPG+F%0NHTCYOmS(f9JKdR&sAiW?3>7R*->%NFn58}fS;~jv?%Of z__n6^w2R%(rv;w^F)Uho7iae>@q7_#wYn9`#INKx$cPKaa;)=nHow{qaH>@$sz_0E zaH48mXZ;N#k}4TgPF%Bw{dx+|3SH9Ow(ZoMu&Vc!$_;T`x2tDa$2!j4QXu7M8d-sK zouCvV3(@yAnszNDdp`Z^B!`ZEP8ksv&(oHkF-cd8*0Ip59asn5aoL_K63$}c1H@kWYk5O2Gnv-3;Z zj-`u#8SsN&&ir&8BDDJ!-r--<_)gSM_&P&vM@AG~X-na%Mjp zioZ(m?>9CwI=HitwhV+5d|~CMDA(h;0^jzyPrsk$??%0!LXlX3AC6j%=jG>eZ-?FH WJv@qpSOgXl2&EA8B{xbr%Ki)Jc%w%E literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/container.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/container.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..d008025b377691edebd3a5506e9308bc5b34b1a6 GIT binary patch literal 54225 zcmd_T2Y6h?^|*bvTXK<&Z7dtxh+d3#O)sX&a>3vtEZY#8v)Wxri=|z$MYiaM&;o=K zTIdi$ClG2v4K1OX6i7ly2qi!g0tt`=5*+xy=iJ#gyOMFpFVFWp-}>>snwc|m=gysS z=FHq#$9W;NkMmr}{`ce1?&^0@;Jm<_{)+-`xX=H9?*iX9edqel@qNR0wr{|<%2ye4 zIquz!->$x9-`4uC*|(K%GhCIj&xO`-jl(?!-*)|LvFAX~e*Bem_Nd6$?#^z`uFfvb z&dyHGnou)g61((onzLnvyo7F!&s5{R5tFtd#F^wc+d9vO#Q%AT*U;3x zCbXU7G;9oUkMcQTXFBpTrQ}EAnd^R0PCk%$GaP5~ z0=Orf2ls+=ChhI)tM|K)uxSqdaB}OU*-i`G2hM~uU@P1W&VoC^xf*YdP|FEUo<3>5 zvmcxW=fSPu{%|vR0NfZZ)OZVoO&f7NIC;XPMb3fh-zIDti$9#)Fln*#74>g-mf}AG z|0S>v;-*}dIR_beI5jZoV3F5ygp)m!4soI?cc^o?iGP@hkDK^MILl3ZNc^vgyvB!I zzr%^+zjk6wsQz&BCleD+7ychj>=dd$obc|%HKA_8--bM=$!|{Vb&kaS8e9Q?1AE}h zFopb!$U&}?cKVDPBDW@V6#Oa7z~^BWJ`Hp5NtlN(!+!W0TnXQVt6&4=GXNjMeKdR+ z9s}=($HIHyaZvJkJp3L!0p12rgg3+0@H_A%DD~%LDD~%S@LK#&fmgy);U(}icmX^e zo(Io>-+*6-XTme#sqid#GCUie2)_Z3h3CM2crMJs^Ptqz^I;F}Z^CYP0gS;5;bHJ1 zxC~wl+u`V5MB!RhnK?|Z`@bIJ>WHPS9mSl5q=v+ z;B{~s{0`h2UJo~eH^3%%Bb)+nf|KCQa00vqZUAqE4e&NN0)7|P!P{W~-T}Svd+_td zHK9ATL3A`JA2=9UK!F%DK;C=9I_ zbK&#wEVu@q0bhV~CjG?unYPQH3bj9ilTU5@x$~0xzbI@v33*6+_=WQ;_5Y=?={Wo$ z>AdW`qW-@YYX1c3*Isje1NVWyg)`u*a5wlnxD$LsAa=>zZYu11?lhp z*3w#-VsPZ2ORUXowKXU%A z{(lpyKct@i!}(PGKNdC(aQ~k`87KY;r62tl%;8Ts{p?!jGnN0hP{SeVf9?c5(jPh= zugC3YJy7~t-1z%Ee%z8Cq@N6Ukk@_>Qm;ZD1|#H#dFoC4Iujo^{=+>ZOngZEks`10 z;pD!?2G52nH`=p-i9g1~$4&gPo^d8VB>s4j*Z6R9PvZp7RF!M=OfvB&n)tYhzmaFM zi4TcCMdUR;oSbaj*t5CHHF-8Q@i#H?aU;K(gsVKHyteRch5y=#TME@5PVQ{n#%ABc@#<@a`2R++1&hs3g>Fsa)4-nRE)A(FyzQ?KC z8ZLla!G#{jvngEUaaQk*meYoR18(%E)qCMyjK2`~se7VLE%7*^&n7Vbdz@2epeHT! zIHw5@B7g7Wf3U|1zBAzv&sX4U@G$a`pLD3O>9>T#(61o*3BCl6K<=k-Ia~w33ZH>d z4}r(R zW$-w7AUqz!a5d#9dI=1+PB__f65Jbp&G4*TEmatKj|cQuqM82tEkUhY!KC;luEB_y{}+ z{tzAyAB6+(F_?vq!(R9V?1WFkDEtvT1pXK)|h90R9Sk;mh!|@oPfA zhM&S$;3x1m@Ne+9@B{cN{4@L=d7+f{}-=4KF13%aB&xAT|K=R}9 zI$p_-$LsS-zv&ffI1Fwy$?pxSe?X}IFqj@6^46*UFroTG@-y694_81Y&!jg(sNsvc90QYZ0~m*6;c_?*9sX^iEU;+<~NfsFgxi~Pni&xhn^NADggx081l z6MttDA2;!L_3mckL*nl)@){pZTu{u`orM-@pHWU;Xh~mT%r2IV9WS<-UaHvzxM#+52wx;KVSS+4hDA_ztG!; z|Mue-3DqA4w;g|=cQO8(Q+_bG$@q5fQrsKiUSj-l2OGy9;#~&E!-L=k@L)I!eg)RS z!;oLtc&Jd*he6-?!@bM#Upwvyq58w%KgUJAUxojGF~UC@*CD)mcb)^pKkn_s|NU_Z zq58w%yW_gNN&Npfu3M=7F!=U3#((%aTmgSOuE(1~?pNb_g?e3xK9lwyh5w7=`h@Ba zgKNfRygB@z9+wrWKMX!TF7I85|HI?@h3XH3_l;ZSJsSTz#|;S89|mt7cZ~Nq{BIa{ ztWf=7@Y~~#_nwIVRpU+&sy_@~Mt)brOW;ZHLU=Mf4}J}v4Nrlm!&BkO@HBV~JRPor zXTS{nI_!mK!ftpLjKQ?&=K0@-4({vV z+OdrP@MCyA{1Dy%{|s-0Vh6YhzK#24_&U4={s!I(e+h4cFT(G_pTOJUv+xf11pFR+ z7~To*hj+ny;oa~~cn`cC-V1Mq_rV+B_u;kh2k>%uKfDM&0MCUF!n5E*@HF@^Tn!(A z$HE`Ne)uRn3O)vV;N!3pJ^`cfNq7kS5nKv?4BOySQ0yE}!~JnT1LweJ;lA)WxF>ub ziXCJP+zs~&aA)`vI34~JZU=t`w}C&0Tf!IN6!;R{5dH#=g};QO;jiEb_%f`6zlL7; z3jBNn#((%J{4M+dz6#%izk`2(ufaFr>+n_h1{C|toAB4Te-B@RZ^0Mf+wdv)4txy$ z0Uk;}^+)&+?mxl%;JffH_-A-Kd=K6N--p-3zrZWuU*RS219%?%5S|4;f~Ug2!Q;ab=M{|yg=pTSRf4xhtixE&wkDfGYtpcl@D zKDZC`!`)#3?g)c00z+^+I1FwM>);ev4=2Lma6B9V8{kM-4>58FL$Cq*;Ar^ym^Gm> z@Kd+}{1}dfe}m)TU*UN8F5D2l4JW|YVIzDMPK2+(Nj_)7&&O=!o9uH=m3|yfcy7!T z-&CJ-nz&)`DdaYWkHaSTAlwAr2RDUc_hY_z%5Ki)zAb&u)Z52wA=Lg7p0X?HG{aq7 z2Cg99Hn?|lw)JhN^3#MW4^P?I$nWHYebWhN{1>Vo0Z-Y<+1|Gc{>O~j!MCG{2PZki z+X?@LjXV2zQlz(wQ1wyrw}t2nyK#S_pW@zNCHdIH=bXPI{xf{e25H=T!k#e)`1XQH zxHn9|eP9RN7k(ACz{AGO^3C))V-LpN3YWrJ@IW}5@P%*=JOIvx^Wc7PHk=1r;r?8I z2j>9aBJ!P_G~c%X9x-Wwx~Gg;$oh}m$0Fg_Nn_f42NADvOuO$uI36yBVnvskZ|g#F$ep;V#*6{Fnr9RzC*bF_RgVFPQ*XVceutsT-{T~9AU1n z_#TYIKf(lj3wFXcU>E!y?1rzvB>WXT621giz@Nb$ zxMp;(FHJu3lTt#}FX5P{M)&#h>VK3ki@)fJ87O)pZuGL8glj#5W1b|vexCP3a3${V zL&{O@B|g71;qK8#`;PHBtEXc>5sDqeVp%j+!5T+(=+-+-wCh-o}|}bE!2EL z&*7uL<~tc44A0Q;Q+%hH{GDp@hnxJJF5#L#$aTK%JCo~#sef>a$2rR<`P!F!!a_c4 z@;u@-JLjwXt~KN@)bua%U5wmz+y|WU`RAATzJ+@l*Mpvk#Jg0}xy*Mt@{$fDA6NLU z#61o-T)i#wS0V3=zS?)K-rqICrcWCf|MCBz;oH8O)&Dx*_2$06W9}O_&+!J|jkv`= z3Mq%1L|)4QdfsWc#doL5-Rk?UiGQ1kkDK_n`|dFDA@RQ_@){p<{kwek;J~l|Xz1tg}_PwC;FZiC(`+L^+ zyxuo!vwGjpg>ZA9YebIwc`gJ!H#Ypl_X~~pQz7N@GvA9EkMUpQG5%}3mn2-v0eUWP z_?7RM@I3g6#(%~4vc~_lxUu^^7lPFD-}-(7JK*m${8gdWbLcsv;dS3@@I?4~P3H|E z`FK;Pa?o>3!&|;TYWUki!ru{U_#dFGtKjzJ8s7E&39f)2sr;XX$iL_N3v$xF--pt^ zapV72-v_v*9zn|ILy_0}gp|+Ud>?B%e-|SE524yMp(obxiSJVl|EG}fe+ji7L&k-* zzRxuLGvB{?URzP_uKRPJ<99r*)DyUROP-_0FYUzZmwF@Zq|jdd$W3er_=n*?7Wtsx znL4r|ByPN&(c%HM!n*5o1X(f%>G!?>a6 z;ZYm-$NSxJZ!Fh2X3RKo>vbUV8~P_8zZvxpPPm%uG~(XWndsjL`Hv<}5+eU>2zpK( zHPt^E9zJ@ie+oPfcN20eM{O+BbfKqj)F%GT@LxM|Q=$69)tfk*`?pm8ErgmbqamZB;DObUekr1T}JKcp8==Ay;XiMq1GGd*<#eb z{(WE*oUP$4{#J9HndUmUNq3fnYr4=ge$*WQ0V+S&KhMbTXXJ4szrTd5JoMC$n(tqT z|JsQQgz69J-`f0(U|>|6f3b!iDAaK1`E=wmf4i2;68}<_Tc-Q~|ASTjAfd`b&)Xxv z;{PiC`ALWP4>S2X)Z_~{{)hXIz%9=KlF#KLukqpPCMW9eR=Ey;T;o3*ifR03L%4~b z@ONtbXG4(qT_R8XXG4&BlJxhf+>!ns6Muz?kDK_t{*;LiiJumEjSnfOqx`E>F5}N> ze8zu`kNsc$^ZtH~&-kzLSBkvmA5xx2`v+iP)Y1OcDu0asIFrt?CLP@5<9PoGCLKsV zP84}f2U6~*_)pSuKiU5^P45)t2l$_*@lW-iZqhx?q>Gz$&+vcUqzg&+Op(`gq38LL zXZz1pxo-&dIh+HZ8Oi*g^4r)s&;LygKVL}rvmv;8s&j$=BK5yesQoSUTr~1q{)^#x z@Dg|$yja|en$+w}zN8WSX z$nW@X*7(;8RsIGef1{DV2}*i|dsdFT-G2+rz*}Jtyp8*r;@s~4F7Elbzo+TlA=Lc9 z)svk&{dcSXT|)ey4Z+nLIrsSQQ~!H~Di2pra=!1sU;Td|RJ$)+J<)l<|B(7WD8&ES z5cJ$P;$i;})&CKpjuX&x=ZMGrj}ouZdCdQWhCeRU^x*0V&XfKhtN)LLYL|wqH*}uz zKcoIn3t7K^HUw9Xr(HZty30qPpTZ?0*7%=?3*ig&+xy`!e1F1E{69s09Q{AU{WJg1 zagU{c7jD3~^dj+wk9aQh67-FDKJ*Lx$B_OnalbyC`9JYwym=Y-%ea3{_-Mjk!5wV) zjsI1`WnB8Lk;Bb+_B;O@xMe(hjr@;ncwO9DU!j}tkc@}F_rHaljE4~S+x~ZOi#`iI zk8r&|zz5(T;oZaE_5TUp4*!gttgAuKO~c>!zXz{}e=+_LH}iiDXZ(lP;{Fg`20wxq z!oNWor~j_)@*n<>jazsg;h(@W;XmQ&@L%wz;cNY$!t3E@`h5N^)cqBZa3}D&hC2ao zK-#ZIsQWA+;r@URUJrvB9uVp}1w`)%1?tp)m{98x#J@f;G9csGa3SfA5NbFi-G;y@ zO}8O1M#D!7wVpx3#|Adg@UemM8a_^_^&O(GO$clVPlOXSyius(knoMzsvzMT1*U2~ zCJV{O6rsvN^tp`#o2q}4Q2jT7(%x|szFA-^jla2&_*)27Zc8JFoBVDQ*cx6B!z#C} zQ2U2zQ2LYYppO4g`Uk>^H$4#1c+&$rXuR!(DhCPQDX^o4?-ZD!;X4O*C0z8!U7+X} zxXIUUf!$3!NWZ&>$ZI`@=%afD_Jk|oES29ou&+sHACnGl(rF3IH0eOnX%%@*2a?X5 zz-&!tPGF&y%UmJx_6zK9(wk?}!;Sv|f%zsqNO}uIUekli?a<4I2M?q4uK?`5OZ_tN%?x?LQ&@ zw*+oe|67IHZ^G5Xo$m(jQ2*P7>JJ%TzZbYm{qGd&_zJO4+!MGP#v1Mk+^6C93bj9l zjOX7E+^_yW5UM})JXQZ--~spmd|1OD5^6YPy#Ha~5w6?l{4nsChCeFQei)Mf#{*BQ z{}V#>hv*wW3OuF$KNhM#ME>c(v+DnhP|F>nw>%eEqyEne)gPiC{XFmj%)p<(9{5w_ zr#L?k{0#Se+%IXo7lj%RdhV|Ob>J89Huy{UZTKsADSR1T0Dq(LUJ+_Mh#lb7z;9s( zd`-iDC)99=p80y(C~MK z8vbV}{r-DU^vw66j0=B(GA{fTN_^zeGd~P`tnoh*s{G%K{NIiIKcJ*XIOYCH;NL3$ zPoc{H%gBFfa>i~iwrpYe6RLk56n!2y`u_0XC=DMW)bNoe95?fo(ZL277&SULLFL8-#}Y36_y$n=aopr{ zTyVUJ59tRt6nX70AoHfi;KnL9F}RV5Kgq<$P5jBhDJDK7{#23I_>lR|Cc!4j58PVi zHw|uX(%HReN22v{C!1U<3sEbt-+aaCfr};X9ee&bY`1$aFfp5;C?0@NILUGUekftALa)S zfYabYm0uv#aU5cQXbUcaO>n7(9~f*m*I8_?gPU}hNVuj8vEv*RTm}z@hiSZngNK-S zUor7;6Yo$7*LaZUb9k^r<&Ow{)yOY5^0<+YO1R2H>>RORx5~$Zokl)k@{Jq4;`rbRMjmn>CyKnrhpX$IlY(bx{F8&H znD}2a@o^LX)Zl4G9uog_k=OVTd)ryTufxMfpA|e49*6rI$gLc8wov6D`8+51P5cjT zJU4ir@rUI5eDT+Q6O!IV!3#9Ki-H$wdKU#R)p!>NFEQ~T@xCSg8V{2GWx*@(|7han zLcK2Z98`a0@M`=QHeMxEe~A1w!EdYowL(H;J$Q$?4%BtN@9FjL47%%lcL}kF-W|Np zgx{m_?iIJ@4|+DQ|9!{DR1 zhv9~}9}7N?JA@nJej@lJZn3vQ&+qGg6nqN*-_>FNhp#}~%(I^kK8suC+0Q_kkK<;( z{9JGi;XkW;UN~V5^5UM@@IvrsxMlwR6Y@Q>;iux(d_&KZbw3ZjNcbbjL+l5?2)+at z!e8Pq_5EkMV)zC;7rqJ4fWIeRzf{T;~ob^4!`)yL?5TS$vbG|EHP9U=8$yHHs7%Qp+P{Glg8J|b{SI33D*-S(vGqaN=7{cuP8 zHzRx}*aUZmli@C~5$*~nz}?_DSXc+%1NX#+8KHecPGiHcy+V7!;SjghhrP+q$cBBy zt@&~NTSG1CKQlB({ab~kGfUVQBK_H#&Kh+OAGUvJE^aT}Ps8^Q&4UfN4>0vXc=zb} zp@kZ6VQ2y6A?rN2(Q_AtmZ|)Kp*9UaP~7z6i-oGkwnNdAmq5{zmqO8d2}l1tD0HaC zJ6K4(uLxD{5GZ;mZuF4DLx;g>Fsj#E9y&tfEf+WOzA99`1R@^`b*OwS)QQ~MP+W*y zLa1^O{UaIbf``Ly*fc5`N~zqDp&sN!k6i&pkHyV6*(>2%-VpsF9qQNo92M%*{2V22 zu9FGnO#G~gkDK^;3D@|L_$x!lY5rCTi8l~B#>6|?#KTRzVQuZ2#*E#nyE`JNU!RsBy3osPeZYmj(ngwDpz`hVz5 zp0kW65cgT)uj7py{*BOin$EeQb2Q$$;@0s6B7c79Li|I+E(m=SdLeENhlF1gx&;4^ zLl+CxAL9S5&}I0q4P7eaRYvyzX*ySgE{DU1T@kvP`^=2IQb>7SB~*O@GCo`rx|Vn{ zjzHwE4}BYY;dPqM^`Y;;2HZCwFZ~^)ecTwjP5o~U-2{gZyII`Y&Tip4BO7iNx0b)_ ze@E!M>VJFaF7>}dNIKsWYCF4A(_#M~>5QnmJ9Ho6qwDSwYWTe-T-?9oIeuUB|AWv2 z>VLmb$34h>Js5ff|At`?haS@KhsCYqASC>Up~vw5IP|Dc{ly&`_C)A$m48C|75c{~ zg^YVYQpz}pTlWh*MY!~fPs@GK?>z&h|9mdwar};aJWjySW2kU`AKGu&F~fc_Y_Gap z-FNH$RQE|;UHw<b62Ip(k9JQF^e;B5>wj&9^NILSsV-5ZYf_4OpeN9B{T6+P+nif|?o zji*yRyiuzk-cXf~@9WM)Z^YZ@&9LXU-y3CzZUVRbm4Ut9w6}wh9`$X-l|mwlPYR!m zH;c?HjTQAqHkuxeEOzSWIo`;O=H}_Uw;U3QI`vC%dgl|P19?ex0Cy{Y#k}35k&T>+ zz<6hy`mbq*n&i8b|5P@g>B%Ot*6dt8CB)#1@>c4fT! zx?P!czR%ecc~3FD{%9uBo9;;VBqH;Z9hqomAkvynbtb#=nP`rJZOf!P3Cu>?@*O?N z*t}F{TCT@uU-=p`9eE_#Na+zT(Cf@iWOLD;T)3|%ndR+p$IX8}n~7vQlBq~%G@0q^ zi4Md!Cv3=k&Ox#bNy!JF9p&o_M-$iAP z^WsGtRa`dKOY=w&660H%No7-t(Uf|5jUr0Z>(k~Hu8X9d`fdkL@kkOWx6Sw=FI}0W z-Nt5d;eOJQ3@qlq?CzHx_}T&s4fGAC{v~Oka}h{;+xgBEBV{9wha7k#^}JpirWl7T z_g440&P}A-%PZ>E>xwrk8Iu|n%_OyIOTG6LE1eZcm|MFYU+8x9| zchmbTwEJ4^%x)h`=e6gexqNnJG(+57*E{~aSUQ!}r$ba{mV8yThcA8~xs}OWE|Dp= zQAuj{mq@QO8cTG@*i>lrUoyR(WNHQdda69VIbR}w*<>oZGLh^^mnAs=OQaW##nSmy zF3SK#Cub^zq{rt#)88EM|BwD=AuTIKk5jw1Y)46uo-^Vt$j#FJ(p5a9Hx1Kc_2Ab* zIz6>hkyh)D`$P6ybJ9E!$5DNvtj(_Ki-mil`Bbbs9;S}wvbjvOudE)(_*)vo7+MoN zP|>mEqI@>x|B%;h(J0Q6FD55BTdpeIa(BGc=*yR-(Fh9t?Xq+%+LJswkx^gC1fS{r zA2J^mNkmMp968y>>L+Y{!0xA#xqJ#m4IL~IkD#?RXA;?TPhL9rvT~a@Sh@>DBa18( zZ9}4DBTG?u<|a}J+=+P6zbz_VP^#E?4l?cLKu_csUt&o3LW5jm=OJb7 zqhDKyHjrkWgcOV252`QO@s@PwdplCmq|w_4)x+(0?OZQ1hY_@;rz78MrQ$f-k?p~sPo$LZ1&LfV z&JCFR9kjo2ub*5ZjeI$pPA-$~iL_*LE7KWHg>sH_w$MdW`pKRxu$UIS=b;R4E z3i4ds@_716Q_CKwez_CjDeB~rgQnb%^y8&^*Q1k{WHc4dcO;n$=LYDN`jav@H1aL5 zW;qq+JuS?mlQHd+n%eVyed$atveYCN>0+KK9iCm^V?F77Jf4na!%Q&sYN9``_jOt& znOP(gF;n13M&_rb`>UFMI#Vjb3pXos+=|R!ITY-SvN2d^2LLZ)Ij@_Zdsn`$0-XrO~yQs$;vLLpP1l{)+H$8sQ ze0{*wJ+irH$jpVwZl9VpbL0aHOj(}RYN_!xmH#!{hdU0=YMr-0McsNgE770mN%ti( zPSeow+M}IVI*{2$<%Sw$7N8SE+IsR`$rMd+Ch|^IyT{g*h>Iprm;;o}VEQyr)RJ&7 zNtufAW#;QG`CR&-=!!(4j!Blb=YP#|D%@IyQKVoube!gO#&hQvqFc4Zu(248>@c}# zEq$zbJ$qiF12l69HJ(No&fD^tSU1Ms{b+dU%s_aTaQ3JkjKA@Y=4^Mbq|fL7_Bt!0 zJ?>@X1V8!se)%OD!xx&o#GU$s{;wu4VpeoJgDeeQ4E;$u0W6}$VN2^t<#Q|V*Gm0j z%Iz29g*rBp!tuycD=1;69<0`4b9~1PS#JNu84~(t!Zyy5hf&4+CFZ4MW@?`7#_I3( z*Tr$VHJZW9nQ5AtPsOpG%Ps7vazok!E8;{Jp;2Pq<|Hlo_-^w=W_lujp=h-r#Bw4} zBSFtrd)XzUPe<&$O?2I&Y{coF)kYmT(5b86Un)sVJ9>GHBKY63NXx3vP?!G+mw)<; zT>i`5<*uH(`swaumtl=6`kxO&>$;?npgXT0^7;$X zvTWB>n9P~((p}daqTY>_#A}3aHHd$)Pb;ghBD&dN@|OKV>?5_V7qR3bmSsciPJ_oA zth}=WS)Q##y+yw0H@~wU_0(2AYuo*#*Q{F96GfMrDK;z7lHJ9?EN*vIUDlrlw8rM~ z>A^o%UVpJ*??PsW)~{@RXGLP5BOT4e-6ya8M2+WKe0~QQ@yL8J9~T$g3hSp&YjHWg z$N&4~6*qXU$0fvvnlK}(~M;8^?>^0zzkWMD zSB-Gv{Ac??*2jJ)qmuhM%Uu7|^(dFxx_vhPSgIb=Jv;^^#gsCHS_ua-^f+`*x*8>2-y+m}ehSu`n3?KCTc)^E38 zE!~p4Todj|$5t$tNus$CPOO)Y@67dh4qv8!Y@>fnQ%6MwZPWg51%FlOoLWUrGx=Km zKg!oiav_WVvPY>pH;!|S$RH%Il5pw|7UkXDO0qxd=OXXILi2Xq`Opyaoc0CnQlwv%uc6w7 z>7Pp#d41;hN2c>;hIW9NKh5_1=i2`u&o45<6M55#-04J4sXb85<^0eEl~1ZxCsbT# zlv%9U(9||vzp|8Q7PH#`RW!}N6;y#FRW)H|b21ZON%hE5!+&<{%EN{j{Ne1e0h0 z%1`Y|vF;rWHAW%30!U+G+rQq|G5-hkcD^Sv#S?kaiCj^tVwE*UG+0@OlM0cgO62(G z>K0Pniu=|EQP9NL>e_td69!4aSwdOrTq$g4S*YkDJ)(SgRq|=w-KrEbgpDFiK zvtF;`ek$!Qy|O7ZjIrF^b?9y=F>mU~-8+M?rwnnONO2ouX+1^u`F-*H78CgYtUYf} z?x!?dtV{|oH6FYg3&GG6)khDcndb=K=ps$8zaGFbnx>er=u zZtsUIzHX=QMV90WyCLIY-a2E0O;?TmvV-l1EW~gh*mj_luF>w(2GmYmk}t^>_oo&kl+v%P*VepXLAvI8-&j+RMtaz*^s)`YQn5-)Vuejs@?`FEACK?0^(frh?R0(C zDdRjszmaw8wblCae<$7A`tqRqs8vtO^DTEQ^O-M^ud+H*IiER3(q$aauSa{UP#ze4 zigt}5jT)`qIatobwrTcWdzWK)?KRi$`V!aw;`U@3wfWQuBk@FkB$e;MmNus7j`K!Z zEYY3lk!`0=Nsbr5P>6;X|b@$kMdr}^cwGTn(<~ReOkjz z#VF3#CE;4{hg##;7oPvS>B+pdY`~TGYIXL@mK$D_b$5A+$iedUpZ9Y^?-M2I-6ehM zQG%}D@ot9>AOceWlZQRbJuU=TqlW<-z$gAZ@INdPHFf*IPZa6 zx1+b~qKz(Hv62wE)M&w%=(z@^aw+Uj>&q4Pqlmpt?qjOnhq-@q^V!H`XQS!6*N^4& z1d%JHQ(eB9L@bf)PdMjma*pq;|4F%2&0Q!B*`OyoGgd`TH>GeYc^cGS?Y6_VbUYT7 z^CAYde;YZo*EzdRyIJl11}%%)F;Meff%^tjVRu}u_sFewT|2!vyW)5an#~iXr1S~= z59?>-7*V3C9)+t&Re6^`q54(M-bSz9?SC*o^T<1`k!zgDiC<9bD?3)Do<$yO`i#3w z09REztR1PQ+Fe_8o%3Cyxu40P)IJOCyfpcd`tQiL?}R(SnZu?=*z%F?NRFDc3LPp&ynjOLg|0lbVV$;)R0`I@(Azj?D5zsl0peV!z2Ub>F+hE*c7 zyl}Y4yhSqJlyc!X<0PHMyeK{^&D$2KiZBV1ed1h4US;TU_j8KH$#ELw%lM;p<~X}X z19Y4>{_XjWUOjn%5ZzB&@Yl7U%1ezbORs$2X!-TcbwpC%iz-~d-AYd~qSw>sz(zqG zX)CWM`-zEf9+JF(){*bzT#QO7_kA?v+VdGX^+Ah4-t0~np5q2?IwriG(Qk3Gt2CsJ zo9n0Q#%VVlNA)P~x24r==raEDzEG(i>YG@-`T|*|+3oL)Tu_Lf!nQ5-(eyg>rS^el z=^c%n>Tfe$e_8T0^`vbY+6`MMA@x6Y zU+z{h9Ch_(crki0>NFdwn|b>$sr9EL${|@&-I{x&nH7l~2BBuN8$KlEHE&UC8}Go% zpQGg~Lp5yXr9DI`=WI7#T7TuB2$D!8J6V8mL-d>`t)IN6mG0vKEm|_StYMn^G>1N^ zTZe2(pO40yw@CflqM2M$CZp{foz&~jpXGf$v%;k&5GJe?mH({nVV|O?8=T$j9_2Zp;OVUS6b9|FQB-h3un` z<@l|h!g&tbPtXo0P%8>=49aLER$LaCi}RgH62EI8lWt~*d?J&{_vOly(Q}AO^}VRq z75e?cKoX}L>Ozx_yQSqgrd|0Cbt1bsk&T_mhN|$*q4F&7Hj7ni5w%tSkm@Nt#0n}} z57m{Wa0&0CZREVoGvr{i=+Tk+PW?XAvdA(TiL{g~#|BB(<%|1_I+5LoRB8ZCT!%`| z|0bFmH96&NLRpP$=hSbe`!aMLx_%QPmG8Ncg?BNu#dwLMPdlql+5+n>ro^;dqk7gG z>r!Dh1r(LFM} zO=X#<6O?+UPp+9vHAnL-_epuEJ_~%4E7EPDF3jhR%}F#-(c0a0%d!rw^b#YcT6U>o ze3et$+;dIJFyMBAOBKkq{b;)gwneRtm1MzS4^wtyxaq%lFB~jA&1DiotQ+`bv4cE`1H!jp$z1o&T3E zJh#2QmHi*aE>QB1>8=<2RgWt3?=&yig=2-ku*jiDS>;j;4fE1x_smRsMIzH8f}*#T zm%EY&PXn!e^Na{H%W$BtDwy5lwGNkQl|6IB*dxdi5cHBGOuJU@hL{CC?hYxV>4)3(G z@rgClUbYzV`b#{@Un#w+u_KhHTNRHg%gKxGYqM_DaDO`4XX2}VT8huOM%rXa^~G}k zR4kt8jOKfCSCol{_IQkCBmFzCE2J-U(2{s9%ZvAuIERT z=f{$F=PhN=ImTfTaviH(oAEeq_gj6LI9mfz8LavuYD3&CpQ%D2dUaVo-0);dN0+|n zfSgw%5_&FPnOu3TaEHP0%48h9m}hEKBK|Tqeu*!7ba{NYKca5Zv^n6SpL(DNHe}r+ zVAOtBChrUF}-Lv-M~=N6%-e zN`HuW`rgO7uhUw*eVI%b-&S_){>{y2IGgUw$s{7*M|+WB#_q3-9DOvWclID)J)G~65Sjhm;Z>%ryex`%;O%lGB8-LkZ+m7hyZlgpJohauykov8j+CO>Oo`{G2l zkG?dK+0WSaB}uzn%jG1zNxn+y$OFmfX+Bvqlt>4H$R?ItZ?s<(fN%ocJ|0iR!%+tO zDm^SIo3%I_)sm_@FE>eJVSRxc$mHVE0`{}6R}ns&gL3 zZ^Fgl&@P9H>&d08{)ceQhMqT3UOwW#&Wn+r&U4Djm3VR)dtBx^Qf}_GB)mEw8t$HJ zTan%l8YwK1Z2vEi!F_AR`wz-h?F-iRCF#O^&YUORou);~bJh80NxnP5;l13x+t!I^ z)$2kyug&p%b!AmjuS&lwd30}@nM2&_C%VwD;xfA_wEG(2<ou>-ABV4rc%Rbq{db+5!`cZta!5Y zA*YZUx>vCDCP`oWUWUyKIwhlWGAjo#7ap)ZUl>f@8ox{Fss_zY&Aj_WEq$gW*Xy23 zz^(VCvuXv=`)ZQ!%JOjY+o><@%1N9$_1$_fxp+d7l-D>>?#%IO$TkfoAL~od&F2a; z5vxBg+IuNn zGQ-Cj-#Z3GQ=G{uKOL-gw{UO~JDwSA!oArp8Jq0!KrDb}79!`T^)b_TYkH-YSk+$3 z;+fftn;rWc`H~zayx59l${JUqE8}iEwB`%?G{fy`*2U-)jnA%Jih>)_QrFoUEvn6M=`WstME zx!f#9KCwFuNZl+Pz+%}2%jDezt$Nv(Nq5N@ zsyN7$Q7>$@^98yq)Scrcaesh0&o* zZ8EvG?yDu<-knI~I5t-fUMTjiRr8;MT(qDHYklFwITo_rUR>{^O@<)-sD51@-ogQO zgsML7`f~!1)Ihgiu=EZ+p1yD`Nl@y2sdx(OBOSdf!pzUpEA9DHM-qizG;$Wnwdsq! zxD>yGJ!i5U<_?WTn<6sSJa-U5o~g01NdGffx)={xwRBDUmY!RgZkb>yWfJBi?P}2U z6FFJZ!#Y^4Csf=Zhq$X?S>i*bo9-yp1Y7^8NVgzZmTu*9a&?^~JGtdhRcz8uQ^oxh zo?|lBSuo4G)xmzARRUH$F8+>6;b3Al>ToS!EUbwu9TGJ7Yg=EDTJBZkU#u;k}% z%W&<3toPJ8{3iV0KbND&^dsv-91_bCQFo#!jGwI!b-3nYJ70yU@d$BB&%35M#|-1~ ziUoLU9yeq}$*|S0M*Em6m+O2k3SP&|xueSX&pX$tTdW+frQM!?y>BE;=^h0b|(kv%h@bBdkj`Z4LC$h(_e?0PQq9*oCT>kox~y=a$7^E+In z-n42R$KAw|Q}ct^JW%5+?Uk0^B}>7*(pcqpJQncB=5lkTd}s4rU7Bz62Q!1h9f)96 zyXQBuC<07SW+}P2BxIF`Tq@ko<4$$Wltb9u{Z*ywYPe)f?8Z`{yUE2$;XE&CL#R6F zWHMiM7rB zRrl^pI+f0AlWG#-QhrNvR>4^1(lT=v7PAiK;~Y#VYq{3CG;LOY8b@2N{8e}w*7`|x zJxIneB4IhU>Vx&XW4)cSeP9qHHn+5I<$cvyM=cDzTK!bBWof9VhvlKDj@$0Ml6B9kEIqGk`EZ;gD`MTc z_(~aA^{HB3%88Hl{3_a8+1YpYxZag8D<#&vv8#{8ie9>a!p1hM9~1kjD8aTqfUUGI zm+sBl_Tqdoz|C$|JhNdaZq3Iise)ZBmUj&R?qt`>Z<(CC!fMsGTH|BkRSnJ2j`Cf4 zF16&_TbawsasG=F>?Lt4*?_f9P%9owLlpzFUeD6kYsIS=zo)M|eAkCiX8%lsps z?TBWwxq+Sp?_hAgZQMPinS5G$W9^8pok06Zt3P$u@Jp8{&gU%sJfCDD7M34F%xB81 zbG*tTg;lCAW%evFSs9bRPN68?vUP1MA7$|ptNN0qtqu0Pt7s2ZgU_slSlu!MZE6xL z%|@%|fyH?2f^;iIbEo`9UUM|l!5QlrtDThWqGo+Tl>q5t<$n1z$ye#VOY+?;c!Xky1ItSwk}eI7X^;7dBtF{aN*i=go?06w6XE zh9p$ge;1EG?(3obuvw_fOl>T^p-+F0Kg^_&rnkT?@B_E&IQ# zr$}vd%?|duG&_x43%mezCeg>99a&kk%BfN=m&-QE&6Ucj%#MAatTh$O+gk6coPf6+ zJd=8?3S1$Amc!C{E$vInjhC%dFn1zu^?Q}+bwyW&i#1m=SXKT@uu9KM_2qMH+*u_X zk5J0hDBq$EAyz zs^k*v<1chz*7Gm@-f-#MW?l2Np1)Wev5o2!TCQZ<*E^ET2XgE>OlfFUxI5+Hhn>tY zV(S?aUt`X4PqNsfS^Cuiv6s4qT464=_3?7KWR@euQ_L{r)~xH7%dt;J zR%{V8bxGu{ep2U;?i|CNE!gd=uz%a=<8kXbir&W}sw&r#yq&&0XWsD4@T;7zhG6Yi zEWJ3*c|A*H=LkD+)0yyGwi`*SH&(8yblo$e+|@-@(5!MTYxnK0LZP{<8n4Rxb!nmU zW5}s^*+a9QJ7$qE?`I|xR=qE+|C*hl?rL>9Q>9;0*z(N7W@lXC(OBhPN)LHQx1dXOSZeAdlVFLOV2M|w;*Rq*V2zla@xo1_93&E(%r~w z*-tF_s{I&c;qhKMNZYE1TBdGUy6xU-7w&kYYp?E)JeU4-y1TwM`XRQ*6?7;VtN2YUcb^NU>f-w$h2NX+F=kuaUMSD6&<}=tvU&d2y)vX> zdKR;$Xte|PxrwPpejHqkIhEy8up_xDmu$r;7-lPP$L^OZ&X|)KgEgOsb!xB1oyxX1 zu4&iTLU>_~YgA>vI56C;0M`9T&*JVN4afRqPqr10thn*4c2})W7(=@?KhkwV$%^&d zYpfr(7HzfVTS2YGINt=_jl$GRB6X|Kw&)Q-IntA zUEI^G%T6WMcVFE1&=Y##tGor1*5O*-{^o3MZGzVGvGjX0k6=AwlDzrjzTd`BFTV!L zdE>mlQ&^zb)8vnrgm#cOXjNyh@|Y!-{A`Z<)^@YL028U7rfGyc$A2hEoN3ZI#fj|h zM0WmSNliCNg-Oas0Y&tcpCmV{C(q*6BeGx*K5`73yq_2MHp^=~y-t0cpMQ~Gf?4Ib zM`dLxDBfe@_S|*ait`XSA1h*h;W&~lZWIc6RO56)o}^E1A>`4XR(}tz@;n9k9TVAL z6i=^AVYe|mjYJPF)q}yCr&~N#cFBqeB4hRQ3(+?gn^$}^iQV}wU9Yh0Que!qGV@Qw zS&k_DT017yXx#k~TH@+>xuSJWTQNM_k{W0!&8hV&RrwT?eTCgzDk0idPHZ8~wDQ7~ z+(ftMpJEMd(RGUO%tUvzKbg)f(%(@u>bljQT$Mqr%KGcOWw%hdzGAw6dH<7B1$+9U zMFq+lrxxh`0JTfHIkfC06o4CO^)IqdM6+n6C;LK;jm1sRdTx3HW}QL>ta*!j`fj*A z9plB=@_o-%zsvy{Y-M1d2jjPD_*Os3(n?Hrw1`QQS!!vokEQp@6H4Uz!v}Tq10M?$ zEA4eM)#Ed)muvsb+IR;QNHuw*ky_~uus)FQNOTr{fzzHZ=sZ-J zO8|WOt}+s#YQKvcPOTI5rnJkTN-uQfFwGYXTTPOfef{1< zxU;u2Tr}DsQZt{dJ6Lu-H+}qBoo07&BE_M0SW5=UFB=L|F~)J--Yim8{cLY~# zRP`QY@+hOgS?!1iDjN?Iwmm7y8z8+|F{$wbO7c|4NM=gU$-DCg;pB;AJ!`IQzwX#^xtGIq@&7W)SQwXyGp8nt6Uv956*4hZ+t{BSX zQA``|!?nhPC587zmloa^m50Q~dQPGbm^a_taBH4m?SC*cps^7g*H|1kJf9j_$&)fcL*B5!KKD)Z0*#IWtR(+_k9*wC%4zj_#FY?y&YNhL1 zz(R2GeP63Q+6y~Et#Mjy&;)=E+AL3o?ATXUf#Cfl(ke>z)H8=-l-j;RS(^9 zILrIRsKcm_c7IlUPrQlbOV!BweKEF~=1k9J^%r7CQJvB1kD~pZ72RRgxIjF$iPlI@ z@7c0vRzC;Rr1z-E_ZOdU6%OsLyl*pKp*A$@uDWKK-f)E~{i)1OtHIX3vI=vK*=*&? zS?$7oKJp%|8?4X2^c+NE(bIZ&Fv0eC>|Q8e^<0y(n_k8m>$#L?Op~<2O?@f+DtJ{p zHuH*byf7};ydRlZm<(I#FIv(fx?X$X*bG~LGDCMsceUm<`bIP5Q+)TzswWG$GJTf} z|IO^hW=RJPUXC58oey0K(wtg$u|mfkUY73R31kxXII&=XdxKVgBK82u1D(GcUTm+~ z6$9Nolfvt3;g#-Ba9H)f*k4)w<4QKgFvF~Ro^6RV6UR0=`iDS1R(|Ym)3!U#?oA(= zEEg)~S2d~XS1~H*_n0?PN~8R&ko6jib*@NZzoFaR%60-VpSH*j@I;)4B(Je0;+*Iu zRaQS*-prnO_ddm5aem;?^%s4tuo<{~zpkvGmfB6>dX!2k(GxDr9GYWn>v4x5YyKen W;Pe8O_M$>M@*WJsb=lcf&i?~iP+ETg literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/coresymbolicationd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/coresymbolicationd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..fb5f74dbfb709147fc4f028aba88f06eed41688c GIT binary patch literal 1439 zcmbV~+fUR$6vj_y5oI+dB%)E`9WMxU78Dfm4&tIF#t==6F=Tc+uoK!&Gi^7lCPp4i zOnmUk2OoU#FZG+YE`;Slou>2aoH>^{-<0Sn)u`F`ELWBVTA-VFOOF|vrYV}F3A#q( zbd|2q<-W)!t?Xm#uiz}s^Wr|<=l0lE;JN#0(wQoH|Ga;4@7|?y9QBatEK$KG(KbV- z^F-cH@B;XwI28?k2gis8zk!#)FQt9kgWn9|{)ayDe?%S*egGR_7u=igI_wtq8=wYf zQIBX2m1%%5ufQ%b-vR|V555C$gKxnF@C|qed=1_OU7dTNtA8JK^&fz*z=y~?K#yF0 zZx!oB@Flnez5pMC&p@Y_>-!1TF1|?~9Vm45DtQ%sqF?wvhS%eX)g6&3-Vv4uEgp2k zpz=Fd?5}pyOhwLgs95Kz<)LojyWU%;ZDAGaxO_xMK;nVw@Z5?xFhwv-hkN$Y44L4k zGUMVRSGxg94f_Hj-}jB=etNx7sGC2PZUl5r-PVU{VDGCopnK;b?8 zT4OT)T(_*SUA`z}Tcuo@$QMZxDqk9_(r(l;p_U@kCa#3R%_C2#%fCbqxnmT%#CaGJ z4fobTW`$I36($PJ?fAV{){y%{+^EeFpP{O=i1|#g1W$+_eRL^U%mUUz*IRsw#z){; zpP(UJ(xi*tX)7%*)L+t8$;{a9s-Ogn#!F*o(a#U|71l^|i>Arp3Ee}N=%XYw1BR7jO^tD9oGx2%i zvwtT^qmsmjB(>rPN$`7U)`4&tB;=SQ$jKq7U^&E;tPMe@MjP`yqIy8gA8q)2i|WQz LOd+&no6z|;!OjSy literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cplogd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cplogd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..4664089e11d84f5e29be7ae4708514702e01f471 GIT binary patch literal 5085 zcmbW5Yj7M#5yyL1wv2=^5R=G3iEL~qjxo2ZII%%_V9Ro33^Eo`oCF)swj#AK0sBfsG_LiLq1RxMe!jY!2El5?`}^g zJHTGu{xm&3J<~liJ#!*@f}TZZ`#wLR?`YW~Ez%OcxkgM)I!<@dF*-`Gr90^e-L|ad zttc;bWHaoRzq(FTt$a; zoX!}pro+W}LBxHDX5q(a<2Cq;{opyHk%!TKj_COh<@QbvKpqom-cEF-L3eO@2kb&4L) z>+OD~?hiD!8t1{#=Lx3k7J2Gf^j{K^26ZY!H*X4`55&6MjxlsIxe4}PZr|=^*Z|$LOAT21^I_~g_e%gBuT zj0cTJj7N<>82ijkEOuqna^g4?{H`QUEPN*QoF5z%rOph+%dOKD@%SnYT zQrE7_Bu(<(ZK6y2>Jy<_fh({j__>T zLXwK6Jrh)wqZaJhe0bB!X^In4HDH?k>eDMJT&?TdezhEBH)S;lg?*J{Ziav^SYqB4aT>_Ts=-)dIn_jlSt=^Alh*Ud%P7S5 zzp}S|F*RZyhEk^*^3>>OFTXqSD~+@3yQm2zB1GJ_4urDmgtMw6vf?mEkd^4U_%4qJ zo6h~p5@jcKM+w|5SdYtLfb2>ebh#WSuWF}3Q!L7e2YFLpeG$j@_@-o33;awu92JCA z$Hkt_s$t+BjA|0?`Ps{_i}^X_xOKSLUDAj2d>s%;>V#>>&s(0!PANDgW7RASMH)m^ z=_s#b47QL?`5Cx}E;ns6HkBEeEz>bmQ=rU$Dew>&;p;={nVZa6NQGI$ml>HZ-U;-Y zrZlUt5Ta~DDj~7ZF2;vt){q_2upkIo5TH@IU2m~X7=&@L_{>P3SL*Zn^wK6yEj>@& z*!?f-HO~~+^w|y3p`A~{A>jqiwBx2yEfnLpYGwU90wu67l45lf%Fx}ivVLyAq&);Z zvOUqVBTN~t9i6h5D#sOd5%Tt=uHK?hSY*%c=qcEKW-&l5wwI}7f>D8 zP4-S&c}-#w^6K`ma-}(MSBQsg5AUEM1Zy*oXOhpDe5$6A_6|m=@HrhG!C5dB1|mvn zSI>A>Sbu?R1ZgEhi;An805}QQJU_e%;?PNJQZ*}lrUkCfD7q3a+|*a{x1E>Uf%HT* z^D%Q?JHa}+fq`RWBLo}CzDx&p+ML6tu3U=3VRJJ71A7sHaLtBU!QPbE>%1%!++GnJxz^8J^=Va8&X$upKQ*`yH{Z>m1-BTX1&atdYQ?rFVUP zPEdY^C-tTk$uy`Ht{-<1SYGS=yntWb33q&72_HwcUYw}n{Z*>JRm4)IQ_4x|)?Coc z5Luy1y4$Xux)b?&U#Y?nuj_903iH@Rp00#aHnP|XrR#*12&b|>f6#Pbi0sw$&-1)= z^z)4CqHNFC$6Ic&XwUOr8c@@T9A9{D`OvX&{M^=S z*TX5Qf+|jO?|69*lD*fqu47f+Z>4c0`hs%d>7tPp^^sHkd`9(p=>{4*K`1^!;e?Vn z>ywTIzDC03IyTAoqtZCMOr(uSo`ClVi-i;&w6HOWp3|!rCWYVQy>eG7(Z0}GVZz(9 zZ6go0vgTtKZAN?BHTB`_7l$)cmd#V|dFwf;1Gid%CseOHv=Mf@VF=PJg6}wIcsBD} zA9vh$kL^+95%N8zWXP?>xFjWrh|k%H=<*BHdyZ&wWY_i9r*5%OmidjHnq)EWEz6BD zo8Gc^7)l;!J^wxDxym9N%La|OE50B0-iL6G+o6+1Zr!sJ>Eb6VKltUw&%i0NC&=FQ z-=*;JB86K>;R8C~Ex*{LNJ=q|gAmCo(-)XJl2Qeyi`}GQ4;Pftam${kVaYuv$cD&^ zd{g0bzdK(So@PC2yq4{Qo(8Nlfp6E|3i(D~TfGWTXMPPX-?H&z%kGudIE*C;m@4}ITmI7^Na(~8dW1|SbeX0liIDW znUi;$A%6{NJJk2+za1+5YlJr_DO;%> zEjv|hGtO3O*?<}#MxAWphi56ZPHi>Ry2-w+;$L}N-!|i1rPkaE@oS!s|3>^5!0X|K za2RfY*T9S54!99s0WXGIVG&*iOVENAya;YmYUMh336%0KC46n)Wm2!TtNJb%o^7P{ zJG4UDp_F0tZ85egRrpSx{(#?x+X??Byh5q|Z@??@zXY#>Uxmo&`wD!6QumyKydCg0 z>S|rik^G?AsnT*F{jkj#QflpU`Ca^yaOq2R=w#@tl-DBnY2>|8sn;87k0N~KllU9) z$Kqb{FIU&;^dIh$ejoCV9vxFRkZu{JL*o(B-Kg`uS-pjFBp;;Qo77wJKZqY1?}0bN z`{6C{aDJuBja55r2Sq7upa%;p1uo|E>5T z2F}7K;qCBocnACtyc0eOzaKsb?}87&cfiB&2jJcC5WEB4 z4I}u2lz#%{zZ3r${(Ima_%1jI-wm&VKLn-U?}eN3|FEwAVRc^?FDw!MBk+89KU@!g zlyO@P-=qBxsP|{{?!C;rBl-7W%1&dasH5w|FHVm%rE>Fa(<5R zKKkb)I)0n+IN>i5{`2r<^JD6x(8zs^byM{C388Ke)bsEcpv=Rk;Jxq{;bHhoQ0DK` z$US=W8THGIgXjU&dhjdwm#b&huhLG@19+%U{hIoOF6ZMyT@ExpXMR$BN{9ctP=`a~ z2=)98_-Xi?a7FI7)Tdzqeg?VHzfjNP--geU?ss%K+l=S%e-!`k!pGq6!H3}U@IH71 zz61U~OyD0t(StuEf1Y;y5q{BwKZc?QFTk5f_gUg|#QzEHHq?vibGlz&RDVji=m9h? zBHibq=*^$O0sMasSHr)6q9Rq|Ailb{|6t0N8$US;_omt(5rVr6W#@LQ1mlT{GCRhQD8qhl0U&X zG24&eS+Y-@MEG<0ev!odDhR31GUGK_{BoV|Wby0y2aRdt6yvlkeua)dRs1?08WB=X zhZXo*DC_hY=z9+BKNIHRO2Q8izY0#k*FguK1^2_%@a=F7yah6;SmIjy7=^7GHU^Ay z2$%I2uDaG(Z>)nu@LclAJcIPhdB*vKzX3VIA>#t$LgJ?J;Bw={l(~-Iu+f}z59@MGk%9$HqoQeFzL&W)=a?% zv7Jdtt<<3YR=F$H>rBh6nUU$6)3hovJ^b=3f)z6~%ftjabeLad!X<9jw9XI_r^%O9 zi~MOj@hmTKtjRD=;_}Gi4eaDL>qf%$eS4Vs;3X{+YgEYbE^W*I}o^j`w zI}wHTnmUK{hBY=DCtk%G_REnS&03>r^>#;g#hVGEDMU-Z&r8>qK>E{Y)@$01tV&q+ z1JAn230-ez-4Bw{D0J%%Z53D0>34b4UJ%y2NL`7)HT<#X)ETH*hQje`2}4mDM_634 z%W)Xg6R%jalSw_|#dKo4zB7L|CA@hKPPuh{EPSWYbANXZ{uhRa;_)Gb2*-HG1cY9cs zN?y&UvwkCXl}YIiwAG@~w>|22#XLE+Rx7MlPw({-8R4j7oWs10W*v~>@u$I;jl`Wzr7Hj@p7Ix*HGYW1d4;eC=f(8?Z~2dt-v zA$mjM2`YXWpRV)0F^`7qDDu5%U}wGRGIOo#roAYzXP-8t*(&#hVeK@muQAlR1IAb& zD4vE?sMwr^W5I@APeb1%Epj?~q`h5d{6F^d3l#tSVv2utt=ww#7d9Dsw5sL=L%8IX zc)<>RjG`WHFA6&WuG{+781HuVY^j%%&Vq(^C^fK*4>O4q%-w|M2<15G+ z$OgZmz=>45LHT~=^Cj!*xVfHk(-fDxzh@`+Ja@31gmk~Gh-Jmpmjg*m!}rnj8c~s6 zcjWjoN=QVUUJChLC1!{eRsKA>AR$J4v~*Z%^~&4FRv)v^c-6!St5wgLJ5AO8rOEZ3 zAgsF_5~^-x*7fATL>Jb}f$x;6VN$l8DbKCfT2uJO<5>H8@#}) zO@`Ik8xue96Q3hbs>C~&CXbDHtX`{yQA2xgUZR}q#`cDZKkhr(%5to(UE(@3>V=#b zMtz1UYVSsM74_}C&xX};f1)1gdU3?m=R|8%*KbdCJe2n0u9mM}^L0p$`f=OIXhff1 zul3@@4jR3;a;`#3J5fhu@&7f~u8=b6RyPc59` z91~8I0=r&yCf$u>>pec5=b#G~DyMB6nrSv-dPIZ0Qe5*q*Y)k7eL~B8Zq@sh+;h^K>xy~p zNGdhLd9rvHjstP7r_=IK4#gs>y*@->qa0!p4;I#b3t0Bu5E$vSYXJIxE+>E%wt>j-aJ+U4GReB0M~#p`;vI#%uO&uVv{uGo6Md+Ngw z+a1U01<$|p*6*%Y7GG>z({|v`nA8x_(PdZN)-gosn)Uke9qs>b;3ut!9mUXvl zeH-h$meVb#WK`;o6uJ8Gm~=g7+>p83+{=(AtY>1Jm@@Y>p#4(5#m(NTa+Ol*)TZA} zBHQsMy@2s+Pj|Z)ars-;Oc(Jc5LT8q{ahI(K>Rqd+o$qvFW$dN@f6d$zq*`^w?$c(rl#b120->SF(tYj zRzvfkRZOk;g^iqG(|5C4U?<~YR4IzpGP6{qV$*X#m-aQ@nHnAEdgb~ABjw83L7bf; zcZ;&9+S$rFQ+MQUbIcqui(-Gg&KyjCi2YtR@F}yXw_!|f5QB0>X5=*kk;pE**X)A4s zTb0FV=&1$K`Y4Y4X z%G$21&5N5to3bfXVhZK-xXyjpP3Zg@$E$!rkvAkcp1Ecbt+6Vq;9^MOp~yO@3Zax3 zGcg%|hE;XiCpyhPavkB-cG_=r5_Q+()0&_i8Ki03`Lv?D*bUN)R9EY6D&e?`<*O}zK|86W$Ia=- hcKfG}zk=_U*u{@`{n_+b0 z4|86FZ(qivbga1)vYUz4^iw}(=whLDsqc1i1=E|2lzuhQ7CJ?A#jWBL^FgykT3C(e zwhUiKWQ>WEG@$2y&hzVc3N6>W9e5RJ39Mv%lc;x4NS5o{Dux*I^%gDybq(yj9QLjy zD)&I|4ZsV5*MV;UugAIx(fQc zfEUni?Z*qo2<^%I0P1~?!oM@d7$n(0j&8bdE5p4+n+$pjfnNV>*v*jrq@jiw;S=K(ZMK<;*}_f|THbyyFGb>BvJfPMxv(0Cg7cHnX26x|6t2D}US zB>0DbPXONmd>okjcUaqbm-dJ4Rn-J|7Q!j&}pd`|`nm81n(}L0|~HANU?k#}w)L81=^akud6YfqFkJAn#`u zcnmlPJPw=(avY9eoyEnw>AhJTfjW-w({X%1-2?wPj=%+jK0qJT>nt$pb%2I%+)GC_ z|2{^|2O0``9|9f%ei(QV_z~FQy0{$*V@j3c@<`+=s>m%TwF}?r|_V-an zoZ}biE7|;)wBDDQ*82g%|F6>5v-!vL{MVS)^FZUTu<|(YFTigAIe(r&d`md}Zvrm> zehd6RVg5kV;{V0nI5OUAKQW{U7w)YdzoDV+*avl8)$a!;;3|g)Gph2rL zG&0mcgT|ckobkNzqVZ?rpT=6TPo(^Q20Lh&Rv3DUpOx71ooX;=M#^$3vyq!9h~PNR zB}Z#9ZOAZkTUMfE%Zg+psJfoIdyR6y^`%N>8Zq)^&n1S?1%Y8>$>J+6}4Pj z#XLcD89zGo!zf4sJMdBg_Uo*9D~@NK?scc5pc&$3;eAZa$BAml{cbg~qIo%)ZfiWU z8frF(W?-7*(IwX=P}cKfs-?UjR1tUXwlK%aZX&Srrkb-=n7Dy&))1`Nw5oC7H4{|{ zt)!lwK;V051DiVavm;V-FqBwTkB>-?-TYjNM{y2qdr>tNDIXD(=3XzTTHa)|#4kP@X=TN6~mTyff zr@zgMEO*Z3-wj=M!eSS)NazD9;S-xmtOOf#?Ks=v)#s`2r}|DFn8~!PN;etuS0oS9 zIh>sm#V9Qy!x76b-EV z-y43G%1@Dy@_E`(sSFK|+*v;He_3afQGS(yb*?hLuf%yQ*FWSPcHpQzP1j2%qrhp}=nXt}t|Xt=>}cTE-05b7a}Ru|>iUwC&8p|x z`}|sRHaeZ4Sg%n|=m;88Ml9ymD97K*8l&`1(7 zFT%m0VXKCt!nqZ6d857;i}ms=Jxp+w=&>b*QeV5>%xEloY2(mvc`a^VmMiRZ`yDA; zxhCm&1S`alV{4U|zy7JOxi0}((IXn41m^PYWpO5dI0dc*XC#I0ppKWr;M;T+;| zQF?FCdL}yRDQfyMo{v#GJasca;Kz-6n=9Qck-jyg-X?F@!FFd+?-JXu!$;=fmVu9b zY^`g(#@Kg$g)X2<NiH|Z+1JZIndVbl$Id7fY!B3reU-DcRtEG?QqStw5F}kc`ohCNhnQy zFX*cwrPZ3!pf?h|nT`{!eNI2l@-vs$xF(&El`nfnpQg7Et$GTCT=7EiapW%|TJ{*Y z9%Q|@LViT=XT83M^^2LUcJ}llXAo)o^Ez#Z{l#hW+=sM-E6WaB(GwU~qd6}m7Vm#B@4fu=4!*fc@UPAr%5xxHT z)ZU)gKpqn*-c0l+jc(!mvZqnrk}t&DP_ICi(my(nz5{zRGlDA6)6qJp9f4j|)vJ+< zcDNphc0WjUCU+$lncC zz>h(13C6t_rz7RQbL1aixDR;sdYu{Y=#^sK)sTkjME+@DTVZ@Gy8E$o}~> z?9R*_q|apj1(kn4tNeREeGdI&|AOe^1M~&e&gYq`9Z(z59;8D`{zayegW6`)`x3YT zJPck0ep%U>rmrBs4*7>b_UpqS`}GlU4fs{C5BwUq3j8{_0{jMe7I*~xIvxBbSO6ad zc|N{{a!q@Tj;eY1Hhm}S52)7jcOjqFzQ^kr{XEJ<``@Q0vhp9OdXIBnjRVwPr61B$ zS^1At`IDSi<)HQotUL|A4E`A8_4E_?wSax`49NTAr;z^#<&5AYY@ z-@#vke*>{k)qZ-8X!&30*YtcgUJ&^g=r`H8!R06DMf$Chzeq1-egL8OJGP_z*0T2p z~{IX@ku!6u7 z{4Pb7@08`F5emyGO@wYNpaQoqrblOUxfz6R(~5;DV%x0AD2~!zm_+B!DUU?hbZrrF z0nvH<>Z%`vGM2XVQiXHomRnIY;mmEf8p0Qh)G)nu`7L}0%MV3l_TjTu_y&rTuVJKeQyfOuDgCVHDVHmVyo=&)Tp$D z-);Zp`q>$~sEAPb@VIGg^<>%d#=^G92s}4Jl%zB9%=QPHPREr*p&8YzP|#^gkMo{e z#^1|TKJO=|Y{qUw?3O-va-}MtH6O#4T@xe16R{XU`6>6m<4~I|j62Fidkk#qay;5% z{uq{i#jPfx#j}7ZRP$htC1uaGxA_&xMv%7fYf(GggUIZ3X@^=LTSXLGUfk}}RVTBP zn~a>Xa^k@|u3wf`=(LT&)*iM;RJfg1=%ya%q3-HU-O^)SAkTk=;11BoQ-##g*XU!A z3cZ4d>FYM$5%e0m)XT8oA#Xw|Au&)dz>j4{ujx@y5QHpnQ7K-pw)Caki&OAVASXoV z$*SR5iEr1O3r|)r=MPrx-v6ETeUJ;`hXafHp?iGWF@Q2Wz&@J7co*`@Jbr+0EIc*% zWE>t9$~)}yoMV(Q(O#Q(GJ(};U9>My!}x65i|<~9&}0qHC}-Sy%|09h{=nvQ6i zK9&@&eeJvxhn6jB!sBq2)7vdVY=YCUOV5s?I4>xtw>?17f7?TzB4-8rrEIq8lPQJKO zogba{T1QwABZR87E=8d)Z#Oddp|FM96e_+zwXl)Q4K)9r z!6xC|=U}Z#ebOuuciSxXQ!kvgmisfrXKorVMsW;m^J7uv4{ha&kK1r8uXRpu;8({1R<#<6Dy}eUaiZw_?(*wJAj5b#w4$1^(`_X1tWY^# zw;eO{%u@sBM9Gt~o&<&`ZObe9xP_?m7F7$qWG7?_Xw^void1^4LkDDr| z!joi9k~swL%@fUf&9#KR(?2|Hx8qv>$cU2*Y?z7#s@_UPo~w2|Eal_jLe;uX8Y5S` zJDQGXvzXl*JC3bcepSV*FqXBiD~eT|5_FcKE!XPag+lHC>r%-FMo@ zjus)`R4|B8;tm(JB^awOY%XJyeDBTm!%0M3_vHje54RW=^qL4TM6c`C^P+6r1Ko04 zhN5**H@t|$Ov^^<>d=@BY}DcVU9R2ql3dL$K~R}BPu=$#$BHcstLZu->>duS?lSAf ziI1_z=oLFceQa>UbG}cy6uF0dKh5>et^~OJM({|Lqb$*i1&4@E>C78?K&$E|EGXc zVK143WL|b^N6|ob6d5>*3fSLsFOV@dY5=*1?VYHLVh!87gj3RNP|?9faOHr3$WoNt zVuYw}>ve2;{tsWy%?nSn>NQ@o_CZ$#))~ap*#`5(RrNXIlz2MR&zt<$6aJ0JM(V?( zx$ESRKg9=c_d%$>KRXTOzbn`RZNk$jKJ|XIzMs{8^F?fUu3tAS$H~s0^<8#b_l>#; Tec>6nD1{+5Mad2lUWNYyljPQc literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/fmfd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/fmfd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..44828c4139ce9654a4917b704ca7f590c4a25544 GIT binary patch literal 12749 zcmdU#4V)ZhdBES>v`XK-{*Nho_CenVa!!qjqbk@W0j73Mm?jR;6F{@r#`6Or|wt3s@|*K zqkcvGl6rSn*?S0YZ%MmLy;c9+rP9CdS|sP1E(wz7YU0jQ=d@C`BeV1G?2dX;xo5QU zOIT!|PRznAR;ACJxoW$yNU1rC)nZcA(FMYA;l;C-NO+NvhL>D8YrAo#Ql}_&mfB`0 z!rLU@FhM!=s=H`{6RUzkj=NA^b7C z2>uW*hcCj5;q&kk_#C_xO1-ay-ywV%d={>N--MUbp0C0yvUXib{FnN#lJ{EpWdEz$ z-*4}6gjOnLJkr0_7*uNDValz7AAv)}e-N%#YW4@0;jA}NZUpXuH^ANS zMi|2_um-onF}Mv@;C6Tu+yS@2*TC!HO>iUpIk*n~JX{HP!pq@n;c{rfGOWP!pbgJ~ z4qO6VxCoBI`LGI4fMf7j=)pPgW;hFuLm8(U+~2p|sKXyYAHDzs_+1#nXW{GM(=dWx zfie67OyK8W13m#K;HTj(_zAchJ`N}0qwp5^2;2i7hOdVohHrom!CT>j@Qv^R_zUoU zxEH<$z6rg#r|&lPW~J^p7CV3^-Pw1$x}k944#s^;-#hsx<1V(U=5D6^yQuG4c&}1(uSww zN@?Dw)Mir${yM#|C42?zbLAaoAoAG<_6!`n_Wa1x!^WX>I@vzyx4g`Ln4{ zcqFsSAL{szs6QhAbH(ijB;OyaKOy`r!Vkl*LBh1-PxbpqJDPI;jCOsI^he0|`Qk^_ zqgg-yIsLq&?=K{*?F;Tbf_fh#-@f8j<6~Oh$JOJyzK^TFBz+d?(6|?QpMZD5Pr^O$ zuV7gGwE7gh8GeR(9pa&J6Z~t+_fsBypq+oC{x<6`Nciv6X9>%=K|P;*4$AvJsq6oH z_4zC;TtxgA;C%QLl=uH4l>YdV&i`fgl`Q-ZS-OOeC;h9mL;Ck0b-sU6U(3SqG-==0 zb^LbYpUHm|`JaaKi{Dh=fQ#TWdS3b$q3$T3{5E_V{u}%< z{CD_S_#OBu_#g12@VoFs@HzMp{7?8G{4e+bd>-BpzX$Jw--ma@7vOF1MfgVe-|!9a z2XGJkA>0jLf&u&y{d_b0F|5GhFgoJg!Kx0Q?wsBOJKA_X*NLZ&sV+-{k4X=kRo_qVK=UBp`f5$@)^U$aL`%g4ZqP*BC)OLC@;W=u)af*@JDMbFM2Fk{|vOuWY z0gX!w3ysA(evweeL!(5yPKRg0C2&4G135+NIaBNL*~VG0pw2eVAzthQYWp~suW6|fIpN&LO!zY4w+z6!n#UJc&@SHe5tAbc~# zZuLAnWT=yGHC7wf5Ei|F=+hcwE%9UI6FSDLjdhe0y@Q0WHLlb7SpRi+y|IC?=pQ_J zr?JV{sN**o!^Dd|LgF_Y*X#Jrx_+sz*^V2KFXMkBlzDjz6g}CB!uBh9h{&j+>c)M> z*Nq<-D+^1C?<;<+`2AvE-?@Fu`>yJ<`ux7P_dS*tQ;Q|L9n{NK7}i|*EX9`ZRD#{* z$hDl(uExv9iije7%}qFbiQJDtLv7f>lTg zE@Al=!FnMmR7k1m*!6s?5HD$yqz>`TE{u^D6SB!$FO-Q3`I8c5^4ok13XOt8Xq5EP zf@AJh1#_NSIxs;4&X!i>@13?c2_mcNmfhWn>r2Z^wq=jW+bi`7`7p!Co3IksbQ9Yg z3*sbBd)-uO-jwv%jV3(XjU_>;6Xm0$d>92uUPMvKAYG6#!pVG@7eV;6yH*M9O zBD+U%H5E_jk#Y;0`Cd(Brel0XskCgx;12T}YTzkGt+191L1Bc?s8uL7l|c&%<^a=q znf^0c{X1brW<98QHP>A4RU#{zG>2p;V{@$=jIVmFE_X~ zHyjK6$r}@|<|UpRm&2MDCu+x`$s61>vN1@!QO~v#6t5gMDmBk8`$1B%>~Ys=gqi%+ zhbDj64KVLv4_Q$rNdzg`5y?~BcNinNo}sCVEt(aDaf+eFn5PVCNK&MYTg-Y`k6)Y( zw2NLQvQNvG3x93 zi5>X9Yo|)6HChBJbtV7P+gIR^deugx^>;W5MlrtF9M*cg&L0i56s1-Q55i7!Q`?~J zc&!^JRxN4i?lm*X>20@_My=*1o?i*9$Y}{f)?Sf^9qgIb4t|Q0X-y5d-IFN|IGumP z9GPS+>aDqJI9+zuL{{D16-47K8L}Qv$=8-a*0-MHwapG3cU8lyB@B|&uvx?88PNGx zyAy6LKpE5(g!3_oUAw_XV3MWLc0;WkdVI@PB@Swh#4UwZGM4Tb(uMxC&hpuo!rhIa z#H!TNMU^}&`JYxF+Q+fHwiZ;ZT3b|W2#-ZfcYlcJ^t~E!WX5Aw zI_xOyxlnC%6VaHF1iOqA&u*?$7anAJKP}&~m7{dItp8*)cdTxW>eaZRfkr7Fbqc;VHiZs z8U7I4;W?RtA7VRL{j%L&Ha=G$+WXXkYSr_rnGj?wpGi)(KMjLjZba#F&1(4em~+-l z<%WlEVAjSCB%|W4fTv?#IPmyM*3NTBzF&AE+fRMcFxMI8J=3m=)9>>Sbl~W5#LyeW zAUnkk>$AbQ-ZHkGIS%K@k#AJL_y4d_{l7o(K5nE3-p34e@qzSWgX?%!+sVdD8a}5P zCWi5y@uc6J-$f7eX*jX%^7suyL)lSk&~YNp`m2HfhkyEr9`@XSG|yvQWj08$gVfu$ z)~3oWCo#7ihpy}JGPT_5)Xe9x%$w&7{Df1ZRnrcERKD(_nb(&?mY??HjO$k> zzdXYW#BRd2x0()Y+H_q3o^5%Gj~<4F_c*!C<_ws*V`g)>i}A!ncnxB#Ip!}t<~bY* zS99RoMGo=SSU4zNo=4}A?Ci5oT_$fao&IF~)OP+ilWN0r$`#M2=sTo5{qWYq=!cgx z)AjUFwfk1GgY9uNs?&~=dPtm{$MPY6Is5a}qc`KeV|`GK&7sJO$2PmNF1wLA+&Ux< zwGN4w(2i;QUCZfJQVJ@yL_TI7H?>FdF+PpM7@yYkKdqBusIaE65j{=NOL1O|7j`lh z^{oEtVbp(69xq1?Y*o0mvS+r?WT$KT99^6HYzaF_WZCYRTa)9O%JbdgMjW>1w8}-C zy@GnWZ#7gBB{fF~MmYp1*8`H7ee^uq`}rs`iWK^)+43azaR-GgA~7w#&_g#^wTb z>arCB$K!pKe7T&d?T%dA^(I_xH)Jhds?3YTvDj-D5;GI|%taN(f45nZ(ZI=gzM4&E zX?x!buVZ32Rm|8btLHUVFTS+VdjCpUVp1Un&}q%QDtPE zZ2PDzU0M}iqfEMJkup!z9lr+O>xM!}HeZ_xgXtF>z;u+2ft2+0jSEoHtMpt_C|x1` zTk95cy&AY$6-wq7Rj{Qajod1(d#$`Aoza<|&T)FWE01{f20iQQkghhD zGiLc!ZFf;7NcL5Ea*uJY<99CA*csu%mD5(OdSSn)mVRc`n|66s z?G8x=X5|+N^9F^M7rBn?-pYwD1 zYezvf~&JXORYdl)1<-tZWwkitnTMtUc1zqjd_e|-% zP1|ivWX{I-tZSCS{lU_>Jwbw05=b>C4Gq4+pf78(yqS>UXtp>4~V_Zab>EXyKnV#FP za3m9tp2u_fxxXb2JxTAf*S2)5bu0?}prO}<#ge&~oXj?x{j;<)pXXpR3@eS(myu4{ ztyefD;We``ES1hfx!k%H+3X&s*sV+rbt{ZTS<7vEXmw0yeN{I|JHD&m2Uo4O@cUY^ zyE?Ej*Y0`2vhASZCo#=Rzct54`ziDGO?@BFd0oTB$=dZ^XLh#Bu8+#}r{|jPtddi$ zl#jfgq}+2{ zGeLZzs=5g8}3%)R!pazb9$X z&m3h*yb07>siUQmTz)O<&hB;2W`S!CV!0N}_Nyr))3|gxR;PB#OZ^Ph>=H_hpfkPm zUdch%d94Yw6?1BzHnhFx%}kvwv25=c&GeQ>1W)D3zkKQMC)Wf;i%$%xbjCU)| zcUOwy?aExC%u5dLNU$tB5|lX-6!rdCwyNzvWJ%b>h8!DGf#K2b4K^RskQ!f?YCqCOn-%;rA@JS z{QhY|*Zx!{AlzP4@^fF2=I@#pd*3f*_dZghdp$b1`=}{;JN5S?X>+>IEp&8tFOsES zAk6!5=HHEE<+R=9<$5_ebuPZmYXz zcY_L10TEG9MDYm%KJbN#C`J@PMNknHR8UbtP=qWVIUYS8Jn_HPJ<~n2n}BnXJ>r=O21RGo9Sly5WZ=NtLaL*h~7pQ(q@{XNlGa0srhE4r#rH7 za@A*?(ob(YT=Mu%=`?pGy`0LBEvKV8In&VD{W%hOc{^#%!#m|U&AEr-yCjoR`s}qI za+VV9wTzY_hxXA`Nm?>mI*ijxwKV+_q9bS<(P6`-Z7kn6llPxcV$HPpIPj%J{R7|% zkmW~1zPvQR`AZHhy{xEj%RHnEBCW6VESW@ob5MQ|)WKsQ|F1qx#}dtZ0Xz=re}mAo zWly|UW}GIPyAASJfKP)bfKP!#;N#$lM0-94o`f{>Wbje_6gmz4d00P{sm2G+eLx?k zRjQvOOeF{B-j8~t;631K@GkI`;8t)AcpJDDycK*Ecnf$scoX<)@OtnJ@H%iEcn!E7 zyc*m9UJ0HFUIvbV7lW?>H-j6&2&{k}_*$?Ao&{FHv%w3%*MaAP=YVH}uLmpOx!@Rh z9=HxXA6yGw0ImYx0GO;4E%bJj<9z^X z_oCc8RK0i7C1{81foS(qx(w;Nkp{K9z;}UnYTM{?a4Yz3@D9kY0B;B11KtL<`}bbx z)v&AHr}SN=`o;R%`R_;h8?+D5wV9o+QTF>Fr`7rd`>#WJ*aiLhFkP4R2SoZK^iibQ zE}+^!AA_9dm474r9by08#8mBqYFwWNd0d|X zw}PJq?*u;wvOR7=JKMK^p1zRT6IAy6qO#|g=*#FI+Y{VEbSr&TweuCGY6sMO?Q8UP zCBKcSXFGsM|B?QbjUPn%ae5-N1Gw;C^d$XR z$)BXBGP^Jbw7;<4h5x{)+xnk|UY`HIfxLg70ePJ~i*C#ze$bta3N)$Rq}``Ir2R+R zQ(vzCU0+a2<;xg$&@`+t^n~F@iS!~7MQ-3bh7^_)_}&zX^pr#Ca%A~VHJDVT$`jI! z14O^L&sVEjrbDdk2mYg!j((bL1R#Qv_avZ98TrU3O5B+aN{NkQ{eIZk_S6~7m%bkR;u)r{Sy*c|xW z$zgoE`?ucmt-5fQ6?)OO?N0i4;tV}uJ_<8m@Eb(TGhB(S7z1!B1yIJ2)>pN}3 zoQ!(f&g?rH_%*klNVFIDSQ2Vp&9S8Fx%TOPE#P+X4D)NJdMvwvDauE(UahyaB8n|9 zZg+;KuWsi%Aq>UXb`xEVrrA-;G@ z$xiLtZMStWOcj=8+fTuc>tM&avhS#pMtVcv2y2FrOEptGN2B^0eFLPiKB45}`X*R* zKDTZu%!&u)4 zpRMWsTmv_Lx*v-=yZ5tjwvBqO@MFGl74*%rp4?#EjmrsYlx z%Z9$mhT(ZF^YdbUG8;1eO&lrJBw4G%UZa z_KnOG@w&~kXPM_F{Ce37g7G9Yyuh}+vX3Z4owul3nos5&`seofY9B$c%XL%KS69b* zs*uNnNA2&tLu)IQQOSc=>o%8LwjCsX963hztEo<9*<0U6$K6@#+qLYVG&;X=9gRKL zG}R2_pcy$m>muo7urfUAd??h*HjKk@Wud<)(M*?{VJBgL-8W@ShISec&0bDrr~W9{ zp9ZR3F@(`}$=o9UlT&PWw(^zHEa=%NU^oj=Do2{TuD5zarK@4CK?A$4H#Rngda(=; zQb_y*wX6PRz2jg=Hrr0>$X(a7Rb-Xzvz~j1FS1Kbd)@BStuL%)^_F(aQ>V=iTVerM z5YoDSos0C?D^=^HUC4qv12+?n?hrqz=#HzU_nUk^9oMS+xB$6!*1n2QiuqA2-6|q} zXH(I4MZ?Fm)KnkAO7rrOy2$L<&Gqh&tULmwdg=+4pUw5*gb|V>RSZG~xD!Mj3C8LR zoAbB}J?q^`L_F>X6Bs>WcQ}pMZDEz+@6Yc3dQmp+o^@g40Bc|T3@_qiudO4S!F2o3 zqHcZZrK_F=!Pr7Q^VA*JI#z69SS{BPvU@oEk8Q!MZk%8RMSQHXA=KrS8=i6B?JCGS znD09UMRtv^A?!w#_ai!Z2lSEJ?;mU{-%_j9ZxVS7DG|Wlr3%JDy z21WeCHyHM3`8M0}vP`=@<6P^iz-5NI^vx1isOz{>&TqlRe-AQykB_b?Tz^LVDGn&R z14X`9=l$OOcG~|Bsr`>xHayoKH!R1=;;$85dfV|dPJdr`1}*|pVw0BbFyUSCKVd~d A#Q*>R literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gamed.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gamed.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..32cf36e27903c44ad7971b003484b8f9dea0c8b3 GIT binary patch literal 13597 zcmb`N3w#{KdBA7yBw>qp3>bnj#ynykcWd4;hS-w)z+f9;+2&zDtaewY#e28M?w(|s zHUt_-DJ3PPq-`ikL)wxikOpXJ`XC`~5=v=k3T-KQlqR8RNlHj*6H*Ex|8I6rx3?!t zMzH?*{+jpfH{X0S^UW%CwQ-=j(#Ze2%(y_uJ+Gcu!^ZPzjwjTY)Whme)Pw2)^;z{t z>OS@9T-i?&9-gZ09`(EW-#se%mv2RKZp+m$q_(IFh+D2s;&+*Pm#%S`TC@L7(6R0H z9ZOv6pVWN}F^kh!l|1_%%=;Xz)V@p95>nLu1;TLgM|+k^_-G>uFTJa0*f>t9cPe$f zy2?<5uabNRr0F*tK<;HqX`ZN*aXa}*UvwKhS*b<0z*FGOumo>}Wu+GGh9=>0DEUKp zD&Ze-N$+YS2@x)6DE_grag zRH|1|ZWDaHd)U}a{7>OUO3i--4ibJDUJQQ-sZYyuD3$A0rRKeu#P@t3Zda=3d+-wY zU3e*c4qm3zKHq?s6Bh1(&vaj*u2O38Q{7hz^|->GC%T7~Mf{?ktA#oq_B=+p5%?&y z;Umz2pMx%Z0FJ`@VFlg`$Kc1I2k(a0zz@Tn@DAw155g+E3D)5CFo3&Y9Y*k47{Cx- z10(3b7+wV%a0eWRGL92)JKTn2v$E`{%hN5Y%nLU=Pg1bzS>1b-R!!dqYw{tA4(YuLCI{sjIidH`vnJ)b1sN8u;n$Kb~x`qups_;ICf+LwIyz+UwUt=HFg{hs>$ zR6ihgVA%Kr^ya#*d-+TBMl78=c!KhONP7YNlu`#@lhmvA_=!}H?^o(5Lw!aOUg(nE zjNcOU-mjBn-#mH)jUn>=xi0q?>Mv_?-i%+S4fKS7x>E~C8hsKxTKf*`hKT*D$ z^8ZZuUc%21?jrmzgx^Q_SvUc|4(sq6@EZ6{@)gPVEy9-){#UpKK1Vwjz<<;6-&;JuI@_vo5$oq9D^8Oiowy2CZ;M34B5_v-{?*jZ;Vc00bmthxt0d~XZU=Ms6 z?gPI9=fOwdeE1OTg`a}^V#j5j+>fwNczvcEfkVSDBSZ!dKuT`XTccF<%SPKU-V)Uq1BANE0+@BM~4s)+Uvz%ICk_!~%H3*QUZ z!QF5@9Eaz_2HXHc$b8Xu??OWzUNtru8=(g`lP-D-dH;)yLE;_q3q9jvV+-jbCrEh6 z*qX`-65eKPPvr%v_fq2$9e=5`r{&jd_j2ly`M3j$J-h+xuT7;6 z?MRQ@aNM)qND`DfOn%zR*TWzV?7&YlEa*(PqG-bDY_}2yjk-F9{DwI+8O3hZ+~|#j zRyb)6Cf!>XT2*%<2zOGoynjc&OokJ5dh@-;tU;+;P_r>Tal35^fDcg2r|QD{bER_LmEI-i7nZ-l=O*Ws+3oDnnjs_yQfCY@Z(|MvcEvT9bvb(Um$(Uk2B z{X3_lo_gyo%$B4#yRnS$P;AA#m}f`n8=ktCd9}g`hA(imzh_2-V185mO^3EJWn# zFEj`_NuDE@m(9ym@1QD}D@EBY=s$5ihQf|S{+bGnq;L}{tV(JfkqGClCg5f$PS z4}JT4^aIuVolK8jRlP3~l)iQwy{{>nx9C9KTwu_8!R%$F)X)C>CUR^_E{WeLXw%>9 zxF+*>AgGOcl}4x~o*8S)wu443j+j-9b#tVXdiT@yrg|#VCW%&}2S!_a>AY^vm$t^3 z;(DGcHK6Ou>UpkQR-Iew7*V2D840W~)u{Dzt7p6CxPf#nnaWM=REiUCPJVmUFE4J? zSQX+Rbf;8ZYEoYDWm;n-{>Bix+~k1 zn&W)16D?@XhdJ6Iy-Q8)c&jpWaE|l6xg<=@jp4b?FVFUahQlVU=2RygS2nCv*%?6Kucc6@WR z7i@%v8ufY*#%Vp5&#hm57Y%I=VsA9v4D4C7bJVLrH(L%=d zjsF!E2!{n?kY&OxjOyjWCB^11**Ldvu5C8g)#grAZ>G!hO<(o8vOUf2j_HHQx%KXE z=A4$CfRCg6jN`O1s6?hU;Uw>?4(iAsSMjQ=Ym@Zi&Kc#={+@a3zmfN@Xn73iMK&so z6}BLuI`N@igykSoL7r7&9ep%k*3qBbe9--0&$i`4PtJ*_&6dAIpJdD9XgSX)r;c*D zEpH+pb?j{Ir(MP4Cr{BZ_Wn?om**a|&HSb^A5iA)3iazyG#yvVsc1&)I227+YHCn= zZ=5-UXuKR8*)Z)XtFP6d!mf(#1ex@662E&R|K>=4C@EIF^)2Y*9^^Nz00w!ZKu=DW zS?-Z%r@Ui!!fJh;b^Hf{U?0fxUA$nyfX?iN{mCWfx-G zF7MnrFff$(uKFA&1`qZ2i#oSxDlv_$Qt>CB5(4vru$hAaf^*?Ak zJrG*a*cMmzXKrW?PHkH79Hg6;Go`kf^iJ0^T}j;ybzOpDDr;TwhLwoj9~?cg*#XYc}6*H)J!k?^M1JUusZI{6kU?ekF-W z-b?#Cl_~L-8x1el{^ZP%C645BWR1F|YB0_ubZdHPZ}qDlS9d9;?GNiuS^rw%-Oeo^70kdsJO`LnQ-rs+8^F(uj!Jn$Ktb>NA?>$#l_ir(@G34`5!W(zhQmIY5HF^-Z%+@-Vw` zsX>X7t&0FW^-{e&3*|?*bD=vqBz~t%n*s_t9yXb@IQaw<$u22xC(GXGocPrXmm zuig}t`HgBYRPsErGa( zW%n9UV_9C9NBsOs-WOFGtIFAO>QFSCIEo~LQisS-O8{1-61o+xT$=kzSr;?ui4D-^ zpgiPN8%WmGA>C}No-wOd(eoxuD-ykJB~LTXRaS(O&&tQ?7aL{yr5YPNeSbjF;(TRx zs~^8HU+xX$nN@GH^;PusL{ec=Jel9E4y_*=8o*_l&ihuptyg{GwLWL!M^lG>*>3*D zFG6t zS|Ew7_-L|PkArIDE+877ag%UMaqrW?B&*M9um*?l!sqRsFPFyu5w?O$)C{=trmH`8nrySY)v}aPPO_s6<@~vE0@bnLnPZ&erca4r}usRYb@@e zt;k&y*qFn--EH|{)4!VYL+;*yKomq+CqJVGLR zx1vN>Warm*}_N*R-7%!$!?SeJCvN zrR`fsx*T4eV4_xz_(QU(qW;}e{wjNbEpAk2y_3TmkN8P5g?NxJkhuKfR z_mFZtdcA7v7k*aLw;DBj%rU3BrEX2K7jIJL3T2*|-1c>z^&>X*@@2*d=Yn14a+Q4C zQ09WLsLvC!wak|DR>o%%jtns|NRpR=Etby_!oKg_+q-e9t&NUcc6{!-GlfyU%Dz|IS+;O6 gCl$(mvn8LV--FX>&GpMTp!gWW;UrpbuoYB42PAU?-2eap literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geocorrectiond.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geocorrectiond.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..7ed9adec6dfc141d250a2fc5179a8eb914d35887 GIT binary patch literal 264 zcmZQzP-I|Wkf$nCpsHygw<(}Oc?LOxcA&cg=uHsdV+5Kd&%nsQ3g$9`Nd^W0{<98F literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geod.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geod.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..45e2f95879b3e264ad41f1bb28b5ff37c24f9b50 GIT binary patch literal 9733 zcmb`N3!EKQdBD%iT^6zd0RtqEup|MJjc{iY1WQ0P$tD{j*<{V~uu_b3XJ+qScJ9nD zGj}(;R0|eFi?%-6T55gOLaEhiZBbj=+G44FSzBwZ6ls;(ho!X-u~x0d|958Y&b@ax znxS9?kcs#I8|*jdOsVDRXXkw^@tiW9w~C%uim46O8um|SN()~ zqk4n7Tiw-D_71{B^U~(j5&fA{`KPxQ$+@FPg5Bc%JphJDe5$nFdTfiZ=-}SF!JzuN?oKj8*1Yx`Zi1Y^NRR& z5A_Who0VGk5jdpO>IdN#!uLb+t$QE5qzGSH z3E?sLQn()?um4)OQ>p%8xC>qbhvAiQH@qC~ffgKro8ex#0bUEwgZtnr_%e7Jybi8_ z`(Ym(g$6tTzgHPD4#MxiG59U`a`+8+2!0)o!>_^X;aA}e@GI~}_$7D~dKW7Ty zA>*~Q%c}es-=tkKN7R`wp!}Umop~{Q9r`*S{y5<^5czkWOuqY7&etn-zM<|>gjcU5 zy&ZonzKL@E>diX8xk&!EAn)kWx2m_1?<86Ujc=Pn#@ltdpH@FZJyH%*@6W1t5Pq6; zXgmdf4n7I*gI|U}51%kM8}EdV!(V`p5&tgu1^90GdDw36dy#9Z_o-i`zCP*~R+#ng z*Y*99ZnxCe&i?@AKTPXmirw+L?`{M&FNd>F2Szk|Nc zg1@Wt|DO7TVjO&uad27X_a&^yCp1ncANJPz`V?W&*B`>i;iK>g_(xFm{At>C^ynX} zKcRlH8`O6DQ^Nh~&(xn6c7qJ9Gp`S2G)T^}@_HvUq5PRIY1P{%{#DMsaA!zbbA zp|tC7;1>yhLCYI5{+6)V;fql0@E8=m{~hUKhsOzv{=WppK2Jcg!{0;E`#(U@_m`pQ z`zuiF@FWzy|05JVe-(a~djAQ28vZlWfnG5D|WgYaum?D20?}Psd-wOW=z5)I>d@cMR*n;1Hx51}j1iuNJ@PFa0@LTBDhyMp}f!{9d{2kJ7 zHonVS?EC-fdxc)%c{2aMujl_!zKOmSC8gbl(P!l8rY={Ju(k&@ZZJ+VPASs+b^6H? z*6GlAIZ{@@{cr%v{90+K^DC?yr@}sX8u9x`XA?C>;OTG|JOjQ2o(Zpk&xcn*#-Uz! z&N8H*XB+1jYRwhI3%41ojWy&GJwU?e8t3VJLqfu9jdg@YFL2GJ#-PFCLHwXWqxF1% z#BVUx>-Y_N+!y0t*LxxIWt?9GWj(qW%6!;lu;6Mxf{20|>ifnv^Ir2I^HKA=W`E_3 z%J#}g<&nx{-+D=Qqo(D=ap23lnmVCZi;h@{?|9Xjq>=e#!8}XlQ|r6a!?cwIsh_5e zDD2I(o;W~Zn%Cb2}+$KudecO5@nGa z1$l;53)7u6o$(gdTTh}^tTvF}u*YZ9%x~KJ8@0qqX6>=Oc_WF_^k<@E3enR41^GHM zY|`oNeoZ@x-Hd9Dz_(xFMxMW`)d;e&B=TA=eU)cG=ilv5`#}`@iMpC_X@=ByTPS|k z@{hQFoS{T(0%57;)Y2$uWqvhwvdP>+xnj@nE?=0?KZ2mlsRd#}{hZFbw;z&_x2KgR zb~@=KzB)zclW@?e@qLXBclOV#*;%9M&qbjK$7AcTOGp1po%$1g;)ht$E;|}T^?D<$ zTXE1xaVC_)qdO5f2b?fE z1)OO4JqPphJDy4XON^U6&qPi+jBfI4BT*~#7)8we`Pre=i;-u{uYZf^CAUl~(Ir`O z^txe>wQ51b-4{+o(jJ~2@>)`k<4$%>)nX|5Y32lND=Bq?{j0Ttz|R_CEpn3iu`W%z zQ(j6{Zdd1;wi%m=*)XR~$IMKhuzXA4C=B_l6YH7l%`swqbAmr%Xu7;p@-@xKtRW#F zY!e$1V^J>VBXQOWJ5U3@B2pq66w0>fE$BiTaU4A}#r#z4QJU?UtlRm{y7_qZ?DZp= zX6+r26Z&!5mD{bSn7VSA<;uQvOTdGcr}C*K?b5C9{V24CMZ{*a=>Hg2vL8_P8^r{B zF@f02fs5zuFw@y;F?%9ok9lz5_G2ZEnxiE0oWWnWeY0jv+)hbc#=IDH;_GEcw%cE< z^tJ$3$*WaooZvZ;lTLCh=ceWvwdc6=aX23z?Pf31{#&C~5=tNB8IjlW^ik?!5usWs z&!If69OP|1k@ivM%~Fo>e9yBO&%0ScrWxb1+8pAqo-ZKzXurBz-MW3}D{W5=+@u)% zd&v-)mKJl{=@#Lp4!7s5L}DD5+&lJ z%d>^QCChab+0CY}Cl&f^JqvyAM?rPHZV&5KBQ+q9%`3alw%K3Z= zzIxO=bw142EfEst5x+c_@A&EAt?C*b?)1ZZ?0MYzEdrL|r7}x(MK8E8^vm^Pg(_`}$m3YfW(A>Zn3;sMYe)?YYjM9cRM(-8sbhi32B_ zh>~WN+W@>q?MX^8dBp!%L~rf$YTF>5Uu)GF0iK)<<#BRw_idxf3zU71HqZzw;;30Y zo4`SHXZ{5r428Pplv&jd0ZW3U*U@lhR5U(7+S9|4BBER=2<$4XL9&$0#a0|iWCw9p7 z1=n)&!)m?hTd}qw;b|KGZBb4qHJg z)1fURS9M|?iCtu^?Ut7>lJ(;7LY5vob)QE#b~$uwy5adrcX!kUUEOJ9t&qOUG!jMV zOD(B*!F^d*Mronkr*!DWosjE<6phqnHBjo@W2AeI-xSS0uRA?+i-FS9Z$@-loU7d! zYkEE9XiBbV=~qX4I(GN*+0ebV*u|8Rb5TdWL%y8ZhZ85Aw8k6F7AuFZLwZ`3cAIp< zy50|y!mhIZm&uE)cTN1%Y7j+Jt=I}8*9od2w{hxpsh|11LfI#&ZyuE;RzJsGKRe~s z^)*i}uqfZt|JZ3@(v+@ymb^Li>TA&4-z*y*a_?lxi&dbwe9|Rx2sp8|BdJ6C1!cLt z5HZ zP8oXZL?2~)@_SsyH&Uvu932XM>3yU(Uvb|nS@eBtM|yFsrB+E|8K2HJ<1A{XUeCJP znop4YJiXtK=t|+G%k4fe-c_-b$j^aGmm3=!qg<9mT&*NM>*iwpDOx9& zLP@i|$zLp$EnN>QB6okqJns2jfYmS`1nqI#W1q2T#!p7|rr2b(S;&$GFX&&&Vj9-- z+o77{PRV6Gw_&Vi#p191s zwo7D4`k=fPq_ZGRdC^R0rF@Ybs-oY=%HPDMhx{~VzbqVyGbDf6er9c&$iCG(|MGcb z$@-JuCl~c-f3K@u++Wy%(+b^5&z^4<{|Td?%H7J|uIww8=fZ9+Tv!ViwxazsahW~~wyS;qViyYiz~bPTBsgDHH*Sfy^8<^E BpBMlD literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gizmoappd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gizmoappd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..df35afc6b616596f06ae366eced0cc1eab9d2395 GIT binary patch literal 7725 zcmchc378y36~|xqkc1r&QG^5%lK?>pFx|^-2*_?0fy zw}^s@cTf-%6-7}{5fD^FQ4tjsJW)i&1CdKj)-V2Fb}C@KpS|DAZ|Ztg_3G8D zSG`34q3vn?q`&9sk23E%x{ltBPg>(58mEXt^2sBY9I~m=)v|{4L_2RSt(JdlDgEp2 zhie|xuAP_ekG#ET&vwZKWOn}TfwH`xwB^EfeNJ=f{6Y?;&-}Ye3y@0-6j_6IBifxd z5bbeCX#?l)kmb+5r8Gf{i00i4B7fdZ;H$tJ!B>MffO}`Uw3Rc0_5Y1W* zE`UDE(MPQ4+4({ zd%@-4KHxFnBJg$KLhx8{SMWG+7w~v+M{otWJ-8Cw7CZqgfhU3l4uTWv1ic=79y|$r z23!R`37!l-0iFUr4xS1=3cdmQd{{k=PA9skjCBNO->;rQXA)h^X>jI!sCO245BNs# zZV>vMaXYw%=)xY^=4P;McAohtB)^~E-Y^+fwR(aWw#<&Dom z{zXKRXA`|rp&?GsJ|E?+{7o@HyP0&3tUoqI{TT8#ZcM0&dNa^FsGNg(!?N87jiMiJ z2cq9GIu~gNX;3*Ed=pq#H_)3w0iFk%$bSpC7JMtX8f=a4ZIGkV`E&vDPe(ooxfjau zvD{X@i)H?$bcw8gDZL%z*#_eSl_OB^GVmbq9T?Ak;N>#^opfcU*LO*MU%_c+S1Y#t!eSJC^BW_^NkU%VgW@qIw{|3UgtmS)aE{)a&Y{0O)~nV@y3$NIZk z)}Nq{BL7+Be@xc9maYM3sn^2K@xJ^xQ;rLi`nn!ueSHEH;3vU4cmv3K{uJbH-1uqw zOtwy-T&El5I(?Qthw<||f#WLOL|>5oe4Z)$0hLFTo9Rn3|BFnS4=N8}oVS4Yg13Tq zf?tLl_ETR$zY5((UzPK^jlPC_UI$RQ3iWQ6{Y}svNMDZho!|xF*THe{E^rLI8*GB# z0D1ks3G(`V3v`ix4`_kk2G@f3f~&#rfM0|&wHVZO(M-v; zg441bR1QV|zXA^ce+{y|{|5Rh!P*`Lw*h~Pd>!S#1NQ?T1NR1h4=w^92loX304@aA zL$AE=|3oxrH{}WXGt%rYz&SINztCS%kM#i}{Wp3t(+7z3-|4ALFW?+fo~D1u{HN)e zOiv*4pQC4G{&TWFmf!04pODXX_b-tB!M{Pa&-J9x4B|(@UrGt;QLa`VQ_5al0xr!+#ls=6Ae zp=zs5)lg$qAkDu*&{ci4iV{cWuE4J<^0{mjr33h7stuGyNSUbXsv7bF{Ba9St)s=5 zl#=FJdQ7UmGc7KMY5#me7su&EN$5ne9~yO`iIG@%k?ngG(=Z!6E25Y4mmY+6(};yG zVpDJUQ5>b((}{MTR33@2X`3SA0-{~`tD}7o`mt~NPFi87$>l~A4O^4@t%rURAQr*e z>8nPgSh)HMyBZqds6LnuZ+U3AV%QIdAez@>QoTY2)`QX>SJMb}*RR@+&`&dcODs!l zCmsxaD={%we#)}`QKBgvKM)};MLIW&NSFx>VH7GfMG!-US`ES?&8SAclfmL{7c~(I4;t6CV;sL~ID=t3OA8!3iXq~q z_;l-oMW^#hqEL?-Mkr`oS&!3>UB&M?GTmB#?%%5FvF(a6-{V2{Ty| z8?6Dp069it*?vpTTshu;-mJ%Zu?RiG(K%(C1}{srzbr4#CtLRc--`{~6Jew;OFRpf zP-sTl3Ls)KM+LapJ$^x&RSH`VFVrf^z4x=-Z>!F#b6v*Fv~#XC>ib*IP| z!%IG$dC8~fNS^&veqpNpmfN%A*Xy=dZ>=WL;Se*We`(2qz18e`5=yg#tC9XfA55w+ z)nmPy&*Q+;$6wQpXMkOGq~}9fDgD?nB8m+sZV%|_&B-Y^je@Xh;y5CU5)9x#9>o^uC-8?wh*i=YBk|0Jwb$m_4Gx|RZ;ykFD-z#m zr|+krKd#z&uH}AvroyFEf^l3jt?H&X@=fiwDfZXoprE+b{@*)oBHL+*)a1kaB)8rF zfR;07zBssB*+b7+H51!I(FJQ5zh}(Mdu&oEq zGEx(`O$TJB8Nmzs$h8pV9fe=R`0aoOa<)A3yEW4^?nrp{;IGZ^6Y7!mEYZ|GY<*ng z+i5Ef4O29P!{JY%-k1pCthQ^{3lYos?)L38TpVX`8V|=Cq_ccOL~D9wJeRM3b}nm? zQ4g&rMQMIfZYDI+=h58WCFPwE^>V#j&g5~2!W4E>$a4TyONWqt02XA* zs6CQLsfAeIS4Z>;@v!yszSIL{$#s+AOzPK{Bdp}Wrq1E!DTuWP99wuXzX2^>+f)*81HUSW6r_)X2_`osZnjg9q1SYM3sa39Z$ZyZL75BCjX^Co5$I4lm+r+yg z`IOEi9V%Er`Yuwj%hgrtO0~k?=R~zX{egoYiZIn7wIa>Eu0~v5htLCPEXwb#aIiL82xvE@>Q2JYSev z!__=Lwrg30x5k8G+1B}a1%KrWZq)0csN+f`jT1$Cc9x$c0zZrgLL+Kut86!cW`#`2 zZgV*e!>h}E6=s6iuJht4*3pGOt2n+tlmwdNn}$>IaO;urJ(`w!NS{H^ZDiAt&t~nS zD6cNB52?Vc{XAwqpjFG*=1wSRDXS;%d3inQR@Ybp!9!{Z3p(YP25xhaaI~sn4mozc z5sw6TsYtYN6ZPtj!B?F0Zizb5FXjC?k)=rqUH98sh_F5lULtvC#8PKMQq$kHv%mB* zpxGWrPY%{Zp5u8xtp%~QD2-R>i z=O`3$o{U1dMS8!_<>AIw_wWM1HZyybaZ#~6ibK1K8?UvdxR;{7{hJ4}yhZ$#*H0H^ z)7y?_Pgy@zFc-;vpUZ(m*4TSjbP zT1{91mbEw?;{BBm$Bq*ZbH{rfUd{CF2oHGDd#a9#yn*<>Ul3&00=!JX=7P20lp*Tc zFYR*65H4$WhtBq~nHfsgym=cY0sBbJ46vG3S33+PRkU3Hj<_XEJRN3(M%)#@N9l}f z5Vz@BkgrF+Im8u+-?;Nrx{&lGq#wLxM{#d<6l*w&OY+?6esLG$a0zg%J2-R_dFyT9 zaH$|l&|NB9xUkIa)$|c6``lxM10LrajxGH6uBhfsFS8sqzPk27M+2_21fP8UTW+fG zK1#mcu`0Zr>Fc86+bI0ojfD&iEH7MR`n}QqNr6C@KV-X??_Z|Km%gm)++>H7cF+Cc z;rA+qf#ZD!XH53*>HT_=KW@KAISg&KX8x`Bw{jewh&9LdhBU*nvU8vPZ!WhL_YC31 S5)Ll}s9}iBSTTcyt^dDn03Z|q literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gputoolsd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gputoolsd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..55ed3df9a66db0f37b8ad96349747d9c17772da6 GIT binary patch literal 6341 zcmb`Le~=tS702Jq=GPq}Xut#$k~1Mf2s?8LzdS%qa`{0tz?mb8D8$*B-o4>wXU3kH zy}JNv3=lLbiW+|bA}T5>0s?~k5Th7>04j=#3Zjr4rBxPxpjKg7=lAu@?#$j^ew5{0 z?S8gjzkc2Q`gQl4BYK{?Xm7{gpXqTWyOD0BYw$@mw$pnkq<}mcrc21BDv3!g-+}UY zOE!+*#lOk@u;$5`_KH@ky>t?Ozm}HZdoeA-chN@kcd?(;Zco8NTDzbiq4ZfWyR;Be zTBxaU(yNJHL;Hvp9a-AP@@=#5y*T4>L|UoDqog_i))nXf6FeT}zk?@a@})%c|EizJ zdJCS@moc06x6MSU3_FkNd&vOzpq&Z(Gthr8(X9JXUJm&^V6*>mq8WFgdfSbTFI0&8yo)7;n(l^sviLROse}Qx6>Tjb9h<0!poN*NN-VPoCUI-or z!jG?*3BD7Y23`be;Kks7v~k)3z68Dt{1<3}FM<{D1<*!6&w~!i&w|Z$*`CEkjp$g7 zh6v?3Pousm-yiE}H;sIy|HKsf?}ojJ2}u$3N|+a@Jp#R0wM(dhez+Zoen)5&w}}u%pxaXdC2rLJq?2`_=f^Zd30HCBKTU zRQgxZ4va^~_&{wJ^sWZ40Y8B8>;ONA@)g=n`Uvs98mA8-?k?9p%w-jK;I?evp}&vP z$Fg~VC|^q-N16Qzs{QZ@kjM8))&DN~R8|I$<@Nuxl8@78Aio59p9LN8bKphbb*g*= zU9akIpc~ab_&igM2ULFg0?2;43493rBDfp;63G7jGWwaAxS76!@$>qCYJI+n@-+Gy z-GXuR`hald*Xf(8pKmZ#KcKc+yOnNJ@^3Mf9Mt;I?sl*jyaPN5{C4K2JJGL3chg;J zo_EuCAZP!B+KJG+2Rs417hD2<7n~2?r^Yc(_hVdhP<{YB0(=nUb^0Fk4%Z%{ht>Lg zpLS>C0oA(w0P-&FhvVKx{AK|j92ek=U zc?^6B{5i<+_zTRdgx&Q^a2kky)cN}>qPZ{9ujz@*58&Jv=r{CRwBvb#DF2S0%;pE8 z{CoOCHcxQw-{>j&qmn;GPiON6A%BMcq~y=2eVxUl>h~|O&+Gjx$oua(kmF)6X*8Yq z(eRg2fi`M&?K@!91b>$!%Xccls3C>rlt-i+3#h=| z2hzhW*jDdHiS(j4kXB6?Vl)9j>aeSthgG; zdYR|!+E$FAsY-lxH%C?uVUa_*i;*a;jmhAG)19uDSTT*rm@}&Dwa1OTOtD!iEs+j z5%^5@7n@G!l|<5vhAb&)meS+0=T`80t|}M(=v2(ut&6RJ&x1UxqdxOg@gKZ)G|B5FgMF5;F?m8<i!B;SQ_Rko~{rF|;Lzy3@m^pkG>IvGi z1rHN<%#d{RXjhaCss$a;?VGG9?@|f?I!J)^#hyF4+1Yem56UZeoA-$|NP#S2V56o zGlJKp@;Jw6gmnubb+Be@@M{FWJbB;{5Z;5D2uexXQ^>4+K zRTYSyhCpQb4mZii6~=X>tEaFK>tU$%a1hT8-82^v0yjpWhs%2VtSYuFf;lgD&!bnN zQQluOT*DYwfqFPD@RSx5?Pf+Jb3V=M?dzV6TZ;8^JDuZ}!WM2r;H?wSD!#kZb8;Q7 zqYZv6YJ5#?j)d&@T;a$3W>&B_#XfL@VK*)(Xi>IR6Tpg^;YoA2pAF{?CbEiE+Jrq& zFpjF1r}e9BTX?uVU0bYRiMo%_PRVga#K;9ygQ5AfzHT$1zj|XxT*XNG5YBecp$U#(4plWe@{U#9xGVYgFG-M3A^#qxO zP$hME=XQoHzoz0@W`;PP^6Dx4U&p;y_JUwI2@Nl>EwAh&3rhWmccQ_{LBW#al+K7?-nTl^*`e^$;mSaz5m6 z3aRv*pazxs?Rs_~MKo5g1kJpw>E}uLV^tzn(n~s0IU=m02ac;WB$u_@jj%)fTH2su z*~2v%B)(H<#QUi*-lD#12YyZXB28Ub56=Sr%I8ls_9~rg-+j;V3glYDL{6=M8Y)R$4 zg?5f>)qE_eYiA3f@`rpp4zfwHtz6zXne9#Xr&=VVsJg|*xswJ9 z^wqx3?Wc>1K(EzOmHqn>v%#WAEzh?5k>4YV^GZZK><1&BaNrihg1;L$2#M6Wk@xRK z*}Qw(+pGA@;>_?OJ`S5UQddi3G_=uXUVFRra<64cDpWX+DU7Q;iUMot07(%B6tLm&hH7wu#vo@R=s11I=>C6 z^E|JQ?JQ6x&6{^v67rd7*dbQanbZzLNgb`$zdb)ld=p`SMm&_68h;c2M~>Rl?&DBi!qz(a#deE1`Et^91KZ9XX2tYoT$evrgR(UKr-}8s;c<2i#)>tC%XkIq*F5<=TI^rNi#nk8KTDr?1W46!(>SjdaQ! zR_SYL@vS#I_lNt}6<#}5`D3d(UbxTrANy(kU!n)?DSux#vo~6P!8Ti~3>AJ4z*9Pn z%oT^WSmkW7mSM57^TQXh;ko{>VL6Vv1&NlzXzurBo;EC`FFXSYrj*#^WgEvkcGZ6Y D6&ATw literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/healthd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/healthd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..ab812c2d47341ddb12a9871a4978c3db664be651 GIT binary patch literal 14597 zcmeI2d7LCweZXJ!9LqM>a_+*i%W}IycP+QeAv-&JaO^ScEXyS>HB~h|) z9Kv!YAVR!CViLi`Xf#R?H3FJIqC^u3qJf|xYBXqKf(eHtYH_w>xp4vT-K z=F|0^cm3Y0_kQp9PNho5e#$Z0|E@H)Xup@$%j%o_lJHNfKT_{g?^SoJyVSeYo$7Y= zn{8=t#Xa1Rc7uAS{<}dXf9<(Q%(ZP2B+e@Qma3x~A;ZXQ{X4QHpG5AGMtpIL?8Qw! zDtQ(!oO3w7>Tp9z40WhdM<~}&M=qG-ihG~b|F8q*3>!x)b=W+34BQ(Y3+KY)l$vkA zH{pJ*SIg0SGwxS$9}i!GC%_kA0sasc;rE~kpM%Tbx8RBJ8F&)>20R%)2~UAvgQvo; zz|)|V>vSmPdJB|tEr(LBGvJqqcP4xko&~=E&xW6eZ-o!Sb145O;EMD+`tbi~?@Fnc z#rO60H`mYhdAL?9W!&ED7;E6Iq$6JMP4HZ$dasA)!E539a2vcpsW~xRhg-NFR(m(7 z0i_m?_HGpF`iH$v?}cg*|NDA33AI1$y^?gB;id2*xCL&37s89-`S23B23`tRz{}tn z@N#$>d>b_374TU2cDMv?g@?c^;epVC^WYHN8`>}r9oP+BxT6ORgg=KR_$nNMFF_Cf z1il0Q7>>f{p%1?c%kbN<0-u2a{5q_{C*W1^aTvl!VFVw6G5j2?!TaGD{5Tw^-9Fs2 zO-(3u>%QnQoPSTx)#@6hZWA}`eIN0zg?GX0;2n^5>$w$PuhcF35bp-Kx7x1TeYEFB zbyHgZkbW_2+)TTadT!xAX&32JYCoIww~^oF@Hdp&Z%ZO~`(A{9S}Dytlv-q{cPZTS z&m+9u*U z?#Ey+{44mgu3_V^3GX5NOSqrL{beZi_c;72?!VFbeMNmW4Hte9|Gy<&H|hS4`o9zR z*YLNypHN><_37`W|Mxs8Zr#tJabwpv)KlU(~;*?(e7JKY$`f{7cAv z9!fj@P{;p~`uEiRZ&2jm*6sOY9sVEcKT|hcB=z`$_8&HWLi{U{_g}Ew^`iQ37{Qmd z{d-BM>ji3kd|3&VO9Y0e)CqL;IQ1^>p;NDaHpL&h@l70cV zcd1_zDt2~+D=gG>0G#!czHwe z88-IBy$JVS@IbgX%tHoO`;$IL`U7x_ejf-${||zq=LbX4 z>-kXhdI1!@J_J61oI~Nq;6ivWJPh6gQ6A$ixES7^JKR`8`ESJyjqBhMFos9MQFs)z z;L&gkJO-|V$5K9-9~_5!F77u$=}${x5AHWZ=}*T)=}#v>=|2V1i5?VjOFuH9^s{A9 z`qPO}`p-%57g*Vo;fwGT(uo~D758Uxp9UX##@bk+Ih6+9Aib=&hSu?--myxXC*15{riP{*D7Oe8opYmTO)3*AJDklIM=u! z4L?tZpD%754vlvqWgWZ?u7_ezH_)%U=;a$>HyptKX2LIo+u6Q zUC`sp#fDmNm2ru2Y5Kho_hrWA>372gzHx=|Htm0f@%FSHAn~?}99?g9c@}QzPeV|~ z6&p&wa|{MdB@Z4cHPl1K{<(*98@t}$^<39M-FJ3B(fwNY@}5;a8+yW?>w7-bb60N? zZ;8MT%0;VM^<8-vBCFyI1>1_DYdMAS(2HH7&)$nIg=RSz@_g64#10&HWzF;BfiQ4t zHs2~wUdLbMj=6qNbwhO~?yPzv*RD~a6GeBM?N(zis1%1078R|bDDZ2sTc}#`NK*4b z#b?^Is5O1sH10M8#nzB7O{1R`@@~{$Q#rG5cZc23tx)4;ajhQ=S^hxS@G4e)FJd;Q z_T|@JA0j&Wu38kD(TEkgY7ZSx+`h-GR4vf%=6Z65%-ActR|gd-X4k7tLDO-mmAAjxj5(Imj6Py9#;63@O5%aas&9fxnX|7O3vmT5wDyJazjY)ahv!C z_!LQ3vHkUy-6t=r1km@bNdi)E_kR?=~p)xmhX9 z`weOR5LW_P;kuGXpZ>HhRza-?hL z*L4;;Wddyi>ej~2O&~xNV%B&ZIvyeeo>itnuQC8#VRd{@Imhy&jDFB1}Tk3Nnw#%nwrpH;(jp zD)M=bXXRR#cLWo%`8JdNUTqzhGhJog`BmkHzwaR%k-X;*6l3qo*h)u z*+Qz^vutNSD3vhPSr1_*D^J(uhWYHY_H#Fk#3hx#OpI8+HcC}(Og#Rt7-}ss-5NhZNLp!77lnc zQ-ff@cQGk=B6f>xwYB27G zSlgm+)hhOgbIi`t4Ge5%l}dk8t)`(>v}v}Z%V#dTgA3r9NpaCKbWlb z`y3}^)L$6{qas5d$#+^kYD+WA`Bk!LmmcgEqpIsVj%WD|<)I9s&sn*5Wu2bvkg$^_ zPuFRN`Ovf~vm3{?PE+Px9=zF`1MV5Ti}R;mM`!4~Q(>CN*6*`9=ph%=lt<5spU7Bm(_MW0kbsP=`=tDue|307xkWoFjwDc+Jd#CG>owk3I(MR4X{5tB>dY7qQ z)AGTKYwSD~*{B)aDiZ`r$0Itx(^YyMre{XS19}`z*65O9QC>Um2hHPgYuD1X zk6$hQe1_#{?$=TRb+)`-S2;w0;+~#7AuBb+0(BczihcREXPgNCU<_JJ{QjNs~=5QV~$4kb992P#m#b4p^2jwjZ=`n;9gYTr+%~hIl2fwd)m$3&NGXpT zL%GR5#Tt%x&#T04NsfIl;>^3>_uNXXPHibqhxMixjCygQMv8*1lK{4}MZ7%o<)!nv zz?~S3gV1dfPLON@R(&fT4#IMQBe43hm?V=&`g@1^sGm>QE81~~Y9(6MNw*1D}D`YiS@aH?0#;{^(Ftv8p5IiM{@wYg5^ z&r!L8xrIriRAiJNlq~dmigs8^il!4?W@jV%l-K4!NY=V?E*v3|C5C?Fyj;omqKYGB z*<);Mj%~H6c0<2OgbW2=a(8^2DQLW+08bB`xii2LcM$Nj~rL)cCj98VD zwhv({NXDfsxI;Ua+21Po?1-=nDyIj2p~CG1eGX63uDQzWQ9s=ws->Tu>P@q}l0N27 z1g7Z^7iI;jT3+ZnG7dU=xh!2?H}$gCcyf+Zloz#>9_H$l$(C;2lQf65rW;%-YT3L+ zDd9X~N1DnpAlp~#t%_B0%d}FF^M^PLu)DIK)D$nd(9yEDC~?_oOzT_gP4<0q02In` zu%j=y)X#?HD@j&yZ3&Ys^nO;B&gMg%nj1TE|D!4Y;gEtQn}w0STY{>QLw1p+?VgMm zjCj-$pOi#T>_e7MW81FkZ>zFbUMjKA%75+OEqM?!cp{*DkW5l<(0{e zuyB=9TF~b5>3cR=JZaMUIi^Txzvm<7t3L=r$E)a#+~l54mOdGz^f6n~0NO5P;n{gu zRP{uDoBlP0qk|*VZcx)UZiz(hBq!Ciq%=w`ZH-4|S7Iz}y-l2=TOMM!k5dP$7IPhX z-`4nLE3_H4mD;D(-x_z4?`dn#zLl#i?%i0CyDG4;y6x?0*>+H)vB@s^udH=CR42B| zpIlDQxvJ)JNusU1N4KW4%lgQfZbBz%iz+dbbyZexasAw));PDo#Q2TsvA9oBDT9Y;w==oqKC;1E~>1yewKF8F0SHFIsqw{aGhs?dxEt9l=>V4)+t|P|88{+1Z zv$fe)M=MSoJ6Qy_eSgx6rZ(%zxR}XL<0l36r;Q?W1gMkxA`4D)pvsm7#Tdts}*q`#HY!w(EaTRXL$ zXE^98pEZWIq2|rzPWQvCn8~6jl4%63ncR|-j3?QHmWX1f#r0gNvG{k%X%cNRZP@?L{bzzKWGVO-^5H0 zP0WZ@p~O<^js#t|D08_oPo3FRa9KJPEHV}B((|I$?Rb-kPnl_p$$ZGl)!1;dna()5 z0<%=Jtnv;AKns@@&21_lNRAN`Oy*CrT5LU6nYx*iVyE-Ntbtn+NSx*TvfvK$5`E3j zDM)iB*9Mz!C8p#2X#bj~W1+svMBk)|X4`nPf$?TjI)%_hZ5uCI?srLqws~5zvoH6t zbm~dp**uYEfWasaavdvz0K2J~2xg~!4I5V^J_et}%$>-f7oTu&kY4G$MI|)`N2($0p z`T2C3u1!yx&z*IQGg`#XTwm+=m)rDA^rUg$N-}6`pG42lpf>;X-qNIbOpCnw{VkEJ r^`XM;B;Tuy7A+1y#W$I^WYtt(k8;Xhas46-=`h4-7wl?{@mc)}?ev$D literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/iapd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/iapd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..337faf657795b055c05a10fc0a20de3765481412 GIT binary patch literal 12045 zcmb`N349$z9moH>FDcC{<+K!N>6IcB$eU0EtOeUNX=$NHY$zg#W#8^3S+Z|;-QAZo z6py(*D2f7JARr>5c#DdH;sM?w9;kTVsDN63|JmK_yOO3a-F))CZ)Ruy^Pl@a z|9M1IpC?Up3PHS{{Vm_})s$`nyZK6y2H+co}6rP(x~{%nf> z()g5|GD~eKSw*^#UW#w0PzOGbqb2x^rB;3(t720*F`v(I_>cdTT!iK&F%&;D4n}?E z6U|sa3-E?!>Ij4L9&cU5;rUt|Uikgic5N}y!bicQ!AC&6Ka%JeTBOmUhg%nM_<$t+ zjsuYUI3mU4iM0EX{si#uIN#hm!2;3T+du)nAM6Bg1y2Ou4K4+51Wy952VX!m`&#g1 zgm-}`Pw`ZQuR!>P;AP-4a69-SFano@E_fPv5qLT{0KOPB!4=?z;7afUunT+{xC-R* zyFu2s2V{L$gRJiwko7$SWPR6ytmis#3wS2j3!Vk82iJpZ!42SQa3i=9+ytHm_JYg6 zmw=~$n^E5a*q7A%Y{Vbex`q2?-s0ACD*I>0OoYxw`_61#sJ#rFj(q14<#XWqAb~GO z{Btes+66>y&w{T2p8>Zb{%H_$Reu@ixBb!Y#iajCqUoFt@25QpN}_2$2K&KB5asTm%Mrc~VNiP` z_!{u)mPOhX;4W|{copKW1g`{N3tj=H`dtON`(akR9`bbBMQ^}+5AQ+9zgp?Z^3(L! z;{5=^Zv-y{--P_rpyzce{afhGO3qv8t%z?$Jg9vo*RH({d;q*2{3Lh-crW;Nq~rd3 z2kLPL!Z#xRw%j}E-AVhu3+;bT%S{|s^BdG|%H2%w0dD}&&$F*XK2X*3R>X5X-wW;n z-v?d|z8~cF`2h6Wz59c78_MPO1y%drj&K`&i0(+*7u?Z8chZMZ{^HiVn5ukG8_C^G z_o(=fFjYLLxzOXIpaky)Z_3?A9|LayKhFJxcu=+9C&2R&zF(Eou6+{WO$dJqTmya@ zJPrH|*a?0XYzIFF9tnOP`Et-m!i^LYCu$m8u-Adk0SgFN1z0&haT-yl7YyWb*wJ;J{OuLXY(UJ3pI zyd3-^cp3O7@KW&4;CApY=+9yBub>P54dn6rcf5DBf6y~(+&)eJOvVSO){}oB{;rmP zqhua8&oD9GpQZmM@1Ilo{=;E4u0X9{`yXj)|7zEEtM>>d`yHqiQN9jd0OmlR-z^#) zmBZ|41zW&rh(8bS_XA%FP6zwIHgFS|2RDKjIGH`9d^6EAfMfgbH+ucC&V`{-nMm_ekznxv1ssE$?l) zzvaP}Keimw`T(*l;AEy(Dj2@+NdD{y4c97q+X{g+td5bujwF(x+a^j^E5{AXffLFw zv_02Sl04TLg@}md5anDtLKnKP2fD2f>xLfb5@G%pfF<42i+JOx*!B2UL_EJ6#oKOt zGxb5d3lTDrwxkyj=i`ra6p)@nmbi#?F^iVu2kH4-YF5u!zsL)W0a=jSBI&ZG9j0Lp za&3tY;Sb>l_OKC2AtO@^dSMjCtt*IT)x8g8Fl?JLY^qe@sq4n>L zFdVV!%N+>3vQG<a7Wkk{t1ZA&BOFs!LaqfZIVE(`(oW zM9C}Kjuhvbo+Ve6Z71ptJgaP?uKeUx`W`tf9nY5mEk`(O#!#AN43JSYp(*_cO<3rM zu&`hhL(eHkvcor`!FVLa1K_CY{K-(0+aM@1icZ}4NOPbnx4OQFO7tm*fd~hUK+<%T zj>C>!#P`EhIPEvCpH&o*U6L1jE(>3Y|Eyp5{RYFuAg~tn2C`oU(nS}hZBjVH@rs61 z@uuKAcF1G+MRjugiu_p%ZIluBOkZR~$Y`5kBH_eI=6B=#R$4H(OSS&e;HcFae^PFR zCf+fHskI)HX+TY@ZZ+XTOta0HQa<7XHAyi&#Z@FOCsC$!p3O?XE!C}jNSKa3V-T}& zR3AaAK$nPUe#ZB*1ic^sOc!&0{JC#H{Sak_P?y&h33_^2tr!;82F`C_J>ivt!wy1a zC38@>)U@V?Jd;1F=1FD$#^bWvbNlUqa)7S&T#@y8Jfj9=7#U8KbX?aI^fnPwQ_IdO|VYCcyHun zQ+U|6WI9z?0gMFwh93on8}g7!MX@AmavVV3(keOdwA8G3lNtw* zQzeF)tY4RjZ8x-GiLf=1Zn99R$?;j@^(BxcFOspeCf6xDD!Wh&hN7&lXZ?CUsrE7< zNR6$uj#H4M>bMW&7-eh=shlR;$r$eU%C4n$!c-KGD8h-5pWGivTsolvumRgJZ_EQ~ zTV9}#x8+wK4H_8#ZNeiM{Mgy~G@$H&C9@_hx>{uOr;XnvrwyF4n;o}_;YyX(>D9EPXR-ScL_Uok9C);$qvV}vOYn4VVELA42d*z~I zn+4a4YK#yRv1MPDgA?|M?I$ZX3vOhGPpTegOGo;Ho;$iF;w{C-ku=^^n%u{`e7~>C zpgWJ1+xzzI+SIqvi(t>2$x=C9(>A#d_eu|LoL(EYVvr36sLK2M#Op}qVJ5ZjMX%Ct zo!jqmeeta1kBREt%`TL%!qnfO{0nDPorZ8;-IJUOqp(6)vFtc9vfZL*1XUaI4wi>~ zX8VLI{XX1e9LmeuO$G`ajsMJyj7+mIbar=lU+f#|vaA5s#467lVrBU`2LBWGOHCf! zL`~fOjoU4rG(00@A@rrR`1n;hKn|+YBP#ib<8hPKXK(yHvFC6}o!pxF+if_`TAZ1@ zV6+F5^W;6HU+)csqB}6c!OfDbVHt>C!-Zo78S%`=f5Z0Nz!ss{%tv5OckIOJ?6cYK z+loVP6nGBO-p83RzV4oIeC@R*(T0sQaa*>*{0Xt)2H0*xY{0P>!$Yiv9k&NQj1hcy zKm##*@_gQr*dn*bdefu1SpTo*L|0Bcri-s{)9tJ{y&(Vt$x%R!@kJYFZWB|km^7aY$V+8U0!rdmdb7LAv`x?I{Gr_YtAFsUcC z*5FoXjlL006k(lYXZ4W272aI-bCQ51D_ockL4j`v3vvjMW?!_$r>-YhbV+bzw9V^!`OVKYjKuLFFz`6qqsk? zzZ6tE@z5T|fomS2Iy|-g<2#ob{WyzYT4dq;9Cgo>m6u-K`4Qi>@v}HaZeFF_L})1H z(wxp^`9pD=#pyCR^?C==l=iSx_g=nZMEzb+>fk%W#FCARAu2SMlim}h3R<#Q9zcs& zGRbJf%$-l-6cY1E9Htarqxb0>^bS71Z_>NsFMNLG3&0`0Lv4q+ui*CsSP&w;V|nMY zuJeqG#d^xGAiYDJgO!lmEzI|E5h5vP337~Wy_i&d(ZRQfCTVG-kwaHKhwPBo@4qku_xOXIqU6#=te4*vkb=r(nV23G5RL&Iv)x+J-ncFc174%% z*2VKRTmioM8EVmRAu0r@i@p{H#iTdYgwzqAG-~$y!}nq z-%LPqZ$qTk*DT&j)&rWug=X>DeMoY@Qq#}b`_xsz`SBdcADJ9=55iGuaAxrprzd_} z_q&JM`-*s+4Rx=n$k^qM!d+0aFsk1JWaTK|ZF2vm%Bgu@>33G|59QA+Kl_oDj0W+_ zpIalZ(my+%Jmr_JX^#qjq{^nws}*`Q_7^379L}Ncxih^Rr>}E@)Xm>|e@?6pJ&&2m z&-^sW`x9#3@6rE~-at+PN3G) zOo6KPom13|_t@w|`~m#3Dqmb;jl8P+7|v3&&c^p+h-d!*?eTXhVqI5np+EhZibz~( z0$Qc@jqkClfA3NM`TCOEi<~gI%QH*zQolfWw9( zl6@j;Hw(YKfrpLfx!lsXs*A5s8l|(nA>6mF+k`Z0*Y)(MTq<47x>X}@W4H42ASL@x bvSL%a4BkCgIt3V%aQ<7e!}QA~&!ztZj2OEy literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/keyboard.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/keyboard.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..efb01706a7eabf5032b2bd9dcf6b1303e1e7d626 GIT binary patch literal 10493 zcmc(l51d?8b;r+pv-!6`LVys+|9}LOF!RFygb3M?kaP_(+iXxlYJ4;EcJ{F|?+x$0 z*=#})QY4Dvf2%gNsFYGe#oB6ZvBgS@t^a7DrB>V8f7aTH{ex|)r9k>U_r2XWGrLLn zQ|Q~z%<4cHUk%;@ZUe`_tHBny9lQ~I z4LAbs0Bhg?SO$L*ydK;Mz78A&cY?dX*MQf6+rZa?TfoNFn4+?X4axbH7ac8%5?m z3`XD=!5DlHOu)~BE%0;TDEJw05BO#H4c-Ob%y>Qsz8U(x zAbRgVh5kQD`R#@M@-rg)=RzxL`E92BEpj{b$?&3&&fgP z0yJn@;Ln54+8eBofKP+J06t~+S$Bay0zV2K2Gj9>Tz(NbHs5z={X;X}d*ohIey{uz zjGrnIo^`DUYO#OXwh;p@)(w6*+8K>$qZkPM%?}zrM%4afIJXAenUP7-3txQKV<)={1)^qXps5`BIXhd~eg678l@{s(5febygR{zl5b zZ0f%%Ujaw#ud+{QJo%cU85f8?kH{Y(SLYR+f35w;TEBlfG-z!>&SPL7_$T06@K3=K z_&9hD_-Ej9@EhP#@Xx`;;5Weq;J3iJ;9nT|eb!%sv!MS9RJ(qg`Wg0L%Xf_3|3>~c z(+^yr>++I@=9XIcxOb-uwf0&9`A z(3CH-aCS5QAbd+K25tNWM9*c`a`e=B0HM#aUSasoRy6v9jPD%lTvL9owSsb8XV8?t z(ppV^vOi@%Z1)!C7FHE5Dr_xWU$~?2&BAvJ(|W$uBb)-wQ+T_a zX*+h)j%?o^wOu>0J!pN4z=j>#WoqiCbQ4qnhf7I7No2?HY&NZ2+gZ4#D>isUrmcL{3>-X^d{aa_AoMH=Ku`zWM%JLj6y5)yAn1^ZnIhUNTwcAZp|xsV~H2Uei#%hZe`dr{L7}|_hRL$mLkushC!X(RhD=1HN2|t#$Gh)MJZcx zPvj?vTzDM5Wu5hCS&ZGFS`NodZ{uP#EVYlLn@>*BdZ!urqi*6kUQ%&}!#Ii4S><>+ zZ&JN#>sP#3D@0D$ua5T3C``giSWg*Fom}t6@t*4Berr+KYRb*ZFH+d^qWxizdDVIL z>?$+85#MUsTcJa{#oL5y)TMW~IB_=lH>TYS_YCuJc6-VFa;4fh^*SlM`K9j1V4K zCvH6{HS2zyAmXay$r*^eAusX*R!Ez$a;skV5^Y!{lSoN-K`SpZJsFwMLgU~$gOxyo#B$1-;!I7!+I<6icL2eP9t6#VEbr)%z18~pVHQPSa$1e zMH5pq2Ql5_RMDxvtvGVxVK?$*rr}e%?w5H#!_edLRQ$2jB}6IuFV;hwR8W>fF>Gr?(SF^z2pTqu3cr?#uML z=cU)nd8e3-3oROU(;3b7umtQp==FwLw3$h+u-i0D#7yj%Vv##DeGj~7eV@;H19eI$ zGbudJBP%(T|LGyrub3^an4XjF&Gi1*i`M&voSO$ZJ*T@)b?Uvy`A9Y!2U9)ey!4t- zSYf^7=PBo*NgjZ`kG5r&I26{Ii88KSKMGf;i+8)%F@#Ss#dP7(UAi9+umxA_5lW)= zb=3O>bM9%2L(gL$OfL{8WB1N@o-~@2&C>aBs@|v*a3mp(H$hj4&=qgktLrx0#<$Ol zSSTk<@I_oR!p4acG)FHjP?|^g$5g)S#k<#-`%XTNY+o$J?vPh(gri<5_JXQ5$@OX` zjWKD9-|8<_EHr96&Jtm!i^=wl zyo%?Kdh)(Z-kmRtT_(j^tf3oi89R(QZ_BKpca4{EzMPvhE=*EQooI^Uc8z<-$kiAF z7S_HD@yoKDZ;118ac))3I&v1NvK>XRw7FgH&6C=6GC)o8%c&bp88N43J??%$v-DX6 zO!oUq7$mMA5P0;y$5XgOoC|a$Q$^62P#q8xQg14XF-q@hbACHZTW{2yO?pJ!!ga7e zNW7X}Bd#HLv8nERK_VB!)~3hg_-am?#TG4!71IPDbD`q(F?p5#9fPfCh^VQ@>bl1r zG#r;dUzsNAcX9%5>zpc+|Cp#BBns~IYr~10sqKvZuO7H+>t-%sUew-lw$}IWFdcGh zA`x?emWbY0#>=@9C*-J1g^BMO|6r@!@RP)gsLAv*at8G#Q*G}>CJipBdLSZ|@*>@;dv|b2sg?Nz)5wxi!Q^x|1u-M>XqiG89IQV%xDu zo9k2Jlh5l!JRG0j@jzQee2pEbI)0#cO=~H=Alb zuW%XBET{*@NGzEITzW4N9WPtvaHAB2i9eK`2zOU-Xx+2*IZeNE1Gu$X=?(6S#d;Wyw3?-Q zSaIvcfJsgLl=VGJoN03Sh+etObKLdVF0W>;?Ww@5z45xWU z-^Kdq51Or{RQJYw!cS4tniz4Z%FFrEdp9W{F1lqm%9vm=^O*Ay8N5jI6IGKi&Spm2 zc?b`@iq@&cOc|iuyG@&GeyV=VI@`+utv%f<%Z|oB>{r`)O&rVhudv`vuDj$` z8$Om;-YF-q&sONTrOo{}mqV(r#JSP;y7Jn7NdF{}f+RL6ELqYiKPD0cwbX(gBQkL( zm*4U=zo1FKR^+wY)#NvFzM+U1n~5_WvNSv7cJ<%JZxU%uHVxG<&94u%A{KU1g*b_LSY^pW5cL)@(Jr1~U`3BGcn3%9qQlj5cB& zriq(vq`C~f1qlde6U&-ZX{3KjzX+%8wI%PDP3!7Mho$IvAKdUV-841EY zj2^R;T-Ng_2a0T;%=@p$*|^u}VDfVH?{WVq)#DcL<1$iHMaT(Sq?hthj$Hbjn9Y1LWj9s^3W;4z5s^IKga}-9^uq)11hMMHNV=PkB zQ$h;j-4k7l02?c%Hx=i=vf1YMIIK}#G#3+CLQTX_2qnI=WW zakkE;uRnO`kB(Kl$SuxkNN<(2q-H3`Bu!PtT$4CoaBSfJ)Y{E)^yyC3&g_ueucLwT ztm}|B#lCIQ+SQ^?Yx*-rdv=|FGgBcWo3^y2DK`dtH|F^%t>-c4ya&y5&%|+<^Sl;!PBqYX7OiMe#-X$Qb0%o{IH_b;i=W#}T~g?w^jWgJv=qIx zR8t(ZysI=$%ZL^dEvLiyI-_)$>8E7$#S1`RNi^?N;2Ve*p9}Ag&j&sQya4zl@Is=Q zj{)C=HshOtkBVMe1N{fZMT}}*z>bH-#q<_6?pj9G5A1jla+d(_1Fi$!3+w~l16&Wh z3)m056F3089e645HsA)}t-y`I8-Z^H-T>SL+yi_Ya0GZ6FamA{`oJx~8t`)XN1auol6waNT0^c_7~Cl7ojSOL^t1fQ?u0=gFCupAKMh7_Uw543^W3&0roympup z;B&wR@NeiJ0UiO40{;qZ+P4RK1YJk(MgKGC2SV@rlzptX$#(Q;N!r(z(;@| z03HB-5cm-AM%Z&daGz@5L?6!ldo%poEk49;6<5H$0`tQMv9H-K}2-vrJ9ehYTb1l|ig3ccUX{P!Ku|3mlD1Ilmr(|0p_feU&3@1cLC_&$E| zJRV@gxIdtWGWvr`?uXn~^8{)y(U0iI8U0~JKfrB82WtO>mY)D$0R9xnaq=_xy@XZz zIq)PP#!+$q3(yZ}zobWq=KmeNj7R8K^eFmyen7N;O~1+J2Sod~^jJ1e;QVLl33^=h zKS96C<_(0upX9gz|2X{~_zVzjHSQll=XiJu$ot}HAji!i(r5AaFCG@_ar zN}8qkxQ(U2@A;}-^pjmNVy7WK&D6Z<=j9(S>Gi?mi&7f9AgkSxtHxf0m4V(e`L#2sz3_!{R zpNHNEy^gR7l5RmK^LfHH?x5M7`$^~+76Z&xhOX!D6J4Kt{;fE-v)Nw^HB-i8bDjHr zZ^)@8p~=yO&{XkdY)vYzV{P(=P!ZL$j=zs(Prqr^5GuJTTU6X{lu>ND`C43hJUxXV zD=4cZt}A25tN3QvoEmH5GQm&jx?`^E7UgMP6)9}dCAMO{q!_}>=wXGVTG#gVx3C;_ zEQ^U14pdC&vkjLzC9f5CIK05!YQYYs>9BM_GgfQH{$pCxKFY)>o6fc=tSMM#Vh+ra zU^a2lyt)5}DX&(*cWbjdmuq>zzw#~la-22A)@yeZ2NLg>JceIR{!J^>>mc90-{N|J zzP?HQSzT!E!#>nU$5OknYcL4{Ka7p-S&cNR(u-mrX_O4;Ip#i`LJy1d;%&F<1jbKo zL$xM4=XmnzcJCVSt)wo!thy1c<-w1YH#Ym#$mkEvsJ2b=q-AIfIA+!Jqu8;S$O?#N z^Os@EhT$O<;F{2C+i_@GvL;GDPxvO^Yu?E%fViT5Y5}?%*~au2-pkQ%1Xc z)OjF}gRD;JkvSyGb-y9?NP0Gl<28>wL5z~Fo)sySmK617N+V-2E$Zp*d_B#@-Mpx0vfZJyq|=Zp z&cRx`kc{&PRcos35~cMCHP9EMMw!@bqjMFi72nD6aIDF6;Wyw|vdN2Om5(diBN_I) z4#I$M$i;b0KF>J*uoIUPNR%xl0x+X&)p1;HjdPhC8{|DuP!1X=-@rBFAwR5_x%y{& zh{gEP@#cPQ`J-t^)6ur9Bvq`e-8>+fN}5W$$bgHMl5x6n{01>7wumw()hk3_`h$x+ zr{7^wPAj;Gm|jJtiA8x$PjBB<<{o1+bzVZEZ0sOmu_L3-K^{WwXRJdvBnou~g{7uy zkA*75rxmVN5j5)Q@j#vPi06w?tkreTkDZ}x>bosCK08j+X*@{o0JB;RWff;y6}%vw z*-lUQpxTc5pi@uaS*coT*j!J|^r~v#g_$Cb`Tot{)O|ET?v%VkH@2=# zcKN~e9PXDFR+s5`IIfF!C~+He$q#dSke=pnUQ(wymQeepAZNEyZD!|L%#_<{MhV9d#rO=zZ$%zvWbLaGj)l4s!Jn*D=ZDV8$`JPo!WDNzl z#Btc+NWu5F3Gv*b+or7ZjyR=VKDMmXVH4(!OcbSu7TpT4n)U=an3Bq=eBO2*2oujh z7(j@J;`?j+c>(7q!!;Ans@X>5Tf@vignzR5DeWVpmy8Qetc3MsB}_*NE2(_WskL|! zjFEH$ltUNEn2*vH(y%ScsIEqxI&B>M7xn1ID0TWgVuZqoyw5j)l`tk>uj!XrS&c8{ zhiL?urx$Ndo+6*BYqeeGX#eV_t_ckjT?%zc4z702Ip}V80KQGf({UQy?%YHh<;5kqZ2DWzo4g$Y>^ge3Ex~p)7#0XI?d4A=&f`wy@l>x*78o2 zmwK`(y3Ks1DE}<)hc%s^cE5HjWLMDTy_zN1tbR75uHR4Ia#K&A%UnBJl2HDP9wXhkwu#=(4}+Wm7oHzA{x0Lyc*>CS3};gx3J#mefBkF zyGPDO=`}>we)|N~z&+51-r#P~1$TmD;12Lw@J8@DqO-Sw+fZg+54!etx)JuTv2S3S zaf5@G+pndYOuyqyBL@dJqTLQ~9r!wMEqF6{0k{(!0&fA=fV;p`))GyC{{eS{FMyNa z^Wd%EKfyiV-@v`#bKpMs|0nD9w4dmaLBtUp`Mvc9dLz-JTm}b!3%vv25_k}N2891> zj)RAYj;?{;6nGZBiRGhDShv%3;RlF$S)w;Xe$2W9f3bf&r!?|7+TTTV;bXbIBLk3Y zBE!Q(msxZVmq#8%eOG=u-iLNJc}Bmpihcllr%nlKK#%hRv|{KrO}iF_=!e^Z==Xk_ zMY)ACXf?nH^sSQ=gC3ZGGmuO0UN8j@gWd5dV<$7?VLM%U8+vzH9a<>jGH2p7&t)_3 z;K(89BaX)Y1BLx}fF9)U1by&bAdl-oU%I ze-8EE2LA$n2mCYmUGQ1(d*C0z?}L8;F>fY+e?YYEcl1O0QQtX9D>uKv* z>o$86i+ve8UYbUN-?hw3g1Ve{l<vo3c~$jdh`mecT*L1JS|+IeYYhuo#nl| zL~B>nXF_#CUu0ZCbP2yI?NcSS^ktMQT(q*@%d)v(Wxq`&+bQ;Z`0h?GWLm`Tfv~PT zwct+W!`rL8Sjy4 z6&(@DR4Cr5OX1Cg-$pxi=~fQHlSW~N-H6V|cX>S6bnaI>Q*PGs zl)#;W^|%~`b^N`~l*@4n>aGrBu_zNBEKp z+{~{t^{=1L69N41IR_IsF){A)IE(r0#%WR}jj-8P9?uS@*36GP)viaOzdvb69tWOX z{CZJ4p5H>K`$IWs@@AjNv=`~#koLTkozf(gjMdvwBy^b6rKf_PG1xl7_J{@^p!K$E zr?#>~yJLH{wgt-kmjVxh3BFB81ACJ_1*xzb_%ajQ$2)^wY)iWi3lYjLq!JPb?NWSL z<_x(J4GV&h1tA*gEoP~6ocq52KY5?;I2WLOb)IyL)0BqrB{vWqH$ez+P3VV#>_s__oK)gC-WMj7R!!sGLe`J z?T;(f@jUU(j-LU?%tL@!b!^uiB}|027wmNF*tpj~s1Ub)d3b}_2mAeXx8hV|D=^O$ zIR-|{b_=7Kdns)g8y~(1yDjVW?W`QP621sK!mJ0V4%|TQb+q~%V^TR=0%U@;=iM6d zu-)OUG=yMn=J8DM*^%e>UTkOk6D^v&&E0`LeliM0qG@|&JgekGC}%@mYokTYH%$QS z@NAwRPO3EWbVI7R#%ERNn-yv*@pAB8#oz9J+YMwO>g^_GF6eHYUT$FE9&!!k0-Re6HiBe6E)qX(*ZKd^63=odF@QTu}HvQPQ6XrdvYjsTNK* zC-xGrDPm4@lZPd}yedH7{X@mU&4y1E?Azv4VaxgbsP9J*dd&nEsL(Isel;tV>ocvw zI&KWXOgSgAUDtNDu_~|sl78;g>C=ZsR@IMWvzceu>EjG;Q{L%vxYzEI)) zq7?Cw?n%GwI_eF+cca$j`u0a>vQter89?SaGB{I8p}8{=59*qOnP)IG!SG zo^5kMXKE0| ztDoy@dy{$#^;^&(!E5Ajlc}bsyi`2`MOWt|v#qE+2tN-7NDC@i@m-oVU zeMw8{S>&uKa#j8;T}J=bDz$V}jZ&gcv`v52n%joXmh@UHPoI73(1>-8QfDZ2u3Bv= z(yNiEPAbY*-b6X+kvGA0N{!qAU!v5?6t0I-em?o}P+8=z35T3+`G=O0+MtxRf9MQr zqf*0rsDA<61urE3a`;lX6>fr;LgXA8rrkv<=f&i2B!9C~$8UfyC%rzexA;8x3Z)jG z122VV!JmLS8C14Lt{dt2e^32(BxTSc4&~!q-6$&cN5g2wnqg@G4k`yI>5r!v?$*z8<~| zCU7H6VHsxdC9sJEqfBa6+QuPfsezt z(T}gdpC$c8*z(W&3;(=TF}H$<;F&t7f)GQ1al5Pp#Sd*J)w zz3^_>>gRn%&aasMh@4jb1Jt{V^smA@><_Dtn0g}?v~DH;*WfMiK`3$g>-4Wge?LlE z;`U?oYliZNNKf0pp?Cah@tFOYl?8nugz(+}c z4L$<@6g~vM4nG3_4Bij_9Nq)}g7L|`4XyVf_b=hQ;a|ab!YAOJ@UP+R@Nb~#?{A^l z>q&Tr{del`3wuH97V7;26ubQ+d<*G+l6=xnL9yRI(|@twzmOLD{VRL}_5KZJ@M$;$ zzX7Z88K~jELm&PJydFLauY=EFhyC!Ia2Nc~!XN&N@;j~nR^Kyz@GbT2LjTaj>vzb1 z#{Mon5xaa(i2wYL`oE(5`=;IhO4`^BTHCE3D2w10dpvK-NfzrJw6^em8(soSQ2c+$ zQfHQ!4;H~8xS0HlDL)Qwg2%&+a0x8KVR$}V3fIBbd~l+rR-J2|WWB)3#|ufHY%L=# zxA!CV#ngD)|x@ka{bO-;3T_@>U{W{CpLZxIZ0AJe__eI*h8hYrJG8dhOQeLm0~}xIbNd?Y56RtUOlM92b@HEL3u6-GffrLcBFdh z6e)KbNjU3e+SQrwPRD7M=Dl#0S}{SQ+bbt(l)ohBbW?Hfs)#eN*+6_yW{ducis z48FIT#Lb2}i~5#3F`s6-=I#zFiI>c~<9YXXBwkI=#mNk!Wn2UGx+=WLl()t;>m_b2 zu7r_xU+Kqz-qsAGY&?mBrq5XAxrD!tI#ca8QQ*9z5BR!~g>l`PqH*eYl{Ai;nJzcH zY&zF;T#x1n$KLjZDf9sZWnLu`Q|jEnOa=e=i@9)98%C?Pz+h&cvbJ;81$@U_#kBGZj$b&`Yu#&79fM6Be`a<@wG?W`le?nUnI*q;gF zIW|izJ8ajpI*J=QQ71^ID|W#S;uezT$>XOh-;D|>?BRICuk!bVJ}QdqDbdhz2jbpT zQ=_I{w_OW=moB!NQfKu*y{y)7_vj$>#yo#opF2=q$Z7fKwK2h8^TLRVJbAn>@ZMJa zy>TXU#W~cq+ICsM@5j7I*8?vxQkA;+==JGs+GVfnbcL~+LC|*1;o6VI^~?+FI?3aH zOx|~-esyWP>t&5*g5@jCAehhH;!`3=snWyhblbHXc4CM2tnJyEtx3zb1lH`>u22%0 z+}(VukS}HPl#ZEi(o&N%YHzcfcHIt4?bLSN>(!FsS1H?}QMyK?8$x)qA{JE=Xz z8ywyrAtkl5b;C_c+`HB44bJc#(l#=ki|yCBAESigb;IoP)P>UfBk92?Hg(6QwLjB{ z!+MsFTiPAPu0)ScMz=NV0W+w(k8p~-`H$zzTU?AFJMAESM~%IhCHme>DiqrAvkGQ7buR<7GsO#kEaxO;fjd%ItyE<2i^ zEF3SsXS|>@g~~j9WWR~)Q(?84m`RVN+N{6sc(cN6wzEDJOFwwF$j34GZD(HJWA*`8 z=rr@9!if=a`O)MoJg!PJigXs%E3ucf*B}vfNIsYkZaAWK_TZ;={;D{9K*Wy|_nH`% z_}7&9d=mM6^M+51*Ra1wC`+Vk+gaj9YFJBrcS7H6-ImdbUOh)~m8tLKfqd2h^29D3 zUHvfopnS*q4%+jSZad<*6Gjjd=7S-AI1MZ?<{quc#1^Bk8T1(2b7tP`QijombnI;Y zdi9aSan{~xwwLhp2kJFC%WknhWhv>ns0inIp?viCW74d**YwG$FiEpXvQDR3Z$FB4 z)-1(JEirNeJ?qwSF|H}v=^#ryUr*~uwiR9V4(f!USlX_aum_E6C$!Uql4MAlNA`)z z75Sb{CpVaNykqxbJ$F)XN|$TwfSi=YS(`lq?)aXhNuQvOh&ih(Nmqx}`+B~vf;3=)?mRkr--4WKa&BMz%oydN+SKqz+ zS&`Fu&)~Qc?dxz>8^2IyJD1N7JJ{~a#;z*IfNMDOj76cYXKGWAyanPTjAz2E+@wX> zH%$OrPwA#SvTw}abETf2$l^qI38%>H2TecrZr!_m$JM)gi`9A3o&imIvh|z{I2q|= za)%ct*WXho(a^M7%L8g`!!?tIIYVG{OIkr@15uoBrVkXqqiF$AD6>G60?LS z8;)MT=$&jnlA76;(8ioMJ9?|@RHrG&w3<0JCrZ|lF8z#i?% z($AFVPg^x51OHLx8JVme9C@zGST>?6!(|U=?XsB&^|$E z%KPmz<>!GT_laHh%*TT=TZiG!*Svn;yp_9FkcVP%sBut$oN72Xm{W~;f1iE1mZ{b; zU08I3-k!`HG2OJzvjXlGDoi>;^iiuOs!(Dph zS~*Q*${rcWm+NYWWvjTamU14mZ|v!(+^e?kklSkGf1a49bhC0dD|geesboW;5(kx( zSkMM97&A7t4e}#YDR+ZD+uXn|b4qe+YB=CxfD1tPfEteFjcI;VX1mP)5$PWG;oU#) zc43c>zx6bbI-7gsEwHaOKT8DV&S|>)SCm5EGh;itu3NU&=j8y?djRR1C%f)r^PbA@ w51novdp}ygo0;_+FL0u;KI3>nP^_=(dgQjwlQaAPpd+XCQ$g8pG$lI!A6H%fU;qFB literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mDNSResponder.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mDNSResponder.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..58b8db003c38d6ba4f6cb8c03744b81236a28cf2 GIT binary patch literal 4090 zcmbW4O^g&p6vtop@;QnIbX7!fK>-oB3;9w6MA!uuf#qWW6+hOV?wXlq`(v!`+1&v_ zIS@lQc+waXV~m=pQDb7l!NibgV&Z`l2NRASxah%)2S4NgRrgHK%r0NnWc$}u_3Goj zdi`FlL9fwFIyvcgJZm{d&(bM6meq=MkoM9Z+D%W>E*hepw4-a}R@6_m+D_rU{nxz? zOFq<+UXHhAw3HsC#jUnH zT|#7BF;3D0;Lng-hW6=bUz)L5KSea-r*xhfm%tUMUj!cpe*{;8KY)*b-+}$$1<(S& z0R?y-Tm^m&J_>#Xt_HsV*MOgbYr&7ebs(>^9^`c%1K$H52j2!afNz3NfM>yt;2Cfe z_&T^5JOMrlPJmlL1wI9ig3y0%1>6QY-~c!R4uVI)?cfoR?Zoyd{!b3Wu7@zsKJWmz z9~=e`fP291c@Lp|C)y8Vy=geFBVZ3b!~2*OwhH|bS+ z5%qr|{Sx>WI0F6wz6|~b+Tazi1bOxg2lY#!3tj{z+6gS9ejcoVUxHQeGtdKBk7M8` zsE>jlgFeW51t9Akf~;EeW^b z!vea@)cwUqoJc4`G)vd(u@b%qt5Km@h?g^X;`myCU7b{YsXllA$AG5kw`= zm%@nx%dXXYX$6DB#e*`gMWHK|Rr9?VCg5@(Kg1rdq-@m?Q_RKvD2w^gv2Jrr`?^HS zC&^7QXSP2Uy;aM*a!k~f9lDV=0@`kAwWrN@>pI&dE_tEo(1*M5g|_L@zNgf-15sG^ zDp(`&q7ZttY?T=UU-V6k&kY;eNxM1OQ@QlGG~X2F9@8^RrZR2(HBjFVO0$eVW@tKi z#-$@u zaY)tUq^~HG#0x92*y;ve*r6990hgZQ&FBUFA~S$8wpqi^hqe|JlxVNR0v=Rtm|6|w zJd~CnUhn*J-S$W0Ql%~y$S^+(L}bj@{@t~mxwtW(;3;P7d76IL^w;LRGC@SsWuBI6 zYZuihPGZhTTzXbaX}8_5MFZBT!a^SW0lvV8in4?sEqm;i4X0{*VVv#U8qFH0Ps=se z&Ekur{8-@O*iKbiF2|8O@HZ(A1#Ub!J|#g-po8Z{(cc~RKUeRc&yzhj-{ z1m^#qM4$z0`gq5nRswNh@|yz7n7}t(v?-os!758^roviEUx%o$1+QkmIRJS!3oq4= zmH=a7;i0paRun2XyT%7pcqd!qb1HnuYYenzy^ziN?KNk0@hxWi;LUCjzf<8?5`Sld z|Gehl1PatThp#mXD-E&HNHyA!nvrM`8@=+geUm2=5n zom+Mwzw8PVS>f=JOY3|`2csw%i~=}pTMsWlbQeFyeN4KqT=pZ|?UK;$&(VGAZoc^u z<)4476Q?!kDd{AUY80g!^Bid*d3s?v8X3b4P?x3r%*VM%fXXY?6X}kGQR0<7M`woE z!c~#W?fl5)BPXuul&$k%-rgO4VEjZyIFE&$<2&-zP<93^qV1l~*9^$42OksPklXh$ zMc}fqCQ@5=p;&W$`QpH^OvWQMdQc)h*tjX+2yuhH-a0sxjx5R}_@;fmaoK9Sa2_hq zR>lzR=egeFvc#r?zm+{d!4<^~(+G5L=lpO>*u^UOb(z4)s@>;gkK2wOsN-=yKU|tM zc6A(VJJ&c%fUfq-Tz(uLVFmhT#ix+nfAW631rBzLy*Tw+@ojzT}0!~21EA>xFimhHOgKM1$gX8-^I literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mediaserverd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mediaserverd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..44f61978ae8ff4e8a246fdfa3c14c6fac8805ce3 GIT binary patch literal 23021 zcmd6v37i~NnZRH5B$K4MLy!P53E?JAR}KORvXaTRNf2Gen(msJBHdlRRo#;W zL}W!gKv!HZL|sI2y;#I^MLbdQT)go_yw(-hTUkU|_W!+C)m2^HlY|cY+wJ_O|6TRo z``-1v>wE7-sbg}p)$CmM-{HAOEO|F>jazg0HtwsfrPfK-B5Q#)-+HPw&pOVU8@a^c z|ET8V<}{@}r2a$ydq|mov9Flo^NMEdd-Sh{s;gc6`Wsc?`wVruI!((Ixyip%aZBPc z@=ns>)3Q(G&3r=3J7qqH9L4hjr4CuB7UHT7%V~Etf8`;Ihpp^5o;S2Epw@}LOGAQLY0;T+(1Eu^NDCIW_uZBfDQ!EGsWL-DB*DLT?+Rqb=?t0AA3*Z`AVgFPlC^d3*l989(mp zc@{n&&dFb+UZB+cBl3SQ)cOy5XXdX}*YUoTf1yynhrQDX_agY%tU0+C!$;vu;Gf`2 z;jiKK@F92u{3(1Hd;q>2ei!}&{5pIE{0h7gei6PB-V6T`eiFV4-VI+3KLlR`-w$64 z-veI<-vw`iZ-cLgx4@g>>){*VtKl2rE8v^p4e+1fOW-Z=1@O)AYIrMrE_@5z1K$ek z@HXhfw?Pm7Gc3Zl!x8un_-y!2cnN$LycoV4UIcH4Tj9UJ3*a4a0KNyF5ATF4;CtaR z_&&H8z8{_rKLAgJAB1z^hv01ZukbMVVK@`s1$*E};A1oA+o9m4R{s&Cfp6b1p|0Ltio@@UGO__0)7{k z;P>DN{64%C{s3-=55OV#L%0P#2rqy?qCKyf`D67H+R@>(BY5n}nLkxOQ|d+X413SQ z-@ii}{v0lbw7==6!e1!$!o%?QkW$l6;Q5#ESooj3Ka}^sf`_PIt3S}5emvth>bFsQ zg2&4^@;lx?Fyr_9l6Lk7;q>p#(DIMEAO1jDV73_sK!Wr;oa3*{) zoCU9id3ZHE1YQ9Tg_H0w7(fQkqpI)-csV>0j=`hgD4Y#1gGa+l;T*UF9s`HrQ!I7t zh45IO*TcAfTy2^0_jpS^)lw%|JRjSSd;ESXE+kxDov8hTAu#?iSxcoHnY6M1jL`EUuG2jlcDL+(sw z8_SWGQ)gK#aG!xY-_CH{)B^@)!FSI^NxOMPOxE|gHH^5uqM)G?z+yq|>FMzLv z7s8jr&G>sM+ybwKTjAAk8@vJz!aBSNR^SjEhr{qW@M8E(xE&6`9dHZW2{*z^;5ztB zcpkhIo&%o+m%?Ym#qe+8B6t~`2S?x>_#AjRbVzS69OZdkZ_ygFOuH;u(q3J8*5e<% zrk8R-?{qy*;9u&|gD1hu;VEzzl=?4Io{v9Xv8sd<{efD4e4g{FX8j%UivGZBrmMiJ z6JIGG3Uz$YI(mA;+O6MD3iW$v<)_cd?SU5D3m={~CwB#MrV-DTx<0S6o~!HgD(iW? zm->XdKCkAvhv(<>EcJQ~lzRPp_&(&kK&NL;?pmIuo?i&x!Tamv8NLX2nK!?f=TV+t z0(Zcd!Y%N6xDMU`&x0?6%i+u6neZRrBKQh87v2aDhp&Xw;6K8@^f3Oz-@{kKhu~}A zgYdQRTkv)8%kU<64}3lRFuWPw0p9@M0^bN<58nh|0sjeJ2XBE_!8gM?ycO<(Z-EYc zE8GchgInO+;2QYPQ0DV*hbwu02Q0vM!ZYBz;HmK4@ML&9Tm=6GE`)bLX&3LI9A!Om zCwd_5=)F+d(fgpZqxVB;M<2kyw4V<`X+Ix=(tiFGO8faRl=gEMl=kxxDDCHNDDCH? zP}~AsOLfJXS#j=$og^A zuAm-|f5Q6*X8e?uue7(H2`Q(4w|)`1|6GUr4|&F&@gI4Y=N__t6}kUXyZ@&=Yj5Hv;GQg_}}=Kb`0m9nS0z)Ei6@_%rQhdshwxs?7xMnF+@bpYVLF}Z_3{zOm;UicDC6l- zQ2No?IZI7f@*%+yHPp&nPmee4?rGng_SETx>7VaCbjH#d=gs)VjE83|n0fxpGxJ0F zzC*<4LisBCm4Z{NmEA%$Yy{=d4MWebmI{IEl>BOWFJ89tXW6yDn{?`~J?R8?#UJ&` zuD#hC4V+-FJ>V24+|W)$?eI#jKj2r#+`z3CUAyd$hjzs+c~0mClWxFTkozZC~hAOQZfCoyu%JvhIDm1F!BP;#!fTRL}F&aXC9z z%LO?vH<@#C^_nzz2|uidrq*qxj%jn3Quc~&C=N?eUHWexs&N z#J^<^?+xp2rKtmhMm^RCPQ~5r2fGk0_15MuJDy#qOoZif*k=krl>J%CO*!hJLwGcl&BieL`zUpHXDdw^aB@h1@*|sym}) zQ`q=f&0kVp9rS%La3jqQ?ZSq#KkAfIuL`xY7uFGR1b^B5i|D+5-v|RcoNxkH&1^oG zJ*+Bfu6|Cpx6-Ix_bTocepM2A7Jtg_mqxp(T6cr0Q*Ks6s?n{hPI`e~t+>^C*i4fI zT`gZteUSWZajGa^X<;fCaU0)9{?2WaQ%e<0Qqo)9x@g33-KkSBUNKJ1(gO@%HQ`Hf zCeCjQm+6nv*+`P%ctNe~?2V-;HPD@$ExPmT4@0+ZWJ&u6s(~r55qmQP1Q4 zQ_Bj~Ch^=-F9(({dhD?7RO^MXQIq~N&f#Ep@+N({j(XsYkGnyk>eok|;x4z;sKsK{ z+9yG7+(tx{=}*%7p2_!m9~D-rzq@#ge&Fh{C(b~Z>31f_{6@8e64TYB(~reOK0Ws< z`?7-=S~fG7jO$^gpW!3O4KkoO3_1mf%P~)i=m9;Jg^XZBj7v2H2YUQ7BVWgnOAjxS z!CCxSw(hq^y=vT#t#v2evR`w9s2_`z8o!4({g?eBeU$0l%(!plnD@FDw8y-lvYYPE z_QDzg`CK4hE$t!QznJky`a5sD5$IY;%|MI>jk`3Aa@-(Hy?5?6_uXZboN!{)cYuD$yZDIGJ4xtsMbZN$nYF`OrvB7t2IW;UNKgx_I!6OSC2$p>N^8Y7|NVv)ESSH zCOPi5{f{|xD+q0qw_1cg@p5d+i`(Ks^bby>1(@A(WKklWvZTIy?m6p$f#Em6Mf|Tk~ zpG$7V?`u|esv_Fwj|bGxm7GX7x^1UqY*H4ev5IwB-UG122bn5=r*oU$;tCfCSSF|>%$1yhWDk(!mi022!~8L`#G9t+woD;h0G+F6(V&`x)Bea8h@ zm+N>v4`*rU$CHguXth*5cRd*^Eqhd9EEL0G=f&2b*5eR;HacHL^9NXtRr%+l#C2Tc z=?NJb%~B1+uzY&{s_cE6I=7IzDu3g|SjsJA#ToExOsCAnrN}QabGDj9I~YA@*}lq8 zD6N-elcj^!&F-wMk3?2hcK_98DTOD#u3#xE1{KU^j5JlZm>S_lpi<}Yx9@&0y(ncQ z)^ATxLO5P0i#@!mcssxpJTF;7L@T zvdX(zD3A8`9QCIPOp8{bo)&`_Mdb1^KCy@G3p71tRl0{?uP7W z>_S?JA+?r2&gy=5WU5U4wR5H%Hb=%tgc-?YBgXW3sX=>+Oi49KU)9`f$^ZHwlKubJ z^7f=xMMo8BmZDY#)9cH~WVXRP>P4)OHR@?ptA4Rn?Vj{R+FPgF3#QwTOtbHsX1{fs zedRQJ^|X#DcSw_Lw)r|mGG>kQ#)JFUp>)_u!iXWXK?z7RkEG_8b&ghw$V@y%WeGC1 zM;XIgM$~+*I;1-Y5`h>Ely**RmMxL-B<4#C!ME+iX|%52ycM zOoqBodH37AclMfX-aC5rJR#W^dLsLkX2<$uhQEEzGd9b%y0g1v#%sME-@pHX0Au!$ z-e`9NdxvcHTx>RbPTyaAY0vnTdC)%RSJC_>F_hTJ&jQPD3D2i}A9%MHh%q&6ZfmyW zRPUd+% zwWlMR?`@Hj5%$`FOL`t?oBaMmqWadJ>X+Ha>GlB z??C#6B+iaYE>F%jOgiPFv^rxwph*{ZsqO!3@T;m z2eE$XFhI>>gU7hw0N3J;`);w8p;6 zNP)#{Z!(fKFrTLoQCCGs(e0eHS*Ml36p+TtavoH6WAw1(t4 ze}X;-m&6wzA*|KqjH7&{|K`&(KP@*B8rt*J2}@SxkLI+U_)FwO=T=hb4&0*aO}ct~ zQTn)nvD>WYc$ys88kb{h+c~2*Q1-AgDbcS)UWa+2Cl>j>1|j;2Itbu|o+MU2`kbDQ zr+>$~lw5u8Pru)|Y{02(s;1l|T*`get;bo>_#uG_Gd`gMbJ5>UCw zea9thm!GpD?IuoX_jSuxF4>p++U2YE=e|4}UdB(garwq&XP>3_$k$cn++om`P#K5S zrfp^)%n$aO({e3Y5g+>8p7@iq1j{%U!_2xRN`2lncE6aW5svvmrL{~%&av_p`5Pcb z#jr(;sqanOHf~zWz?*W4bZ$4>tliVj*Jr%hVi6 zpG3RXuQ*;-s};AP`Ou(7962I6QqqbyvYzvQgX}(S+IFGWnqZwDt)~~ddxvG;yEQ>k zxkimx4!Djs#y9}l>dTyWiu9yxaws!xrO$!J?`1a58DH(7`&Xk^<>AI?#j7*n!6mML zDfnSIAzEsU=`ax*g){NUi`Mv~c=UTYPa6Br%9DiXbc7R?ky?>56YU*wiuC`|{x~sN z7cK3Rvh>VGr-+k}jNeJW)$9l3bGdN`TcWte>CsEB4yBZ1*z+u9pRMc#%6^LOaM$OC zb6awKVpQFh>o-4SZ^W1<`}A~$^Ks%n&a9=L>wEf=RsEMbSJ<0X{(P0|vv*(tm3}|W z4@(rOeUJy0{Xu2lplnCktJHCf5dG`*SMFSUk;)&bQg8aAILmqqLw0W}xe=yIVl4Hr zSuKp|7?`JRZc1pk1 z=XQN!PpsNj3bK1Ey z{PQ_czLNO(RWWK+C^l+7z17~ro*D*)lUx0DI5=8}r?%o#pKD0T?c{%WAUf1O_@-ha5k!9nTKvEwilFWJBUD0Q;g7*w>4gfOSpRyM4EuQ9by$>@HJ((ZW1jT41Q49K>x7Ib@kFkLS*%3(BJI_ zW=DV{$@_u}Ne zHog_2GkQ_7B_gednQ|BZbXB9$1DS(il7BvWJWR@AEV__VDj-HW$#}ra`jcBt`m$A6 zXb|aGXqs8}9@!X|ed?wnjCZuErDRu2B9iz$r?#wASjUAkxk1!i-4w_kw?9TXgIh`u z*}7nLezn~uD`&r;%i%85 z!DjL;?<*n7lWDi<^Uqpi^m;szrzb%4jC&`YM!AlU>^K}vr{ zOvJfImygbWdfe)-)nwGl$TgcD(tAsx@yXFtJ3`#gX8QZ_TBG7t z7!kCo0}+{aQJk!V5;mI-y}@FHNBNZa`DDsB?avE?MzzY`jri01k4bvd{;K|N8PQ~u zCr)+SJW7uxriU>7m9|4A@@g_4VTY0}4>}iq$UQt6v9j~6S~L)3`eUQ=CAywuo>@T2 z|sk^|FTm73}Z0coS zwmnAvO@>9()bpjNn`q9Ul5SSQohV?Ir@J^yP-zw8ThHH2QiWH*zit~cI$UMMy#dxbfD-u@pF$cY{~DL;zo zXpg-_iG|G07cdX?Q1I>l5keh%SB>}P9F&{_o*;A|yB~H%R>6+SKbT2LPm$Ao~{!Q+iMedpOr28N3BhzkM?uCg5y>FOQc*%+6 z>Uml6UixEwe=C!o0p6SYSW&o4f2Q|%2IC1PJwYZtW(Ab0vQFU#7*)-GYSK1-aIeWk zoU!Z4fTm{-nem4EKE{70A1G*akEe6~oAbWRJVfsjPH}HXOUmT8Ho(-$D5gFrQOs2&q20b zrSJV~IUV#-msQ4|+TIUDldnuYnE7ta-1n6TGVRg0r|$>qRJ5(vWSdUkKhEfrOax<< zohto0j?DZyzF(a!kNCaZ`b5_#1?2tX({wY1Bf8T*_peWA+s~X%xs#p zJQ|gUA_$6tyrjrOD}sn9AfQ!2K@mg*1r@|MzOaaZBK1FaCfS+Iw)NxtT5rDHf6uw+ zo_p@O=brlrQ9+qZvDfw&cg(dX{4J>m2cr$39(V8~s%>V73>nG9MF)GhA>zBRs2X+D<1s()^7WrKrVuZmv%V43;YdQ7o+3@Tkk--*}!$cIlx^q{MEDyeD()uIi9m*{n>P`tUs5|0iXTC zv_fm-xY(W%KYRfFU95hP&QIs#Lzs^vwDXvj@da!@5AqjCy%*Alp|1`4fUx5ubP?zY zpn;%2N*9CP9yAd2CHO_dW?madWV*V0zN+r_CV!LMB5F( zH-Mi7z7D(*_!96Y$hAQ3X0&?-^ewn-Ket{VO zL-ak^u|fMTqqGC4+^#%K-0gXa7T1pOra1T@DBP_d!sDbPF*PlN6S{Zrscz@GtE0G|Q!dU+P((hzMw2etrz z0sb=7{}Q+u_#E(9;Pb%wz+VBofiD2(0y$1OpZtbs_c_XM>36V)=N$<8_w)zQJpaJm z4^v*GKT7_K^e6B+9)OVhGyMhnIF5iA&tK^!$$yFdhH>z^01f`%=^s+h%d|n(zs$58 zHxTu&&}-n&QeLHh0(Bs0Sr0`0>-2B%XDa_b>fN>SO8)>Z|GuZN7GbcBb~cmdIb40CLA3s-XsIs5j? z_^VM~L@Z_Np)hUVbB7?ZS6;3vY{!g5I3U7Athh3CVyK+51-XuVJ*+H7re~M@LD}1g z8csi1yBg(aXRbGb&>1jeVTjl=`ur%4l36u~CXcCSYaL5OTtT!Of92W-p&$E}?2-%9A$0-7l0Yf)&pPDu<3i)j>`IMB~xrxcpukg+@zWf2MwW*9v~Q7o$6 zzE^fCwa|>=aicyFX4%r`3pRL>SN8S5b)uM6b?}#w>Bp%0CC3%LeSR$xy=E8+DL7lo zjreE43{$zLrsTVoec?pFMYFele9z>$N}`vvbGCkeSU){jg+A7jP>;vTij7t28XDvi z0~c-0HnGD|PgH9%7ewkj*b}QOrCt5fCv3Ba zkfyMdW!W9y`SIH&BX+7{mG5x|{V4A?E?Jqo~5@LE)@iU$qWaL;v_WZvK5<)r)(VP3thitx*67J2Qd=|S={^P#^0T+ zr@&t+Lf5b8u37V}K70QywaYk(Mf3Ymef?j~l^Fje+hqLNJhcSA;4_Sk4`V(w)}?mc zxb^KaE+(0{VMSF9jDa+V$72pm1)o{-F@qMeZ58(ODJ%k;=;qYk>$kqWu%YoB*Mrks zvKsB?Yt*s7>gu0ptH*?BlBXy>vUm?Jjd7j8@WmZG2dCZ%t%0+merdojf|-@ zrL(KB3vLT6SJyMv?oe3584!5ukp*u=TYdduX2;|#@D^dVOPJ?D zYQv)5n_JK0H-zLKumIPJML3vO_*i=q?$X_^gHt*k3bBkGW6!;g-|xgl+)cxxC7S?n zlVWhK6JeCql~*X2k*BLlZZsa8RTu}2QdW}-kljSRS8 zIvKmk1-k%~wnQyX2C)n`F8KpzS~!BYkD}bcDr&^_6?i6Ai?jJ5#$07ArovIA7LAih zwb)Tnp@+LL(tc*5MdsWrb1|Q#Ewzl4#W&3|c($s`hY39IaXTI_Qet0K_x#u?r$g_x z;8@PdTz2KJx&zEgB@`7rdB`M+s(teHD@5Rjad&7&eR_{mt--TGQnK5+o<7s7$owCs zia7t)tDD?ksyNRUUElAo1-k27rd#xIyCOcnqiAhpjH6dJa_Gpi#kk1otH|p?qA+dW z@czT$*X{eE?RZIea9m^zu9_ZRxNO9K{WV3$iw@tqaNm@-VX3*n4|v6@cz8H+tke(k zd|r2ijc1q8DdEOu_h#oPntRZIyaLR~+Y!k}olQ?CwKtW=1)-A6xQwTI|5zy^>$O~?&k;Sz11mvf_Z+?{#8<>MVGeK6DA zh?nn(j>OfWJ{a&DSL1u1&yP`+^w9t!4fB+L2e8f9#IOb&TZH-H&~)goyTOTT9>$J$ zOrFi;(T@#I?)94zWDEKIAX9IZ13bY+@JNNT7ttP@sJBf~WzX)AuaB)XP#VUKl^oRq zUVFL~U^eZBb}%Jzw4DFky)mqL2Eqo7xGR|#a`iZG8tLWHhWL(4>>huAFkz93fqN?WX2Cu{K#ypMVyk1Div%z1n?{MASG9-2*(iQ zO{7EG7sk}*Ytz##t;ScwI>PpP8%)D`z_TkiB>vCzTk1c322a+RCt}@oynfxZ?KGdy%;_E3&-z8^30KDfISjEF KidInL==(2vR4|n+B4$Kq;k#mJ*<}sd&5LDFp;V`kSg_C(`5 zr~^4PQAHfwmS{(sqtK2|x6I-AW=fns_3@TYWoM!pkAg^_@h~_iiFbkzB0d*<0DK>K zFSrZQ)VsjZg1u-Ee3P@r2dgD5ZjeVxvXWjvKvwRg^=GJJRjTx>F0ub z61ANJ?uGbSAj-F{0rw_q9RcTor-J){tHFJVHW>u>L!9|RFlgDI4kVgcYB_)@+Xq|w zTDqwR>9@2T#FXh^YXRlvgU5jjz@x#1U>;lqE(H$;4+a;52Z2k#{lG)Oy}_m6uHZ5- z2QCNafQNz|U@y2Wco;YtTmeo1^I$7@IH-b0fbVFX%8}q(;8Eb~;L+eK;4$FK;IZI~ z;Bnw{;PK!y;D^Acz!ShH!Ij`+;ECWPpb0(%7QhEU3%n1sF@JY!g8GQg*c|HtoO-KP zq<*3^IS#ho3^@n90Xzx37R3CFyApJX)@%m35;&1OIsa=kpUR1zL9Dw@<-^ebh!)@* z>z~&xO*#eTBeYimD@2pZalIoGkbg0eGO~dje&SKFk9(b zx(?&K2Xf3i!7riQIPH4+N-}>pVE)!nKj6qXl*c-dje~Mc~&! z*4r&;ckS9+>FX%RdIzQ6zk&F8`X=3$=p7tsq1)*WxnIA8w9cnGN~-WP6>;4-nrD@gIVd!TZ4p z-~(U__#^ObtlA%gZ-GAnUj-ioUjQEhp96miJ`4T~*Te^ZpLlQ@X{sme5zYb^; zcp!bI0;S4%1d+aj(jn7#kow^9SM{gRnq3uODZGsydQwgSUW9FUMuf^_9_`5VkpksDnS!dc3d_xS^LG&?I7w-@<=Srob$iiF24=Pc9em))l=S>7lI z&Y&3yLqwL*?}t$sk1LZN#)A&I0MXX`k;yLye&k!e8w*Sxoe$ltvPZX94E#!&c7VKM z!oVzvRemsls##B?i&hjuAHUknP@FN=WoMLeCZP*@cxb{ML&L^*=$^gdJ;>SiJI-AW{KWi#rR zGn9)ba=UE#WD3O)DvHd48!H_$2jV}~UtK@bv5P(t2+tCsp)Yd%g6Z}KwIsdlI$?w= zHphRXKDg?5T$L~|!hSOlw5gQixa$<~eVU9{=bhWP3r6IW#A@H;PM(T?1Z`-e_Z#oT z0qimCIAbx*or0}}U09c@>T(Zy$sV=p^V%21?Xzdypr^q1qq-GRQ;CsI+fkyh(64y5 zDQ8To3MT>w?IkkK+Q=dG!juTL5C2RL<|H;I-0>0yW5O(zrAg7%Wk{Hn@9Sl)}v+g1I~A5|`~e`DE|v>Q%T@o*|(B1Nq#u4#<@w?XwS zlSWr6H}2VjjqBGKJ6U#%Z-N}OlbY_M`g49`eS*GZFU1G?erR;e^QEfa%p%26BhL$? zw^DE&Yq8ho%WjXg&KmS8H&Uconm%!H4`{nJivs@G*O zc5JtcFoCw(p{~m`X7xXYp=>i;Y8M3S$(B=EMw}D~{i^JUR#1&M6vJ1HHpMu-X`h<; zes!mgam0H*i}D-U?z*%xh93Uk2gZOBJHC$6%)QP|XQPY#KOAoJj%?T&d4d`b`FOd~ zcweXH@V)qbvFFYHYg)e1eXqIahoWyjY8XTrn%#KZ>ir2D~lnE8lvnlZgg zH&#&lV%VvDbGfd0-NzaxwI3e4@OU}lfH#+B6WeU>)Zd%r%56iViKo+s{)B1;4v{PG zP<)eeWN&TRLtkA52^T3Q>_oGh*ENZiy(;c6b%9Oo?2$fhV97-+G^)oq@wuP%BO2^# zrX0Urucw`)W_^8fa1TZ~6)3aCsB%$>&#s+Dr8o4m$M**u5#9l!kt{$vJzR&loE3i+>NDr__*kR|p z$3k^EzDHP-oIaqg#7Wb^&1d}1%>5$iC4NSba<&*WJRF^PR<6bEC@?M2FI>Jp*2%3F z0S^1|HMszHLBACHzg!ReSWe)41ir74!Re+5S9Zz!aB5GIdzv1aeIi%#2ZbIAPdX%N zzsgZ*h-eS42kS+b`m{0LLDev35{4b&A*8%Z*F3Y2FJtApc>8pDpHJJXK0TBpew*Mh zD~2|+zTTwL(3nBfyXLh|hRI>Mw4TxZ4umC~K|yS95wyL?*bU1Dm#NX0s1S4M!EO|g zH)Q1EbGv;PYJ;-m`jYN_>=!M>wVWOOB45{!z*|L+>j*ERJ<&+opE2yZgKZY&Dkzb& zWD&p&croJU4+W4+m{7O4Q6c+%eume5ti?;Vomg@WnSo zjk@&C@O;Xpc)VDO{UzP=Bd0GJ`brCm=e@vTEB;6oU>1vkDB`Ip_NHSySeL&-l>H#; z3Cyrx&pV|GG%I9GHk;PdZ+b5_^Q0p7I3=b8D@W>uEV|lDiOpt%@VYy zTfP?sKJ1KK=V?9iG?GRsxpyZgU~G?4xkdSW53X{f%A1yjhmk0>_2gSg-fn}&@|HY( zMwhqxk_)F^`-aOg_8FgNb>pe!>fM#7|DeDh5J5K!&dAEuzfab^N+$a*9Z%-nl&g^M zh;{kNHJB!6>ko%Z<;X9EcEdWX)G}Bep|M=DLG6ZlLW`w%dFxiC>|?hN>qBKLeow0( ze<~-lWBZx*H-6~M+!gie5hDAuJAXEp&-Wyc2P*_tmx)(SeyLo4x%tcUnTBP1yR5%l zZ*MQk@v?M9!2a2K`j_;MFTFvjY7}=~e>tpuJo6;`y5U_Mj}-Cad3D`3j5kiU<0_Ju zA{{T&d<(}tSKh+82eEUU>eqJ6qKAiX$4c6rlkKOC$C;KkQoS#RsY19u&iQ#C6q zAIgX9b(_WbTuIwcxRj=8|Kx*frpm)*N#wkLp~;}btE$oFMpbztuJ_wi^)q>IFojnKCSV!5+pXluxrN5-BT=DKwyuA2_mO_P2MyA<_5;6-pY%5Vc+I3X1{ef(3M zt>)lW8YODC@j%44+#zcBxy29;A^aVFDPnt)PTRVdRov}S=Srpk%goEvH-;Y}e@?M; z>Fad;uRn>t2YMFPy%u+S!|Xt29m9roGwNJ#@E_{evmA^RIlC#(X)f(<$)WV=zOyh3xim{t z60{%D9D0Fh?j3~}IDhvnf7)$@F*=ZF=4KH2Gj9P80ylxL18)Qm2CoO_gDiIlcn!D! zyb63hcqLc@F9mg?X%~S8$ohMbe?j3;*592J4r}e#`dyJaf=D~3@H`y}u7Nz{rkoDG z0UQ922K&K<;7V{2(Jm)~#~{r-7F=3*BQ1vh#f3L9)wsbaM;DgRajM;3rpgDW9D#a$ zU{LN^~iw!6}bG?lkZr@O1D25cb&lKJZMUja`si15Ty0 zIKTTg@m4xJ8yARq9;0)RzgeusFCH(i5qiz7sBeOsz%tss4z!TI8ibzpyWo36#zCU} zHL7rW+QleuP?}Vl3zE0d;oo0wwzBPkFs{JEEQU&{bLgL8Pyy z_ae=91l9V!ChOO=s@?a|by=D@6>`^u0(?LCk~T&+K#uM90VO|1HzI!w`5#nro9HHR zs@Meo#rx|+Ow}(?+36OL?Q|49uqpxS3YK>lX&L-d%( z`ydnR z$gw>@r2j;J&g=mq{TF&FvkN%=U-UHnRpmcTf6MFyBL5lsyUKq?wa5A!?LG_ryw3g! z^1go#+0^SQEY|qr_FYEAgw0 zd@dVBX&-)BqKdKzDGRbSp(8KAhimADosY+hlF*G} zKQt>+mm{(CBFFbimT6UaR79`kFCz$@x*1DD#+Fg_qc}>fXAtc@t~`=q-LYiE1w{Ms zS6lrc^kd)h-Be)D@#SU|4cp_}t%QCOAf~|F83UtHENjL}ryQE$sL`KxZ&_&8Z_2-Tlkgoh@sADUxyQc$KKxNvK-1gZj)&$&wwbf0F6> zt4zmjc4hg?)3d^f`&>tQaYG@mmmRQ^V`tVmZpZ3dzL%|ztRsteOpohVDwwLqXoy~7 zJ@98Ql5ydrE^U=^Nv5d4LD^!q=!Y|tVi12!4{j`VXYH^@*};OIh2|j66<9e>7iXwAHgB(S1qfnBUd zX3~tFg~dG)Ewfy%XMDdyX-TIp)p~_!;V3c=!-Py2?MG^3+PEY5V#FvBciSi~pe`6o z&08%2{OWqb6vX7!a#OiM`dyqBs44fC2`!#E>YdZBr2u zmshZRVo^G#XJPLebDgo0ii=53-KfG8GiQSuYBQ{l}acpxRR+wj-mtF%U8?5 z597YjjH>#8Q%hi3sZy%hTu;^XDr$d*nIhgFdGQ46p@w*&$s(zn(5)@ZF8934CZv)kU5$|yriNzu94oebA7gBRy@~|Ij=|^gmtuMcHpXd5BdA=5;D|GAggwfz`8Z~FG zeV*pD_rp$PJmmSq7(L9Qo0!i!%uMvEb~!i7#@*ANZ@~dI=0tZRc3TY{si{MKB(P9t zMti;VFt21mFGM=#sXdOh&Dg}S>R1Js*4AZ5v!FLOlM^Q%#?EdLvzfl7;D*P&FKQFy z9(JrpYcRm2K7vImSa_(vFDuC#YL?q3Zr0cVySJCeR<=+&#?9Lx3D{TYR)E>GJL;h; zsiBphZ;J!M#51rAP>GvTe!i_7ahH(=%SPl|Lo7vfMT){kG8U3?8#CMnxNe|BN2p7@?xiEk-yn;pgGL@!zmkGj4sF z({5+yU2gZb3M{j*P2U9mQ@v)fOFW(FYn#@$Lio28D;err)^Z)_^+tQg9f&GU%KKqw z=Un=}F3)d7rJeh??fnZk*>S$GLrS~Hg?KvlAKpu(`6|xK+hd1-_XOko?_~F0rKn?F zHu~LskHYVT@@BT*u8sGzs{fvhb=UERbknx8bCvyiuD20a49U=wu8u%546(^eR*>+n F`Y(+^{V@Ol literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapscd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapscd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..764292d3c877345758efb968b7f08730e5095dc4 GIT binary patch literal 13237 zcmeI23!GflS-{V|GrN!pgz!utkc4LlVdf@06T&0OZW0K2ELlhv5aOM=cW0+NbMJ8P zoqYsK4R1t*R*Q%uhjLyHE#(Ew1l6pz~75{Pilj^tCFR91WFQ~Vu zH>*e0!|LZc%05VVpdsyUwNL-ut>VAVS|sPX4hfQH4RPnHa~dfF$ZY>RyRDvB?wO7J z5*FE~6SFvpRq-?TST$fQQEKi|wUiWfv`H8)zODNV2`@3?@F_~2rFI+Y46l2)q|Zy@ z7Yud}7|WD8H4lkD^;Wo?@Xhc%H~?3`8{qlyI+%sqVGeGA7L@WU;U>5WZh#lSE8&H3 z4ZKLH1*_o2Q0l#e_-yy3($2-px>vWhci(Y@E>p^w-@VINt5jw#`7eh@!YhbR!7G)T zW5TNlzuKkS-~9u)Ua9Wyzzy(a*aN=_dzCuk8*n3G;U@UCuFdKir51ms>uRCa7wmqa zYm3@S{Ic$Ag*qN~f1YyN;B#<0d=~D2pM-tz8F(Fh8t#No!G8Dwcs+a{yaB!o?t<@x zyW!j60DKJI2p@$v!3W{Z@GkgM@D6wj9D}#Q5bl9h_|vcqZCHYNI0y?c4;^?5bm0IT zg#EAx``{3~7M9@E@C|Sy9EKZU8D0S^@G|JZi=YoJScT`o+u%7cfM>!GE`bp|1=ipR za0JeWqwpv=2D{)mRB$izw|R1iuP@27U=L zpSoUvcPVx6eDd85k5TvNd3GRuuevW8Psq9$Fz#oZ_opA=n~bxpHFfMqDF3t6_kQ@0 zQpdh0mb-5r=}#)9`SVJhW~fIL;RWv?y&iuk{vzd$R&Uk$ADblqFC*{Z!Cz62lkX^6 z1C58t_p7?x+tk~sN6JC!{WbLt!VeIJ#+%@;!#Bd;fP2%sjo*Z0@SSjk_$Ocpe+%9Q z>+O6O@=WzR>fO{cmwF-L-&OA=-!Ag~9^3)n12;nANq?XEeZp4}hJ^n>y`SHbT*>-B$_daUW{hy)8k@(ff{SuUM`LfRc z740ZSp4LVEU(@je#=nz)6>?sLSEjz9z7BigON_&^?*9<#ae&6T zOt1UxeR=UxeR*GXCF%pCkM|_!;S%_$l~9_zZj%z3+zy;fJ6y;`w9n?SrOi9KpVFAe}PO$vy~Ak@en1{Qh*etaJKt zgpm4=H0CDhb9A|kgmpim@m}*Nh-^f@X_j2gUP1XKirpAi;bnUV_EkS zp>78>)|sapXX^MfggPD?m(s4YU=E%Qm%(%361WVW1kZ&>!R5$LQU7^*zMpTbfTlX% z$PzE>3hH^8BP{-gMOfC=N+|1X6_oXL0hIN0p`^o$psc5h;fK-sB~a$arN|L~WHn*2 zOKYevCHp^2!?nb}h5VPpN8lCkA$TRcA6^CTgX`ekkaeo<^9DmLywm74df;BTk$4$@ zxUgVsGBzh+Ncz>rHI$e61qp94u0`K6zaZhQ#x}w-&meMl7~6IH4x=xbcf$SVbyEMr zTU*-Ek6anw>!H~58=%aCT};$2B@Yn^HB`xXtMRn)bz_Tpv$;9-MC#+IMd_94J?Tf% zkEfqVe;=D)v#ZszoAbh2P!8QNEcu?33tZdry)wHgzUL(QB0sQ; zZq6NxTu(}53wB}1m7MA>{i#xSsFO|0teSyYGDl3?j7*oXd<$U3^vygeWgWYfZ+YS+ zZJg8|z7@a|oaaI1LM9$o%L!sGk)^w~-$;cX0rgfrPo*AJHEZ5fl(aUUT zdrsaT)4l8Le`k7jG$=*VqvJ%5RSilbcH~-aRIrBpFbZR>TS}ccAw6`1ky63Mb&=;J z`DiO&4gAP2_~kgm@e|YSFdTIz)>{nxT2*0D zztBUiv3lEwViIM~v3!*oQfOVYUt&z6jYk%C5Dwln?A+-0G33 z8CsiNzrS^0Zb|gG+ps?SdUvL%GB-(Qdh|@L>VYZo-J@gUdMGUGQN@=E%FRtW;oBFI zEQT_FKE-pClBFRf!&uzwK02$7%nD?Zg`4yYOt3kE!Nq zU*Hb9f$L#8tfpP&Th;b3vEjH^$W_awFcLvZt&@*7dE0CcqwFkg6_l)n+~%^Mx63Ul z4N;d(kW-zsA=}+()DMRHBRirEr9zlUST)1)UR>U(SA03;re3$cH&`mx0_yX6A*kH!(xZJd!G^|&Yb;_V#c$uzWFKT-C6DZj5udUik!9+ zIXfTv>@J4#M6TC;3Nf!#UwR+3qC z)$ICH_KQWPPID?=IGvotpRf9(Zb0c=*{*qoA?NJr%JubKj}_s?Ofo99Og?5fpCoJh zds_27gEw}0Qhopb9`R#&hnMYC_M9!TUe%2#chdc${(iUBFNRi6V249HU0LRCVD*;l zqQ_f$sSqdDedvCSigkTpd!b~MG^M8XL#G#^C%`)SoN7KzA_ot&?o2!R?5NEx$@Kfq zv~t2BZds<^AEuS_2EP_~x=qqGPQc|!Jw2uSIQ5(VByUo4a7~h9ojKz1aGn$3yM@{x z3KKs_yuDt$n^AJeORtR|b$BO3A5GrHo>Hr&7gLSX#Pb3xD%MI)E?@E}+GmOYmD*xj z2MlYiVeNel3i;pZ)P6x_oOt7?K%`#lvOynIK!2B-F0hoP| zCGK|qc~Z5*P?b{-cN8XQ{>o<9C%Z2u!o2~dG zZZ32^J%yU>u11wHr7qH?RVt_T@34MGFujWv%P8VBx4L5G8hcQTZnY(xS)}h3n)TJM zHmZ@_*~p{kHS1|{tK39rXq~DStz45ip4$t_*OW7{-GN(hOCxTqC*)nCtPA8UdooiO zVjDd6<~-|v%*rNv#R@eCrE5FD+e_Jv&)+t2oOg{ExkY(>zkxfGo^r|cB6V?FdnU1i zC4aaSWowkk7IYE7jfwPGo(1xu>$%n)@8_b*Z4pkAEc|NOjt2dplI7Ni(?tDZC&lEE z^*D(>>gNn~MLTZ3R%B$IEzr)Nq?D&LzSH8N2S4}>w5|)Ue=U6C&))r0d}z%xJ9nM>h|x< z_Vn22*5)qPU#is5tgA!1+NPW#+binz8zh2c-Zzsc8RrW3HrcZ857(+WdHXJBJx-aF zoTu=l<|wO6y>d{dmVTz4H?8uD`Zzomn3P{4Y&NKBmjc&`Pa)(}mb@P7mF@ZDydozb zXel{V(Iqi3ylU1XDbsNuDd!ToewLe8+#pBC@w{!;uhWa+#u0`_&+U$T*ulW}qWI7` z)Ms)GZQI3TM}N3Gkr+Yygr5Xb9%swsDKe}4}XXhMBm}o!Vy0_*^*!9d>B4{v@rF%d((SU-0^zZ0df=*gxNxwVBwZO(ww{f|0C~i+(Mlu5N z^jC}8<;9nv#pIGxj9Ytp`@N-OM>gFW!Kz{=Tf3v}cvB6fsKyKk#jO%W=pV(1;0gO% zTSi%da-Y$%o(hBdlpl>~>!sAmhe&s9ZWz$)y!P~{P>2=Q(QnxXljHtEmCI?<5|IN zwD3o5j^O0iK|?r?S>6(?ipn_LJTn>}G)X)7Rk z*0jl+#4ps>WlmP6PjUevzgA0b_Y!>%_iSpp4qESxub<%PclbTq@dI`yE}U+vo*&JQ zwcT?`hK}@Bze!K9j{S}XB=58 literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapsgd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapsgd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..c9557e38fcbc10fc69887a2e6d0969f5e0cc58c0 GIT binary patch literal 11469 zcmeI2378y36~|xq%m#LV1PCF4gd7ACLYVGN7LX7i$A*L>fi(#M60V-^+S$(bbPwG< zyV-zXfPf&U1VK>_Pw+rNKok^3L=X@`4#g7?0YT(cIW+!Xb}Gb^2;b+Yz2D4l z>UvfEs_IqMt0mf7*`8)7^?zAqyo`I09;C106QysU_0&xz^66wMl1C18)s^i;xV0iJ zM<>a@97TWiwQ$Z^brLwwzKGkMCRb8gA+z>x*P41Fxf3h-In1)hSH)2DjNi~S0kJee zA?*#6Knxb0A~=5UIESox!zX9FKybJ+c|!5(>~ShUAG-VA0krr zX_}$z2hQN~3Juf1{fUO{3C;$mf(L+;!2^l5m;fGxFmnz#wrMWSCmO$F(>$is2RLj* zQyU$O_{B{Nm@*z5wiU`P1k>OmPyr7C-%YnFhk|c{hk>txhl4MIi@|5XCE!!w5#W>H zk>C?xJNPL0VelbvDfj@m47>+i4&DVG1>OO!0B-@025$h50j~#-h2E}BucTE(XK#ys z1xH_=K8}tjI)}sHuuGBe1n@%eMDRQidTUw_8bs?yAYTp~PNvlR>a;~7et!_-q*dvF zUOLiw{9?WE7^CfSC~u>_mEdZk?T(7%uGD62hYoL3%lUQw&gUYYJul zIsN4CfxL|y*HAC=ZH3l=%D%|AR+c-3PDMRj4n(~lq09zzK*y6C4Mg1?~)%+j%zRsdNr~4Dq874Cw=J^)^h_qiLqLWVy@ zpNaeD)99bo=_@%b$1S*SOUV5!^7W)#Uxj{IudgA@85Xp1=PKO^1 z5AFatydIB2nC;Mxs4oS(IvPxaV-TN5zMVh|+!;Ix919)?jssVLn0(4HAm*jC$9Tyx zOO=VrB!szt!7&FZyDF2BkH-s$@NUZPN;Fx)6!R^_m>4Ha(2@zXhyN<2>#9nhHK@#HJUFBE8FASp+FW4=SKN> z<=`jPO*^T&T2y`2R=ZV04OM|K|MJ0t>Zv)TI5KuIe&rC)X}w5o!!J|qL|TB5iM$0> zLtGJmTtZWiK*&Y>5*ZulKB@XBnwBZj6s|pa4>u_JP7r#&kr$d+6ACx5JvVC_W+%T5 z(f0hM7k#_i2!$>}Q}6VGFo?9M6OHPV9tgkNHbuY*L_6|VP5Gklg`Vj-QHGIy(~ThL zvHI4V_q|e)F!K3HH7WXO4OPgm?&6b&LM(Nn+79IjwF4if3$;b+t5tPB%52s>%5)O6 z%G$M|^KjazhE>;!tna-AsJI()xB*M?$wxAyzMY-Tw#=HhQh%Bg~Sh5WaBHBYM*Biw-_gD>`-%YACN% z`lp}rZ9EhLeUb2%Rd?+1aX%cb=#ReN%E(h@B`c#%j`X7JSR21xD5h6-rLJF0_)$RT zX#Gxz+KI-K#lfG4;u=cv)ZvmrB<_9h-TjozbfwV?p?l*8D-J)YH|W20yuWvA^-655 zUdD?b%x~XleD*)SG17~M3sV;Kx@I)eSrE|y_%t5xp4(yPOTH1Jbi40$U@`@IdnxDG z=AmwfC#4Y0Wj1P8Ja3XIw?xj%MIs0dC#*DSi0_vxIgSWzH|H6?RS||JVY%febxOlY z`5!cn4rN5WaYO@lQloZ^RQ08b{wC>XeNYW5QO2!r(9qY~#V`_i7zQ0iq6Z5}nOT^d zXpJqKk33Q}X;ku?V?elT*cu%YFAJVr7^)VZ%@IDRwdYnPb3Lq+{UD*Nj}?Ii*l!i$>TP?f5*`fm>h~$g3(JZwbX32nvmy6K$f9XD&Vs?M1a6 z(-t{i&Ty)tDpPy}#MJA9MMv*d3Vc22G<-o@%6uGl>>PfNk>T<_j@NlBr-ybyto2-O zbhl#f|m_M2-BVq%57&=&K;UQD{YdSJ;)g1 ze$lq#*32JTJ4~#q(JnN8sX0TF<9PWzRFi0?bs#zMI$ZR6gpbmiW0YL8)7pKYa_#NQ zVI^>o;fzF6`K!@-Uo}}dYwfuv*;lu-@x%Ij*#GyPh&77Ovfq} zj{1><9b*U!Yny>)<+4470}-1qC+I9d&VY7*!1k>6O1>-G1aSlpC_ky&8gBO*pOE`G zF*M6vk#uh~^Cm(qVO!yVyu}FOtp)GS7GRUngB*OgGq5!otcT?0_{?!r)PCBJ*{GlT zo{RM`U$QMNXS*mmNtJ?9V^#eMMSp_ywVR=k|G`b@Y$c=dCUjNbP3Vev6S{nJHlgjx z(9Z;$awYZSJgVP8)1-z3Vp*Aoxm`O~ZB#v_7#sJd^NA=2?6W(gLGH zWD8!m&;sGgp_aT~F)XYh+FO>UlqUPh!g|vUt2CZ)o(z{WmaY+yz87Vk<+)`zA%N|Eh0TZ-oB*IWM652 zwkW`g=weOGVQpNaXL&Zli9DT}p>)~*e4G)HpK2l8UWdA&$n$adDERc-99y^{?Nig9 ze(aU)b=hIIgc4a(76IVVkKP*BW&A_dbGYbThKmPLB^*g?6pM}#c6fdvi-T18c*Vu| z;d$GSKFa6zvZ5`KE9KF%R=j;DLzbr0D$=2%38e2R6~7R^izRB7eJV$)^P(T@v)~Js zE;SpubJT#-*}oI2+1c!$H`eNlDKm%EtiFO&lNA|cmT?uh65%H`4JE2?WCGmR@GXsr zD+qQ*^HoFuiCXOGWj_M(`(h||7Btrj?T+|ld7=r$^PJ*m2mVSFVC3_@$m43JY$qqz zrbl~SX^ymIcA*5#3K^2sCUQCrH!tU}9}D7fpCtFw&js8IWF61zDit-yGYu!}!fQk9 zpTLu9CcTN?+{i;qJ_C-MYI%9-{)hy|&SWM>dA$=pyAg`BV~VQEGw?5w*_>+n4{ zjGVH8^lhO_Yc9m(eOU4y($~QmM6CE}_3c27n1N*(R&DJR>AOmv;hV6w@qA9=Sp^05 zO{^)JTJ>Gd@Y?$F!ixq#T|5@zC|<6ciQIz0O0oEOUvZjixZz{38T=*EYtA)9_k>9~ zczEKYS3KV2`MNqC9wj>mkDGO3^;`(%&ghn1wOehwBV})T+C+9Ikss%G;7*8UmYlaq zIxLp(xy$hqzK6TBpc0b|2W|qdD^=stDv7Ym^?LC3P>W_@*mR@&h_9 zf0g@Ma{@M_Wf_sGeeOZX8e1zb+T7*i%LVS_+VtA{0?P;uyjHhu2@IF==;ji{^DI$= z9hO|YJDX`%g!InJZ1wltH5s{u>~E|RWOhg|8Z^RF2uV9_BHc1D?OdX|@fVtAq_Dd8 z=IK=`@-baAi|9?Ot{j>Ym6PjE&HlzOxjKdc3UO1U{jEvIK3b2RMS9?wU7U;XzgO}} zttWjJ>H7?BscnguS`ABWO0GM#_mMglmI9Uq9qWyOqb=V~cVcnKVi%wnC}ZJ1V{D72 zuc3^`H3nF~u|Dx`n*CTwe{H&(qh`nJ??{W`my`cy=-N@vLBfxMESrW(d%&{p1S#q^&yIv``@HqHYo5<_Q{X?_9%Z{J5VyYr{o;+{~i)~ ztQUDw+aGC3^x*rY{C_F3{jLZ#$9B6k!?NQ21g|%V-17diOZcvEG;EB0A4Vc;7E3%U F{|y-Omq`Es literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nfcd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nfcd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..d8b616b8abcb1d574d71d8ed3163ec0475957105 GIT binary patch literal 7341 zcmeHMd6*nU6@T5s26n&zhLB)jlRzW{oUSF2V+lt#7X%WsNdN;Vp{KiMrrDnEw!3F` zHwd^$K!XU18U;_{Es7U-pvD6g6$SB#qEYZb5lzERfFWTnQye4N1HrxMB059t&(VW|qXPUXQ@#{%jDR~Z^qd3%a zdu|RmG+RsPmk=FKd+@q7w};!OrtQaW&5hAZiDujYJdxww@ZJPFAB1;A^7Cj;xi zQy}jFUzX|>(0+B!V7(qYCtCX*?FMx!k+vqcn-&t~S3z$P=oLW7Pgx2)4R|i_bl_s( z8Nf4uXA&K}2-pXj@hqUoEv9qO&&j#78P)iJQ%=a8OG{M$=P{~w;FQ_W>j%yRE(J~p zE(0C`Tn_98t^jrcR|5CxV{|_7S>Of0y}(t#-M|Zh&j2q1J_TG2d=j_@xC{6S;N!rx zh|6R80Iegs=@7&pIO8FGJ#8SmnQ7pZ2O)Pca0l=b-~&L!qw9X)D~Yxo47rWKDRddP z_uQplPFJMk0%AVL=v8RnroS5h;_>pDpd;^q{wCmUz^i~;fhNxrun78EAnc8H;k_kA zNpze>C8lQt;5XX$hl9{Nh+HLKo*fo)A!H_a4m2%a1Gk80bU4vE${+h!_VtrPp9i?6z%(wowFZ&mYf3)5wfNOyt2Cf5s1jzCK zDD3Xr_c8i-I*&j#kDpNUcn^IN;rxScslT#zyk1F@cSg-gTOh!Zv%P0zXN`c_FZ~d&GSR_z0_Zz+Hc=S`!@Xt z=!wViFeCi?Aw8P%f28ytVOot7sLj-VOg~Nek1767m{xqCb`<*m8Srr6&w;$2cOvdN ztg2rC4+8!Y?T3N?IItV|D_|G!*FX)p3rN7<0RIKA8vFYRqM6Uqlk~fEyg<;ur$40Q z2G0BkJw<<1?N8C4(l`Ji_h+`F;?}VD7tp*eo&oZH{wt8@;cq}*N4w!h7x4pkQdB_w z+79gr?J9jxujzN|_v(-6>vPPR!!OIP8fFl^20%x=5dXaYY{k6@f+i+o1v)sMaPw5 zqvhLjY0YutfzY>W7RJg?Udb<)b?N$n3~4dwEWDAlY6$3vA%`s)#E$P7B^Zkgvl#hq zEtZAAj4Mgxea{`i@@v;mr$!FLP;3@mo*MNm;de8BEq-QWmn9iW4-pr}`L16y-GQ*# zWCX4g#V~O=ex31P)5*AMQ7EE{8A>`t$uaFZIMryTqFdu+7e(w;oxH-i5uw{UFd-x>W*I5O+D5nX#Q6STm$s*E2Guc=ja1ym3j$3Mo+i!jv!aneZ2?^ zE@**PA1wy-0{n5C(Jg9}_Xv&L;6N!}Fn!Xl+fA;9P7$55TO;UVHM%IPu1$Rit_g4$ z3vj9g2W<4@vdjz9$pj<%-*mK0jWNPNVD>QSO>a_u31%&0WgN&TS3{7O@ux5TC#w zlA-ID4cDxBR>hwGTzW0ZlSSLlr!4<2(wR%Sf-YiB>?Gk$8j$}dpBFUwOm@Uf9_sxZ zIO3n$M5l~Oi#|AmNT5Cr06vA92hMalU>$XspA6@g=SP)F9Sb}Whjk@Qr^GJk`(I!yTbq#k^m;k9VvY_01;^bn5G z7zIUeN^hT8LPdhrlF|8DsvgezYn0?cjFM12Y95hSdRpzKMk8@7&FbyTPeawsa+#g+ zeuvVMPF*JFGwhvCVj;oPiB9zhRe*;v6tTpIMS<9Dkw1mH5ya!!tA4&iB(7i!QbSV{$eN}tX1Gn-$kpAC&88Yg8O`ff`n z5IKtF*86_E+^?FB*UkiM2J@Aji{uDQg|c0Q3zxt(ifoo*|JzGV};m_Lfur_l)HiiLOq+r(P{!$>Kjn=7Px3!tM@1W;8M#}Ii--4lzPPc zGG-vw3yXXE`Y$&(i`A4rkMx4L6iJ3BB+75#E^y`IC$|6^E#)v0RYfHy3)LzY-&|Bj zT(zc^8s9gF$BQLhsT!UiJEe5!n=DKq?=^l@e6s+U<#H&?xcW8n#tAHx@sr%3(uA?W zsn!r#sVLQLCRZ`Nvf9^SYKZqw#-3okR8ij)T;Ct81%~Terd#lEyHocVsOGv!bkW{@ zyhPRWoa?XEURhm}5`(G!RL0C9B+A55zW=neL!z35%NPzUu+;v@^qS>H;DV33qbx%u zIk(-;0GB0eOwTOKDxz;#$y!hAjm(~f1#F{MwpE_Z+N(;{hFVrk8n{_=HHmsnRg>If zazD@X>}Cp2=Rws&t^6nsog!|m_NLY~5-mBkzKHG3<5wmhsf+mjms7GI$H^ywVN+^7 zXMAJ?8FFQeL4-c;v{ADKWA&uPJl5-oC&y^e^M^3{G6G;iu8ssn^dc6{?7LAq?%wux zj&tL~h2ch=rW!VqP$#oUG^<@N`Djp1i*8JL$2_&y(Y6_z7*^e}W!OF(mH#p~ow(*< z?3}(h5bEO#cRcQUO`9OE$jDL{H`8w)!Bfc>>D@N^G~o-Mk`n?f8DBBOfj(OyJI%|&G$Bjdp@6pUZ3%|_$1NX1-9da5QX)(~S qulBEpj|Hyd4H~9xr{~myHt|ONGblq(x&{ijFvKP+SV4_f^}hjDD0QR& literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nlcd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nlcd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..9fa78205fb7fe1b2ce9d21fd71f411f6b1af7f03 GIT binary patch literal 5117 zcmbW5Ym^*C6~}M)vI|)yf-!7jFbN?LW1Q}Vkmv@GEDIZ>Sy@?$5j3%;yJn`dJzY(8 z_v~&Eam55BzVU(Ys1YCde&Q2UG>Jz)@WFHNc>LheqhItK{ovz^XZ_#mo|&HA4MBU( z^l$3cty@*MZr!R~qF>MjbZW`xr}SMTJ4#1s2H#xcPKxODbckL{chK$h8rn~{EowQ1 z@|liof?jSu6O?}z_rsc%j&`^91(0o~%R4n^V6*qL33c6m@|GJr`dsGP^(8IJpY=!V z4Up0X%V^MZi7unlM4M*p(=1Xg{Cp*B`LAmhH`- zkJ2_GYt%kPF9fg8?F{S!9ioAqpbKsXhd~#-is<}p;MFKIw}V^kYiK9zZ?bnV&3M6q zb@q#B#Ps`OrjdgKLuj`Pya>D&yb!z&ya2o&w7{2u|FO={4dB1P-QeHBQSh(ejo_ca zG4K!IO_=X*t($3_=-2@K1r9x7?V*4`^dQ>5is<48a(nZAkl#sU_-dl(S#*HQ zL&s3xmYogq(8{jlpgFFO1un7vVJw9dZ#AZBfr!CjeJ7^`;D*TedFDI>x%VwRyq5aT@e=&|( znk&WuqI`tzLYe&mnz(xd2b=)k1dfCArhG5G+0@^Q{myay7N+SJ zH1jzI@_gyD&cXBZw~FP46}RyoYJ} z0j+J;1N43)e;?DxL2DD*eE?hweh^#@J_xP?KLlP3ei&Q{egy0XKWh3pLmxxGg!0G1 zf5Q)-0NIZxp!ZMuBt2yO{3-f$(I05y@+9OZtk0kYkK-XG*5|YIg`)m*rrqbcY{m&% zf1`)#%SHVcP5qa+Z0bSlFR=0z@Xz2^L5_>B!EYSjUkA?vzXAClQU6Ww_u#j{-+|u- ze*=C8d=h*F{56PpF#FgJPmx9aCZAgP#ZUew+F`YJzD3fhQBL zAi9KKJ?&$yQst>IS6H>QUL?tkzqH@FR#}WQ19Nt#=8{x4-F-n-3q9vf=EED;qA6#T zo`z|j*Al&w!j-1JJ+GF~Zc|l*P`U>^<;xqhAWSE<@-q)}(#WSj;na%wP^IHH=UFiT}67HK2*yoy3j8@=s|rIE8Rl!|J|OJknh{ORRmP|vhrufV0oFYaVk4Fhj)R8wfr&u)G_)jY?9 z*T59JAw6N%YmZD)5vHAa-h3`QCFhikRkJXZX%JPF(0<1lY|XPhqQ1Lmt?k;et?j^W z*}_h3i8BAv-~<@qTZh!QH`dm_ zk|1P3fJW(7v&FXaD4vFYVl^XmsOnBAvdC-rTh7(41y`!4X?358|EZ{O8 zj_=&QkjbH8lRvuiDB{{lL`_zjswJI7M!0;G`-{`&EYUSAL>xFK4t%Ut%XZ!Mgg{8` zIXm7qJR)jXDy&<#Jh;x}zixl+6db2W0p{79qi=oLZecWWFQs+EBZI4uWm&IlXX&`L z^kmSIW6>Mppb*R`zU2sXiqs>^%pZ6jKt!?>Uu;<)ZsFSCwK6I|5)JAG0!>UqHM2jj;q{Y(f&eacR+Ei7$?U=N!}EZs7v1~A1)4V7JRxOf1A^V zTjckXu01~x^#~W3z$@&U{8+9}QXN!rV*7{6Ym@B0s%28}W;WW@Ps~N+?8}Jj?{fM` z(Di(!O&oRYVTVY~CnYAK70&deBf(rF>2V#K1QG;i$SB#U{^IbMv_^cS_mP;y6`_3t_NbQZY?8#Lms_#W7MuH#&Ei^JPZl!rfQ z`8l4W?5t zrpLxh*O}31jt{clgJswM*-!iLC9|I*nL1$*O*_K(i+sJc$8P(4o|Zb2p@WNs)(HBF J7iS!0{{@aBG}QnA literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nointernet.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nointernet.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..59ca3c5a1e24ccaf2ce8e538b9a7383be4866440 GIT binary patch literal 864 zcmbtQO;5r=5PhA-M0@vOh~fvRi0l*;6a*3B>P6!ZC@l$uuLerx>cNwL+9_R02#Jxf zb9nn^cHVng;29nwxI zwf7f`P8unk;dnVs;%Iqa*V&|l_A zLd0Dfi;WU#Uuqymil)LwV%L`0obAYh*izWD%s+z;WN#*$E_G!)m$1t`gykVlJBKxn a9H*k{Qa{RF)p<(b!vDhLbeOD!0e%3|CUZdm literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlsessiond.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlsessiond.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..182d0dd1a86c27c92caf9435b8045936dea814f6 GIT binary patch literal 10581 zcmd6t3z*zg6~|99v!$KVmQtXFJ}FQrWs(Kjg;J0%Tedt}Sh_qaubN5j&W6n-W0IM6 zixnzTKzRtLAc6>@h=7PFD)JBzQ4~-?6jXeH4^R{p6cp?K++-%1*_~ZV`TWd&Grzg7 zbMHO(+}Ftx9iU92g-Y{ZyE0S8JxY(#SMZ6_Z={dYMRXxuKG=JsT$? z)Ip>?ndQFGn8#4=K%y}ZgNwoY!GplNz$M@v;KAUn;342m;5)z@z(c|7z@^|dU?+GL zco=vE*adR`mVuWcd^mU!*bSZ!E(gyAj{wgGj|4Y>M}h0XqrnQe0xW|o!4h~3cm{YZ zXn{ST0UigQ3a$cIgT3JK;PK!}@C4}R@a&0n649m!7$0!zlI&`FC((Hv2FDzLd?$nZ zfv12Pcq+Jec9C)#xF^D=gS&xiz&YT%z!{)Hw9PcIfH2bpcgR}QM>K0vRxqVqfMdpH zi)17I#cV%Q#)D(BD0c?Z|F z`Kn0n#vIabB$C`nG*hAX(fg6_BBY;#_;HYeFyhZ84P%=z%cnQ zhP=(2FQE@1-!_mBDh1@bRF=DpE=N6F4n(~lrjH`L6>H1rgpj2DAQCGW`bnG~)M0 zJc#yuM)r%_QKEsN5#y-A-SS z_1sQhM0^|c0V=Pl9m*Y2UWf7}@MVO*3_cIuiF{e)gI%CKU!||b`T-HXi@uI9j}xd| zg8X-b7lQYIo4|WP?$3R)-fz(TahS>de*k2CJSfw@N#BaY55?&S&*XMKEYmxbZzKLJ z$o&quN&PN80$vC{D(A=dn6m$%QbE4Q(Ebd{KaTKe2!9`8UVnc8c?vy2Ka_HxpeJK} zfJztg{Rlh=dKLsa%KLf{rKL=T_&w{hjzh8i?*I$CH z*I$7=KEFo2yw3kdw&yweZEQEsBcA62!pfsqeSZf&1pXepAN&J&ANT@z5BMT@7x+i; zcJNP-a|`$qcmw!nknQF#NWWfrnO>Fl@>lv>tS?Z`=fBJO{0eGjJ-*6B`~N|&$Lar+ z2yD-_ zG+!8&=Q@MPGH4EU8wkZNmAliw)8p@Y_FZ4{$i84$Xnr;Na zT5D*%Mc=EG>0snn>hh|Fua~@n?FfB^UGNQmQ19~GKD$`)jSvdy@x4AI26|7W;MnGo zZlA~X;aSRGBg$b_26{3yD`h>)MGzWJsFfW%2qEI|(d6{_qEGn3g+@}s3Kho@q3sqt z!?)_fAnPoaN0b?)omE{etG;ThRn<^KRUpj2e6XZ?Y5^&Zj9r0W1;lgOAX0lkq4wd! zbX61I0pd-RDybUsmGQ@AH5tdbO88iiW5@v|+6|2uMbF-VErMNTzTUwg6s7tY^hD;; z?HeVr*7FB2)NGH6-jpwuf$e+P`c|8sB@V0DPKd#@Dkf}?pPbCUOjL#Am4#1B5KhJ_ z5M~7iJcy}biZWY*Chb5o3W4WTLXj^UVZWRS`DlX8Y%Cv76|oM2LZjeBlL~p3;xnS% zq{mxZ?sx^mNk!F%dJ@Dm>w`r{{i+1M9`qZ&ps_L^haJ0s-_vBcHXqskt%4rfC9&Rf zxseCq^QPOED6CYoXr5nhq5QIns7YV}MAc{+%#;=VzAZ52E|{nbV>e)mE=FzRL>2u zcHHW=FGJ?Ow~g!1@cnV4{?zx*jd4HD9I+oOF%eySigLG`({iV5 z++T;;H^=D?CMRTDg>&an{CjSaPnKIz*0NarIy@KwX@4fy&>MIY-qqs$Ny}hejNLM#XN`YG0vT z|Nr-DKUK+1Os)3wl-$m5`)dEcIVHB-AJY?HOZLjQa|t<1jh2uNY>Fq~GvdCt!Yc-P zmv039t3=uJL*eVoY@_JnR%4qoF*y}Atln(qLORp@hJJ6n(%&sR((-<>l1~HrGH_BD2`|@VTce*aMTRjG`A@t1g1L_*=D2H(EBeio>du9Pd8h>q>94VDyQ6$*T%25U#~Vl6IBD(mJAr9Eow#4xD=Ncv@bULuth`Z zNjNuM`X`e5YA%v;$UYZ-c8`#mm6jU|4fGi_y?t?R3cMhkFOf5}-M%n|T@?h6I6s+7 zx5A!=IggAqclqMsQ_jZxN-77tbRSWfW~3a<^1bppI78p>4ux;NH-KkzP6tLA5xcN3pb=is3g(r zF!S7o8zRhCP$F;2A^5D#!%U=vBb~clc8svk^GkVn!Qds5hkq{1 z56_#V{`$Dq{0lXMu|%O#goRo)M}Z+rQ|1)Xp`zKO?<5DjTkTa>s(IcjkHtk+{=nH0 ziZU_b^KyB`Qo-p(Xf9OqOZaMQtk+ji?od+m`iZ2PtjHkO%T>Sy$4_QHO4OHf?8>~x zu&>92ABeq3><~3HT4@79aPGEuG7piM$>94ho(g3n%dLV zxe6PL@O$CBmIlE7%2a#N>&Ph|YhC(BQ|ZxJQXVU{Ub|GmiXvo4PPasX{f1kV`=%d{ zH}6|X@-XXL3HQ6a<9P#>vgUZE;pAO-Rf+wFcrxQiZ=+W>^O7o`QP<0~yrOhZMgrsV zt?fRwIKl-Uibg|e9>2O@$FNE^#;(NrchLL_TADv7UOx62MpDq1$AfTn)* z@U=Yh?37^W8k83L9?nrs{owxcT46P{Yk6;P7gFN=GO6D%O}Gm}oEq&*dro)>F04O4xsx?+pmQlc(&A#(dF1A$lK`dJ7f5KT6tNbK5lc zKNu{PL$4HAP5Vuyp1}3tY0_J5!dOjuM~$Uu8`I26*~6|r7>#e!yieuhRcgpS61}kK zYS_+dM_$<;x%njh8!mruSL}RSB`}u_yshFl6I^=aa?6hCZKzn*w_x;gJv}`r$7bdT zziB@iu6=Rq_~n>isvUmz7`-0YGNxa=j>+>x!~FvHG(C1k>49es$mZjJPUMq0m-NM? zFM4xF$M*Q>sNv|Ck>{x97h@p~J9ra-^OFHbKELwn$6+Ur)45)voCQZ6AAQ$R&f^*b z97u8AVvim7GZ}`~+hWx0_&nL70OwiUAg^YgsrOLwwT_ifyqf8^Q24hp7BbM)opR50 zx`UlV4yN)xm9(S8dni9m`yIcRk?~FQhSwYEFPHCU6FF)BcdK&JUoX$qNx269B^PW; zZ@5TsI{U4Y;%{D0wfEBU{Djp+b8L4&Gb}4Uug-6fTRX2~)pCWS;R5OVIOOEba)nP7 F{{@EZ2S)$^ literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlstoraged.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlstoraged.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..8d666a6b6da3e4bf11318489f62d13a0ccb41d59 GIT binary patch literal 6565 zcmbW5e~=tS702Jql3*^#uLzfra5+N)#IQ3*kmx~#92YOf{NT(9i6F+=nZDieW@jeT zGn>1hNYDfkLBSvR162HpKcXlqYBVAkqktktQKO*AS(KJlYDrQ4VQKunp4pwFQCH{K2Ot=D(`l>oyPG^C3e%>D503PQAh##G(vA`t64^R zypdOc4fJgKC@3l z$wH#p-PDZ|dZDf)smm-Z;`Bl-O`k=yn2r!Fx}b1`^H0w5I~NyNGcD)_&j%NPOTkX? zB}AR4fXhIZy8!vK3q_Xino%&C_3u0psU9NjulixSkf`I&`Zz5Ip9L>M{$cQ?;L{-L z&pZUK0G|S11|9@o4n6_)5}o)McnQ+XOTh#BO1cc~KCHijsm2A)+^b(seX2jJm?|Hf z`5@|D0p1VxgL}Z$;C%(*dIadNyv?q{aEh_y^x-GNUt;&w?;Y)u4)6eYC&>MLuNvq3=>6F^K{d_~sBzv!AI!!HqU#@`k0^isFjKV$YIkaP(??bQ zJxrAkYPUfD$G{uGk7xb57wPMf{sg!U{G`%5PM<>B(>_g~fm{XoptcqKEVu={4;%zP z2d)7>5B7s!051c-2=;<|z!l(^z>B~ygKWS1K@)4!Yf?LH>j{T@A>l|Q8FeV^0HKA_g2 zJwiXs%738B_j6j6gW62AdjQnHAA#&IKgN8q-#-eT06vEN|Dd(U!GD220sjg96nqYR z0{jQ~Gw^R9{6ejppA*gf3mv3iAfLw%BK=ExDjPqD^sngGnH|8n&(b0Kjmkenzs>9d zLhg6U-*{f@`k#Sb_OIWAyl(ygvL7BMjb;!(8a^o%=x*(x_Kfx??IeAk-m5>ScXPHK zR1GT(J;Cpyw0x%&j2e-!oZ|M#jj>y>`Hv+>r*pX(MsCfDg(+g&tOPQaY3nA@857E- zh-$7aBo`2!$*-3BVHCuH9eAn0oQdU@l-r$&?Uth;32{vzj78O4@0KDf8Z!se z?hQm%RcsHU5vb;IO^|C6I9HX|$5pc;vl^6KPncWmz!6s@t``qRfs@!6D?c4dezm9x zF9=1%Cs&hsrLYqibj%Q=wg_W4@Qq<8lZI82ftSRh7+P^9wS3@v*apvTt)ESe7=@zP zDtSCL>RH9_hW(oQnU7rzi%9sexM{5Mf|BJ8MvW{Z^jsN3#VPo<+k;i7<4R;?%8C^U z#8@oHY0oX;_gs~3wv$sbW49`H1U`52q-J^UKGOWO&THQ9ZZ4c`Jbmy}*S6SpZ1JwC zAWcaZRlhFtXlAm$Ox4i(W(i0Hdww@7EX7QmFjbU4EtR&K~I=l*~}N( zMiH|I4#gOWj9pu1Gl0mcZQPUB_tW}Led78j)XV&IviZ-uu|YX=pOhj_HSs#ki(wlP zOXZKOAI~CuwT2z@`D&~&rAu;z)i#df>d$6T8VC~KQS)0L8>>18-($Ah9|R+=kSnK` z^M~DX5~&ujbk+JZ2a^)KYOOyUaASB@@#|RQ?6>R+mQrr3)Rb$4j4dxSCRF^Nb|@vD zCt}wx1y*(G3AaaF1j4#vI zZM-Gqs(PT8put1hL~ei_1NB0DIM0}6dek8ZnVjLGQoK}c<>#Rj`PhA#M4pU;2rCAA zTP%Eu^;xvpMykKW^ODQ|FZ*D60-cKbt@9sOL*&h3^`;|grVo=LY;B~SII?U}5gu>D zO>#R#gh`&=kc+UV236jlQax}D&fqj2-uKdcOUSJ~>Ridkk?nVew1!2o8q|a#h3{~c zykB8l9VNc`@Pj)O&zl3=)^yYCB1~MYkLlsEo?dGhriGpJbjN&kF6QmkkLEDO(V(8i zDGFW9dNZZcTtM@CdOPOe^kunR&%}O5!WM2#sCj~DVFj7XX>y-{6R>wV@SH#&HH*aE zHanKlEEtRT2jV?ir0Zb-$J<&z7G*y6uELq$@43Q{aZ7IQ&m{ifVmZgf1T~7bssdm; zV)guV@=LX|PK*t~^F)(!6tRVAJOha<^}h56)(Q+|>mzy*YbU^Blw4kh*6- z6)RQ44`O#XJ1)1{Fg&jXeqO|{+yGX&9EmbQH|4x2;{CR%e3J-+DDICeSuuv(Y68m& zl~T>-dMcJ*R_iXx6tUmu#goi)6?;U{!{(iYh8NhDSM(8`sW=2x3$w_aLC+s$*HX{4 ze$%Y4tiqgBVOD<*v#CR4)i4gK(rL3tBI^ZH)XN;j;W)ENA2e4}GaGgi2JpHuV>Cpt z!|~DNa;jLZ&!+M;a77H0pH)VED`QRkk4m$?$>fLnvmj%WfQ>CgtsHqyUvKrsp_YcZ z2LA&zU3-IrgB)~40gkSyXL|XpcYNqZRdpPr&XVct*~%)Jf3@99d?AJ8v!|+}w&anWI=*~n+Qh5q%H?#0tNkM{=MhI7Gh+}@fIEO} z!2k zk{Vi_e=YH8l=vpx0F}6@iT5HduVQU)5;BAzWCsDqRZacIwL(VNu4uu8e7>$22yV0c z3YX*I`)O;OjJVA7ti-n~jwu6sgawFhO;OlIW-pl+A75zElZ6%rLW_brXWIkb7>8kq zFvY_mnW(_Fg2S+gsK=~Qhl9X%eve^}Qb)ioN}R$tk2!+neI}o-sog2&*R)hX`9CSR%xYbu}Vw--p!@P11j?zOBBZ{#t!meMx;$ zeL?-DdZerDZN|gu(<+f5B_2?Ju74g-$xl{G@}J}!%Sn)wvxz%ay}X^Wn>KX+98FqQ zkCZu5y{w&I!jgIzG0W3fl{^a%pnWTpS~#c%Nl}Xmy1i<7JpXVBuP~DEOO!f7-EOGE zFP(oolGNhCiQUFgN-bUi3BNGSx2!&Yx3N;GCFAfIrIy){^kuJw#}U35mf-oY49|fk z+zN-_CU`u26+8i+2~UJ;;Ysk7@MO3eo&ryWe*jN{r$VW36&!-6!Q_%eJo{1V(o{O2L^`acKHQL6vb za69}IJQv;%&r@ptJ@9m0JFZ{)>cq9AW>h{grg71PAcoVeYbi)9{V(SMVD66nqnW5?%{`3f~NW1h0cXfNz1{h1bJx!MDOE;0^Gr z@NMuhcq9A*ya|2|z8yXU-vJ+he+ch|?}T^5cfmX0yW#EdJ@6y&z3?vD{XTdz;rGM$ zzz@K8z?1MY?w!;irW;K$)P z@QtA<4#NB3GRQobw*=m=)U}Jq_W*o>`lOz3&-6X0K9%Y-#9r+-9zxH5)AtwrCweY6 zP#yTIJ}u{fU%<~Ob->TyXQ}^(@NDr3f$i8tJY0J@HY> z4XDR-{xA2)|2N2c_SwhPSIM`4)U|DpO9;&&1cY0r=Jdr5m*@_#~l-1o2QXKBCxlzxAv@82Y>?F(GulmF-BbNX&G zo`e??{&(u>r#=6n6>gd!X@E;{O-9MdUt9_(8&opBVXup{|y7 zut4}$;?XX)cSo0@xSR?B6`hxEfv!K7aPmc^q1&z zhe}w#H#ANwzSI~@)0gY?6%y9z&^U$q4}-_U!|4ZE*I!0h#_b3wdUhlfJv$2C2aksL z!-TYl2UN)@^M0b=5c#HYJneY0e@Lj?0gXe7Cm1K`_!EUX z9vX{i*U7LCo&tYYVExx}SpNw>MR*mIaXStEgz#!8`gS_`MBiRP`wVr4@k&^LYls(p zgT{BsKMZAj*FqWJ5h&xk4t|~VGok3^ddi7jZXhgr`6?)Sxe-1}zO&#X@ND=X+yw6} zY&N#?{&x}H0`Gu?(c@8L8)4DoS3}Wb!nAYD*iQOK3+D)ze2DxK{(kXX;{w8>-{;X! zPZZCWulypwzv!t3Eh@G5vQ+zBs%HTW9n6m}S|Mb2voLt{I%;MuSO*Fqbf3LSVH zbm0m(4iAA2zEOsj3J&V}e2JC~E68{bI zh4AYzf{()(J_eicQ8)#^2$`SSPVZt8JYrmCOv8ua<;2T)!=;}zUT<8Hh9T*1Fs`J$ z=m}*0U1gw*OYcRV@L}Uxc7b52!Lh51t*K%0@HQ!~tn{=@k5c%&h-mBZo`me+9 zGu}^F>;|NLHya<&@i!YEBwp+YB>ooTLpuHzZO>A>ru*$9$d`HhQ7G%stx)FoZ3YXj zl81>7|{a7rROgcIT@{&CrkBDDr}OA}FZ))8sj-SH3t1t*Tpg zcg1d9N|bENoS(#^})n@?{wPaP<7%tq)jCAP*&vx0;%5#YP=_=m{gE+7QKgn>=%ycV?b~-cbt%gCfp%x~?RGep+Z%{8T zn1x0mEO>>ff>nqME@AmEgqvZV-zu?AVX!bttXml8S6DCD{Ef(0D+GlK5`4lYu>mn< z$~E|rxbgxsPy-W+NQv+$6t6sZ)~dTjZlX+uN~KxTRIv`BQ^ZLFw((m{WG1PrOQoSz z!xx%APy^pkWZpoApfJYYuw5uJl|c&%<^aoknf^1{{X1oaW-X|AzH4ssDxnolnVe=Uy=B#pR7#H|t6^gjQq1v!nG^&GVq+5R^>VY~UD~A1Qpli+?Ua7t z5xt#tJ`H23Hq-%(0)Wsqvs$cl0o{nj}50mhqd7x1PODU`J&ZWCXw{KiG$MN%nL}lAbwVHb8pr0Gg+?sUv+PRfy_N0?09koq!lhcsljM(%|isrkPZ6h=8YTq37A{CX{%+nc< zS?5R6L(Nc6z0oijXR{HRqk2i)SRW5$JbBj0pV{nRx-ZG*P`agXquBDZcbj9sSDL=> zve;Duiw$|ldT_P0OR3`Jv+m%Y$IYX!2HgDSkp>*buVIc&qr<@y1WNQoWD#vpR-Cg+lA zjuf`r(347!Z`rCuf!~bXQp1WT^a-Mr989|HTb)j9MzgB`uo+VjuSZ>P<8zedju z{uVbD%^QoE-%-roK7F<0_py9EDc_!RbDh6lP;=wZvpH_GWl0m(%xFjMywlk&**HzQ z)7_@vWyt9{Z`$XkfTNBZ-5~X0FRq={Ud(>t+tbmr$6-@WmmK))!en6r`uZ^1K6i51 zK8D83-tOeQH_Ar%Y%f;V=;o{975`7|Z*b0y_;EVV%e4FOy|r5!jMLya@@2!8&ew9b zZ)drWEwAo|CHx4xrq$71`LlfO{e8PY(h(wm*8WSDp~2QBEU}u2z0TT|-|w~ECAs}) zYq#f=S=Gc)==bZce^2|pR*9tD7Yb&xpEK6eo?9fZ9<#TxeC;SorgoXV;pE=Wt#g*2 zwEx}ya9&TbrRM9Qdtf<0>cBw>66LF$6ND8$FNPIt|+Fuf-jur9t#N-cPofMmp zr$ascJ;+K`SbST1J|W>!C=WYKi$M;i#IY)6}kH`&pP~RW?XH0PPyWV4?*_N znJWA~`>Dhsyg%i;?L%B^5GVF?AKIn%>Mz?AR3mdFw4#Y^t~f8;P)?TVVT#RtdYC$S zZ}n+8y-G?!r7llUY(59QXwUaqC;LcYePIiF9izu$1SShRn7FmH{_1n6f1fm z;f_t81ws=~p;_k$!gYH)?8KpEyA!UDeck|2^+jF)%Jtls>?i??Y^ia=C*@HKu&A0>E@3$%vMQiw0JRXF#l6V7BU!)Y1NA3f% z_h|QP>s;3wFbCgw6%BD(2Q*8UR>g~yNms8><{^3j*K_x>oRkb8aP80O6Iw$V9S6+17lJJS4Q#_S5l(AL}Be^A(x96 zn=2Z*(vhngy^Bm|mYg${ye}#}Q4`<0H=e%w4x0g#IVF$ozpMkSYBhALTwUo&K)USv zJ31(_f!Z9F$GlpTo^^FdSDVS1u^-DuHLDSocQx#C$C|5N*xjD08zcjhi;rBtXMBC!PU6L1-0@yx zYh^la>Ci4o=gGBO%*aR(gpOC&jB+XhRF$DT)eUoiNk<( zLeGn=yc~u?@xM6wf;sI&J&F`b*Jx?ia`}^$6Fo_Rc^ zfyv1^86c)0Ez2%=S4yF*{s@axuO$|vX18pJodf2Nz+iJwk&`mEm@_L)KtCcTkhBg)@*AH1f%tIsKxGC?) zv&VdBDbuKBzLngo^n4%gpR7qY6u)WD^mJttB@$sdy~x_7Z^P(-Mi6=Q$wA%nI2DxH zH+gPu++@DvN0q|KLX%r(Djsg;IGA)9GX3Pz+m4B3Hmbb+lJdG-u03rBg5Eb|l161?whiF4Y6A|J2@*cTg2RJn1ArfZEjs6|e0+?(wLk;9WOmu}4R-wV-0 zwPagUwwsNBUEZ|r?)*C3kxxb=-G68On_Mt(tm`=LwvHgWJtxZF+4GN$q)y>&+&oQK z>0SNa%dOio)>W~tPwqSSQs3z4DCJ~XWW~tsS9-lq+B&&>3TrL>J#z2$uq@FliMr<3 zcP`-*GhWl)_AsxX*}Yl%Un^g^yWS+)Nvdl58eml9i4mOXwC6cdPtAxZb!0s?|Ivtp9g9FWTK0xJ?~HO!^$@t?Hvp6 z+Oa>$*=wii#*_76r|&x4VU#T{Zl^eiDYdA(y?$y&^7~b>EqKr&78 z>qv4*z%fc+E;3begon+;R<=NifFoxI45{bE-}nW?$`v^_4@ zFfwCHY9DY&RH9Cugr|N-_bo9qjUZh0VH&8c;~y zrzn4T<|jz@aWnGQnDg7*sKLH9T_?q#)iK|(>QN|mDsP_?yDDz-^xi40N1yw;>cJmo z`c{)w%`qc!UF#>ir!iM4^W=SV6%3`Wf-J&{-3i*UZnqt^$&0RhPUT=S_X>>2NF3 z`fRWBmNxD0$&vLP*JH!=>ERg;gxtPoOUJ#WZfb5_7Xu;J8Z+A8d4DGbbL(j9J}!UW znC<&QUBAAE%sRH$Ii|<=c{BFOz00NF+et;aeL>gvbCRyl@mV|c_i#PR4R?OuCh0l9 zLdSQClA3-mo5}688#+C=e`xP(d&KKANp3tlznj{VJiSBC*<-%@(b@C<6%;7_o+nAp z?{C`s(A>GN*ByzLkZbQq$M-loJvT00-`7ZnTzTwY`+FH(KG#p}bv!qo`a41?a2mha zaP0fMOF!?<_ecBtR^7i?L#{UKlV!_sl4FIE^K@2U%YVnNw(k069J*o15u{`{n)p)G F{{gF5Zt4I4 literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/pfd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/pfd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..333abce37efc1dd1b9839536e56ba364480137ae GIT binary patch literal 5133 zcmbW5YmgjO6~|BakcEs2^2#PAY(hxDHBR>i2xcLgEDIYVSy@?$5Y*7qeP^bfp1#fP z?%CZ0#UKd^KJbkXd`F2-d_VDl_#j!zD$BC0Qmgo2m6l)lK>304!}>qBduDoeHw5je z>EGOQ&pr3vbI(2Z?h-vkXVHlzpI_5YwCpGyrCEG44Mmdfpab+Kx}EmZZM2VWS=4eG z<@v5`l5V8e;yamt7Wc!Nm9BQL_7#wAqD#6p^RU_f*@(JcKUvESU41Td?NC8N*)w#P zxgJtlZ)gpA8PUabl4#?cd6MO4=kmcjO}0Sm0&p|Ypa)(Gvivg0?=WA^^+Ws3;iA36 zXQH%)$QUnU=7+`4W0*H1D*r!0L$R3!4miyaKV_To#1oeF7R1!415N>7W^kT zj(I+9Tu0Xv9UXw5z`;Km6SSM?J}!d;e}LW%;8Wlp@JSH(qTE;8s=E)PC{ z`i}fmd^6ga^cJmu&ocTB>@6%*$%P)TKWNNB&(rM$)zA;O1JQ4t8Ym|ygN6cqFaqBS zwv3b11e;(0`jEH48W@5e*coS}?cJ%z#r8V#716#hAGw7IO;8yvh1`tUc# zGe-yW@qj2FqPtLLzkoXa-Ud0Z!`ndP{-+)AU|e&87+7`k1(-L$LVW%{a19m zuX0(B7c`!wuhXM>{Wo;|H@U3qLE{-%`4;#u@Y^8A$9LdAj`#0^XMo>>{2!?QKKOU= z2jJ7-55d2JKLY;({uul-h`7-Eygz;ivj3k1IUY`sK`V$K1D}i$;@dPkbQ za7leERNHq&%oRkd_|?}wQZkXQ3^IlDm)1LRJmW3xx2|Lw;Vi-2?diEV5iNVKUsaBp zv!}A*O(>@&W~6GuG|y{^UP0kfUEi5k+fjB)R{cQOx4P03*QS1uOeyK5F6PQlS?gaX z+9HsVP<#Ru+#3rwg+u2oG3$yb@nvY$U@W$rYAk~^5tYbE8ky&17|bE;`rGGABW7VJ zajF3?jed6VyX(KgID2y!HK9ZZkK5MnKvtb#N_9n66!>uh6X)Q&*dJ^_{q zyv{w}|1a^LWtx|wz0o)Rq!mH75?``C(Y8Y@0j?w6vX>~w6%7&ab}Q%|6beD}qOP98 z-jS^rcgqMh7H}C4$9HDm5%GZ$9p70ws<95|lis}YIJaV_CMqr27FH}mTvCetM@egz z=t>qME-W1v9@egH+V&73FcNdljJAx7IyEdE*0EPEuhsdm*Iy?kM+s7bel}$&4HfO? zMq_&&tsNOHpO37|dObT!$E}1b{I<~h6RM@F$iAGGk2wSxN3Vy-l;*5mAs)6}-a;$k zyp24bF+M}G{WgKLwkJ$PozvYd$o1oaFT#Yj^^Iql`0!=ZPbw)|R9xKzK&EH&{BV#* zfs@pvYE}5m@?D)VbR}N6*)KQWPTuV}(i7FRj+OH|3Dn69lx`;*E?7_YD(%<_a~hkr zav=&gnPb@x>@_&THJfGydrx9B$6Q~BXA-k=&B*B3e&?XQm&!ZItl0a=blFjHd78Vx zQOHke7%d9>8NO}kJ?s}a8%L$#j@Z92| zV&O)?rwa16K2>zfMf3E0rykHM9f_fsemEAYdn<#=A6mxuf8 XcFy6ZP@xDcTp*M}&{y0jUt|CAFn3G2uoivokNdV`gW@IdT*P z3j$R<5Cud<0RaWIf`TH7qSm7*qE$f!6b}>?5#*2kD*k4tg7Hq)X`%x`-}pDtj)%ZS~q> z3gur+$zQFNAT7l?k7=r5F)gCQ5cg_2sGib>I`e-AA}wntsdxW+ehzc$s}R$f#!~W3 zosRL$A(}du<|2irsR)Cevs>nIc#e{UUrBTTwJJ1kW=kul@0P~TnBLN+985HOHxTiX z^AVnk@F8F;xBw*ZP@)+x6xx&`$mKM|KU>hbozABUU5)K+*cG9LM9M>j7UgiFj;$zn z1o!}WB;xM_k0NT{0v?U1r@An+`3fADN@F1QYy4W0we01a>tumny6O|S#Bz*bOzDmVzfq_!z# z@CC2}J_Fj|li(Y{C%_@h_hYId(Z%h^AA`HlFzZX_E$Rr3rt$}&r)|m@=H(`JJ-&EeSodlA^(cQH(e!J~F7IZ__CV!f zWcsf;EYm@y7wta|c7wkKS-*Y<`4p%{c>-(!e~?yfvX&!Zg62SoU9^n%RSrho|lo&JF^ z%L&|fs`4WJQ^vnYFCm`w6GZ$r`j?E~h8`#F)%u}8PONt-$m_8HvVOK8p_TYSL`n&o zsa&T#t~{?Cs;*RBbxgfYy+?giy{qs@AxWRhFukf~_`W0fT?`G^DtV(?APlQG64;SI z7EIe@`DkuF-3{Zw2}Ky%o@>dPJlBEsV~fa7A)uM6uKH@A+Ul@ssF5lV=C1&(s-9Xx ziX&rJWnXT>JQ%1?*Pzg!Fp$MZ!%OAyY) z7z#6nqKrX=rtl+(P#Z*Lp=Ojq&xs>Z^o^*JXjGyI`{m20Dknx!QDl^yMEJg zSB7iz&+S_!J+iA}z2|Z#Pr`4f`@}*kGgj|2SG|;9 zxp`V+xKLJWZo?>Rb2rKO7musQ&!nVh9a}3R)}VpNh#)xhDecW+J6YaM%3HNTbdM{S z>e)o|mvzJR0#Ox~ZPe<4MdhdPH0kG0YC6`y5V-i2VF)aBuG$BqA=E+qm@dpkVm9(7 zW&$J9u6xu`A!$t)b9%5-a)jc#QGGH{#WDCz zxbAE7(c`&;b~z3(|DFpIAlI?p7ndB{TA@Mk7ppLwr2C>Wf26bk^9y%_)X+30( zXN6E^_i^Q-s*kw4@xxQN<7G_N1b#_-=9aX>_=IW=C)Mco6zxj-1{A`M>?1DVVv>H80TvAu`GMogV7lHs;K=Kk&pO5dUEW;^{Bn- zTEs>e7sn5&>)F;Ij)m&*mV&9ja0}>QE8|zIg4fWYHt7}omp71I; zUsg}*e>C(v5T>w)MKbT*?7JuSwHI#JN;eW^cE?VJFWTeS!j0(2TzwO)N9mCiW0WYG zvIqcAH0dsmPyA8ySEL_ViU;9%H8df!vfqh(1932j+3Yq=;Rx&{UacRzuCw%h&x`Uk z%;a=Ao>hIvuUHPpHs6LUFVjyDV*{vH_=mpgxPBYlGbwFLC7TLz0sCFkGa1^j8OelO&E@vzi zPA_9sM{03N*P`w-jP?3z>Nt+nqJ9dgChJkyF~CjWNWo8GK1wv6Xn2kBDaV8>!>1;8 zX+qSf$pc6_KRjNjbfv1fUStoZLtke?0eDUEvlqWI0T|_SAj()0auFbD|9pDC@Vy}F z35>9!4cOHfk`*!}o6YK}7;agv-yp4s*H4x_fxcDY9~2$W8;X6+@l3-hx;VW^KOIF2 z?WDKTbKBbGdPc+!^|!IUvOESP74mrS$a7fMp%F+&t4dEg5e)Aq4IS6+6s(+NC;`7xP-JXjpe)%5hNaZ6@@j^bECk6otw>>v-Ss;vD&U}m?cif z)5)(aU&xzRIq`CG2TN%;vwSNC26_UXM7a-S@rG%7u^WY!mVVX7+*IDgMA#FQHwROP zUaNoM@Bw?$q$l-Mtvik?%K~pm1l^pmY21zH?S@k}u0QhQ&fOnyk~|M*l$roxb(1LIaLSb^M~?6X8UHhS-;c# zj#n-xmRZ{Utbf>fMZhO83?lGww-MH3FjiNXoW@;f(pM`M(U9wnVDz{nz@m@rVQ2}_ zw0wV^FdcW(yz;rbW@j`fjPYHoBb|Xn{b^RdzQp-1r-wT%fu?!NpVurSGBB)R+Y&*3 zI5Y?KW@50T7#a}rHqU~PmvG$hxckUlMqYt@Z_`kbImp)?YzC$EB9eYa)=)j&GDMXn zyIa0|WTuMJG;Zv;VeIoBshK`z(`qV*t|Wryb2pv>oQH*Q+b6uW46)<$X`lpuc~mbF zy9Ij30^&_j+Q*!K&*vei5gO%+<-Rd49UJSA<&C&nh!4(2Q{;Pl`Kz!M{UY?Ccd5g` z=cNWY!tRCv%wO|_V$v6pe&o)H zs4Eqb1`!pcKh}Jq9KmVwA#MkvjUimVHn!9vyllNn9TpDmv$`~WlsY_aF@)gZw?Xd2 zb}Lhl?W=D(%;xo-E5Lacijo1^5l>J literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/ptpd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/ptpd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..4a0f5363641fdf8bc2550130f1b4c0af03486e7a GIT binary patch literal 5237 zcmbW5X>c4z702K7#yDOA2{?+C*p^I4VvMshB9|lL5G!(IM5IK-*f@!?nVsp~ooIGu z(lfi#IzUi}otOj+;l7V>-#3IK5I|O{_(D-sQNRbPfP!+lDn(I6aeTo1U(f9BNGl7+ zy`}kW_j~>3_3PKiis)%tL-ReKr|7%7twk-W;4jtKPkZT=w2OAqDBVmW^a{FhNzVo1 zPut!$x>kR-QTl1Ox5=7a?RM)ty$tP}>9UTU)N20u;$?bn>gcm2wmXn(p|lJf6@zG{ zK|^cMrANd9y@==%qD$#G9!JD+mOnp}ZOKZAR~KZ0%lUJE;d_R(Ev|1H|@1b+ph4*Pd&KiPg;|8 z1->4BJOSFey-YHTpM&`I3zzFUPrx~Wam{P{RjOtFgLt1u_n^*k1oeDPgU4Xk2akev zko^ll_BYi2N2Id)y_p>KjjQmUSj!hELHh&HZ-7UQ8ES&Zz?RORS*G?6)bTn5a=h*X zPk?U#Pl9g*InHl_-BYLTr#ENw1nPO3)ARHIy#?doc>?DQdXSFj_Z(*G_kc##c!-Yb z_J^6e9W)N0-&?^w;3ME|;G^Iu_%>~Cf!>b#FzUy^A@CjGX7HUL&(CAfO4>H z26>*|1Fi$#3-*EU1J{D@2QL6W0Imi<2>%86A@D!2^I?$Z_al)1i#|$^>v{bceLV9U zyoBHP3AA4*K8bHUp2wMZ|EK7)nf%kb-)Fe4#|s*Nr_a$BGx_JW{0m&ya?p4NR=xzD z0KW`!{(c4VFCdG)3Z4Ug4eft{{OjPKz;A$m0KWzeYd!r`PlM zi28p?PtfbAMF1HJxM>(?N8E=vv`2e`w8c>jvuJ){S$JOL`Ey~9rPDy5Tc(_K zWR!SeU{(;k*tE-W=r|$&FoB zq>=$5ZkfCMux$HNs?%gfz87P6qx12%G#+d^9ake(R$Q}{q;s_%*L|;y@BO--kCR)r z60a@~g#kOcAAcx?y>zj#L?o2(L{r!z5fXL&rog%gMHv!bw@%<&8SN}%a+>tV`Fk+X1-o?Ck6rztv0HHrT|jv$K;frr7sf8P~#@ zuEoi-vo~J1t8&zil7^CD<-oY;Oh4 z-=_sE9UDYax=hR75VClO=1d}Dn$i<%s@DJa=tFkYX>=7NAB9l z;YjDYxyJITC<%?+;Gt83q((W@`H8|Asr;~N`gS95YVKz4yi#0q@nF@pr_sMAJzff? zVcof6C>9U#*(}|&-w;j{ZtLHK$oIrpj3eslT#f43C!(R}X$(&rGAU-zONr_HH1sWR zD?i*=PnoOdx&{j~#goMAqnl>WX5UXw;)~IL+4VKayA{y|J@TX;p>1bRd%C4`*5yQ4 z#cEb|T)RU?p-QB(c6xR-z-jF{S~yk1!JD3DL?-O5m`A<#xCefRqO6pEz5SN>!3GGw zg;6Y5Hmv|lmFNYXx|=B5ku~Y_F`LsnBo#K7=XUfI&djiWUZ;*Ni5s|%!sl9Q-7;P8sJ4h`EC zENQIoZoRl(-+Q|6YhTHt1V_Ivm!&8SRW%gJAKd6!~^i301wscS+CDJACS9nlH=v z(Z2Vz2k6Rjql$>S?F$T2noHqsvf$bvSr_R6kBQx4Qk42oxm}E;U$8gAK?lpUlpg;g zW_cAJC!%!2(D2Az_91J6iZ_ucS$na5c>r;7H@^T^Q7(lo=#krhvEkPAp6p=v=GzJH z;xXSa^e&vVO@ zW{fYaq3?Z*?O=Ud+2(F_)cBVjm%?GPhRM42%%*fGn^F@~TF`M`dLc^?j0oxBBS;N> zkkt^360*&zQ_;miwSLI7W~mtR8)GC2=7UeH%i&CS{udvwuASJp)i-gu$)bgyKkWT! zI81 zpL6<4?rp^X0m_Nb-0$}9u))Rlm%Yca%JcXU$i(!$VA`}@H;e2RGDA8Ezs>S2)6bWHLF3$%G-31OzeEbl1!j)7{mn?w(`- zfygDNTyiLfh=2%!2*gE&712dpQ9xjk6%~Y4ltsh?1zq<4y{hV}uI`x(ljv^cm;TSI zdUw6!d*AzBY1-F}?X?GtNYt_9Q^&9o|#tpjv+|rNJ=jcc4N9c#^hv|pv2kEne zCt>(Kaj&n&)~Zie|627{eP{lMzCw!6)2pekss2^qFH_sQ>RwNrwg2|wS(J{%w}-Y{ z)xWsq=`P%v9^BRZYqKr2^~MZM+pJY<<%u@gzzwIb+Tw19F7B1^QFuK3 z20Q_N4SobZ08fPX!IR)U@T2ffcrv^lehl6USHYX%De!t|L3vL-@M_!{cqz=n3!n|p zfxYl7*auI8{nVESo#6eR%KZZF0eI@Uh2bMIgdffj!^XjIN@)T&eJa7es=QtLUkWb_{*gA z#wX$L;f3%`coBRZUJPG>m%yLFOW_OfGWZPq6#OB)96k=OfZv8!!iV8i@F93LydQoV z-aF|Q?HYI&ycXU8uY){RXGw@pYS$HM90bUAkgcrh_;JNT-cozH|JOh3{X!mf! z;G{2Tx5Cx%w%|Ube(un2hxti&XkQHO!wJ3Q?@nmJFTpe5UGOY;H#`@98D0qQftSL2 z;g#?!@LG5uya9d{-U9E3cfbeWUGPD8FI*2-!>_?X_%ARIAA-%i$FIYaaeo6I55EbQ z!G~cdd;}f?{}pz?Z^5JCqwom$ZFmTL4DJuV1Jm%k@I&z5;O_8oxHJ47oCcqOQ{eYu z3;cK31b+bE-)z0{BzzbC5dInd2>t;+1>b^C!#ChF@K^B1@D=zhdm6EASThOL!xE z6H(Z^1nL zJ?w{X!z}y*JO%y{o&^5{SHeHTW$+!i6#fM+f`5hc;JffB_#QkA{teECe}^XgA2<`f z4|j!{&U=J9+!h*eOV|V_!EtcHX5;mVx;Fj&)C8gG|8TwwPPvyPBY4@k5 z>D%er1>%Mi?#18s@Jnz9cq`ly-UN4oGA}Y-p0^GDTXk*x72Kx~=WXq~&)Z7d1-V3< z?xuFtcMHk~chGpgJLMio?STX&@Fd+FMi8MrrG1!uyK!Vkd{;6AV$?hB8F zZEy)p!$r`9^WiKw7w!j-hWo=K-~p8LKzJZ-6OzAmTavz|`#f0JcGk5+bllT+<#~92 zI37v3DcVuW|Mm_1w-ev{@6Xjc@V5o!hWZrz%~Rp#>kCLn!a>qqs2_uSGu%)&;3D{L z3-dpG3oeFl!X@yxEe{%<@O8Kp{)+p@!dGDzdx8{+<`elq?i5f8-uF?|)!b3BKX;}lgNQjReF z9-e1;o`D~MS;B8dcpLZ8xO<_LuMf_K{VHBZKQ(wR+=u%E)X#1(hr6{UuNQ;%RG>Y% zDOcRIr}YNZr?z!7akK=wE_vxhbX!9B3R_Q?fA?}|^ye*`A7VgjDK064%j{D8r{{;6x&i!-XQ1b)E zxvHMd*UwYsJYT;6e-rTsDHroUJOTd~!lm#cxDZ|prCnSCkHmec3V)gYso=Tr0PbH7 z_k~x$-QbmQCwLW<_H;Ge8uzDF_-piQgXh8&_pgKF;q_31pMmdATyK1qd`=*r^c&Sa zZsh){+`kEC;LY%O_&F%`dJ8;m;^*}*P#;UUe=9r&;-n=0qXnV?_Rh!{0f`_?}OXIufj?2e%Lhe z0sTSZ`TGRsf81}w_3$_FYw#EFU*PlbA^0Qsb@&+k27Cy96W#+KhIdYQME_UfyA3zg zZ-Cztf8_H~DDC0f@EYzvhCeC)cc8Sd?{fbV?*AJ+2R;th!tcQXd;;3=`|u?A?{Fpj z0bC59gzfN$@L>2O*an}1yTPa7j_?_{HT*G5!DpckpM&p=Xa0w8!vBD;!5835@F(!c z@J0AI{7?7@{3(18z69@rKZBo#KZl=%zkpZ4m*GY56?i`UB|ICx3g4vsufa0z|AJFn zey#rsZUJAXex$!bHE#R{o{GQULJPhDkB9#a7sEHBq(Yq)0IcE&ca0H?w}xGg*dP9xkn zZ98Lo!(YD&7mnM(*oo&u%{vO!x)!c$V(6b9xFP*-hS3_hA^mU{W7oh9>5sb^y9aJa zzud#vGjK!t=U&F%fg7svawe31{UMbe^FMCs-}^%8-)&I(cN$9nHenm(p9Q5I?gynE z?hmCM9su{``GK&N`j`!Oh6h0zmk)+Aj~)VL9z7Jk4iAIBg@;3#e~&O^UO&<}ihRku z4%NJVH0~+d9HX6b$h;1zr@6*F-dlEZhfuvYsBb-PzOhiRaGCzF`%6zm6%KUQ*l=;VkGVk<2 znRhZ!=A$f>`NxJb-}FKm=lbBbq|*;4LkEt7r^5H>Ed%gvn1eDu<)O?^1t{~A3q|fJ zQa??|b*tex=yCsdge$=}U>W`zR^Y2}5dIRbfxmzcP){Nk4jI~ZFB+#Ar{k9ThrEw7 zj5E3aJpMiopN8Uo+Bn-dOWi-)z_Y4XxZRV+ImRc{{d0`-xj)o=u8@9po}%c97KO&pvcXXqzh2PY}`liZq2lbjkn(|*}w|eD8-cdibRaP%}BkI*$YnUa&Xq&1T zW@@!DlmD7F#{QPI^KM(oE|;A`U)ZEogJ#94+Vyj~IZZd$jo7j_VWal6)WFyq^*pLK zL*vX-@r8}AXj(&wn9BTfh_BBmnOo`fGOB%wK2k3qxvO>4I0lJV`hR=Sqoq5^Sm98D z0{6T5I~+SUqN%h{fH1LGln4Q1oF|y;nUSqRbxOTjH50ArvJqRz$Q4rCTQ;J&=0&`l zsoKocC$%HUmp;-w-{BT|oxX~vW|}U~?L{alnO&8hoRe8p=ym;aX>)`l#v`IvTy*JF z^36h^*9By*K)jK&Kk<@PIgBu_X2!& z;Zw@Rb%6YgqI@0wc4naHI^mn|*ig8}a-EWsJqDe!?U!bq#KZh~`iSjk6OJ%BEoCQ1 z7&0L1h)Ddj25IPa*%#H7#LteaTus-Gn9tgF-l;mdLl2bs)gSv^bP>|AYwwk$qpnsH zIr0KBggK;{gBp64HTcXi=A=sEk{KlL|9L7SMTN;*q=_82f@^w#hWSu$KV>6r_xjNP8=spJ!}XxhG`O~2DF zBjc4VDJRzq{_AGFHXkoNT5eC0*O{lG5EgTH>IR*=%%DHdC3B7=79A@V2&D zhqj++zNw{NX8c5{B{HfzjI0$(W060Zb@POgIZ|ZTG-@>w411(yHjX6_RV6M2S2C0* zTr$%#EqMHMcPC%JDBafR(BHmE)(~XwYG-DLWZ(J$Q zBbhS|C72?DY?O?@p%T4CQm@C8q65s6UeIVf8F~G_)GD~k>^@`#Zzw)(DLqVGf9>+s z7126QQ+km)e=!fD7ilJEQD;abja;232dG?^4bBng8$@(@L?@M;3 zg8pX+l}g4|>$|j)2hvtg$<0;Dc3aUZ_s6CKZRgtXfojKIOGIU>C+90;@Uw+Vw|0Eu zR*)YxfA?FStu-ru;?6le{JouW$H%K|k6Cu|_GxZGB0o|+-{5+9`B2f#xqU;+?2PMW z5%Oym#l%rtj$zejV{Hd&zNbW@>Zxf5W0W8I-Mn3*!lWch8d^me#?U^UOwO%jdC7%r zekf~;0u1p=34iH=Tkf$k19rAjjIz99Q>KGPZjDn6Bp``c(>^ReAH1I}w{v!}-z^NS zC_6c)?AYNVZtmFPqd|37ibdB8CD$?b|1R4_Q`3bq*7l-GBu~r7mM_O0K#jNP*g&}U ztYW{DDJ`(_POi3H?M?g*$Axgbn&)Ihe?t>ef`RBm^{U{Ic*wIk{I7j4omK(mYqm8m z;08L)^unCmW94E`s%1Z{E}mjT#phDHEc(3eGV793nKA}3>^I8r1wVXstx(_3;_3S1 zQq58*riAsZtP?6>7uKa8lsT-|SfOK4bXrBxzp`vlD!XcRh{bNAUPl!lV_9Fd?@JVO z}91(q8JU^Lw$Q1RsH3|el7FIsOv47 zDACWZSQIbU7~@&7s8%gM*7dQkn|0Vxkl8!7J|5%v*Wr40rz-aL_;KaR(mR=v$Cq;o%+^l$%A~m30{N*K7e*gn$thTCY^TSKWpK$x z#AjtPblq|Z>5?%$?7NlG@*mRq)zkCY`e?g-m}oO&=+>9RoR4mQeHvR9gOPP09ASIW;di~l3WUlWBH)ZUo)Z3ZPn z;m&=vQs;+aeKJ4SpzvXplGP4L!W31qGa zA~XB2vycomnny=fzwtuFYIn^0Fs$Y&A2t$UWMkaVk$6;}*#z-e6_yKOJoWO%sOrfY z>}|OHpU}^%)qB=ub%X(rddo5{e&F}pAxeOGL}LafKBgyjJyE-2B&adlN$N|&Mkb~~ zHO;MozBx@omAqXjFAKbu+E(s2YnIt%dn*>rJCSrp>?g5_EjC@WAKSeYakV#Sxx=e4 z4%krrB=q0rvD7TvL}QeHGrk5sYz^!)jgtauO>N`Mo14s+4Rf(!-lCfmHew%j7?TC_ zInBIDLn&NmGtpQVUAyPsFx(JvRnSvc&}oachL}yr9`hRRd&WTO^2W&>kCz@}feI{& z>*@wC0miP&AEww1GyYGu)DQ*pKhEr7p<&Jq%^v1p_Am!?>ESJHYBxmw@sCnMvN@VF$NAg%dyV7F`Ub{zG!h*-r|4_>ef!OZ z^FXKC|LnGU(fkqT2IX7da!~2nM;w=Zf2QoI_Fz$3ivCJxd)n4mIT`kRef>tnQ|izA z@yI^u2a3lJwqbjZk;`$aTM?5xk|w@}^&9E|gLsyRklgJXs!A3%xNd3?&J4mY_e34< z)zs%EimzI)Qm)a|YqDG$T>p-)T-EyBjcklqza1z}P+fC!Sgxk0Hex1e&|zB`!2=t^ z7PXx#CI&gSTV>0#}BCuJFSWk6lS-?GtbaYr_OH>S(~Ah6u|zF#hFd)TlZR6o`< zk<)6Qm-9taJya`-C;WJt9@~ie8D^$6FKIm8H})Rej%I#nR7LZVC0veLIF03#)R|J0 z1LbF=b=2ZOQ(>wWTHVM9?R+@FFIUrTo4!687D~jUEJd=ENZ^~bO8fDRS{;O`AtiW; zNR{J$rdABo4kEL)?>Di2s9QINsv3VLka04S;{*L#I$9^994%W;!S>p)Z(lp4?N#GH z@>g9?Rs-OXOX43ff1OI>(i#f=;rz4<;i7yc*B9X_grq%ExVp%uu_}`dkOt`wx4sBN zNUq1ceie%wUtJSwr~K$P+%ALn#QbP4aJ{^h(0_i)kEiLve^R?FF}#UMiI{WtsIkkV zoz`?xm7_iQjowo^lSvOO@8}3rK<(KqN{P~3hT@;DQQE9x2chh_In#Ig z!*L)Oq)V&Wqp?GoXcNY#=I~+X?-BAxm1tMU598v+|D^WU#klAyn|+(%-nXI`^QL4A z9JYOoP@ZAxyDD2qL5H13{CJ}#;%ltZ91Iy)C0c6<%(X%JGwAQ#1*=%X*f1RTzU>EZ z`sPN|^Z)hoNNfcTkaCRFZ@aBQj00-4iEQK9vfdamoL_GmUmB3B={((>qMKK3L~S(| zM;c3M?aaT!&(ShJW2Uz;XE;7cW>#?gb}>noYdgi*7p6<-aTxC-p?1*IEdJ_OR**&R zd&>M!j^=crsaZd(Wr&CO4$x-prT8{*~?yE;F9 zi}8Qf@awz}JZ?$Ens%uCjMU#oT(^!wzdowrDas@k8C~44rYqM+e(?AYUmR@ZYLbPR6 z5Ww~%!PK?6{4P3H>^^c>bFvGjEZ&u!Wq4nt5YEP`2dcdX{<|wZd1cAKlWDPd#8|`5 z#xlvX$+72tI&wqP;^_zJsQY5C8K$3%PckBQmOKwCM-D9ZRC+o1TAQkG_lm#niYHbQ zs+cxsRNS!sw({c%o_EvgmN|X>Wwl<`RQ-RrYyQG{7}VCrt;(yOvrrVhid~y>P#;0O z%h-9YeJ%qE2TaPn$nb4ev{xqCkt@yr2JI}gs|_1)mSXqOW3p_esmt=wbdqM$^k!)0 zwyHrd-~?2s9C6#8Z!5I>e~6{H=$8jL2q9_*hIDz}M~f^QZHJ2uyLFnmL`xmbQ3-P; zi*0G3rBt^h(HEp+Y33mW3eR2H*p+uO-^}BGt7&R#Wzb6JG56I{yQvngRR5`62vk*# zFfpl<7%;iD2Ya?_27Lp`kx7Hl@`~npGJ(f{eLxsdKjUyV=8LYTsC< zW@@R{Sf-}?=O5w~&*>gJ>suMfFN;4p)$Z?4$NY&sLRx+}jT{(htB}4aYe}Eq5|6J>nPvJB2H{nHyDA)-vV9}S`GdTbE(+&+*hUa# znEd$5-=H}D`Kx$%`j&(iy;Lk*UbN1>Heo26#<*jL+UMa$13N~F z%$E;>WG#+t71DAmV-+oBvEkd#s&Oxhr?1EsXC5^L`r?cs=!+=38Nd9KXPn2)pjxkCCpMK9){Xg`Wk?eCf35mraa^8r zhy$BAb>u7A?j2t>Vy%@Z5FvbDYX~FhaWQ1Z>!YTjM5)&K>-CT+{E8Fv>{5}*Sz=P> zG-CDJ(Y}l++4ibcnHUcOyH|_jYAUvDt3(pLpDfnts&>VqAmjEGu<2JeEQ$8S`)1gd zbGX$I5>fE|jwrsk-I;oxs812o*in$9Au3s4j*G$<-8Gm2xN_Kn{wLPg?88V;RPsX1 zU#@~$QrdWNKn;R5dRPCtlUyZ?sN_eP?4eEpWR=CVK1ioP^fKecvG1GZgc zbVYns`vJrHE0;^Hwek42D(zyia$Lo(L|t-b!e5PvTKfre=|6MjEN=LMRXwa&)ZV>3 zZimr91ND2-9wWuqXRS?Fdy04rg(Ki6np(;dt`g*>R{dac+hjo_O$gaLnG$iYw z4Wu(~X?IP+5<=OFZ6I7%R~O+#zn-%_u{Yg-{~&krF$39m@#m4mc+{vK7-gsx+L&C4 z`2r+6KTFQ}__iN;(;450XQYm%l*;U-=B-s zztV2`p3+$*EUVb+X3=?BsSl6`whrXKH2W$@|etw@)5B@Ha4gx-aidBjsDHC6Z2AJ*Q%^!DIi~jawtjN zcoN#b1{#X6iW72M6d(RA2F*nI;?MazoaO4;N#qYPQGHG$sE1+m#d=HD4B>)G>Di+9 z6~!0&3u;&Pvt#c+@~31gMEE|NY1&sUiC3|=7~cO#&$D@lNjuU1RD1O6((k#6_U+4g z3=-i-MWR1_{|Wg^WMGex!A`q9)*0@f_7x1gyUjj-1djJ ztUnY6ABjn0DZpS2zo?Fclr^@#Oti;r#V!vp5K(&0z9OWQok7$R zfu1zVZ>|)SJ25{=`;+D%a#1>0s_=IhM=+E4(|A&j_uENd@G%{x^2B?p{XULZDNrmW zW!4r)wU;QHwdVN#*9WAw>c-U?k0MDV=DSRkbeC~`rtFG|eU7hW zm5*nMZd0tic8LMXD2BSj`aNl z6(Z3O6X))Oec!13GC?TGQ?1wP&&4PELG*f1+=xh~CRb8c`@&JYc^L!c+CqM!`^fz( z7B#r9^kH&8G2gex^)B)}F^@LTS4ZdW#eZU5*}?qdpX-)~T#0qLY}u*$NUReYohw!0 z6YJd2_%JztF}ntOx?ng@lryfMQv-UUo%;KQ?V=A;$tK^6YUeeBzV9tLPt~69!%rd~ zHF`CPBJp0cRuFGuy|Cf)M?ttmxnk=T-$SDR#^+t-p_SjLIVJ4z)K|^?7P+q`Tr9pfu?}_~{PdmeocIC!3jSLIzw zruL(wa`ByAKR_Zq2FBp<|5f>ScX=MgC%aI7pG$t{Hi#$DUTVG@Dqa%lRNH+b z9Q71^-&evN#{VcAqn{sw&vhr~pZIrYB>Ln!HF+LBsUNHFPr;G8MEi|RM=F_QI?3-d p`|l5F0u$uIK-$89)DI{6=BWIkeFh86f}Kl;n^kQYw$<1M_+N7wDCPhF literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/racoon.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/racoon.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..5a29bf42229c0c8fbe66afb727f844d96d387b53 GIT binary patch literal 3034 zcmb7_O^g&(5P)lXL1a-0Dk$O)^5cR)_X2{VsK6qK0wM@13Ttooo7tA0?yA>17!MwdF~*qaSFd|_W_H2on@oRGRj=Qxs#ok1i=o8-nGovzsXIU_ezn(mda?|Ey&iwR0OmW)|SR3mkwO;8M5|E{3)>rr*V_bj{oCOJ$bP3ZzRe;t`%8J=On8^b zyjm&SIQCU>{9o=QzQ0-jUicT>1^qkAIQ5a`yTi^@?NO(rtbG3dd=5<_$&4U z@E7@~`7rzuJ_3J$kHYWa;Y$A))On9r`Xlf=uIQQJp=U|o`o9Ub5PIW zdAr{Wnpe9XNw)jF1a-fc;X4q!t&>y8nwM9h=H)f0d3habUfzJZ&zn&9ISqB6w<`IJ z)MTdZzgpRa^0UmX?X5LxS0dNERu+xQOY0~9!)XGgzd8&SP_Ay0J?Qu=d`l@gGoO$N9{5(G% z$|cqwnlX>{lQ6Z#fNsvDzEpFq;3w}Z84L6=>9?*MrvZth;?$zo5O(TR$tdNbNhjN( zd13U;lZB4w1WxK?j&X9wn_n6hDJIv~dhg`TZAIa9dz?0^m|cE${HNa64i9Smi>Gn= zCLbQO^nvaMt8SInF)$C8$V#Ou_!Pu%^oH7ba-s7 z&S%(q?|RP!ZS_2ytHzE#4f2+~dbB^g^vr0M?z<;iS}QhRo%j4kBQp)IF#9t0g;UoMmG?yVz1>yEc^dE!Xosy=e$A2J?A5=yRQGKZZ=F;fqUYUP1HO}R<|A~^ z32%+8oX^buRWh4m@9q1E{_*p8I7(XWLTvwZ&LuI0Yp;`GvQlJeZ2NOs{}Co3s%y4> zd+hYK7yIob7!AEnV5h4%PKmckybb>?l))+#mr(lb1)(J#Ib(!hQ0gAfCS~u@48GGQ w2?6a8I%^gUZt|MaABy8H8g#uA(x2*%ISC4!W8_CJRevAdt1SIPs`L-*{Jx&qo!Ps~ z5t*&o&-Lrque)Er?tXhjzoB#J#Ej1`=!aT%2i-yY@Man*De}mrTWAlxjowN((Oagq zyaDA?9obI0R)2O<_L<%fYYud@i`oigtLVZ`%_-RI{;Wh@(NETLMMs~@T-#rgQ1~>@Tm-%z^FG(yMsFZGI3NB5`wa7qw4LY>m%;h}HBQkE@ZaE@ zz<+_5_q>0ABSZ)0L2oB`7VTnr|8I>^dUHO05bJY_u7mu9aXtRxdGXp(-_vM+BhgEq z%Ixj$fjlMB+)eaygKp+>-(#q6%TGrK?M$j_{fB1J7qB-qRiireI6gq*IP@C2olkE^ zKim#Pzhe}jd<Tx^MK>~eN5disOR&3kmvIO@Cf)p@F;jE$bPsBcBiI3L?6!m2x>px zt^N2BI*jqLA3+T1qjZn%=VMIW4`}Q*?xl}w`4Og;gT^kjI|^8; zOZ2c_k1x}M`MAI(9KR1ie!}<){^IdI%)~l=mA;nOKcd?`%4Izt(D)C1oxYjZe?!+l z#${a(8qdPYx4?gb-v&8;9*2K&gToF{1f_VK5uaG@8}tNTFalIpXGi4q4#sPqy5&l_e+#{{eK1W zzWFuCadLtTnn(N?_+-=|Vcc&#Vmx8|!T76jj=9fV!D3f7EhmZs!QYkG3B9VEu#|AT z%DD0q0TsA=Euh6EDI$-5+c^n^zhuJ8n2iAh%&XE(d-Ue=pYMvY))Fo%l_$ zSB5;uVZ3KNzQSQUw6lleSR~mHIZlddgn&q5?Ju^EXC+=^EHY?>ICi45N9lN+bIQA$yhZF0+IM(RXWNmJ8D1MBkI{l z7nrsgnacFdmg$&@DNyFW6u1Kn@zx>r%oXMcq{6J>Wrn7U?-+VbQ<_y+2vD{mm5^9y z7vaM)Yk?h5uOJ9n;G?r#I%O|Wjw>1>;A5(!w^t|x&AA;tg)>Js zU(hKd)L6h}JbW%>_8k%L8PMl$F^~K_uwthsDoxoERxCn~n-t@Uk|xrv^(;gjSUL_o ztX0dj?S4WaB<7?UtsNM2YFH|)TT$*^s_%`WzxLG?B{(|uvnoSRf7xzsG`5$~(t*L= zMYx?~%DIj3KBvT0KOfG$-r|@v!aQwX^`v;`52H%L9?^ zuPr$Kw}pwQ^R;jt?!@817h%G`OiJUKB_4b^<|maDEh?^V0^m4g^Zam7M}d>nq-s|9 zZueb%Lg-3-S$JoeZ~J~~JJJ)?w2qbY+82$J8R*$fHe9fr?DMr_x0s{Yq?PkfxYiuX z{=nXXBV2RLtYEK6Y~Gmb>+nosRyGa{4&CJJwYO96Rb*D|>&bN4QE~4mcY&0FpPn^n zQQE)oZA0&A7rUQN3qA#6ShVym&hAU%`6ARBO)Hd%U(2Vy$Ax1#*7UAaR zNL_SrqUyr#`dxz0}uPUzHy=aw%a3z-|=LOAF3Eu?#%<|og0>LC(D-_8A`&(UIB9&_63jJ( zKTyXeInONl!%Ian7RqtV9&WK5=(Vu1iC);P7sUCz2fF1h@{4w2Yy~lI@3xK1)ykTP zT(nu*-7Z^4PD}W*hRU>c>b`$HCvh;XmhTDGJsnyOyM-J4Bn>flEIzMhmOXRFGkyQ1wpPmC`50ZWPnOy+``4wQ{3h2@2 z<@7`+!J!u6Itg&tr8=Q$;83gJcCwq)>mgxTI$+ro)GN8i7^f-DRnA;4!eEN^I{h;1 zQR8dcKIm$|I)iu%d$XKZI{o)5yqww3iSn-%{F{!Aj16xor9DI8Bwu*l7tplxAiE5Q zIGtw$GtOri$n)Z?n*U>19_UmW~c$}03)^{P<%n%)mN5s|46UR@Um4m&T(e72?wcxA44d7<53~m7j!L8sL@CI-N zI1DZUw}A`6?cjWH1ndKMfW6>rKmvDy|Iw!CM#SM+?Izkqbo>Iu3mo{HwwrDyx|e0J z_b<@f1O5pd1^);lPV;^b?j<_b3%v?Bk8V+MJgwbI`!at(%-L-X4?;yHdqk}9DJdFBw`CPQou7{-3e`pr{I_#Z0=hB_f z6Bq@koq*n$YUfb{{ct-F{rVI@J_Z@o?g2yah<29V1Re$>@NSgH;3SxU<6wJyEoEn1 zjfd^D%O|0iKt2Te;9cma2Hvg8-%LlcxE)5^PHS&rS*;K7Xtq8vzPHjn+4w-nZ=++7 zIZmKjug6h74}RVYvcGRf`7Nk_2Y54h0^9+AV@Cf)2$nkkE`Z;&*ef0h;zMzWlNfqA@&<8O-jxTtW=tK0d>gU5u)eop$t$l;*rq`kA87pkEF0XTg6X4v&Ex z@6SQ+U-Wr;LdE$D^u??{P_5g?QGQDM5?b&$o?v3$zD!@s>c67eeU)W3PEh*?eVx9U z)jz4~zrnJq2erS$%D2G3f~P=UFW*Moda&-l1M>PuKWhD-CR+Sw`W}5Bdh8bn`3LmF z%pVZ)kLbslU*O_r=xKUNl|M~C$@~PN_Y3+d_y_Q3;P1engU^82&+T=k`u!F9qv4fOfi`OUwfnS_+N0W2+LZQB%@=9;GKLj2bTbS+sYkNq#%|!- zoo}fcEuBj*PE5!3ot547uvUsq->wD|uw>e$@yJaibTDnj{-*2k$w8V?nT!+JFm}1s z$c!e9(a3F?i5!W{h8z!~F>GhHGefVSaHXmb(}qUNjEqK5bv@uU4aQ>Ktj2-YOk^oElX~iD;Co0P zmv^_%LLnz$C^4%ZheADD_|uqWoVo9^CL`%vGB)%bUQji?(Wq0Thn^cJFtGsd>G5FG zsb9@FGUB=!NxD$!vFy23d|#~OV*hs4NZf`z6!<*I>u1zwacqxoIPhz((~L}x3PP&l zVvIJco@?#&YXRExvxPsN%g8)R=DXE=?T}btUefV%`}yn?f>SV7ZF-(eT)!Ha zk=-!{TS#;K^xQ>Dgdsu^30Jg)DH0(e^S21x4f=RHD7D2(F^W05RCs`Irg z#Di5YnL{5ZCqF%RK4%nor0|7D-08RZJJ*Sg|{;1njllh9OeL@%D9pETI_KCU-x z*)n`A6D7k2a_?D3%SqK=F$!38Yi;eD9eH)VXVtnys$ zceelZ*sRG?BWOuImc9y5KCUonOc38-`RUQsJlQJxhOwM56^WP>;o9<$S;LaT`pV`0 zrL+i*^8VVXIZTkM)WdPa)3dy2H!~U=%Lwz=e+exl*30e89Csuw>9(ZG8*FbQ8P{OK zXWI){E4-_0ERjG=7$xFi8~tmk55Zc+quI)5Qkn-wkZyPSiF7y(-x|wk*mI?y@J+rj zo>|t98;rS0sfiXPOEm$^I8FL!JJ9LpCOKJ2f=CvOqmDOc=$T0^h#Dn6BV9{nI&Q{~ zj`u9_XrCADK-;p~bTG4aJMo*UHT4`I10h;L#v&E?5m7<1DJ_JsM{G^MAV(ljmKeis z@(?OV#9Z$na)~HyDi3YF-8^LMqW;a;Z^k|n76&r!uW%Pe*3TeX6!H*aUst)wLKfq! z$Js1~MO|g1^!y_B7fZ3;(ET8BYnkf@Ed-wT0za4XM;-vvaU$v9tX7K`Rja$}_sTGc zlHtgV>w3j)G!a>;B-L$hr*8U=+ILZAh}V5yJQv?y zYF!uF*{e8YefQGj5^of7!!ON;Ax9DIK)`qh-lm>-OL(srb+o6u_^fe>BP zt>?v=-{tP|;*{xL%xR=;BMo(=PlOiQOuHYamn0{S7oJEP2%u#QfvcZv^-(8K{8NxfSo+a<8YrS3K=}dnn6n}-_?=vBBUBJ)WySuQb&hK2MZZH<9oksERI^z{O?iuxr`aJ(h`p4Dps9#aPtlq8e zSMO54q<%sDe4*^y36FQB-K&01|J|#SzhW(tb7Mh*AuPNa z-qC-J+NRWs+xoW(^*F*#B;d*!zycpgL&x5am75LL|4crY^!dJs((1J@~4IT|`I0PLy09~ly z1bn`4+^ECn;3WJG^x!w(E%0eL1)qWq_*K}1k3%1R2?p?sumwK{Ujsi4L-;6+;3F`G zAA@c95jYJ$1ZUtwa1VSC&cgS>TjBliHh3Sr9litp415cGEqo(<9lQtL0q=l&;cf8s z%%`aDXVslb-F+1L0hfAxcd5ITx<|rrz$M>3@YV1Q@Mg$7=^ux0RO+rH$#*Y2LcK}P z$Mt=0R&Pn)H$>mYjkhunF6nz4-((($#ZZecp!_?i?;Q9}r52x=$kqDy@l+4*Q|c5$ z{h}hgbQS5H`2F!clp9j-)%j1FC;$79w{PDA>Q~7(NNb?6h?_pS@kLdV^)klecoOnq6AJhGi`aAMILHZX+|9$uv`~%7lAomf%?79 zl6Kb!|B=r3$Ldeg_wXq1VSV4HB&_uj8sp_ZQ-2DtgP*3{HI#$KNO`C68QqS@)Ms`3 z9#fw~ejoCMWyn0BonKI2Ovecl{&V#ggynrfZCAborC)!k<@}ZUavBycCH`@^82&Ys zaruhQ_f_>o8isoOp49Pwqy9Dx!&9WcPwDt^-gG|0NwCsNciC!Y9c0Z3)Bgz)!({ zgCB*@!uP{}hY!H-!gs;%!MDNxfcL=X;GOV4;T`b%P~Ptk;0)paf-(GW=)>os2Y(1{ z_&?Bs{|jFQe*|xWKZZBJeNg6y;%_@)16~D7a2S^16|fIp4*TJyZ~&eQ4>QnHcsN`Q z2cgWbA<}Ou9bqhD9a`Uaq;XWb&cbD)_bjgH{V}5NjQb)X{aS1sm!==9%Po=V_Q6Yt ze;xAH!Q0`ba1Xo;#&A81;N`Fd(NAqpuQ1e!w-{F%!)ZIKV}yJ%-y!dJqj44S z7UhH!#wKGk=`s%>;a3`4bUxO99lqMQhOo>Bc;d~*He;)f-)3wlUgifRe$=>D$B*jv zq;^BMYX|b>eT+e|!`DNxqdN^27$px8DK*sVjn5iS8q3OOm2W9OSbnnnZ28!}Q~E~w zM*CWQAM9T?uu`(wL9=SLS`Ak|E0N_pwO~&*bS^?r5C?Y9NHQ#$n{GwXj5D|1dKk1@>WE}`%l(G=T6I#% zEVW8u$tz8ltWsQZ3Cp(-Zi7Dmbz+^;%F-yYZfSylp)j=~*Lz9X~iSQ^CuQ`6fs(VFlrA&=VrCGC7u@Rxu#7P5o@Lx}4CaITIDr?sb z-)Mea4ShwCc{3S;(iop%w@_p%gBFy`A6@T`7Eq3F@sVY zsLf(Z{B3Do*#3@Cg+;576EnLhw3_Zr5Kdtt#h%Z}m&6to2 zuH9zAn8lRaZc8+`s`a*N)uN!$j@?SjiYJqmC0Q^|=`EiwJ?I@yuk4I|vM*=^#Jl_o?b3@yA zI&W~*{_=OLj3SqHUG@j_t|vFxf#YsydySaIz-im$mFH-kU;5{6@nbjit%i;tmd}OO zh1}%G*>gJx-KOh!R%Z~C{e{d6=7CI0lWhP7-*t2~>PTHrEVc4;|s1>gSQO z&GOkSIVMO);0y00d0En0#B#^^XhrW9*hLR6vK6hdfW&SYuBBJvQ8a>J=lEJwMnZt99nq{ z(^$LJ3c}7#^ZWzJN%zaGV8#tu9jXnh?c0;inFlJD(<8~cWIy?Dmw5K2(+h3`7v7tU zu)DC?k0b|}d5$c_O_3RLS~y;<8EPp!Y`XqWytMTX(xmjnG|0XuVn-OV--&b^BlbQ4 zv9fF2$hR53%O24pMvh++)V|w&zr9o=;I(KQnU|+je#8 z`jL_Jh&1dtA!q9isDM->kG%f{^`%gT8-<12mzyuS^)E5bVzJz6)N);irLd9LTRFF7 z?S3Kqy~LC7c0(Gb%J&-P50n|bh*|KH6TwS)A`rW@;QZPe)bj`5&PHWv`aTyM=G`yi zW$w>AauBMScZ|H46W0rA!YFnnNF6kz`g}D-OxW8LJ<%7<8P~YkBJKi7ozH%3lig=d zBfYrovuj{Mo7x@C`nHtgk^S_%<-6;r_PeOtBp>?Lei1Jx)3k-pqMJ(F8HE`8DreNG z(rz}-tEKk&`q^oxo>$gPx}8?s1j~nH^d2bL^of^*)?b;=K+y}>q;Udokz}FiG0hAcCXdv@63*-`|@gJ zO}Le2FpcqbeLW;ueXY2;C!IHpPgReP!+1}ZOml@|*kjy#t+UszvnIql*UE*5mTNy~ zR$s@(+ls|!E02Cp$X$__n+lE0lhyLI>xP!#ZIyhPoVo1|UEB4h-DH01W7#(CZ`*|X zP7Y{waS!aoM?2E+Tt8M9_Q;!OJ@MEE#+5cDDz+{H@X$(|<&kr%()C>9&W_ zk{8@+Sn)&;%Fl<018uruNh5=XI(OIcjd;#!Wx`<2dU@vA85FH>o_CxAkd}c)c#>;wMsvMAhzm!+C=A!o2RLR)^d1F`SLJT0QahB@+jBoAJ<<0`x%AXclAP1B_-MA-ii2k46y{00n~;u+KHufa zr3TA6P13V?zBLnduiEWafD>@Gx~Ih^qBxJTd^$N<4>CE4;}73nb|+KqEQz{BvVY9g zJ74~>k<_`g!$sFEZi&QGeBg2$w~zHytm`}bz~x3qM=2MF0ar9(L67HaU)nmkTnd}o zVL=^oPCG!qnAnU;s=x((Ve6J$k|v547Vk%gH*B=zX|*Dm{MGzjWWi3?-5`09g?YK4olL!O(z4_}I%^+$`MQrg z(X-R}QLw*`EFxZwn-OPsevOWQq)Rb0;!|3p2#yp@;PJ3hVlvA7*Ax;2eVVcR#E1{9K}9Ht&I5{?Sg3i+6mzlqJ=;YKai@pPlONb+UZ>0!#(x#wN-PE8VaPw2&wGX z<#gEVr`!MZN}4^#&h-?KJnQ(+hH;*Ku)cnDDl(0dpBv+Z`6c5D9one^U7Dk!c`2X~({XFkonKS}#{ zjxcNIf$v4qa)ouM=YB%66!u*VZ0f&H%P$dT^>)`Oxo6GAb8jFK>FYi?>O|lgkoBYE7ho6dyNxOijWEOrSL{}s{ek*FTLWD+ literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/seld.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/seld.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..e9283e3e1f96b3386d54a4775e6ada4947e7ca2f GIT binary patch literal 11429 zcmeI2dz>BBUBJ)G-A&jf0a6GFO-KTS(h%-UAV9J}OO_3Zv`JXA0tLi$?%dhC!_J+# z%*@>fl-6J=t)Pfj#cGSy;)BwsHnxgl)!JGqwpLATeH671+bUXYv6Y&Be`n_2x%XzX zSrY80e>nTe{myy)&g*x6=gjX!smqL$)fS`oZ?kc>jytFhst@rmOMj<&tGZwPq`FuA zxO$U%qq0w@-dZH*m2C+xZ@+Ef?R@o;c6bPx-GAqjR@9Tp zJ*S;t!jgIxF>CTzl|3geQ$xmDrA}O@){&x?nuOt+`}@z9@LD4azgVgDYOA5nzOR3) zq@R?>uYP0yka3<;tM7&{RcghZa0B64NWRr6+(`H~cmb@#a-MEMDQ82GvkBe`FN7Yv z2zj@_&AHr*iNCS`5^2|(vHnXt+qeHDLR*zGuIQ()N)2wI+-2}$cscPlyh5n~3%-o- z`4Bma&da$TZc}Q}Iyel^gjc~c;D}O-m&5IZg;&F6{X5hTD79uu|4yMEC%CA;{~Gm5 z;>Y@5A=L43kwLj#@Y{Vu#%}m5+ylQ3uZ3TQqwq`c2jNq2FZ>)Fg9qUc!B4{L;3weq z@MG`>_+j`e_!ztqehA(K55Sw@`{576N8v5-VfZ8PA-E4d2wx2!fDXJDR^UC*g?GU! zd>!=Q9dI1Zz#44A33wayVE}K1H8=??Fo64D9o_^(cms@>-)s9C>Ncg`uoQiRE3WQ~ zRie~A5{8S0$(O<_U=wbI%wPXzIIYy(OUO3^PgJv7KUVhLuI|XkAELiQ#%q|D)B5h@ zP3A?`gj#kAt_=iyX{b4BM@JG5mf2=-|hyNr`m#~b-pX&6F zs*mMip^V3$K^dQq>-0ZYpUA^c3g2WVL2`vyE0eiN>O z&%$N!zu^h+Td*H~8!Gre@H?#b=b-4*ci=Y(|1WZ7A3H?&-C_;+dl(wLHO6ViiadR}PCs43IvpA_NLdLJcm|Yp{$kca3465)_QBP} zH%Mo2jXGQdeTWdlgX>@wo&_DqI@0#;97C`Puj4kG?&9|A4o4ZRND1El{h0@cdwS5=#?dlt*$U4d9Ms>?+ zGy+e4%ZU?KE76PtbJFGcqfr1UhyXZx!MtZI;v#-duBnw1kjL-nwZK*Wgb|Sj2n0 zRqb1qX)jkB1}8W>@)Z5d+LuPLQ}ZluCiOyTY1wt$3F)m;FOna-5&Kh4>e*iE+7nTd zCfVrPN-aMuJ@Mix-}Tt4}=D2?1G$TFOIc)F7$)78W4t;JEZq0S<|VUNuw zsaLmm`IXp-XYJ9fc{^gK?oCJWB%)=W4$Ie(LB_#ow`aSMp)USKDN1-%w8~?i7x7!I(rs}$m zR;&J%-_$oQQ(@XwaN@0TID=e z_&ReGW%ST{PcuaQvTe0{3!Y=C4%m@mW9?in8;)naEO@!vU(R>+FVf-d((C81Z+o0D z+UwOYrSWWAM?@4~VDgk6nRgJo2dDRZ(q6xIMR8b>gUj5De^ifp!lIX@?=dea`6Cz- za^Zf!Ynm`SDy^DqhY?f9mV0;?Uv=_7bt-xu9?nL#xqm}D8j!4#1 zkC1<9pCqW#;y(M9lKr%4KWEtc4EyuSo}PDP7Pt~v0{?%Y`2Igo9Q!xf5w;QggQk6t zd4zAY6jSG#lbnkpj+OEaC*N=R!E3=~v}O&?F1(TyYg^a5U5#SL-sOdFST~lk&(Ir6 z$6i~psXSi#UTrEE1hN0cG41($?`58YQz+lPf28#Wad07&{Hy~Dm2VxT1BsWit=1CV>a6Lyg7rsh|E{Q(*c_^}=BSq~DE~<8 zBolkRMiet__IBT?g?MFrSA=DPtmiLB7d-oD<+AgM;wEhVdDs2wZs%zGki}ssKV)69 zAUSiDl!8ibcH}8Fk7NC`P0GCXWW?NI?qU6;tQYxmoiydkb3kghtKO6yadO8@~p%QwJH_uYNYiUr7jjZjFY9usY*YlOxs?g=uV0=v9WQ}kTcGA3s$2D53bVw zyQ039OSF-S4^tkk-^g9lDK{6I*sIm5O+$mH;w6-Pg`C`<)Y0zPb3K2`({`4urAw84 z5vJw{yPtfzRq=&J=8Rod(rkNhqZ(kawEhl@4>vnE@4yXr4aTJ=?z!vmO^yUUr+g)P zSF~pid+tY*ep+r)qU`D-fRA&E>1Un%>Uu_EuZl$92{O-D+)+#JKh^oh#;)#2IZev% zjiPjWRCoNaBSjLpevuzt?v>sweuvoW&VuTxM&P95QCu%O^w)RwmxmOSN7jGQzxH^y z{FJSUta_DZ4b7>x9FC4Itx7j5n<-eU?9=tc?l8y9-DX+7Yp*qjvlsbR69@F9S=QSJ z9y3X=F*B)IzI@Zr@J-I`_AWJer83L*^~!W*qLRTesRGxrJf#hkXm3^80X3mdKrWx+ z;uV)q@&t*NbeKo{rb_yYs!!CdFiQRLyzBd1ra{)4JbHYK0dQ(Hydb!+TXyyw$yB6g zwp5!dYs{}V8Cg$bLdf>@40e-OQ+e8ZNUl3Azo_jkELj7 zK-vB38;3-7^>b9c?37p2?%qsbUS8XuqCq>y#za5!by37St{XMOG^twoTU~o?#Ap5+o{%YGo839jwZc$STe4b_7?SY-a~ZUKIH45H(!3A zA|muXK}UM--pju4iuh!<-bkZ*Qti=;W;;QI@#ycuj&k{esh%Z?MLciyOx-NE*@#$u zv(`+*&HUwa=hMlVy)5Kp7a3i?1FN-VNR8R|@cjA5Mslb4UJqS!xW$m02q`>&x$S$# zx+<0uYNPzjUv6}ClyYet;Yx@%9X)^EI&p%;^_G!3_vqzZ?NQ0sSg}i`#NoDvhBjD%_48T{1o{Ueerf=vzzT(hvm;YETXjCFVfjj zy;wYEbRv$p!%EsQ^ff;tO1Yl-sy4lJGK{9_J$FqQvDBYJ>y=t6nG5+rKAgSt=rVz= zi%Kgd>tzzv{)^-BD}1n(3!aG#aNp zs>DF(%T}rQu>0n&jABvbey*dx?zmi=iCNdySgA9PkY07XdK4GCj%kqU$>`ZiY7MgfMC1V)@}&BR_}bt7EJ7dPxI4 z$v1fUp6=*3yHOHjepTb3|7?e2?3?Gto}u(^Eh9W+>gQ>>*`e zvaloRru;~1aU?D2^Hc8yf65`J!SOcW@YCclE7$l{v&?DPuB*W+j?q<{EPF-`Mp9$K zL6>tD$0sFrvrz9Nt6SFW!}iav0+MH_OWqvk7kw>UEf=@3owwNecu$V(=y0zNhqH2U z?LLt9=tb+EEBpTeMTa`?BXk#f&NE_2_{`4rq$oF+Q$d&S**ALc#gyDT7h)FP|JMHp z={+yB?%nkHy+d#--pW7qwVgt1t-uc_EvH(|&#fD}+S59>b7~5`z~Tchjxi=>x6zc< F`(4TP&Hw-a literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/sharingd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/sharingd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..7ed9adec6dfc141d250a2fc5179a8eb914d35887 GIT binary patch literal 264 zcmZQzP-I|Wkf$nCpsHygw<(}Oc?LOxcA&cg=uHsdV+5Kd&%nsQ3g$9`Nd^W0{<98F literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/softwareupdated.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/softwareupdated.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..8f667e5e8be6c4a2e75e22705aa733ec463c3a19 GIT binary patch literal 7477 zcmchcd7Ks3=}|;sGj`2dv@us(YqqW+w^qhdrN}?^e~T zS5@!T@v4{Tztly~O!@qi{vz{kqMPUg_$CsU(>v%~I)~1tt+a(Es77&H&4AuOla0Iz z+457NY}?vUZZ1hcx6l&7}w7+nwf8^30lpl7&RG z7SSS<(B7()r0#2S2XlI%lB8csbSOPbbnw-=XE}eLG=J_DIo3=EUJ4!wUJNb%q4Dv_7V~J*-0v?C- zAP7Cv*Mld3{ou>NK5!Yh0$ffs<3#X8q?xY(PsqKJR-pZ*xmPje_`vB)aw}<->{l;S z=7ZCZK)pV25x5#$0ImV&f&Jhda4onucoH}RTn8%PdT>&mq?5s?!2$4ba1eY990DH! zH-Ha=!{9^UDc}R(2zVb@0Ph7if_Hs23rvE6yD(!TwPo;j<)5bZ7p zBceISCHdQ?LGE%Q$uXh@3XOAm?vW_3=kJVfM7=%eO;Ubg2l;K#w`0e7bUx&A=nbgs z54ktXdfVv&w8Qm4w0j|4g!CMwL1i}h7H}{1S$Zqj1-=d36Zvlkr-2uPIk4WpcS5g< z)%7muQ|S`A6y=X9lT7HpO!kxY*X7@h@<&j91?urSd=J{cAL;iZ|32k?^#0VYS4w+d z#c4U8LFFFE!4J@THGMGcH;D9y=o+NiexO`m9|rG&{I%d6;B_GP>m#zCAEl3_X>h?b z^y7M&KS>`){;iPvgsgW1eG=l}pgiFM}6> zUjffozDjpN-#JKwN)5bQ>Yb#oAzeZG9+2($b~rIz>~o5f-Au9p}pnc{oqpY`yl)C2Pp4Ren<~WKR!S|O8X7Ub@OB7uUCJ<>jmR^ zkO}|)lzyI;|4i0=KZCPD%s07C|4KA(mhvb)hI}4Bi1gp+@9FqK zr2j#Wr*;76O;?_zCuIJU^i*mW=5pm});mvW(*G}R5B>c&$m{h#AkV93NTF%OkAhD^ z3A#>sP?z3hcinDkaBddZaXPy{vG6xbU1 z*`I$}>idBgd8X$i0{cxZH^Oktn%ZtD@M0g40&JxhCc;Qm^#QvW7{P=-oOG{0FsfqA z3o1~}M1F;;%Mr2J}86OQMLfKTow zH-y5BVbBRpjGMxb;0$dP%0kU3hMp5gBJUefIk9}=pare*CfO8#xw zuc@Ee*u|&_gbR!7+FHje8qRRg$kKer4kM_Tjc>a>SamY4I1Kc#Yy^V#lyaPQ>>~c2 zC)3S#vWj|SSH%|3RWZgAo6Lem(GJu_RYF6C?`w78;!-9xU3r zZ)W?#u{+b#X~yaSyy68yLr1tCo)_WUI-jDdk360~nH&C>{Vq9awxT|sT)a#FwAy_D zhAqM~?7Ip0VE}$8N&oc8+)yp6Bk+cg{6Kn|eY`>4sP^K_^x@&e|9NKnAeQLitgwaOom>h3K-HdU~l>N0tO?R<0a1Cjsttc=| zQ5Fs#S50zTM1aLSt05QQ?D495HPYAuID^x8_oB~>gCuhnK1nb1J=2bC~9C$`uVP2} z7&Y>ytO8*BXZ8HdCOk)LW&CLPcCc4H&Z#@X62-U#&s+6?#gMfrcP8mD;X=~)myYRI z3)p`nf_o(V&mY6T&#lPqm6FTt{rnm@5;S??Lf7JY!aR*;(4PbJl4Lx)`j zZUUhvKe@%I(X=naH)Xk3o7mO)6yV)Gghoy7&dEMNJYG!Ia#eG^$R16HzS)Fhc&+gB zV*betV3bOMDB+NolN&{cw3d$u-wUF?zzEA)!LG)ztdJ?$Y^JAdxFxwRgH#c(i>$cA zJgDM4%{!h~iG6I-rs3pWM7c7aL)F|&(x=f=J9z5JXSegJSzk$pi;2Rt{t{+WhY%Fn zZpqSy3Y$g-3duzS(ZTpcAqn&4ev`?sEfo3!Hj-QiS-xSKUhGDprKNvWWt12s`&A}q zVxV@1`sQdFxM_{Q5M*KuL2PLiXsG)^#y+1>n(4!vR$D!E zB{8(z|61-ZLG0?72I&=H2DgW&n}4RrRk6lLMCfBaqz5VACz{5GT|5l1ZBhGvob00- zE{W;Ap6lV^xV^O<+(-2E(xiu;Sz!U>W6oYt%Z-TtvWXojd(@ORlKW*nu zO9hr$hHs{?L!2OA-&pzVtw;0Qrqte*zW%0bWUo8H0c307C;gf=w3Ay;`rfZyu9sg= zaBqqK!}WstTYoPp_W{fn&9U8zW>{7lmo0A5TaV*$%DckRZ~+MdEY`f~$Gke81D0_X A;Q#;t literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/streaming_zip_conduit.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/streaming_zip_conduit.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..f9fba88ceb1576d1732fb1003cd9cb68f09c724c GIT binary patch literal 5845 zcmb7|Ym^*C6~}Ma=D{w4N(>tec@Tmz#OYpwM3;voS&|sZnw2FO9=i5)*UYxl)7|!C zb~iy|f(eF)ilPyTF^c#=#0My-s6mYn6dzH1M2wGQJ;yJ8;2bUYr1RHJuNl`163rkm)-2`#Tj zdAubXq_?QgAf=y){jjFd(#~s_LAIFAZ`F*$X8UIm>hgZlmJ3_@T;|&O1qr3k{HMhN zNNItlH0YH?=g~2uMTf*OmYyxC|5B!sgEK6&yBxd;yaK!)d;@qbcqP~mt_0VEtH3^RHFyQs z2lj$jfy==)U10wlD}&IpxLx<-sBgAE5r<)4 zkfZb;oxZyUWA^*nzN{cKm`=YE^|x1j!R?R|7> z=I@>G_YrLumsNa$-FHC$sA|8PZp+3E!rtw42g>X}P{sS5Oq4$W-U5D5>D@&i0tMYg zABLRA17bbK=_5)$PIp6oGvpst?e@^ez}?y&~*B0_CrR%fW}i9`F%R2fqO>1HTC_ z0w2Y==7Eoav%znHydK|1{VeS}bU>}wPU ze#m7t4^TTpJ4ipx>VK^2f5K%|4{Dw0_h;ZV@JW#4?&t6;@4H`s)4-=7*C78T_&j?3 z75G2!*WiD^-+<47hrnk+#Fg5&zayISZ+e=34>`{tMEMW&$87!}%73E6nIFJ8|DtE; z&r1Fb{U!4YIOm`^!gf`BH0}QlWsZZtgS;>Q0dl+?C5@&NKN>zM6{w~?s6DD3)W)@E zwX?*XVy{T$3mKMQ*UcbsC4ZM9)3eL|s2)nwE{%jvETMvBcp*JHi|dUbbQ)$X4H;X; zuph-yItqhm_N4kqh7HG(NE!T`&0lTpgV2wC%Xd?SS(EF{C>pUR_gfA9B*57S9~gsU zQ7r4m2B#dF;g~Uy4sUH}*5!yF)?k|FHA%0afRhvT&3QG<(5U-m$Cbur%eUp~#Bt++ z(60c!q()9xw^2t_kZzQb*4jt3ws3n8g@jbl)W07u_Bi~J8SqjW}IQ6{m zxk!)m+S_MKBS&E3A}XjMa%} zH)qrj{ZpP#9>0SzqPFgM)lJ?OCm2jatTj29T%_z~<7PJ+QM1VqS`1mfXD3cfFPW&v zWjwfr<#N&uP#DEt*+~U)FZPZOLe~?^+juqDv#&=HII@YMk-U!;uIb8i*_@kk#R1~?dk2Bh0}udayyg99ZE|&4N2!fuiejC zUg?*%W2XBRDjh4xSWZ*NAcBsg*+!)LV$>)RPs`|9MxAh`$``BnY)tpxTBPgsUM#De z#y8;%>vJ9H#r&pI81EGE;`lWuE+uGDvQ!fQCm5Qkhl4(F&A8%+^%9@Oj-@h4R?Tl< z1^X?3G|!W!qitDEs#saOc`(2Q{B+z%23)X!jI)*F*NQ=G;?issHi}j059~cS!V)!6 z!d~>Txg)Nx!ZWcbUDngP>IQR*v4Og-BvCT1BVnjQfp?K3$`6kzQBU>L0tSk@a^5(?t1?~N_N!uUsbiUmUjhHbGDYZfzpT%*So>`SP zPSgA_)N!NZ(-7y4It{r+dN0iT#h$HtFzr~`dQ6y~jay3SlyOtChl;Tht-PqAj*P`@ zG`AP23*d>vin^!N$AMB!=cVF0w}%}oLq6FtiO|PgDr!kES5I18$0qsySr~_%$hhYD zBbYthqMOibAb}8_(XNN}U;*)eSc>f}KWr_d?nazOnl|dn)nU4fG`GE78ZXuC(twqo zuukpw0NadBOsnD8GHjm?aUA4saN@+n++&Q29icA$-0`IMgf>MEG`=Sm3|W-`mrw*D zq6Jx$R6d`o-Zo{OJ$q(*``F3?Wx~9XQKBT^9H3hPR@0u)4ns*Dt=7Noo)IRVfv`a% z?&@m(!oFUk(&mZoL!n4;f*2}oassuHK1Y#pO~bknx8b8Bgv-R8Mn Ulc6VF9T%`L#AYj5LBi4ff4os5;Q#;t literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/suggestd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/suggestd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..21092acd16e9e41824a5e343c97ef9c13e5b2354 GIT binary patch literal 8349 zcmchc3wRt=701uarY#LnK`1S@rnD5Wl$}W_MN37RCbSe<8cB=D!#F#0cX!O}%rK8U z3JMhqRH%p|BB=F&B8m@uASfu{3q^b(qKF6zK0px#6hVytb7wX)yGfIn&(F=b`|Ew3 zd+s^sK10QFN$5uHtbQ`;KSg%N2L67sJ? z$=^sp`VX#oOp^pIdL{A>rGrOG3Xs|Ox2U0?MBG6m^*PP5+j2RSeA;HUEI=+TP>5^L z%ZL_|s?ef6TU1WZO7rK>XelU*iRKI!3d$iw^Irf_E_oQz&mjE@@F{Q!_yl-3_$as( zdLj^G;lWfdT?LxbZ~F*3~&$dOt1w!3ncIj zuN;~?6#(2%TunuLMjBKu z1m6Z;psLDta2t3bcpmaE0?!362DgHB{oXF+Tq5;hIraRVs23pp4$uQHL;ouDc_-4R zB7Hg74ZaKcJpbMeJysxng{=P`x+=Bnm9Xm_>U%jY;}KL2SFfh`fr~--X-*s3ff&#G z=>zF_K%_rNyO3tPf^xom2%LxXhr!w4M^JAX`u`}%`dy3sS;+sGEWeIEF6&>1^^oVq zCzw(XP}=2_Alv0r;5P6E@B;ADAlvgZkUKp5S^6Bt$^HPPKW;?2g+5PTfPU-`5H9&5 z-6Z?@5>xgADo-n4rdwqG%}kjODvu+|z5+f1eib}iy^U@K7lU7eT(%1+{qS}0e$=~N z_ES*qK>BW^?*#7zzX9G1eiOU_{1&(i{5E*C@*TR1^+Xy}c7opp*{|ON*`IfV?9cCm z7oq$f@Lcc*U;zFQEQ3D+&jNo8ZU%n>c7ykVCxbr)H-Ptn>%pIatHJxx|0?k3;BxR6 zAjiuCC|{=hk{*_E@*w>xwGSxg3s4eDE*eT<|GyfAFv1 ze&FB0eL%#oTo0Zhn!A_sEd4zlFNpL%=(%*<;M^I?^Yl-d|2(~r+5tqpfAM^fcB{+# zH{^314uiZ75dJt`l({YE5o5t(|`3!^a6LMNI%syq}yzio<; z3y2QjpN95+;6VC%*SwPL2>mqEv&5R%cB1aUvtkot zRY+&%4TTxQphKD%G=(48o~xB1EYyrr=s9sDioOw56U%$9GlZ~fY@fPD3_?(3lpJ=A z{H*5R5&Pxz%*HOtA`mVtu50TYuVgsg!AO?oJ9ZdB#7ppPwg-z&#ubNw9#)M&&>pfL zryU!+EzOnbyq&C)9@#aq)pJ?NPJAb=U(R50r6NK$RG6sPF*P}f(@evu4|Ma?X!WkmcgDj(;ZWk8Hfn^6PG)jT6c18G>uAoJ;jdNF`bVxypEYb{dXz z0%F4phPu{F*^fCpB_81Uo+*f_%m(BYhsTM}B7DcyE3rBCa^>;#AKN0f>3Fe)$>&KGnzn0d^1FqH?W)^`n}WO< z2{)zj2p$dYjWT7X-;Z!!uH7p)Z7G+1Z}Mns9t(djB`)f#f8184H2`cZ}=* zM!#-=<4W*6$Hox+yt`-^!~bx2j40wbg6kp2L-d6CaFEeJv=~Z_YhUam!nKS*s!ueb zKXSV)H^I%4KZQ&FPvh>!h`n?cbYtA6+J~HA)X4XNQjOz|YCiIgVr|Eo9~%WiA{Q}s z6uVfp9nb9R4Y7xFJA7vHkB*&5cd-=UnPDVtMS)?8s&M#tnX9)|1X#TG9H|%JtmxJD z8cAcx;|xyY!{@m~z9GWic6naT;xawQX`xXT#hTZTV21O!Nv4+{)dtgX!Y`Wiiv=6? ztGeDs2$l%J<}YnuX_T>Kz?50Kb)G!$XZ_W$9Dal&ul#U4;ZtbK%T0xb`h1$#zOr>c z+$y+UCTFzXfiQ*LFXX&qc}J6eB#ph+A+CAVv@lmZbx)l9H_&C1>cbQJd7H&i<8uS@se%oH39Tj7=D4Mbffa4E~=g%Dek^P(`hI(-7 z5;@^0;_2o)MpX8KS`oK399ZN|#?APn;X8&s>i3Sip)FC0EAXsUzd#tWH5JYv9VS{p z`T^4LYtcnrR4Rd};7Tfk7exm*mY*W{tkW47VO8s~YcVV@I2?l(4dl-^?&U zWCqg2wp)<`Up2!uDhRe^jr!OYOof%8{-|MTwsm$a0^Ia# zC7c3qyD;LYn(UK#Kh(-RRETt==BnI7at_V(iR$P5c;vhfS34u!8lr|b1dtF8vG3h*;*VrzJ zPk!RyO9Q52lb;&z0TyBv!|F%01&zZYo*$VRl0yYw+S!}Qs~2}X>K(74BCiC^>qObd zBN2x`M=07K$U?G?%zC*cBadiSV>u4yNuV^18!LI3-ZM=f-n5$9L6xMPTo)S7Q9_YuH?SZP>%DLo?bTe5T`1xMRZAm!gkVElD=YcM}YS92%zBzP>}m!^MxzIrsd-} z;b1e1<;ALsO{<90iC&{t3m2z(?V3JFtseInVzV56yMd{9ctDjymLX z4%cjsm!|sZ{Vr2HnGaaMn)ctETq#!GA98w({hpJ)vv7;%^?GveKdD_Z{YJmHB*{QUxn26(3+#K*0C=t+golsBiI&5AcmvrHy=uAMjcKGrRYdq-j#?=iKk!Kj+Mu zGiPSboH;Wg`UgFYj*R*Im3}69ducBf@J%Fg^kRA;y@1wJD_uq{w2sz}YB@suDe7BE zm&ngbNxs;R{XQO5j(TqB( zLk-PTr6kqfsV!!Dk&@8QBC4mOM2m0NjxvAlEgEa21vdki0B-`G2fPv30K5TsKJYr= zQpoQHJ~wTb1%E)(xqWS@8I}DEp9N|ek+MTOLd%IV+tBU;U?=cG@HYWh5Y@B;F9N** zcrmaA2z}Gn0Go*R%!J)5foIYx*-yQ;nx2=A2Z-^E(DTuMowf#l@i=*oXm|!Nm*S;F z3l(Z+dhRUfE%J|t8_+I88>M_^9QiirJ9ey{HbJfiy#W;ka+_tl4tf##;dVguyM;PI zKc$W^Do+3}2R^PIrLDlnfZKqNf`0|@DDX<)Bfz44+oAUitlAFfQ|Tr2Qq(_ydLZbl zXcy@FLGJ_}0)j@rrnH~?E$XpQe*m-%eW$~2A?3QMOX}&S9`H{CAE>yHbAY>mF9YrX z_5!y8UEpS59=HMMq1|+}^D)lzK?mS3QD07Rx;`P+r(TPgmVO9Cy29`~X1@ z&>(1DC!q9)As~p?GMd-urt z5qb^yb0Pm)V6A!sT@S1W?v;N1I!0+XP_EPKfxJ#P0v`ju0r)uZjX+-CH$m^QV>i)0 z%nSPmQ2NK4L1*Y@dJD$K{sA1GMsKCJ%YNR*DEk2_Pbs(1J0$;BM#%>%k18XyA9xt} zP9V?YyMPaYemC@K=cLGJ_o0U)pc2Z7gv{t%G;;KM-ngO32&4?YUyb@~`^7;+y64go&_eLUZv1Ra9@ z6wm>F8YqCD0b0P%0!`rOfL8%O58Mj;0_Lj&_(k9b-~k}}*_Tk?svM;Iq<`H*Ury%< zDC5Fcz^~KpMbA8c_c3C=zDnOn>%S)3eVu7Jzd&WJa)`d2)_+she~W2Z4^&p8|L*`V z27VXF`}BL5XASY@`@m_yAAo-$>hA|G1O5=01^x)w0Q@oVJm61&=K_C<`KgRsKPQ?u zM|psL0Y1k!;Jjn>EBYnyN#L*1j@JW-d3lf?0{@?oV|ZK-yNwo4Fm>t+zRLieIV=td%n z9N)9`P?)ywxrhe5td(+*&PJwZ=llUFHCoT;`fPvb!~!a?<4b)I|)IQZz zV^x6Wzd~SM_0=3|T*+<2Uper(ZVY>I4)rFb@ z_%XP)v71z5HZ^315<8F;po|`W?1yHz(8WM3Jf4ZHWm-LKJt0GpMO$_9_RnSw&)^>; z2%SDN7KVr|qsNcpC|Ny&ND5WeM=-qB;CiRUd?Y>|4H@2+SH=Z$?qSJ+|NO z&@TkYY~VXa=U^0zywT?5LNgpRIui3*Lo+Y>{je9R*$>9ZRS58WDkZ!6%+SdDImZ>o zm6mUdOAC%0cZ9xOurO9G87bc)`h@ETB1EoHxg3$O3UHi3EQKY47)zmdL0P1mxyW}5 zvB(By+#@|On>gyi>h`INiUBB!&77MoB4pO$Tb{oPJIiAiT_O}7X57%%yME4eJHir6 z4_qh0X^LET?0m55WL$+PG@>3e6m*7^W7>6)70^6M7uTQrw{u49t+ub- z^x%|sU4<3Jxt+kim1Fb-S)NhTDzn2gUhq z_Ps8ryAYy3--AoYbtT*aP{#A0V!O)Wm(9OIKuGI z(0cf7hJ=TYK$whC!_*XmDaWX3N-~arlX1<2LurR~9=_e^(N^nVQ;5I1@MYv+orLr1 z&_7OauQ7be^bn#vM|(M>hS?K#U9Iv|o+eMEr^&ylji+Jieu0n|VZRA4wtUYMmJD&l z*upAT<2&_zWONjAu48TVx_nlGvX*})vagwsxTqo`w9B}?UPQ6!miNF(?$2Dobw%uW zIo}LRdw@+E<{#{Xt0!E+Q|LS{WyEObfdLn=6_c2s!0#8K>v!v}S@5hLd&!B~Rm3Y6 ztv;8_=g!knSG~@0J^+u`zZ~YKavmlb*WGB3qTM#({8sOfBs9d>td0y296AiO1vK-F z`Hi}V3q#-?@K4U;mLgG5BC&eS^7JdC&exEtQspYEVr6FVsjte%H7e<;TP z&Osc>_NZAUenA=4?)c{=cQsaiR6nD7IA@IhQS!~c-|L8IJ1d`rAC=d1+z{Y+G15KL zm5FC^0O_u8_43Qb|42V8COVV=?rx_vKd*t~r0IDLd@4dl9wK^2GU)Tc#K(^3iy@VdS_F^(%Taqumt)e`rBzCDU200EktXeb z`UxC75;2a0?nrud;@Wb(n)!F4{nO@mM@DmKMm<|Z;D^{IMn~xoMN*j_qAMn)XS|lu z3|f4m_Q`q4FJoM^!l`hs2|cS>ZB;j6zr@%doZR)QJCT6ZaPNjK`V0?8EYaB|+Kxlh z5XF$cvU$Hx z=#lVjZc?@@i1P!)FV9@?X3dVw_wqjEt+j;V#5g2^rHxHy7xFkni87s;FYmeK{)$fy zLCkLwT zq(?n@-ScCoD;@ey3+XNUAeXuPQ?*VQPrz*;bd&(~lbNpE@&=6V!4zAC$spBZTqXq3$27i%us z9x|H9STQ*lYD`^7hYM+PT}MBR#hCm6?&xAs3UEGt{<769yxYiA#zsQRS=j((eC{!V zV`BZWtoWZ-<*=*MaNL$nyc+d6#Yuv!T%YnrscOIjYpT*WPChE1JM3&wdS$45ok{1r zx4E?7y(O>mkuCkJ%pWiLlI{83q%1c1 taTeb>XR;P}neIAXuWs6Q>i-Q@dW&(WSA?E$bp+5b#A;-%ppf@H`VaY#lGp$M literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/transitd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/transitd.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..d12062fab7b4d1a336cc7217f8ae1585e7092481 GIT binary patch literal 5333 zcmbVQYmgjO6+YeTF3A`pieZBZNeBqUINeJi(IsHA*|2eO0}E>~0vhjh-87cF#=D>}~?~ z)Xq2O-1E5S+;h*py+psD<#c+%=cn|v<{hJBbO?W$L`ZcyKyRbF=uUbI?WcY8rY_Cf zL7#2$#^`4K8Kdme?T01HE$Q~?tHHa1E^m#Th0V^-MvS%nWSSdV@=WvSx&nu?XWe7w zdT?pIp(W^*M3>PSqK(JRGt6I^^ZOq(*#fOS3Van&|6$;jK;~Zs{)~AwkFSf(O+|aN z%Rp@=GVV4{(`$hHGdq3zfEH2TZ9p4%3vd8Rs3r2ujKr>zo++|)z+hG4jb1S2s zFR*W$`C1y(eqYC^`M|y{(7PVE8MqyIHSh-D<-i+(Yk{u^t_JP^z8ts{xB@r?Tn5|) zG=Rg1^WVm9x`}A+0^|wU|94}A_7FY5G_dcl##wp;@Grno;IlyFqxa9iHxeD~gWMRf zm-gyBoic8rTl4t>k@vGSjyO&lx8WDZ!D~kSPeXr#=w(l3_GVuMen_P84x&p9dNb4g zPhz~uUkdMrUJt!h%Rjz|{M%t~eqK-oawfb3jpLAWw4O^6epn9(zg4P%ei$^+cnCNN zJZ79B4>$*W2k?IIr+~9SA9w`VoL`{rC_Nvx)8xMsa?_wAU<{0b3YfrO4VZ#rswFW9-l)W;Cg?6QTqkzc;5@;cpn7L0UrV$1HKQ)d3qRr=I0-w_vd*A>O6ly z=lO$l9P{Hm12L5k(PP@rqm0@Q(C9ZlOdr+!k1%RJ&{zq*j{$pu9|s!1$AR;R>l48L z0zV1-5AajKe*mA*e$LXT;rDN#KLdOY_*o$5`*V&I?tb{FXaA!x^BM+{z>CY z(BOHTV8r@-nZA~fe?{wkm1#Xspz$aAIz5$-e?yOdlW9E;H2w%H-va&?_-!E9&3BNu z9@PJLfxHjkNAH905v~3WeV=}i&mRc-hxDU74&drv(KGa8&3}eY=5YZb_Y+vk@&VNL zeg>M?=@gLb|K~tn&(ma3FY#mGlc5H>%-Cf-YCK__Fn($L-uRax%#6Q*!BKTfgrP6_ zyBv$at*B`$lEN(?jJyQ9iPLy4IrL=sv?pfbMAq#wuM&x9#vYHnhDhW{B$t+S8_}G@0cIxM;kkc@fh>Fjt(9cf(wilUa zJ9b%>kqjIe+twamRfIntwOCf@doj8Ny%c}l`C!voTxlHH@uY|(Ez@#L`(6dVS8KZH z->uk*SC@xWz>~aT!FZm>=KO|LQ1xnQBseQbsm_Z%o>qL%84aom`uyzVuXDvYESyP% z*e;>HdcF3@I1zr*iu0!P*(oHaV62k*zD&HJqD17jjKS6{+av0^hb}Q~Gc+U9GaIHb z6H|ibUlDLGFu-38T-V%Sj)N=BD*hM))4_KPxw@&$3M}}bZEzJh7W6`Vm}f1weJV); zlNlbAl1;040@w1_^T3HcS-Ht*>(?EB7{ip~(n z5JLq?;55x3(g1Tr4RIgPP>giL!CZ7Lmp0sa@U z1M9oBZ(-VN1}yt`RQfe6Z!ebz28ZsnpQF+rKte`gjwu$17ckMwH;P{s@TXVNg~*f9 zu^vesr?%b??HYX{eIe_B7ca0Ihf4W&-Q`_Oxched?b>gnsNrdB6c+B7Uzgkv`mpEd zUAbW*4MP=a2g|jdD;suzErIJ+i*}PpIC4_@-2U)x!1h`0kc_a2U)-W2^fFan(W0^S znZYz3?l+m9knw>5-OtfTwRYO{_3|v-e`wNr$G|_d;#J;q2F}PTyhH2aD z2rHGK(!$LHgQAM9gQ{xNr8UI)ZTo8;L1BWHte-0~=vh~^n;VVowX|knuyhfvB9?30 zSvc=VI?`)MT@MiL*+%vjE~`cMJW7kZhntm_T_&EkUD`~`k*tk8A6_e&^}7)qE2BXo zYkb`7i)A$IdooC9YsY*RsXI?ic}Y2iM%mFS01;=08+5tJguY0sDyo@h0sAhT@WL8ilric1shLf1R;ya^hGeu~^q>K^N$8*}&O zt{lUnrMqf&4im?VQk$$>fl9n;9{K?XiRD`7=N0_bUT{&XMY4uFhb~SG@xCmK-!6GW z4M!rLv?jcIip)w)X}4`VlOm|;eHG<~xUSp7i>zZE=U~}aYAOvaUpc}r2e|d<^Bt-^ z%gOGgf6jC1=;yq3QM6an*N4ntuFvaUm{45=q9$FZc&J-pcBf)9Xc@^B0+ylimh<9Go&_^Hdx57MPeF0p0xu}0pc^r(jY(;gwwEbfz z$cS$!2qIFrOT{e?VhyCjV{DS|pM`n2sZ6EUeYP&$9dcXoqR_{ z5}q3#Tv~q2+p}pSOLb&ThYobsbn0czyp~^nAkwu?o%b16Bm!YIJXc1Y;m~^6ZKuIY z(g3k1m=z~N->TX1f_r&~AkUERi3LMWHN+(}Mn-Dforo@3V%!z7&Y4}=Ii5Iqp>)NK zof>C{mF0w3O}9%AQ^^vo*T3WZi_*YG*+7Y1@%_8=e8l-}=a(isRt{d(`N112KRrju z9wd9~^K0P)c?-AD!h3YT>%KT9Xi6cD10T&QMe}#ird+d()5We+$;AbbuO`z}QtUC- zcabTyJN}PTAl8{933_Ei`f*yz@Tu2OF$Vnt%P?Oo2x4V;@of+QD z?%gFQIV1rMA}T5>NCb?CANYaaiV{B}f-w@KXc7yx$||k0%JQT1539~!znT5IyCh&S zTf4t~{rYvk*WItXcZq&Sv*^gA*RN>5rrk+*(mU`@IbsTEGrgT|piT4^x}L73H&0l3 z4aUbBv;n$GzXm9MP1M7j`384$_SK**p~a1vW02YYT7OU^fM~|uzzZ>Eya;%gSVk8^{%*0H zQSTSnd8>F0^=ZAYWz=+F=MJp91UL%36j%ek4tOK*GT>I=>w!h!<-je#6~IlvmB5X_ zD}d{P{W#|uv5KxF+LeQyfZdmg)wG7_HXZ{z`@r`G;4}agJHyP58#=V4qRs=&*f;wHIA+jC>El|@ z#~8I9ps~fcmp-BC_c3ZZ(6|ok?gw5C+ylG{_({m&czghQ4SI+k)aQJNJ_S148))=` zZ!gdUej0c_@L^yN@H4=Lz(@3cj?rhazj+vc4mbz+c_91i3*bA=c$6N~e)=MPDccuN z--j=QK1+NB8hO8uF~YxJrEg^OU(@Tp&SQNZpfS_Gt6rvaY;eH_~M0sjm90q{S-9|Hdg{1NaUz#jwu21GpR`}h;0xqqQ2 z>8BWToB`+liJqdT!N+z1V*E2Ykl6!>@z3dCW*6Yx-_tYn3r&B94rO)%f_|8Osp*Hc zzATQl-d{sL$H}umzOTQ5e!h>t#hByj2pKe;_%ZNGQ3EYAwi>&QhmFI=AB?{m|2DeC z60u4=Di-pz6IM(+ihRkR`PdHJLO5b7X}kGhW-fCr6I#oDe6ee_J zl)!{$5yE2AF2tc@NU|#WuMKn%c4{= zfW<9yjUN_le^50@X5@P@vNXLE?}_$c(doIWv9jW_tt6eI`FQMm1$>{Y$94a+ez#yH zUPW#T1KuPu2tOTr$vT(L6qay>6g6R4b4Vx*JQ0hbdA)ts63Wd(v@lDA84pahNWg6A zZwgoup(tR+*VF-gD}d9+dla+%_~wW*=3>pRK`a!S|fCK{3?k zcpiT1=PMRl%`3f5$KM(mC$^t7{B|YFYwY(V{%;B^RDEA2UQh^aMKu#-3#k{+EhF5+FB=v`wFE!2w&$0o{dVyr?6Bj6c4$A}iy4tOWf8e8-3QGEw&$ay z5`o6?*mUa)$unt1Kn3KdW8aH=&aURg>q0!lxO)l?=KB}p<>7V)h#U*GD-^@{?gMR5 zUijU8JhK#f1w4!RZ15@Mofm66*OTDv2}$rA%FRtnCfBj1U$gvb#&%KWD`8EV zu?$=m*gQv+R7QxFF%f#qHa+tRsWd^FjF$HH*+pD2+_&Z!nV0KuQ(wJxh!T_{{VYkL zV}7gLOlWMKMM&YfIoLY$HRVj+w~~(ZYEs87SUWBz>q0ni%6uK`EaM`}hhoIa6K~tf zEu}6PSNnM-_d01_T#a(NHb`WN%j~u2G5UQ^1_>>1+s_pD!wZMJBwxjfyrY)@km}Rp zru|Fg+etB0l|1)Wo})8+eco)7-#Bl*-q#K3%0jgS&$;!&ZKnb{ZXgRLSU}bp+OVs| z2C+`$xel%uE7LE?i7&GNuW=3?{hTx|TIH2=+ms5-*0bMRHdL_#bjYsL zTKr9PvRwU9Uv>4@D<_=O_3ToBhS_tnbL#rlJgAHAOnC)#i0hke;1DWA4;eQoIBOsso@0@muUhuuR%J32gu^&J z%wpQ$tKni2y`-JbkF#_4w$q(Z$@&ik(~tRj)@7uoR^~|LV9mVtb!n4c%9!H)kjqgEQAdfu`2%E z(Oy5%XINQtWyPU`zlQk1KP3Eg>?Es?tmV%yg`*7W6mBAgcj$aKvDHtIlp>S^AIYk! z8_6<~Ql5VxR4C`7QJmLnS|gMTS!0aCfV>Ey{10b~nUC*gy=#0-xCdL|zdhi^MAM}go;0Hb!|F^nldS-W%pvRuG z^P9SL>sHmhRduVE=r2^DW79r=q@OF1{MjZ>6`;we+SbE#HXp zWJ|V_u27$ylzyi6!Nmd@rL5U~l?oDeCfm(w0j)EOG6kHVLKAqNDm^ zNNKUA+SB<&FQel`OONQsS$=jVpXfnp8Ij_0BJELql3orz2tu#-zLX2@1y`WFAG|1& zuOwPd1-RD4W2Uq~#0Ct1$ z$7~H8BHG&xy`A7}+NJ#UjJBJu%*G8OK9h76=JT|6HGc7YIP%o{lr~A%5WV;a2zx3{ zBN_J)E!61EgmUkbsBg+oMhop`QAz1PHiN!^y%Q(ORDoU>dIz^|g1MP3p-bwGu{CETW_>6WVm({ueC$jYp`|qZkvT=hbzlZjs z%>Dz_I^CCz=VsO4d+B{y8C*CU{obPFlk|SbL$vza{z#{--o`Ye53 z_47HV>Ic*=*S0XR$AK{<;zRP7b4^TTxdx*ZD)qhXbKg?xS4{AN=_YrUw_ydsF-w!db zF6^csfwRCzA=e=PG5Bxv`V;Uu@GB`kj&=q2FhI0wF(2e^BzHs=xO0`YG7w_3LJE$907@5?0eWE@0RMHpf<7QS=?zi3-_m8}uIgul!%avN4G zOcC2=HIT7PM{N?#omMYJ)NpNqBZHrF`KzOS7zJ@)2VSZ$XL`LQ<%l!A-%1oDA#x*p zX6_!7v8bEd-BM&lW9Cpgye*Mc7b8JbgK74|G`%(j_Jh_MSHp_TdQfsbVP0bgj@X#E zUOW^9PGV!O{1lY_CeaXH5Q>P_p`3?93Ohjn#^6F*gfU!blwnL7R!Ih45{qJJ#nm)Y zf$#D0*x5b{r5J^w*eZFc^P#f=f4TqK#+lDultm5buk|JJjlzY)n|Tej&CsV%Wfr! zEcOaqs{CROB_+?bxB2A&?fKcjUo*v{WrvrfG;^QtQ1RL-WNdkHYo41=XQ$0MZN^H8 z=ZV<$OMw+REn~1X!S;x{uBY>KQxEk>clCyD>9H5(Di*d{}1mm>v}bLC69Zjp7w*i(Sm4cpm-iNs8|O;+AwH!aI_I|?6DYw0?4vQvcM!j9y_)%AhS}>0Cd@u7 zgN_-JZqB6@1>92TMfmI7uW=o>6}A5IHSyo_2sZF^-T(icS5F?)9>iZ_W)T9) zvy=F^h`f)LV(OdlYXrYN(1L_l$>}|FF!Rg-TFRq8{kotYrRRu->0_zmn%XKmab($| zDm*^c+VsXngw6SamR^K2DyYA(RmPTP0hjUcIYK7ew}c$-Q|ELZm+bs7q*WHhde9Jt z6u!ev@^OW69oNT8ScrHSDjp8})zD3I5n;o{SVZBo3efHe4@xVfDQ>q#$~SCejYd}LuacY!McKV2)(qV1f+I5k_0(Khh9<>RL3*zHN# zz>SRCBk!rK%q`M;T|QyQwJJU?ey*MQL*QxII>K!>Wc#UA(W_#v#>M zPaan4olzf&t&&Dwt*g9$>=+U84Fi*i0^EgUOMTHU$*ynONL?KnqoIv9^E=z6m!wK|d4bB5ICb7f z94odkt%mD}sB=2B7Do(XKbdQgH)l+*5{DBf=4x208Ye z>2Is*)~%{rx2kT<5Eoja5=aT zTnb)D)K&lsAnQ|+-=5c4-|YGMj%+`6Pef`lQEqbn2rU68LLPDxTEL}X4qOKQM;W1u zz~{i15uNf6uoG$Ka`11;3c3XPpHVJm%5j1do>nfUF4^v7OqmZ(coOxx!N6^lId9R9=I>c)aWrG-Vy???8J!;MGW98tdKt0+jC}k~E0U&XLLKwnZqfgDNmQvQN5J)=nwn*@eg z_6wAD`T)pw`XD$J{17+|{4mJ&{Rs3PJ9ayLG?^bz&d{Cu1~f&TLRfH2i3=~J?u zJD9Q^Ft4_^c$$lWd58KEyB zZ6W<-@M`cLa0~bq@N)28@DlK=AkW{|K%Td+gPq_(@FMUV;8O6L;9~GTupRss+Ft;E z8=M8+5Au9}2jw$z-=zoTJRhR(CF23*y81ryH!2TcCU~3=GSTi2=!Z%9VOj4XPD?w0 zxifM4}D{D~<4CD;N!3g*CH zf&WG?ehvN$d<^_22>+Ao`L{&VpQXp?cgc7`q<>FOB;y9B|COGiCuROq^oPU_AmskY zdZgWI`u>D8`^}$0UdMj{*}slZj#`MH96m86=s@m?+&RjH$}(k}QdagVQ}S{CT!!IR zRo(M!!S6z#J7&=xQhlMDg+bp61w>%>@#N^mT&{V(HK2z=6QQA1+#n3%UT8$qMwJJ` zAFvD&Z~@Vo{A#H0`EKYMt{n?Z9bK*m!Js+1-LmgS9?n$QKB3uMz{o zc0J+K3Zzr>2EvG7&|y^!8Nv%K*HKGQ7N~kLaP24*1y2tvvE^OI#okxv)D>-Nj^Gab7q312v{xTdbL-J)*y`t>Z;v#kKTJ-rCuW_z&ecwAB7Ye7Z# z1x=K4oVKkZ{+=$=Sv#3UEwrj)r|WPhci?-%{YwpI8MYglFp^_dhfTo_W2#-N09 z$n#u3O!RC!Nj)3;u5d%EWEr~j#^aiH)ye7a6)v`wUJKLYXU#|#Ltkz@f9-Ldl2wj; z*)J?HxlXiRIrVFulFR+U)5WiG_2@m$lvOJ^yX;wipjDFceGgo;3#|MI~Npo4E2xu!B#=|!$kO87Dz z#lSm&Tvc(EA~e`YYshtxqoSUN59g_qG@DulA(JyKR0`YWmb-*|aRT=7+(F^nZdtYU z$T2GBdJY(5CmQPJ*g^`0@&~}af9l@|;a6LTS-Z=F~wRhII@`T?OSRYOf&B0Q| zb*r8>Lti&UMc8~yXXJJYADhdmbvYkru3L@Q1M9(-#2H+UhtI`Wzb=9u9Ww4n2br9Q zYM_@yq3RC6sf1&4m9$@8SRG32hWS_J{F|7I0Y%eh6E=(xlj|+)=+sMC(wMR|-8xgo zO=)|z(9H`GI><-b6MAQ7^(IOKZ5GY!=xm*e=#1r3J)`^W3qx1~LhjoT%`YQuF^#bYgtaUCj!IAr=W z#yYdyek&|Qs8KLv6#x+-tLLYUU$UKbVz@7KeUVX)B6e=i*29wPR||-G5l~1!=4$+? z_>N(ZTKrZsv?+>F88d6v0x@0Iru=r&V4^vsohc2!TIs`PUzmo(Mx{Ic1A81 zJ=?`05O8@JmJ5}_ijL0iZTe1aJ+)p&No-|_Wf=y?3X}Rx_nhvPt8~QKdLUN02D~Wt-?YQJVYrbK2Bw<) zRn;B63?nXLeW{#f!nW}6+NH--E%Ta4__zsFi#TNv)#_1LN%p_Ao>49F<_MKe*eoi0 z+|}4lSc@~GdYlQ9+4W|1QN^8uvkcwSagmX+D0HyDXZjlt!!)u%n2H-2M`5)9oNL7Q zy0pJI6Uq+4X3I$CSH=t3@*woBB5pe7j;!wmU5f^mus+_0GW`hT1@8E68n5$IeJqKfTgu!K8kMEC}ewdL6`yF=>qc8JZL2dxkN%X=- zIXg(k-O-qDU<0a6f@%l6ZPj!n9-|IJtQW^4qw3^6-QfM?(@xoeu&N3!!c=Nla6FSU%_Tvz^SWMsntZlKC?sB zhN#u$76Y6DI1e~-Z;X$RKh1Hslk+aMdqV}5>BKiJ9%G-C*Lt(S(;5Fvko^?`|2AMH z{XMHQ;eEF=%m-}a!P&Il$G*QO_i9$zyicCkeLv|>I-t?_YgUe@=^R6clY4Vq%>N08n{9kp?&dkn`pqSKtGyl9- zuU@@+_3G8JME{`4w4>?oZ}e@=yPV!hFGv|zkps3dID%5wi zE(D+b1seRfQc?4ZWP#8AV%i{EkC*ML_M;$wH|QSpf0yW`w-F&ehN%zpyj8eN>$m|< z*#fzKt>2>(^p1mGAo}wu0G$I31Rc^vpvQv-f{yTuhQ_Az4?7YngU@yVL04!kXr4Eq zu>?4v+YQn>wA&BufJOoQ^}yM{i_vZ$@GsHh9HvXbKNS48>-r(u04#_htZ$CjcQER4 z0AbH%v=MrFUV&4li%ncV^eWImJug=Pd0yTHd<=Lc@NwW(K%UR5(eKWko9P;~<9Gn- zcz8GHgXmg%5Ah)Sbm;py&;@-TkmKnSsP8rIrw4Q# zeUd(vjSr~f>(k)d#%ItokNW{e#NUJT`KiRD+t?Plt z`RM=4z}3L70C_!a!#tUo*RKM{03QbbY}9`ZxDxmX@J!&Nzz*Qofu{o>11<)B19+F% zL5~AZHFnT9feV1&0-g+f0{%0g7xwEs^CZ#KImUPByQpXX06~9`zMuIC2>L1dLFO;u z)WeOZX}jh>O+U>1$2eX5h<*(IOy~h(UVlQ*Xt`(Tr|6H@7ijQ*M!(Q{o~57b`e&Ke z^AAM*FX=bnPcwc^zXDDMg4Xpw)c=;A1AnIRJ4Ve1g8zH^BlzQuKQIn)USN8T@h9}m z^?#o{fPy!|}AW?qo27cbQ z>^`OC4{ek$DaW;96;)K^6e49g`L&UoKy=z}{A6vdt z3D^apyMN(N@Gogv^1-)_V zmqz(gP;@;dm%GKtiUtqn#v}SvV#~fDPU1A~B$4j6p`N|(+6ub4Oy;kK`Y;NTzz)1r zU}AH<6~}9x=6-vlpd8`^$K&f7j1yI=+9*5I;dVq;Nv#c{eyC>uH_6oraGbRq_jz{U zsKsU1OFE;#Dccw;7anKmSxHY2mGT^$u5Bd<4qb__96p9zqAJP@LKV>h(6um*m0d<0 z4kCnY6>_^m51bqqtYRE^$i_4kS8L1u>DIZfOvlu8W^@5`1)zuU*@Hl~r zQ=0UIb?s{-U#SwFk*);ZiWAq4GYxZJW_v$v?^HWp*wn5uUJ(nmVeG0~+dT+u03;^TqatMlkcvh*ouk-Qn{kTdDUl#59e zkcvYz4{HtNjakCH0ZH?Q)J)u)s_%Qm|``Lq|&lfg)SwhHL z2zL&6B?@DuM>)mofEg|tC8?`V$m}SPJUUx32U2bymQ0&-(6ozgu?*eyKrzl3W05=$ zLA%;8t6R4kK!Q%JqQ@yxm*e?+SANU<9|mhxgsrsTS!LhubB@|wyE=cfXyg7@o1g2s z66^VzUHbX|bv~<)>lN@jpYa@g7#m$bg{^AvOH}q{JQ%|VTy+nB!R|Zuyxnp$=|li4 zOCpq&EGHzu#sgheN%ekzQd+p3AeQN?m^zJw!UHXq}GjpxXu z6oSY5K&{^qJul<@mtI)br~1wEe-W3XZ&}OXpI)73+u;`rzxu=~_$UOQ_b&Dp-^Ds` zBH=Zk?Pa1HhoiCFzjRbZ`q&E6`$I}QNo3ioPkDUIt&>})A}pwJBkdwwi-OYrBQ&-= zW-yJy=h#%ArQ+_kQS&t7f2&8q+ZBbG@EvYavnxzW14OlbfY*bAaa4qqGYG>;u(-lw z+U8q5*fKEa8l9WQFF9QB2DHc5QHwaQyZ@rLOYfDTo}U0_#&S!x>TlBbr@A=Gu9{)O zcTp~fr(n*|!<4LVh+3xt-+gBsZ{S4XZyjwt)qa zy0FV#($uC=08~?4wrL?S6-5X_*eF#cMVF+JT=~u8+iX7>h09H=^|1+kxx! zGCxthe9b-wZxHRCtNeujQ&O*|`5x{D{ce&kqeb4+Wa2L3-JDxA{2YKQfAA0!R36EOe) literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/webinspectord.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/webinspectord.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..5c0a95fb05ffbbde6a1ab87d74d3bd92955fcac8 GIT binary patch literal 5829 zcmbW5Ym^*C6~}Man%5wR2J&#pCWMzUPWM6#WD|sJHV+~RY!V;=l+e>%Gt*8_cU#>( zyBko6CIpG1Ac`oy5sfi|AR^);YE(3U-KI6w>NvkE@ZhaH#&ZTo&Eytm=`?DBr?Qyc6i(2wr=GMNB8p@u&7sNu; z(n3Q^(CdlLrej2lpBKlt{o^T5O4`QTIF1w?Zn1K$9$+!EA3EZ)fS zeFwzSPW`)QqEsX@?h!}H1n+`8(ki)jV) z$Kn#Eo%r+&^t%+a!MA`nftP{TgO`I_!PVeZ;2?MfxCUGU4uO|} zYr#vvb>K2^Jy--cfail(VEuh!BfXXA_8G7zIQI;3C2b5$tDo&sJ4&H%Cg zX#yN3+B+R`Tfk|wmFxTdY;2=z@^ygl&vCjI^)DLN;TNxueM@tHZycu`M6W#xqTlXU z;XBQFBhdnb-p1v*&!D|oKNW5C>!FgCKRk)NguW9e%2a`z!04dy1mvo^pGWV&INT4! zxHa-oeiUWUcm%A2hm2zsfCs@4Jb?NLdJ%(2T&e?{Qbr# z-ICj9OxtZ2m$m;v<6g+YE||}|=-v5zK$PD@x1r2-0d+j?2Jc4sz2JWEeUO`mb?yOq zy?ar=2lcn>_B&{wmcIk%0>}INnR;AMuWLWZ>-qqA5d0u`2)qkqdwd9bPn`HL-JRPL z)b_kb+w&uIFXqSg1a}+sQMyl$^D(9#2Q)n6#gT~G1_epR&_yBkf_$hD; z_-XJ;@H5cMarIf0SEBqma0U2za5?w|knQ&%xD@=Np2u-|2<5X;{t~zV{4&@J9suWq zUjgTU2fhh;@CNzMHo{rQ5&5W!(-M|Am(Cf&T`-4|2R6h97zmB|iXp|NId3 z|3v$bz<+>8z`ub%2LB5F1pEv5Q}9n@t5;i##k?G{Irmq>`f>@Oupuj6(rQeMMOq$Lx_s)lhA zXS1+~&YaL5OV#ikiLK1f9RBL+AE_`2ozTw&W>0Ll<9NiKIBrFSX@olqHn6sh#fhw2 zo4k^;)tEJ$O>e!j>vAMiHK^uwO_1vlScUesd1C3LFvyrGM;#d@UKp5V&zG@jm*UV* z6IqPxq?%bS4163r3%dK~rj?^ml-MPoO{<^P{M}lA!&X*3EJ1b0++|rR8Ngzexxo)h zwm+;|Rc7RSaRL>u!Qc4xu93BTv*a?^i2zFV>quP%3m0Z(!* z{!V&+ZG&x>rHw%xNhb+aYmTgH-7C{KB1>LVpWCVMROmCTK?Jeq*zA}*uCjHnl?~~K zkyJE8%VlxFQwaHssK=xE!V-~C!V?W)i$qA2`IiFgA`~UG__}ror2rB(Y68?K5kqE; zNKtY#ncjZWx{eB)Nm#3j#r}c88!SnM9VqIJK%6OIzMb~Y{k_8pUAZRp{A5^#Zt7qU z@pGD%=k>{rK_XRP6_@cKvzc6fb1w{qLD{RMN*fD9={UBA(-I80 zF(~JDq1CKxvU#@j*iIE8*>?G69k&}~oY;QSa?vaFcPaIKnRr1dv{jeCck{g9w_9G) zZ=2zx0Dl#D$rX#lFnlFNS^G?)#lbK3UAKQ7__r=h^o#IepPRERp9+#t$rTr4!ah+rB9$LjOy5oer|Mqta{W3sH;c}mLVodt`lKFN-P;7i(&>=vjyK4mj^m{5 zyZ`5W%Wj5QdVE(ltN^Y;y4fnbiLxD8l|FAfyhGu!SZk|?FdP( z;C4K`f3tqJjCc0ybG<#^eE*oSU6#dq*pOx{1DCtB$BUBsDDj&DKRu?77Z*Nl2+Qgt zY~w_XiD+s6fL(@5;oo+-(5vsI_IS;!F-mZ>>*w4IJ$;>ebEUC$7WMWI6lUZ0W4X4T ziSt&{kzPY;e?YY7VzMs6X@Llx5Q_*tj%pVtQYc2PBJs4X!cv+AW9fL%$3(Ud*W(W1 z1Ea#%*0s2EhkQ>43BNIQ%x4n6dtuE>iYa;&9o+@MjhihuyU!!vPRgOG7m+nIkKJaw z*`>d=-sb(;G^8s_X$78hn-`&-Dd@S8ESO*+S#z{u*NbgpvnZa4!qs9h`++?OLpY)) zirAAOHhIkL6<8(_#Z`Rh+PkbxRJfc(5vQ?m*idm{8xLXS<19gsj(rZ>R`uR@a7yrP zz^6qFjb?ss^LXII|t*2@S6}_)iu88Bh-8_jO>o}i_ei+u$$n- zYWIr~F+n9e^-H!>VGDmWs$%-1zw{b3l96%qd@p;KSo4(y6_F=qSH zGm&BPt%rL>-+J65%TwF)a6P*cAd&T)+}`@!?re_}<&}{6xjQ>!Azpo9LthQN?>pC} z6Vj=}2CqSr$>RjCWRW$seX$zkhH=Z{-S*{txMLn}DwA3ej$rjLi)q6T4IB_eoJV!Y z`EkDP{_c7wRI=#`(~tR>XzIvJt<2GgbCKTeep!-J$&&+!jPq0Xeec?djb$}FSE}yi z(88{1dPy2!?MO1&n^~6615bEw=@R4_a^BmqUZ)%(sg7Zh3ZIfh^QUNcZCU5YJ*~Sv zaq>VJw{DKyG~zvOIuX3-j_Zf1WQNxM@5(1s8d&jI%$GPGeg1T{^L?Ku6;>QNHI^dU zpP^?jSp#G(Ke?-2bTvU z-;rhw24jO0F0yg+=t`_ug??{sFRb%@hns07{@TqaKhNfSx89F|OibSkYNqYF`Teq_ ZOKMK$`X&+~rLbv=PLy(#{tw0Z5VrsT literal 0 HcmV?d00001 diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/wifiFirmwareLoader.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/wifiFirmwareLoader.sb.bin new file mode 100644 index 0000000000000000000000000000000000000000..0bb125e6df86f3c826271af7c58e2639ff40519d GIT binary patch literal 5141 zcmbVQYmgjO6+YdYEM_AJ#*je5CI$k8INeJi!3B|QHg1e=U`+%fQRAKNJ2Rc_>D#&8 zJ-Zu3h#0^JzVU&IiW)UO@rf^zwe*KpX=z!OWtF96l|S^4#Sg8rtg_;FZuiV|?{4Cw zr>4KX=bn4+dEImFEYT0?Idpo_=X>;&q0Q1P&EuPM9HoffK!@qIbcpVu*U(*b=Yo~{ zF`nv8vIuLJEWy0SMj51G}^Cd~Es$yaXd@$;Bxhf5U7pW*xL z4WQBn%W%-;L@%T>M4OJ;XPACbL0_Y7mO$&@F9CkS>Evr zFxpCF?Y2+Ti-0?GIfJ(X9iqWepbOjq906_vUQcv^1Kfr&;|;*;>>FtZtGzdQd*Zjtspglwn^B6ezEAYJ>_;cW1;7@_@$MPQoUrBUgIrt`l z%V?kR(<$qAx}(q+2*1zM6zn)@y$XM^9UL>dDI+H~`mmfXT|@36j1%x5v{ITW{FK2@r>qW- zO}v5De(=HHW}i7A?{f@z1b8nn1ilf-`rT*jdlTJX*atNBJz(rRPH!&k10E-OkWQHV zdJCi34`|(FJw%Tf`ooNd4zwJ|e=Be^@NK~Lz_$a}0^b2#4SW=M3Gkgj*85$+3xV$j zt^~dZxB~cI;2`jQz<(hQ?>G9)(__%@9~gfC_$=^)K=#vz!1q`BFg;=X^EiE^&!YBbv_6IvtnU+y@axCv$zuK!X5A-wZ0rGAf2L2-$zuM~X8togHuFI1PmuCi;2(gW z19DtH5C3w0o&qidegX8~Vg8H2-vYk`{59~)z+VEt0{jK=tH7TD5l55PUn5%k6Z$%R zqp%l<@i*yPh26llKcc7U+lKx$eW&mP5PaWdImUlodEdvFwj<&=l>DwGBJ%5M*3nYO^CC%R{Kfk= zwaQ}DeAw zNL#t*RTSdbUr}9OghtLnP%7#nhsHcR`Q7thNzcCRvLUsM;BnX46RNrhr*x0x#9@%6 z5b->G7y5%m=XPa@c9WLS5_byb<8c_&@%LIYF8j%^yJ^st$5g~h=JUPvZX?j`83=M` zf(EK9U1ZjeaT4y0QmG?>+KOkLq4(FZxFBjM$CnL}h3ObGRqT%YRu%CdS5YHqW?Hbr z-F~w3)?LHVNnuY}|02#^|5bz_ zwX8+OKcQ+SCJQEtl$cb)m)ZdxtQX^3jZ4~&LF0J!efYnetGuGEzNMd4A+p} z*iW_aWJ`v8e5ucOOlkyqWsgteEUNZ%dt>Am6L^e=&r2>}$mH;dsYiW%i#&4@(U7&a z>PRP%5iTR;{o=GeOLQX>5jV%g&4+J0w(AZP0+-rzcD!|DR5ajP__;qGT4(BMf4^=? zk5iNs^IVm~z;Ib^AvAH<)4Gw-p;f5b%-5H*SZ^&o8FZwH2UrJokh_hR&Iu#|XP1x6 zQTD7`BUalT+Da?ntWB(sIsW;1m_S+NLeS)Lc_(_sco@hirR^1cmWX?xrh~MWVMWa| zO91E;ES?|JXUsmk#`oPlId*$VHqUdC#-T_XO1Eq1hB)1(Z15aExZyA5k8WM>I@*`@ ztcl3_-2yGlY8p61E?l&M+)It)C+q__bhXtO++mO9f8eaZQJy_**Kl?e4r9XeO?WP~ zYqyMyj@=`Uxsx<>8`(AYF0ws#WHNMsw?M1qXJ89fl+Gi3-!f;^!)fNz&!;+pM8}-U zyw4EZi&Sj2ok*o9j=AZFJvg4v0zWU{S3e;{v#DhhE#D+Brmn2c@0YRC>9`h2%Q+CV zGk8{-k=eE{rzN7MId{4c#ChMJULwwI)X`d~)N~f3RCpq+Md<3Le_`ps3UZgz-_LSt zndd*|O<7*kw8vavv7X~zQm8E=(UiVd?ko;&EZh}PcTHC?D;L=52cj9_Vib6Vo!3<5 z`sl(ssN*K!A1=or*?E2E24>~+Skfag7o2m4i`Fd3kJ{SIBWm)c?`WJ9sku$U2(55e zNO~058cC1mSR~)CN_zO2Os69?1MA@yM}V(`gG+Q_l`l*RyGN>YPifh`5ISMP$G0mZ zceQqAWBh6}_kq&Bd6RAy%@ZsO;#BR2zDNbk>ICR7RdZ-V#hf6`BG{fnD|Upr)Uv{h z?!gsC){yTxCH=exUq=#nq{-Eb=(2On`$D$avlmt8Q?E!Az6X`$;-n^7%xBB-Vnowl zunwx^jyCbH^jn=pF487%ujYPP?Z@b^ZYZ+IYx!=XJp9z<2fz6E88|`iD7oAJyAnTA zlz0ave!$ebg%^($MJYzR2vMvubHQk#DAmw?+%^sQxInBMaokxNQoLh=YKXeXH;K(q zrk}Rw4ztl3uLb9zvVeI;@$Ji7qTZNmuV3rmF3Y!c{JV&SOpi~Lu4QA<95 Date: Mon, 8 Sep 2025 20:24:45 +0300 Subject: [PATCH 3/4] Add test for iOS v10 Introduce a new test to ensure correct functionality on iOS 10.3 (14G60) Signed-off-by: CristiMacovei --- .../inputs/sandbox.kext | Bin 0 -> 577536 bytes .../iPhone_4.0_64bit_10.3.3_14G60/logs/.dummy | 0 .../rev_profiles/AGXCompilerService.sb | 546 +++ .../rev_profiles/AGXCompilerService.sb.xml | 38 + .../references/rev_profiles/AdSheet.sb | 1609 +++++++ .../references/rev_profiles/AdSheet.sb.xml | 37 + .../references/rev_profiles/AirTraffic.sb | 723 +++ .../references/rev_profiles/AirTraffic.sb.xml | 38 + .../AnnotationKit.MigratorService.sb | 306 ++ .../AnnotationKit.MigratorService.sb.xml | 38 + .../references/rev_profiles/BTServer.sb | 808 ++++ .../references/rev_profiles/BTServer.sb.xml | 39 + .../references/rev_profiles/BlueTool.sb | 546 +++ .../references/rev_profiles/BlueTool.sb.xml | 38 + .../references/rev_profiles/CFNetworkAgent.sb | 163 + .../rev_profiles/CFNetworkAgent.sb.xml | 38 + .../references/rev_profiles/CPLDiagnose.sb | 683 +++ .../rev_profiles/CPLDiagnose.sb.xml | 37 + .../references/rev_profiles/CVMServer.sb | 294 ++ .../references/rev_profiles/CVMServer.sb.xml | 38 + .../CacheDeleteAppContainerCaches.sb | 328 ++ .../CacheDeleteAppContainerCaches.sb.xml | 38 + .../references/rev_profiles/CommCenter.sb | 514 ++ .../references/rev_profiles/CommCenter.sb.xml | 41 + .../references/rev_profiles/DataActivation.sb | 974 ++++ .../rev_profiles/DataActivation.sb.xml | 38 + .../rev_profiles/EscrowSecurityAlert.sb | 297 ++ .../rev_profiles/EscrowSecurityAlert.sb.xml | 38 + .../rev_profiles/IDSCredentialsAgent.sb | 217 + .../rev_profiles/IDSCredentialsAgent.sb.xml | 38 + .../IDSRemoteURLConnectionAgent.sb | 541 +++ .../IDSRemoteURLConnectionAgent.sb.xml | 38 + .../rev_profiles/IMDPersistenceAgent.sb | 387 ++ .../rev_profiles/IMDPersistenceAgent.sb.xml | 37 + .../IMRemoteURLConnectionAgent.sb | 545 +++ .../IMRemoteURLConnectionAgent.sb.xml | 38 + .../rev_profiles/IMTranscoderAgent.sb | 788 ++++ .../rev_profiles/IMTranscoderAgent.sb.xml | 37 + .../rev_profiles/MTLCompilerService.sb | 214 + .../rev_profiles/MTLCompilerService.sb.xml | 38 + .../rev_profiles/MailCompositionService.sb | 1299 +++++ .../MailCompositionService.sb.xml | 37 + .../references/rev_profiles/MobileBackup.sb | 9 + .../rev_profiles/MobileBackup.sb.xml | 21 + .../rev_profiles/MobileSlideShow.sb | 1268 +++++ .../rev_profiles/MobileSlideShow.sb.xml | 40 + .../references/rev_profiles/PasteBoard.sb | 216 + .../references/rev_profiles/PasteBoard.sb.xml | 49 + .../rev_profiles/SafariSafeBrowsing.sb | 301 ++ .../rev_profiles/SafariSafeBrowsing.sb.xml | 38 + .../rev_profiles/ScreenSharingServer.sb | 533 +++ .../rev_profiles/ScreenSharingServer.sb.xml | 39 + .../rev_profiles/ScreenshotService.sb | 254 + .../rev_profiles/ScreenshotService.sb.xml | 38 + .../rev_profiles/StreamingUnzipService.sb | 229 + .../rev_profiles/StreamingUnzipService.sb.xml | 38 + .../VideoSubscriberAccountDeveloperService.sb | 213 + ...eoSubscriberAccountDeveloperService.sb.xml | 38 + .../VideoSubscriberAccountPrivacyService.sb | 163 + ...ideoSubscriberAccountPrivacyService.sb.xml | 38 + .../references/rev_profiles/WebSheet.sb | 1244 +++++ .../references/rev_profiles/WebSheet.sb.xml | 37 + .../references/rev_profiles/afcd.sb | 550 +++ .../references/rev_profiles/afcd.sb.xml | 38 + .../references/rev_profiles/appconduitd.sb | 501 ++ .../rev_profiles/appconduitd.sb.xml | 38 + .../references/rev_profiles/apsd.sb | 441 ++ .../references/rev_profiles/apsd.sb.xml | 41 + .../references/rev_profiles/assertiond.sb | 328 ++ .../references/rev_profiles/assertiond.sb.xml | 41 + .../rev_profiles/bulletindistributord.sb | 661 +++ .../rev_profiles/bulletindistributord.sb.xml | 38 + .../references/rev_profiles/cloudphotod.sb | 20 + .../rev_profiles/cloudphotod.sb.xml | 38 + .../com.apple.AssetCacheLocatorService.sb | 527 +++ .../com.apple.AssetCacheLocatorService.sb.xml | 38 + .../rev_profiles/com.apple.GSSCred.sb | 213 + .../rev_profiles/com.apple.GSSCred.sb.xml | 38 + .../com.apple.WebKit.Databases.sb | 129 + .../com.apple.WebKit.Databases.sb.xml | 39 + .../com.apple.WebKit.Networking.sb | 399 ++ .../com.apple.WebKit.Networking.sb.xml | 39 + .../com.apple.WebKit.WebContent.sb | 1048 +++++ .../com.apple.WebKit.WebContent.sb.xml | 39 + .../com.apple.assistant.assistantd.sb | 695 +++ .../com.apple.assistant.assistantd.sb.xml | 37 + .../references/rev_profiles/com.apple.bird.sb | 786 ++++ .../rev_profiles/com.apple.bird.sb.xml | 40 + .../rev_profiles/com.apple.captiveagent.sb | 132 + .../com.apple.captiveagent.sb.xml | 38 + .../rev_profiles/com.apple.cloudd.sb | 679 +++ .../rev_profiles/com.apple.cloudd.sb.xml | 37 + ...apple.datadetectors.AddToRecentsService.sb | 276 ++ ...e.datadetectors.AddToRecentsService.sb.xml | 38 + .../rev_profiles/com.apple.homed.sb | 975 ++++ .../rev_profiles/com.apple.homed.sb.xml | 37 + .../rev_profiles/com.apple.nehelper.sb | 676 +++ .../rev_profiles/com.apple.nehelper.sb.xml | 39 + .../com.apple.nesessionmanager.sb | 626 +++ .../com.apple.nesessionmanager.sb.xml | 44 + .../com.apple.networkserviceproxy.sb | 388 ++ .../com.apple.networkserviceproxy.sb.xml | 41 + ...com.apple.quicklook.QLThumbnailsService.sb | 605 +++ ...apple.quicklook.QLThumbnailsService.sb.xml | 38 + .../rev_profiles/com.apple.rtcreportingd.sb | 551 +++ .../com.apple.rtcreportingd.sb.xml | 38 + .../rev_profiles/com.apple.sandboxd.sb | 68 + .../rev_profiles/com.apple.sandboxd.sb.xml | 43 + ...om.apple.siri.ClientFlow.ClientScripter.sb | 456 ++ ...pple.siri.ClientFlow.ClientScripter.sb.xml | 38 + .../rev_profiles/com.apple.snhelper.sb | 171 + .../rev_profiles/com.apple.snhelper.sb.xml | 38 + .../references/rev_profiles/com.apple.tccd.sb | 501 ++ .../rev_profiles/com.apple.tccd.sb.xml | 39 + .../rev_profiles/com.apple.tzlinkd.sb | 22 + .../rev_profiles/com.apple.tzlinkd.sb.xml | 38 + .../references/rev_profiles/com.apple.ubd.sb | 619 +++ .../rev_profiles/com.apple.ubd.sb.xml | 40 + .../rev_profiles/com.apple.wirelessproxd.sb | 68 + .../com.apple.wirelessproxd.sb.xml | 39 + .../references/rev_profiles/container.sb | 4172 +++++++++++++++++ .../references/rev_profiles/container.sb.xml | 27 + .../rev_profiles/containermanagerd.sb | 479 ++ .../rev_profiles/containermanagerd.sb.xml | 38 + .../rev_profiles/coresymbolicationd.sb | 194 + .../rev_profiles/coresymbolicationd.sb.xml | 38 + .../references/rev_profiles/cplogd.sb | 184 + .../references/rev_profiles/cplogd.sb.xml | 38 + .../references/rev_profiles/ctkd.sb | 96 + .../references/rev_profiles/ctkd.sb.xml | 38 + .../references/rev_profiles/dataaccessd.sb | 665 +++ .../rev_profiles/dataaccessd.sb.xml | 38 + .../references/rev_profiles/datadetectors.sb | 213 + .../rev_profiles/datadetectors.sb.xml | 38 + .../references/rev_profiles/debugserver.sb | 200 + .../rev_profiles/debugserver.sb.xml | 45 + .../references/rev_profiles/deleted.sb | 391 ++ .../references/rev_profiles/deleted.sb.xml | 38 + .../references/rev_profiles/duetexpertd.sb | 451 ++ .../rev_profiles/duetexpertd.sb.xml | 37 + .../references/rev_profiles/findmydeviced.sb | 743 +++ .../rev_profiles/findmydeviced.sb.xml | 38 + .../references/rev_profiles/fmfd.sb | 627 +++ .../references/rev_profiles/fmfd.sb.xml | 37 + .../rev_profiles/ftp-proxy-embedded.sb | 198 + .../rev_profiles/ftp-proxy-embedded.sb.xml | 40 + .../references/rev_profiles/gamed.sb | 678 +++ .../references/rev_profiles/gamed.sb.xml | 37 + .../references/rev_profiles/geocorrectiond.sb | 20 + .../rev_profiles/geocorrectiond.sb.xml | 38 + .../references/rev_profiles/geod.sb | 572 +++ .../references/rev_profiles/geod.sb.xml | 38 + .../references/rev_profiles/gizmoappd.sb | 522 +++ .../references/rev_profiles/gizmoappd.sb.xml | 38 + .../references/rev_profiles/gputoolsd.sb | 482 ++ .../references/rev_profiles/gputoolsd.sb.xml | 48 + .../references/rev_profiles/healthcloudd.sb | 290 ++ .../rev_profiles/healthcloudd.sb.xml | 38 + .../references/rev_profiles/healthd.sb | 578 +++ .../references/rev_profiles/healthd.sb.xml | 37 + .../references/rev_profiles/iapd.sb | 658 +++ .../references/rev_profiles/iapd.sb.xml | 37 + .../rev_profiles/identityservicesd.sb | 625 +++ .../rev_profiles/identityservicesd.sb.xml | 38 + .../references/rev_profiles/installd.sb | 320 ++ .../references/rev_profiles/installd.sb.xml | 38 + .../references/rev_profiles/itunesstored.sb | 625 +++ .../rev_profiles/itunesstored.sb.xml | 38 + .../references/rev_profiles/keyboard.sb | 563 +++ .../references/rev_profiles/keyboard.sb.xml | 29 + .../references/rev_profiles/librariand.sb | 424 ++ .../references/rev_profiles/librariand.sb.xml | 38 + .../rev_profiles/limitadtrackingd.sb | 324 ++ .../rev_profiles/limitadtrackingd.sb.xml | 38 + .../references/rev_profiles/lockdownd.sb | 422 ++ .../references/rev_profiles/lockdownd.sb.xml | 38 + .../references/rev_profiles/logd.sb | 443 ++ .../references/rev_profiles/logd.sb.xml | 35 + .../rev_profiles/lsuseractivityd.sb | 345 ++ .../rev_profiles/lsuseractivityd.sb.xml | 39 + .../references/rev_profiles/mDNSResponder.sb | 137 + .../rev_profiles/mDNSResponder.sb.xml | 52 + .../references/rev_profiles/mediaanalysisd.sb | 693 +++ .../rev_profiles/mediaanalysisd.sb.xml | 37 + .../references/rev_profiles/mediaserverd.sb | 970 ++++ .../rev_profiles/mediaserverd.sb.xml | 40 + .../rev_profiles/mobile-house-arrest.sb | 516 ++ .../rev_profiles/mobile-house-arrest.sb.xml | 38 + .../rev_profiles/mobileactivationd.sb | 542 +++ .../rev_profiles/mobileactivationd.sb.xml | 38 + .../references/rev_profiles/mobileassetd.sb | 587 +++ .../rev_profiles/mobileassetd.sb.xml | 39 + .../references/rev_profiles/nanomapscd.sb | 662 +++ .../references/rev_profiles/nanomapscd.sb.xml | 38 + .../references/rev_profiles/navd.sb | 465 ++ .../references/rev_profiles/navd.sb.xml | 38 + .../references/rev_profiles/network-filter.sb | 348 ++ .../rev_profiles/network-filter.sb.xml | 30 + .../references/rev_profiles/nfcd.sb | 387 ++ .../references/rev_profiles/nfcd.sb.xml | 38 + .../references/rev_profiles/nlcd.sb | 96 + .../references/rev_profiles/nlcd.sb.xml | 39 + .../references/rev_profiles/nointernet.sb | 7 + .../references/rev_profiles/nointernet.sb.xml | 20 + .../references/rev_profiles/nsurlsessiond.sb | 642 +++ .../rev_profiles/nsurlsessiond.sb.xml | 38 + .../references/rev_profiles/nsurlstoraged.sb | 429 ++ .../rev_profiles/nsurlstoraged.sb.xml | 38 + .../rev_profiles/online-auth-agent.sb | 397 ++ .../rev_profiles/online-auth-agent.sb.xml | 38 + .../references/rev_profiles/parsecd.sb | 580 +++ .../references/rev_profiles/parsecd.sb.xml | 38 + .../references/rev_profiles/passd.sb | 974 ++++ .../references/rev_profiles/passd.sb.xml | 38 + .../references/rev_profiles/personad.sb | 506 ++ .../references/rev_profiles/personad.sb.xml | 38 + .../references/rev_profiles/pfd.sb | 176 + .../references/rev_profiles/pfd.sb.xml | 25 + .../references/rev_profiles/photoanalysisd.sb | 674 +++ .../rev_profiles/photoanalysisd.sb.xml | 37 + .../rev_profiles/playground-devtools.sb | 590 +++ .../rev_profiles/playground-devtools.sb.xml | 24 + .../references/rev_profiles/powerlogd.sb | 215 + .../references/rev_profiles/powerlogd.sb.xml | 38 + .../references/rev_profiles/printd.sb | 516 ++ .../references/rev_profiles/printd.sb.xml | 38 + .../references/rev_profiles/ptpd.sb | 253 + .../references/rev_profiles/ptpd.sb.xml | 41 + .../references/rev_profiles/quicklookd.sb | 1150 +++++ .../references/rev_profiles/quicklookd.sb.xml | 37 + .../references/rev_profiles/racoon.sb | 123 + .../references/rev_profiles/racoon.sb.xml | 42 + .../references/rev_profiles/replayd.sb | 550 +++ .../references/rev_profiles/replayd.sb.xml | 38 + .../rev_profiles/reversetemplated.sb | 259 + .../rev_profiles/reversetemplated.sb.xml | 38 + .../references/rev_profiles/revisiond.sb | 391 ++ .../references/rev_profiles/revisiond.sb.xml | 39 + .../references/rev_profiles/routined.sb | 696 +++ .../references/rev_profiles/routined.sb.xml | 39 + .../references/rev_profiles/securityd.sb | 348 ++ .../references/rev_profiles/securityd.sb.xml | 38 + .../references/rev_profiles/seld.sb | 587 +++ .../references/rev_profiles/seld.sb.xml | 38 + .../references/rev_profiles/sharingd.sb | 1046 +++++ .../references/rev_profiles/sharingd.sb.xml | 37 + .../rev_profiles/social-services.sb | 959 ++++ .../rev_profiles/social-services.sb.xml | 37 + .../rev_profiles/softwareupdated.sb | 382 ++ .../rev_profiles/softwareupdated.sb.xml | 38 + .../rev_profiles/streaming_zip_conduit.sb | 416 ++ .../rev_profiles/streaming_zip_conduit.sb.xml | 38 + .../references/rev_profiles/studentd.sb | 450 ++ .../references/rev_profiles/studentd.sb.xml | 38 + .../references/rev_profiles/suggestd.sb | 563 +++ .../references/rev_profiles/suggestd.sb.xml | 37 + .../references/rev_profiles/syncdefaultsd.sb | 427 ++ .../rev_profiles/syncdefaultsd.sb.xml | 42 + .../references/rev_profiles/syslog_relay.sb | 245 + .../rev_profiles/syslog_relay.sb.xml | 39 + .../references/rev_profiles/test-common.sb | 20 + .../rev_profiles/test-common.sb.xml | 38 + .../references/rev_profiles/tonelibraryd.sb | 332 ++ .../rev_profiles/tonelibraryd.sb.xml | 37 + .../references/rev_profiles/transitd.sb | 114 + .../references/rev_profiles/transitd.sb.xml | 38 + .../references/rev_profiles/uiautomationd.sb | 350 ++ .../rev_profiles/uiautomationd.sb.xml | 38 + .../references/rev_profiles/userfs_helper.sb | 365 ++ .../rev_profiles/userfs_helper.sb.xml | 38 + .../references/rev_profiles/userfsd.sb | 435 ++ .../references/rev_profiles/userfsd.sb.xml | 39 + .../rev_profiles/videosubscriptionsd.sb | 217 + .../rev_profiles/videosubscriptionsd.sb.xml | 38 + .../references/rev_profiles/vpn-plugins.sb | 471 ++ .../rev_profiles/vpn-plugins.sb.xml | 56 + .../references/rev_profiles/wcd.sb | 828 ++++ .../references/rev_profiles/wcd.sb.xml | 38 + .../references/rev_profiles/webinspectord.sb | 264 ++ .../rev_profiles/webinspectord.sb.xml | 38 + .../rev_profiles/wifiFirmwareLoader.sb | 263 ++ .../rev_profiles/wifiFirmwareLoader.sb.xml | 38 + .../references/sandbox_bundle | Bin 0 -> 448034 bytes .../references/sandbox_profiles.txt | 140 + .../references/sb_ops | 137 + tests/test.py | 4 + 286 files changed, 75046 insertions(+) create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/inputs/sandbox.kext create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/logs/.dummy create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb.xml create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_bundle create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_profiles.txt create mode 100644 tests/iPhone_4.0_64bit_10.3.3_14G60/references/sb_ops diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/inputs/sandbox.kext b/tests/iPhone_4.0_64bit_10.3.3_14G60/inputs/sandbox.kext new file mode 100644 index 0000000000000000000000000000000000000000..eb1b4203b066cd8f4917f538bebe1b37d93754da GIT binary patch literal 577536 zcmdqK2YeJ&_y0eeU_dM=+XDoU4keYZwwbdA=Dw9Dve3jJr z_(WGmc8(%lYcI1%*bD#Jk99Iphgu%(YcF6gJ15JTk)kA3tlz;!cXIu{?r|?XKBV^KyZ;qE;^UJNauQgDPx0}U z+v}`04)#>jS}yI1`dfOsD?^Q`Xz$k*qJHgF1yFBK@unv=K7Mkx<~6Es`TDh9DeSG* zWxSp}@|)-%WG6mi*w9ftxsossQKzDR zu&1w=h}6#4j??n>YmzDI_l!m4`DoYm?NK`i;)stQGHB@F$bN&km5A7qP>1@5u!8e5 zqMfR&wo{d;%7I=QBo4Pb!E`7`XMti5@?4s2_&^@F1^$@AJG?lv}l+q~O{ z`$z#EnIr%933G3Se}RS@q+m3^oxxjZVrXo*fm5$|w7!(CAbiAUx>AET8`Y2h&{I}* z^1dv+^f&UopyX*@E-yPO@E6|}QY%Rc2=Hx5Y;2I8CnCPJgu8_JHd0#y#kVB}9_rFg z3POBy-#{YkgNP57F!~W6qUg70{exXPNSzSh*0&>(^})b{T{=r$IQ~vWzYFXC;M-N| zj`$GYZba4x1Ap-CA@$<;o{D}i*8eKFx6~K$cl!1rvOXC2RdA>j&hcT2emLu22#$~< z5#Q6dACdLJzzf0sX=EXOfTBN;^*;?BBn?J!Kh$?Dk@dmAkAufau^c~M(T`>QkAmZ* zyAVIdcLI_1!N8A#CrXnzK3>tE#QHz^CP;~hpWr*0$ogR5PrgY~GRHd<{bbhv**8UU zB0kY~3X%1}z@L4mN@*OQs_3V&{*S)tk_+)ueKUxx4+j3|n<-^+{4_;Bi}kJ)>iYSdpQ1XMgJbwx3pRyEkXRy*mp6-bAB+;(rT%+lJ%BJ z%Q=1}5qc{Wdn?(Vxz#FZ4dPe&t|oGRFwoqpNLt77YZd)v(K_bV4f%RKGB<)B1Vc&g3 zjt2w3@;x9OMEnuohlv~y2L9Uikn{-RpYc6RNY~9N*4h zP*?r{o9~N?-`W{4&-ojmbsU?6n|xU|O!jGKI03tvKCeixvE2`(S0$-QzRw3FBmSiH zI^t=i0Rswr-jLp8y>OHw0)bVfSM z@$V7~Ye^rlJkszU)!%Rx`tM7Uza*8R-UelNZ@{EJofdb$pRuA*J0$62=@Z!b7BX>z z;Zx~zF8?!XZx`29qh5R7$eznuXz zJY={ieardV89>85hVP~CP;VdUd+CxS1=W&%mVV&$A4v{4X84JS`|vZ%V-3GhyC7fU z_Bjo|N|z<6)gi-gMAWOD0qppc;diPZ%iw%p=?}@rAT_Eb{YivhucCCR$y)|UkiRe( z$PcjVL$s6`d{JX5;6p<#C7%7n?e#;Bdkl39wGCA7I)+=}hg#Cjh8wxOx+J6CHxXg) zW|qeqZXtV+ZzaM%^$fRjJ#Hhie?a)BzQL%}8#Fv@Fd5LvVBcmibG(IQ*tZg4&&Kjt zgI%%j&-R^$1_pEv_@yC{{Q$x*0m}X6_H>*NZM4@A3^ql3s6XEUd8DBk*$EhHXl`i1 z<+LNhZ!Hb2QQygiRz!o-(1utjNo{m?4g54k4i^8?4SfvH8D2A7rap&%n3<)}ka~mq zIr1E7u1rT($h^9PGqap|2|13Cyo9WfdeO-Vi8-#U{P=WNZblB0hd?Xam64Fn z?};G6_!2C~-+g@RPCt|W6U zB+R9DpAer+pDZ7zPo7VLPmYfRGF@f)goMnILNcU~agtBEkIQE=RMI#(0#XK46A+Vu zm@J=cWD57mg_I<8%o5^r5s%ac?YoDhN_8hob=yllgM!+359=Q?Q>vRmvdxxDGtCjK=mjUFCp&`^6EcDvGaQMzIgX&j zq$vs6Q=r?TQvGaaN(P?ggPci@j2vgO(~%{tOHwc{;5W5^dLwciX^wP94(>;Xu3bBK z>(rsseE2bPMq-X5JEtDGl>gCl$1r`pLvqqHb#*ThYQCGU>-Tw5NTw7LThZ_1d=laL zB>0qkO?M;5XE?l1ak)s#Aum?+e7aOON$>gDQr*nTJilJ5yPV?1KWa|DBu8FywrJY| z$mp-(!ReE!-QnpOIm>R6I&@c?HbA{q^}^A6Uk(jgR*V3?=}zX5&Y(Z$gGRCub#O<%jf#BZa%N zRh6jh$ca&C-oxAdP~ae*8se zCOEV34#}06I>nWiPQ55Jt6sl^^ek5r3H>n&U0IH#dZF_|?^$Si& zOLI+!jupoUt$-}Gny4FFGU7Za#M6sCor>b4L(1KCZbH0odA|&vj%h16Js|`AEQ?w^ zC<5=FA~2l^F(xcK+mREIkT}IL#D!by${OX!qUNv%vrj~F4+?%{WQL0-KymZq6FvDu z)9Uqer6{%sJJFevUBT(O*`hlSQ2dlcbsLxkKV@S%;u{i^>6-4yLgx<7Oq-FJhzl4A z#uXJDmf=_*nKRv$mCCx2Qyghn+{j31`se+4LU=SP1-?p1%TeD_-^@tX2Cp9vFi3YAn!jhNlOv%mS&W!cJm5i~G6r7nm89kizB2XhPJj$6l8uL`< z6jw$*J0xH4p z!mZq3uJFM0ba8()M+`}4p9Kj&QWXaz1a_fa^_^Y(kLyof4!mT2@x(=R+2M=dk01L9~GGg zO=Ype*rPo|jrM2tJR2~vIip?Kyt=$a!=k1wBiNszDBf>q)5JCN5Ve4Ja6ws)X}MTf zlPDAZQD#pfu4%tXajiLC-M(C7FT)k2&m~DM|5862EBIs=-aPQXs0#B?Kf3phXA>|< z(rOnR78Zd@!lllHw2|lt7%2JuaP3MVcVpaQF!sl3azbJ%rYI-+i|BfzV$gG^3_-+L zr(^mkZL%6P)`jsGjqb~1FftFDHgOp``sv85-0Ylap428eGH7_jIGmGRVWKwC&J-~b zXf+s^kU82lG9f8J%sSccMCE4ZI+a0ARUF_-M0JBl4Uq?qPnhCz(I}z#K?7W_lr#s4 z)Tv{gS8$H zq!r@FJCb4?lQoa(lBtlfiCGRu#wcVipOq^xeCHqxeMc6#g*`WHiYv#JUBN_X^ixA} zvz>`!2I*WbX5x+EqoPMq)1$(YlCXefhr3*0-)@$WG4= zuGb&EI@6WSw`Q<@-lI%IoC!(6&ak9mnK{F9bEu4nfv$AN`siRnxw;@NGF=pOEO7jB0tm;i3I@4RWe8Z1&3j!4X&}vUtXafk@mQ^^Qfn5bD}H zAd7GDm_bxfYJ4C1AmLnfohz!qiCZ(_w zhK6OQ4tHdwJJIW18Dj=f{UynQQ8k3udu0vQ?FnhX;Z3u2SGj$oXZ&V|gy&`?rD>aH z(x?3>{`oeNLhO=HFdo%15%>|yBGtV`!lsOOS`(l&q@3M)!>_TdZYG^sxfvnaEQJ*p z3&M>2;E^s22xZ`7Ag7=gsvDWfu#b5(f_9;+!m@b?Mc{#e2Tw$9HXd{bP#Ttho}UM$ zVV9B?LQ$IsWG7}hGnI|ZfVA9%oGjdC@|W1vCV6DxAFXEUe1|nH!;u!8;>Za~#ZEAY zb}!@>Z}Ve9W^#5gR%vX7X%Tk>(XN5@+v0q!eb&de2PiTBOx;zqYJuty;X@m z9;bqJO3~GIqB?+0&hvszt`i{c}w|>^Xv*$;eX0a)cv-GM$;? zHqa+2RjD6sP<6Q^sY9jt6hC8!j2`2n9e)s3gz3(VAZ!=7M0y^+)*o8FpiC@anD6n% z0e6W;wD5bo>*Y)3jvGX4UrH91ODyKs?FY0`M&E_w^AeOBRr&LWQZKY26|*7r!!DK9 zL*4pKb7cpmLz&)zWV*03&JUuM8grH6ZmE%%{E3-(=Q=ZPYCF_^%MX3!Zgu7JirQ}6 z3Yu4v&`GkWSN%nQoiZIw#aj~$CiS}&mEUirJ}GIg$q8ve^mL(4(M?dswf9lcpX$iT zPDrO}@O{inM^@}ha`!?8Y};}Riv!nx^`>o*7b@sY%7IG91(m)(w$10-co18#p-N#Qgk|QZO@_O){a|4 z5cGNITFdk27B%himfw`?U$(?TgF>8qe#<$JhR{^g^!#nhms{S(q1qyzDkq6D-}1!W zwauGX61I%rqIzZC=A6yGn}6LT>^`#Tkxd&mt-yI14iRQ6Y5J0L5T~^;PS(6KZ4(9Z zifhyLyi&4JwYPC2d1cMUH5>2VsJ1vx?zS<+qaifaG(E{H0UPyRX}Gb$HTmLX@`{b) zAH_$0YRP)W$Ukq;`pR1y-q^5h!&@7K#;OggHZ0vxi1S<=B1}`#^fuBESGiZJ+E>o4 zSM6zi<)ig#i{s=M*H^W#Jhoo%mBZ_=@0Ae`c=L*W1Z`VivVQvdZAu+;*HcKtF_o`K zn&7Fw+75UGaW(VGUyY!_RrX4sa$fnX5j56|S9+{(wZ7$gbp(C8?u&KzuG_gzw0QNp z)$10ln~8Hi4iQq7G|eY*@?^wS=9P)-CUBUzZsNK)3c9(6uC+Yxu2s`SU!h)ddac%1 z9$9{xyV{Ojb=(RJH8bqy)T03ZMD9(Lw zh|s=5?Wm4Hh|^lApI53nf=Y|Zdxa#uSE@eSK37y7ujEz9D-RVtShTq4A*GHqVipzs z^$1!3{r@XoDL=3LRbR>X>Xj))2}NpO=~>jhs9sS|#VdYA6#iJ_SM)m$5x!ZY-c^k? zUzzV!tnOT+&9?fLdBqxSwq3Sn*_xee^dm>TrV%uIP1X8}sQq(Zy`rCOr>sd{(|64j zrH;MUQ0RoC17DHU>|gQ9cdJz&SMC-42>N#Qx6oESp=b5?D{oiHD{rlSWA&cZZz*-$ zwVHyAV+&vHT3xjI9#8$%cErgwA3?)BRx9^P*lMk>h;sGbP_L`+mB_u7&$c~Rw_Y79 zH&kl1f7L^)7OdL8N-23&?5dbmLvbFwDhlV=RRdS`P|`G?sP|2a(ROiFoo%&Qsq-q@ z#dTQKVU>QiwXCYDSNv9$A3@&sD+X>y=|h!!B}U%8Qrp}1UD;`6>5AhkL<{d*ao>uS zD;D5%YRE%TrS|QeUaK zxAnH;7c2AA`@DHYKd<<$sI}tkazCX8rrgi`Eu!} z9*yhwmFjt=-G1*QNZav0vGlQ}tCl{Y)Zp%=6bf+6;46}*R;V4-F$rXomTXnp04B`252OWs%_N?x~Q-I5hc?!kFJ z4iR#cG@&8RHSa4%k5$bp`o1D9`E#+pM0MR${U%ub5mfBeE3Yrs_O_cBZ(N+Rc(YoA z#c_+rFCLEbP#hwJs%hvWYUqx*n)Q{B7OA#0uju!-k1cw{qaifQ`$O}}?nUKSW^Zed zuyWO_SM+Pp+C^&?Olej%?MpI0@ni07a(uU^?dPus6-nzvzI#=K2R%Twp2 z&YLR8ox{0pF8Gp~%S#4Gy!O1~<3h5AbM_O{ZYs>~}PbA#sk%?(lN=rfnXZ*zR+ zUcw>5`8n!c)%fr4SKgcRZiRBM9Y11Tsh(GEt&&$>nDg8mdCm(;4K~lAuo}loz9MN} zh1!vC{(Y}heO{@aS4>s%O4^*Mb0X%XDJ`$+2>O55EB;=+^6hNxIcWCmX|qkUZ=5Yg z$N5?3XO+%6f%9=3A{?2ejU4r==I`SEoT=KXd~bVX<|7`B!!r-#+S>@K-rn{DuU>J_ z)YhQ+Gw015F>}6BgQ%HNGY8J>i*s)rB7}Hqr?%st7(tf{RBPHA^h<%-@;LciK~>fu znr+`JsM^Xb%JV<$ZMHpu($%+4y9@3sNG;f{)X`DkD2OWRcku0=)S3OF2AZ?souQuhF7n=k*|4WNB*|_{QMnC9bNgZ{IvW;oD*<}Fv?SZ zwH<12)?{^WTlMd+Xg(EQ8JRyaU%y`o*Lfu@KMZwH`;ng1S32fbt*?k(+&KJrTC2Bq zRer~B&$s4(H^Z*9ysEQp&HKs|Gt?SgMh_9!`u)m-Gxm5iM5^8!+V%Z2*3P)UoTm5p zD^yONSFhyG(E7@V8AE3nXN*wn-Z@)6{mp5oE)?iK1QvD2&8SA><|M=S3uluEu9T7UoicP#u>9<>itRx344V;r6i zE7L3=SH8^lUc3?`_nWTul~&VROuwAhO1UpT=KYxWUEY^Ce~v?h(|P4fA*tq1hqF9Z zMPHejSCE&Tr?wdH%k!!_+g5zX@9ncgF|Qk~1r3W{&79sX3`Ru{k4f9)?4NP$f-hh;z+%{Cl!hd)kg)&epu*%uexW z2u(FjPg;Xwvc(!CywY&v^}SN;bzbR_t$lWQCF^q5V_8?SM9Dj|c4n>1T88ry93sqA z($rQEYyR2cpVL%(T3^xc;?7Ka)1x6Y_1;jg$t!AKQSEv2%4=+|$Dqi_QfH>&zWj@8h=2X+G8oU`Xgwr$7Iprs^-6r^#B%vaTmLQOpRe(XC?!VLzqjq5*)MZ(QGdnK|BK%itlp0QPp@8Sl&OuN z3$AmnBd!ZB;jtaA9WL3m7UwlMM3|?f>F?b2M$l|mdwgHLwRPW*9_I3)>rgz zv){>h)1x6Y^?gLWzP7K#$=Bbn#5_@P1PSZqpMxIG*q^Z|<6)%+RecVs`CF&ao;GV< z(LV=;XH<0;SG{NE1g~DXDdWbBAGZo0J)M3qeQf&SbRqRh@0H#ny&=y2I4D@s>nLeL zL!1qWtJ%EbN>lBTS5njPJEFAlX=)$9OqJHbqaifaG(E5FD}S{Hz2?;`Hk7V<GI>d~odranDYw0XhQ1ykow&Bu8<4iTJ6n%*ll z-^KZPtWsYQ-q5eizdALqTykD=s{X3TpPe5#e|GBYc73lr=G80uHRx&QQRf=x(~8}d z&Xvw(&iOdc!y!UexiUrhHTTMG9;@2CqW8+5Q?5+Wx3%(>nS9g{@6hy`-n=6AD=&HV z%BNGbzVhOfBU2VnIjYoP_7n;^II{SPq@)V9qZ&*?oW3sA->)?GSk=6upKa?-(fW#L zbH!dlGR-UHXWJX6c=L*|(jI@9Q13(aI!69JMf1v=DJN65q`a9TQj1cGQkJC5!+8!4 z3bRvON}8IVSo3+MzQ?NY%FMi(dHTL0rTmesFR}8za_wyUS1a@MCk>T){= zPMS@j|4BK^`Z6hfzt_HU5~Zta(4)zRlNTmGs#uzvJU4k}au&{+I7FCSp%k)R^ZiPD zkJZXYP?O{UkA`Ti<_+!Y+7aY^4H8z~^6C}+Tc^6ob&@}J)KzNm-`mA$?^oV;sP7r| z^UA;ViRuSlz4EF<>njHx2k-|`4myMY5!M#zp^*6{F?+Z+iJgOe%y;!%CA8?5_cqS$06$IPNY!GXK_tuwf^N< zaqbtXaw3KDnwq5LSzn1xkv0)XJoolU}?MBd?mgU~=kYk*jvX z*OPvZ|0-TcBjbl|y)pjxi6i5G!$INWiKP=&`)_!z4&f?7k@`;TJFyQA3Oy!v=Fnqe zr-{K6gFO1G1+9ir6V$j~6KJ*#nh-SMh6!rR`|6-uER=x5tbTRUxS8B6C*c&k#?UpM?PUTujsg8mz8(0Q+3(a*LYjxQU3X#9st z9S@8@Fn-_oT{!Q=A;Nl3{nd8-6Z@6_)okl~+*@DKdu8tU+2a=%%~e`HV>|^Hj&!~v zDgOUgUa40luUxw_SLN>{)O=+Q^!WO}JAy1;yJ|M6 zdN$@*%%+%Ul^U#%p|BjsQobT-R)yM89c$iK{#WzLhAMd_AtpYiTTFt|@~S=usrv=> zepmnfin>O}Dxau!iRlv4K1S^aXkpYYV%6K*oI?29P_~#QS#|Ar^mcD=6Rg|gF}SF zN}A@AIJxG3t0&oGRr88|zY;#CuSethUMc@BuJXP@UJ=3avbU8vV2rklyD<8T(K|+8 z7%lQ_7`Of zNA31#2u(Fj&ujb2U%iX_)T>vDMrnOz!l>9$)=?9b8q^t8XVh;azZ+R+)I}U3d^A$6 zzs8#Pm28hy%`5sfXw=Bz9*uv}E7lX<`ig#Dq2Im-kNofd_Wi99s*ifSsMj>FRBr_Je$|^-oP)KMx!vG4gTIbyr_|uRsQ02?jd~8}XK{#dC`zrr z#s{MAi&~|NS4U9Q_qN(tS{g;~ZD-~!j+z&xwl+>45jDtTe_+%=T&rn%R<^gL*>->@ zuNdjtb5M)dym_TFN>|q)pC~En%|Skjl@o(b40>VE5u6{#A;JTLG;gR^HUFkY2ai?J zSK1G1KS;j@)f-gDqfu*6twEJPGkf!jT2CVRU-QZ$uU^s5E1wVibl}l}pAQsv9vetu zACA3zMN+YnrY}i9ugC-Cfm?AQ3?m5pA#5;;)oEB1lbf#(OL)2uXz7kJy#+r{Pkam ze%xdAP$bPOefsz5|4^jb+BjK`)K+Fu{^i)sk>c|p`ZP#<9zOs0ksTs~BAerU2M!TTp89Lv(Z6+~*y_)=W&KoZT3^xc;!gH^#iJoK zRgdXOUa7bSdHY0FSZU$aEBblmaKD57R`ffp)L==!CH)rln}hQ#93o^?s2y3?&nqNX z-z!}`Rx9^Pt9}*xiryRQb!A@hw&NFG39FJ^o%`1r>tHLXjA|^$|!lnpu^5BT7dZps88?HaEymYeiZ-5PmxDz!}N6_sN z^&-xN->%g0lW+=WaJ<7;pM;l&zYwnXhq$i!%DjfHl4tdOMJuW5Ymm3^uc&v8sJ)^5 z=$gJF^vZu@eP(!m_=xbCO3S0eDfGh;&Q~OL{#U&6ZJ6o-y;ropayIN8kA~1x)AX$V z2&(mZ<$b06H#JU#Jr@=$pHOP>R2YRLd=}SqR_m|vF~q6&LW`xi@)ux8>@e-GM?{2$h1CsK zjYEVFLa(jiJBZWQruwsOp~q_FeI+4uf=5G?U*6wBqP|kSzoPe=SFePH#>$5%d@YK znzp+S-SPYS+}B6$qqaOwPV5uo(HPxlbe~b4G*yTA+m;c1`t}*&(IlJRXIm=0KmNOM zwPZbGa@t$I@PgCZ8WvXd<(g>>F%DmRAS8OO<^~$$Bzv=m0&u@E* zk`MMg*z=*D_u{+*hY0JGG`(+XzPIh_v8s7R{~Xk^XLFCn^}VA1oS8H$>nn5z#di{{ zZ+RO*xAxS$a=ORcJr?#j-9wZ-t;e(;aXm)jJhaCUoGJ8C(*9Ymyxm>3SGiY?c0c0L z5SscvqFz_lS1R+0_9o#(mAta5`-<*^yRTAe5ZXPodx!3=ac+r21Y3pLQ5|c(i#yQm z`d-=8?cedr`(C}0-A(H&!@CXc7SwIHQpa}PC^W{=h_6Vh=c&Kij`H6Yq*!$g>bSM4 z&&<9at6E>tKOJ7Xx22hkR;$gCBG7kjtG|o;(2G~DcGW)}e%kfpt`B$pw5w?Gp00bk z?(Di5=Z!c-SfZq9K8cg>MqJHi+kqadnpgUDRYyjg+_7u0M?;jXrs-K7uLQ9@TdB8s zMemjW)%W6l@1lBH^UC%6iryRQHF>3~f0ahuMSplj&HaC!m%C8-wadR>&xT(6$~!1s zU72@xxvxu3m)**pi|-QOWptOpI1j=>A+k$X&s|mT?)B!Cs(uUkWc}2gs{k7vS9rY#BUAQ(>e-}648n1}E8zVo}QTyz0R>#ba zO*>{OHK^UOcE?K{E_SHh@oO9+lyxXyJCf2iyx*Z_eWkI-s_+W^e~0y9Q-nDAv-Tgg zFJG>jrYCu&{Eq*x{vyEr*LX#g5+k2zul1FE?f15y*M6T;gZ%dS?ep5Fed6QYfvn2<3c){q#*D|JHZg!~@- zLvWpt?{J9lNw8K|_3A9*YBqx6Jyx~8qFxOldU{ycLdSXO~asuK}JtpW#6HsC!m@?2mR{REBYP()xbXj-wC`L zDC%DtNZ|yI<9tQZ5hYFE!t0G7+Q5RXsrIq z+}5jC^nGP-y9e6MX}4FY!Hjk@+U2%O!+9zW5hhfqooF4^Ol_C`O+r<7{90~pUeW)r zN`u<P zx9z7mD4cEcY8$Qf>Q&AEie8w?!_x#qBOEBv`(}>(fVZ^LVCV6g=hFIuIVh&^yg!2Lm#7FKi!&wDpjOfDt<>> zPG?_h3VT|sEv}f4WHn7AeM%-Iz5ew-C7a~MD>3qNl&KM^FqIG!d z?l^bFAwrvS^%vzgN1WEezcYdkwo+T7jUfFy{*qSz&Mq#)t5@{%%HmcFTgA6ptkkip zza^{r8WdQGSM+b48dTXU)%!eXx)-llTiwt~>nq>4{I=!smfyD&ckVweDLjGWF}@;c zkCLX|TVl<3{5c-0T3^w7<=VZiHgdEpnpetuB|fvVU7XghmwNFEzQ^BE+uPb&T3VL2 zuqkzXp~VX=9&Pau&JW@cp}2+KAL9CYe_OC>`;`EXRn05b;Bm&8t_M!t?5EYiNG8+3{uurH)TGd%D@7W)I-J8;1y6nrYrpuht{3 zW?t#!u^QZr_VE<-eZ}6)9Op-Ih_JhH`Pz|G-5tMb zLF->Ok5w-tDBz0#HJ6~;KlH4AUm1DYTVK)7D<=Yu2b2VyP-?I_U~|BRfE73|!y&@# z3bms;76jx6Xf6CZ^GblnYUN(37x3@wSEhUQ%Abw2dF9JSpEi1;(U*yH06JiRHd6SfKWUIQhLfRrN~wmAUfoBxv6jEcEIX{r}e1zfr$N4IA}W z>S$|ZYh-P7E6z9L5aG{;<$E$oHUIQ|j>oF#EA-5)pKX&GPWEVs@>P%NS^W`opI5I8 zZK&I?G_*84-N2^Q;CO@M4URTAg!98VMA+HjTCdc6UYX#rs*NE1F0OZj9v+SBd!>4P z<+N9?G;N@bphx@<`QPLJh`%T~&p*$9n*S7>lW~YJPD#`IM%*tgrjzpir0T!<&}Jpg zEBf~<1N^Hpf-3&?2&z$Kdt2@MD}HCZ&9?gIpb-Bce?R{arR7z94yyT%ztk>#s{h@g z{{Nb)`Yx_|edWd~dF6lgorM3@8_Jum;}vaQdBlFmzSRDRa_0)|h4#7jJe+fIh>)zL zY2)Re*sp|mtZE}jKd&^jS7ijzY+Jp)V!w`8w0VX82H0hr`ZvISvQhX7$9cZ`$#%|m z)~5G|xUTt|gnzEDRD46}ZC(*IkGif`PAY9ZWP8}Q)OJXb7TGAw!7+=kNXn?hE3xZq z`W)2WW3}?W(#U4_Xo&XcS7i0N`h8`l7q6IY2AkGb&Rf5<9<`pgijp6-K59K|eE{d( zI7HZ@qzMgi{=d{$syBi*c=1Y%ywIw7#br&mhFe`q%X?XSS$kMJ;2eTOgr@(BSH88V zUaq{a=+~f&mWvj(ca&%K`^wW^y`o>4Pg~x$?6aI!>iB?#!gd^Pz9MOjr~Ya?{)yj` z{d4n5_4-PwSFg;2=QEVH{$~Ek{F3=MvuN@2=I70inIFV?4-N|3%tcC?=9BU}{_=OP zyrj=V*V^7qyINsZ-_+|rXV&)>VWqrfAyHo`|4og*+Qrp<*V`^G!K{s-w&vF6uT5>0 zmVajY%=C`wHJo3;LE$CS6Q+u7i<2KgoYtC-<2H=R~E0Vf;>aX>gI}um2zT)e#s`VB9F0Se$sCx5?MF0Foxnt#8 zM#=BNl34i$@DS){l&r6m)Hc?ETnd?Z3cL|~53CD*1l|OOyKgq$YLo(^+_w-L8}J=o z(C;GB>w(?ew;Agry|?>zBBz7MXEqwa0?@>IW}_8)$!-gg^+3N1B{pM2#Gfj*8~v4d zFkn(i1Bz!o(9e!`Gy*S`1Q?qjy=6&bBBz6XMQ3B>reJgE-2t`%n}Lno&5bRgUr^G5 z$oimPs=Jl34dOH1t%)2D`VB+Aw(!q*cRORCQK~%&GU&Gp?G1vQ067@)m68x+2js8i zZcpU=px@2zj>gW2ukY?eGqYVXBXIC1bdKu=aqCb_JLd~cP9p%k$Vu4 zuP4i8axY_VmirJ3ec^wkBVS+iSjl=`4kZR$l*5f-pigl)%Vlzeu^;CfPAsJFUXy;E zlKzxlSX;=3#pvAwjgny*IEdq;jDuM(Rt6hgy*k7gjr5yQU*i46L$?kES3-XnxVMoIw>aSZJG;kRm_AqDzl!6YySbRpk3j*l~r2UCmVjIk6C zPB2RTRBzBQ?pUmR7r3K%qA}hm1yei-`?2yQ#4m%r1aLh#8I-|9@O7jofjN*JU_O`( z&H__Fs`nJ|;-OgC344!1f2z`sRHYqh;6B7ZxK(QCfPRKiYUsxObb*K6nZ`V$6jV#f zF;3(9W|15aT9Qq~eavCGOwKjp`%#edh}L_Ne>&{$1!us{^L?#Hvx ze`x&925J1xLB3Z?<{IZgrtwRp@mmPe_?-{Z_`MqpcP}*F0~UY_z;57T)Gyh+h{)xD zJf4?;joeF(%aLACvW&>-AjZoI<0`~wx>pi89>jQDZ7f23%aS!jjt6jRvZrq`aSCGf?PLSrmdqEn%yOi;JALI)q_ZuICom0iTje8V3Am*J1D4y+t@Yi1B zKE(HSKSbnsP#w>WZa_agfc`TT_8$f_z=L28cnHh`52JoGE*=4CTs#Vv%8wb3!tNRQ zaU$$K!E%{=#P}r3M~Q{CU?1ri=T8~`1O1EgG2_#qPw_F9%j9Q_&$9l1h=nviLl5OY zZ+wo+f8Kb4`{!}v3*0|nBpLnlB_hf_&T^UjveG|K5F7bOuNdFte6Jf{<$SM^jC?1F z$oD$SW%3(JzBiS8MO)v3UO`DIb|9p8ipc(WTk!{EjN8)`&+`JM$37A(zYEehJPWot z94o&EJsOYiLry9F&{zhhf**h`@FQh@0C_(77<~4DSosr>=7Uc`nh!n$X+HQIq

A zkmi9eL7E57v7PhA3y@uqi3?HwSKyA~uZ`a*^9{)J%|(#z=eHo;&+kBGez@s&=?CMF zO1;3Fnn*v46LznyenCcu?E8?6`{YZ6omwoH$v0qsO7h2Bz=rXd$7-9z zJcRl*?6C*yze#Es1^?9rX@0v290$FdLDIhk><_(LL0_;QI1#)J+ydSXmVoua9iS0> zWOuA=0uQ^*rUoXer`=@XdRj?FJ#9qP%g%C{?61_b0kPrJ$lnn8A9pu0HHLmcNdS@k z12!Cua+-hvU{kOYcn8=8Yz9W7JPv&08Hn+IMsWPw(nv>dg7^3w6k)yY4h~ zQDl(kr>-E)Pu)P8pSpuIZ}$KX?doajkM=&ktCy)aw>Od)@YJq8roM^{20XVb)D))3 zV8HQR;id>h1_Ms+>PL3quSg>IKal790bnEdKvNX-3Q7hM*{>kx-@&G6#Mg2UA#yzE z_uj5yrlH`6;Bdtr$n)U{lh_}PgdFZ3V;Th(fTO`~U<~XfyT=mQ9_Y7m*ErL7#SX~p zSS(2ESR8n%WP)iT^0h3vi^%yvzrtPdrb$XZ&~NbB1k+?i2C+USnvxJt>mzaaS%)cE zNeBH#pG`4MQDl(UD<`;O*Hlxg5)b-CqyMFWNm!@S!9OuiWq`K*SpPv7210*6_!aWs4Su?7f$1LbOK_pmF3|6nT}w=h zz$@Tl@P_-An3gK(pkFtPn`Pi&v~M{W39bNBVSgoPyl<6hwW1GVf3U{17VXb;7ZJJr zpq~@@)`4N*dNAC*!L$i_QSOaI)&sE~Z#ESp{#5Z6(^e%O#Cj}KJnMme;V8cZyxHwG zZAW^2_ckJ@gMQm~?KJHGm+szaI>7VI{ib`lp1VwYpdVUt9})WZvs@4fZ zt_MsHvb>)duxHm^(?g032JG9lkL)7U$Vmi2H^4 zgD4~`O1-cu}>$xoY(vHT2?p9heR ze9z*22kjI7L&QGedDC;CPx13Cm&q@fUgUhA5&3xldX2FDn_kBJHXZ98Xg$971nC=I zL%$_^bxK|(nV%OZo}L#@g7m!bI>*0ZdXx2HWf0E`Z<$JwPR|QOdR{mM((}UGAU!X@ z4%&O#bO!Pl_YU0(V!!dO=@Zy1k>6dA;Qw3=;-4B|f8&Hjo^BtHr}4b6>|co231 z%#9Tpgq4viVUJ1MO&Mr-gy2ux8-`bB=UW01=4+kjD1}jis$_(rBi=t z2U33t1ovUS4?_BF*p~%^w}T;wuaEY%2OEMNK-zb91Zm&d38Z~zXONyl?*wW8*#)Hi zXIGH+pWQ%u9_|hrk6`^reW+jd8k%hn zH%IXOij_e_yY2nVk%|l&I&bf99-zpe^`>_Rnnxj?_S=I%+V@6r`e5@A$h03O(*8Ue z?cOX6H4lSK_Z2MMBn>x@P-L)hqcoE3Q9A5mT#Yu5QPM$-EBu!YiVPOkmByLJLtY7e z5c5y0ISw+-Kg5*ciRKAlDtH&@0^^nXgN3(9lgxN7=lr0pNKQ0QHcPfWphNLf5=j1p zjQC{p6v*Vy6p;K$@-f+Io(g;Po&toNYEFl~r8teq^E1gO=tg2mYSC->0se{X*riq>8OXFAI8N>)MKuDm3g&U>^nf~BKI1+g%|rR5bM!e^Jc`C z%Ik<&$JP@uZ){+>Ox|eT#PVh$uVY9@zAgAPgXX)fM9g=^W*PJ;E@rt*E-||~-}6LX z$4LK;qub3pAty^ah-hz|3?lws^L>bSNV|v}4 zn)g9(lJpRf^Al+u+z-+^cmV0OrH9Q2IX|BNG4EWxddPej>9h_KX&rn7q;>F7kk&ye zm)5_>d7e6IeuC?D#C#O?lBFk!Tpoyd>>2Y@oc^@=8LrPUBBz5$f8P8or~ilR?~tBT z+7-v`p#Jv)(y9Nw2yWSi_gTHgx^^6PXdQbQr1k0qNb}+=Agyz+LZ9-#rsO{fmddZ2 zPw{*kc@TZT_Wt9Ww}g# zPgz&qC!#-;nLpwF@S*tw?hhZbTqb{H{+RQ9Lge)idho}m=JQ<6m*&s7oX<%{IbRS_ z&X+8g$>)@E&T~0$9KB%v8g|A=UlF-qfaovZn7>7Qf^?C{@gT1+-@$G{$@lnlj_m$G zWPkq1?Zx+Kk^h+dv-ua~r}+hhy-TEre)TKsQ-7s=G_PC+X?^$|r1jwn*bL+E53n8h zC)gRh3evhES;V?y0BPOv0cqXw1!=vhWfAxL29WNfA4vV6Hc0bN9gyao8$o)XS{Gcs z1JD1+zoYnO%PkhMzJP}KBez=WA^q($c>V|9IC`6gCJCXeYBHm~*BR*a-5jh@2 zyv1Te{3yvvJpLi0;gBK&^` z%VlyiOLLZ65DRaB-;oaemX>y`---zR)-0FFZ7gkBZb#&Pi*)D*S~{?P5E1&pESJe4 zmi8=nAoBc$boA4XmafphD0jAW0)2`*vs@ z)*nd3bJYNfM|%bmt!I%BG<*O?f!~9JVYjw4#1f74I+zDQp7(}wy@pvvbG=4bhI73} zuv{jOw2WfAqlr8}Ll5)e7|U4Xr}+?UZfBV2J~>P9|6; zz|J};!EzVmvkxX%CW6z86D;wFUyJxjkgq(PfKSUML*tS}%Vfx7K?my9vLuO!c4GZU zeA|)~OETCGOt;X!IMp(R`;(Jo%nwtE&`)K#Oim-akki?IAJh-)n;{PValsGAm&3gx*riGLFadKjahga?1*oN9_TTzS6QvkwN5NZE4tt_DOh8*N4{cBFiSkm&$92 z7?^0+}d@@>X9J81lDA!7W_RGBCX52K^k{^KpJ;shxS_!g0J9y z?L~g_=R+X*Q+*!Xk91lu4}i2zJ`B=2dJv@b^N^D7u#)c)uvC83@+AA^F(Ul(ILl@7 z6P6<^KS|{I2kG#~QOmRJkEbn9u|J+>xlBH0d4~0$CGz-(9?E~t@*gh$Im^r3zhAOE z&;9!alF`3kB%<7xST2)~EB*UrBG$7LmNz)xNy{so?^TkK?=>Rwon*O8eqG7;hLW#n z>zmLkD0vIt-66eFBKzZ%;t$B^FYi!1uY;6Mem()v}HeID>W_$=;2 z8A$iz1CXAxJ_KpK`v|1fq1^)=Ky-%*pGV9ewW_gerFNyfxido^SK{j_mz?#Ek8k~ z_m9L=;Ljkv*Zc*f_q>uu7m@xu*v);#@+Z=JyZ<0^I*5D* z>s7D-l&qv@u=-l*{i+X<^+3E=t7WZ&_*2CgREoNA9q; zhW%2x84>eOb0YLwuv{j$w6M>DV^sZkmsL{Ak9CWIKH#>PS(Tozm?X(F4nF{r}>9S^G`RB=AZ5$%|Eb% zaoCgW8e;GsiMR>=?+rWDpZkE+pZh}3Aca{&SwGB5@2g6nr_N6i$Vc;1Kal37NRZ~G z{vgd;13erQIOpqODHkD=3+YZ)8%w zR3iH=joX9u9{xBcXHY!PUzASsR3=D%oCeZ7lm+to5AymC(!7=n(ma<3()=|Yr1@)x z;_rNr?rQ-^^VCd`=BZgA%~P|XzoU4Lb*@$H$3fixLhC%Pf1!0g(&_#aQ;HW@?*>!B zdq5Yco4>GMSZrNnrS*KVbt&vqzghxP`H&I6%(?+%hB>ImgCITU?*(Z*Kg8+#tovCX&;RiI)vE`r4LiTx_5$}fm$6$y2{y0c}e}eDllhz}w|0Iv+rO;Ey^Ha!2GCu#eo?yScLgeubJ(TmB^;Iwr zEah?bru8I`v)4(+ID3PL`|>8sc>Y($S*bFfPg&oE-WmCABJ|#2xlBH7J;U<5L>|vb zho8<`KjLyeu)fFTyiYR9DI+5P2P~J#A1dX1q>Sf}t)D3E26;SxihKnnpW%Dwl<#vQ z`|S&EPpk|X{rMcl^LVCoy6+c2^5a(^_2aKW8pq#&G>$KVH159zX*_=i(s=$Jr1AU% zNb|stir;?%>Hhu<(s=p>r15kKq;dT#^mi2hX1%P8YY^l5iuHGH#}(@zNT+^4OevOZ ze}bvtRnP^NAJ@J%9~+H3U)v2f(Z6beR6bbHN_LjzZU4xxUzyY zu52KU7wo4R#^7^%f1A`W7kUlA9LNn(k9)B%pmdT05FZ3K2I+eWO~5$FO~GML;PZcw z>@)+(PIK^acMDr98})~lMD&MP8DzVyLHb@m8|WQ&x5e)yXx$37wX@N>6-YArUl0-b zf?3A%zfG)L;`;yr_!OqkV*k~Z;<+9m_KV$Z zJ)lqfMI!ANdxErI>;=+(u{Rj*4z=|G3&6f$H!vLblHFlMwg>Y5F@n?k+4>{Bw>y%^ z=^*x318jp3U&}p^$nhZdZBe!%h|hEnCUQK;`@?APQpr%;aHO{^8AjxEkiXA00?ftd zyd%M1@VVzGkUk$D4SofA3`n0Jj|J)T?-%s(O<3PUjvrPMYfIXkF`YjV;#$7@_O3_mNyc4zDGLzu*p`;e%NB$%zoIy za+$otm5RvZzmdoS^m3(`Zd_`Lyf?h$%KK#0i^!5|k9|shFK*l_Jkm7kg zp>+D3<}et22H*cv{PZYDetrz`DaA)@kAtb;6QB!xlIs;KgZ%lJoq7(Wb?SML?(+-aj^Y<>FWJQY5#;sfIN}{he;G2Z2PZ&U zA6`K`J%7K-^?8lf8Pt!z2g~ojUg!L8*xuy!zD;C%Zy_Jmrxc|6oC2x+Z-dm1cfge5 zcWtM^RPYSw0x_=m`C5#x_iP`-Ua9;(5#y_j2)}>8GS+|FM=XC#?KDT`a`V@c8a+&;v?Mu%06OqRk^bGw`Kgw69gy5fHcm21ZkX+od&S~Gx8Tnzt}E8rq9zr?gzhuH2!`={G*R) zwm#*M1}DQ(TwjGWjO^&8&Y5k;fnOP<}o8tzaH#w$u1C+HbSdeY>4xjHCKQ zlxt+UOg7oYI%y_i{8{X0##26jyOs0VNJc(85&8UCE|VK5`Ob_-zJ_;TJ#SwW-8 z>waUfHsYIrx6t|z-VWXY9(Fggx8eG=vNz{)T9Ax#S`txCE0)XT)=D{Ti2Oamw#fgu zyPZ7<`UNF{MCjx5fB5TOlp72x-y`JpsJ&gR`yD`9_d6o}m6A^O&X8$6C(?R;CrImg z7m(KTuHen?ZuTB1r@p&8k;?&j{q6}~DCuPnMf$1Y-u6C9I*9#4Uy5ga5bJrEJp%Ey z+~Guy2eCisXYY@Atp7xg2YEdo0A4B?XpcgA%aTDvP6z$!V%;7L)&qxtE3j@ygC@vB z!G_>4@D6Y|+B@Do!amY2)^Cv4=TTs)d$fHl>}R^i5ZOM6^*6>o9`OYw`oxE9T0knb_e34+(|@^2X*g>Qtaud zcd0yui1FeiLT@U|Wpb)LjpcMA&o4;F{E~s+eABpb5ixG2*)u_(;%O|G$yxSn&R0m} z`GxfBl;l!6&nqC$E7L)mS7va0zP*6;@ceJ5^?Rm$7Sd^6A=11u8>D$<4oLF~*{P3t zWgch-Nv8Ly^TAso-wk`T&fEji{IURc4bnn8y(fC<-bF;~=Ix7#0q*TflyNX>D~(h7 zUi&iG;q@Qn^&h12R)W0#gXb{bR)aJztx?J=Qp#Hk;`4v|X7=xTBK*67Wqkf`-^B7} zBF{%ihhMkY-RxJ{zLotdvyAuu_7c{26L~&@9?IQr-^TUXZoi+$`!4$q9`8Fz#(2M% zh;nzajOTx)o%a(lAMLj9<9vJVdpO?%BqQI0MC9Aca+&;)l5d}quW0Lj=oOS4z+VO+ zy@!eHhl5-ntoLZoG5IjX^L~KR>ApM)(mMDU>4T4hv|c{}(t3Rar2F_JXu~>j6r^?k zDUjCvr$JixkAbw#K7(@TK0gc6ef|$f>-TdYt>@2!^qlzu^s)ZiU$QIfKjhWhkK12C z`sVE~6VVS&DD8ZOXgIg+Rr~9l{u&YKCzbTqIX$KLE&Cg=lM22Gx74xn;xpani5w5|{P-1k zrQ~b-MWokqe?#PS5Z|lC`VaQS_hi2Vn`3_Z9;D}zAHZ<;&-Nd|0`MoW8+ZwJlHI=$ z*$#+#@K^g~#21wOM&x)9^Xc#QE6RKd@_hIQNb}*J%6xbg^386^-^ZWU4+D|&gDBtE z{|3ZIxoZ(Q9#rQ)9^bY7#rUoR()hj+q;Xsqr15=|zvx#tgVe8X0ZZju{f)4DMy^MM z-P>3$lW+I0&$5xo;~D7~&nAC6^e@U5e>3P)Y+<=fw))#x-%jN53_X#|L-p~eC{E<{|9Mb6$O^! zxqL8q0O>9igb zX+3ss=Iv>uZk`aV|{^nIjk{~XA-!LK0XTq=*>%MxjRpANo-?>Wu@KR%7`|MUHu z>0iM5GyP{F{u1JeXTjNE#3NY$QNKiKuKzs9^c+F#i1ht^p zq|XhMIep$#UPFMB_QQr3evj245a!m2dVrOT(6b>>-fGG`LE*pzM5p*_ccV^ zuOgPqd0dOKOh^S}QtmhU6-yo7Z0m;3$qLjR(?$A35IQ@n@eGWh}j z2U&kFk>@4o;r>13zYp~ze}Is&{v#jOfBbDND(_(;`|}{T1M5G^!TL|}V*N)v-RDO^ z^5M1) zdF44!2A>CMUU>ne`RPTF=BJmyS>SPy=C7AQ`hM97kiK8`3P|(TtKinh@clofKb_=u z;rsuHr~CH?Nd59n_ywQ)`@hBhDfK^vcYr~TAN9+3K$_1^gEXI=0ZZj~{XgLQ zca{i$zQ=Nz{Jwt~%O4Q=dt69|{)hhmA64fbFH`mZ|8d+Ug^o$p(1H+hF>_nUn5e`vMa^nVo5|H)*||Fzm> z@@~=A74n%Mds^*7f3NdPtDj+B`7b7CoxQDoHT`{}o#R5!){Xs8=eT}@S{HtYw*O~5 zjvoE9)d6I!AEM4_9kg~1wfe`}`K#4oYv(VMv(DeGj#xYYh&B(=v-4U1LY>b#YUO?T zwe!`_y!;w4uRPD>tWz_;R=%#YwrJ}fdbZBhfuEMw%dZOuWa{M~OSw(u_46B;enSyI z=@_L`zM*L6!yxCjLivp#b~*nz%Inre%H$*aZgjW#|3*C+7RG^Q|QFyyuJP`%TU|0o98fwEA@pE5vox^@aJip4M}- zBfNKr=121Nej=J*NWZoI#h~ULGU@UBB4o|K1l0VK%=!QPB=zZhCPYrN$ecb5j1vo(z#s$v@S~VgHdQIc@S!v-CFkr=zFm8}gpyjQqC9dj27LXXdvv zy)*OmenjcezaF-yKH1%~^L_sA^X&R84$=`>??29gve%uUerI_u`m)cRk@dUD^WYM< zOaA$cXIZAJXyXs9{tMtDw_EXyz#$OwEkR1dHwG4 za(L%ve*X{8=XVlUz*+OLJFq+Ql~BLS>;?6^%-&GHH@ylz2m3(9ar#2Vaju4nCiuB*E{P_%J? zwvV_49?9IAUrK&0_cqb;A^VTp^9Pe2&)gweI;6fk^M}API27{xzx=z<8|V%bO%K{W zVmRELxjX+}@;8-_$RFwDL!PsHly3UaelJ#L_1%~M0Qnu<`$fx#b^iDe`wuVVeZ)gh z?^Pa#`kmn@*pBgj1pYw&Xth3{Ki53 z?(a!>IeZE>bf3NE_G*W9bg|reDc}4`XzT4FD8F*CrN5s4hUsDdSx1i^U6TJM`LYY5{K}teMd6S@4F(``JT!A{?B`UKM<*J zwfbrHTU@#v`ww4XzO12tS})fk%Rl)TS?lOJ+^e$N?-Gi?%yFKiZxAAIihq5RUXp#0LWq5RP-)bH=Uf$}@P z_4@Ul*WYc{kMHyMkY8H$L;iLfryV9QpZSBxIPJ>+(Z=Z~$&AxZk#X8(a@N`H^>2?i zPCw`WX65$f|6=9#N~YYeBIWj(oOSkl<$e?C{~!6k(~lAGFDrj2|4%D_Kr-bIij+TO za@INQmH*4imsb6g|F`x3NPbPf{J?)i`d`EUuhnx@GWGCVe81|cA#$!b&!4lCHAUuc zEq{H|_d0d_wP9X)9h0+8U4K0*S6?*$0zICS2L9vF+u|G}Qg1_(v(B;pMkXI8nqNge z^XPbgWBRB20nIONLiw^xQ-4d-KS8wn*$nD_B4b}$DBbL>^7T8q6QTUgR#5XXA8J1O z(bMnk0?3+=L8#x`g`oD)VJLsM0LtHuK-uXil)oE;@^=fN{M|VGoOLt-Gt066@D182 zreB)pNvQdsg7Op6P<}!Q)V{kl{W;cmlK*7N>33_8-?5$IKh=}PLFK3WPlKhf4IBc` z@XNnp|Bt?YN7$BhJx}eR;(TYqTln3@S#U6H5A~d#4R=;_@OPs9X)`;DJV)pFbN9KE zII5}dTz_Zuv|kV_%g^(7@#o?Ku*Rs0^Zi}nc6b5xJcd64c}_3%ceDF;p}#x%dVa-; zGcWSbv*-3=k@ha}+M73n_V8OS_h06h-*dVD3hL9i^?({TWYT;3dm(H5u7nyt$t#@R z{;Rlt`B@OXKK{Ozj{Qeo<6Q0UNBg>eko;@>{XH4tKV9p;4q4*@>BkNJ>rL+lKYo*? zLw_atH&JgD_5nL!{>K2n&-{*oP=3=OsBz@yl)TcOI`2KAkbQmF4-+zzjWcR+pT zVld3WAyD7B7z*VF-3jI24D;H(3(6lGPWmGEZvTDu{NC#yVe??5WS-x9M4q#IP3HZ- zKX+g66Y<~f_tSr#rw2sz?0U@qdB~shhaQHqpQGRx*xg5dIB!29_yb>f0k5_^FL|*!TuvJuYSt^v?oKpH!Qt0{1I=2`zV@;8+~=YQVIhxk8Jm2Ub__TTT2j{O%c9pZ1f{&H9bGq4?; ziQYiBLNq;S{#GR{b!Yjj$sg)giIxxTe9CNiKKJ_tc>IQ|ojFkFQRYI2`~M)OR6PKz$ctCDeBzRzZCi;vHB~ z{ht3_IBw2+{`EHRKJ>qD^X>!x8peh1|A>sshbD9W&zpB^M81Qt*8j0LZjkRFtn+{3 z$&l|Le5!hFT%mn;VguB7Cq9E+x&Do?p}WcdIr>f9&7$c;zK6p8AIgv00_E3jg*qSf zCDivazJi_Iul?UpzPp@v!-~T=N#Q#OhhkRFr^Z!tO><%bD^9QK!NBju& zJ&K=TjP#xUoFBOh`7!c$Lw&Dd5Bv)GXZS7r1fFw`VZ32c;vA5GkK$GW-8PEt6}D=GT%>xjOtqfc%2GB7Q;rKs}gOUf<-b(;#q+ zm1`-QUn~83nPZi2el0Y=_BbfN_IOKg9B5*Coc{~RuWcGQfqeP3qWs!sP=0N5D8E+q zC|)W~=D9nO^0FVTkh^}4{YREv!Edzp6#>%a{{^A^!4Q4o}3!waqh*vJ^)fa;s zox(uU#wji`P6?BF{~steIVqZ7Lq6k^3Y=`?QxZtq_>`EOby^2bGX0Z9^PAA4{Zj*{ zSo^02+6CmNoe?-KAba0NGSA!TBJG}Ga@J`Z;5kEXC*n7q892wvbqJhg<=RW8+}R>} z9Zb$T9ldhrc;zO|=!9Nb=3M>{LVBG=8;|q6@j%Azc2&CBUFByF+t*qMu<{FIAHmtS@Xl)rT;l)rTul)rU3l)df&3hk)2exzX z4cte52e(YLd`P(m1NXx+_<-p>7O9zd^tA51VtTIz7MR|vf!Dn9kacolU=ib?xFlpfTpSoid98=yoQgM8 zFYRFetvtUELDsp8rPQN!?JcNvZ5hO$eiZlwy)Dif5xuo0XPu7&>rDPcwDpmE*2hl+ zo6z6uYzVA}dF2~S=KOzPqv>xFZGA+KaoimE%KEi6@VWKt3(53ri%5H0P0l)Bdj0xJ zWPGxLudRGG@D10e`vYyC`7PzkGT-sErPmV%|-4P=l@Ax z1l6C`!IbqU9Xy$SbN*kXKdnvX{C_al zpOZ!WxQ=Ow}rbi?Sf~Mzp4Dp;8|WiWZiDBbkm3I z&pHGzAbm-7$KW|$I%I#=DR{0YL-uE#gXeiNWPjEr*wvFE`?K>^kJSsY1Kon%N$32Z zXz9@G#6|E(=HlR`%{EdRSFZ0BAX>`nO&ZZFZw zL)QJPf_+Kn{GVv)(DnsaL+xYxLHXa;a3A}+{e#z1zx-incI7%KKm2+qKl}zLKm0~0 zKl~;rKm2AWKYRe}?A{U_2+QCg*bd%CKL)zDiq;Q^UTN?S(!0C2ie|{%aJbW08(a*b}?A&lz>fRk3Nx7l!2+_(xvtRc>?bn&_O$PHk!N&bp@%z7E z?t5|fbN&DQUi5>(N0B!=4~eYT4~x_{%H*u`NN}{tkBa8^laJs382=)tb$g7+y8T4( zahO;BgvnWFY;c^FnuX^P7KaYN%Z>s9AaWmH~-U6q?UT_9fyw9P2t!w4*fA<3}`LdH0PaFt1S9|4WL*D-fU$SwS8=Pa~FxO<>{|D#UIJ_j9{X&oW=LcW5`sW81 z+4}HW@D*Dh7D#4&cva*+yk>INSs2W%4~s=ywwn+IECTE?MUOTHq%DoeO*Sl_rJZZ*zlq<`;&wmT5+y|nK z*J`^S;{A-r3g;uGo1Ij?zIV1(^)UV)L*0*cu(JG<;HSZy-wy5mtcQcjHwHJrQurAh z0ykN|dH;_*s^atDX1E=GL3@fnLbIb=pzP>YC_DNklpXyF%8q^wWtX#1cKI9YFY$k5 z+2ik^_A%R__A%d+uX(Z^YToRCvV%WB&!6|7$MyV#{W%BjB)uy4{8@Z(H|ctxx(Dh# z>d$7UehL0=_hWx>uU*%#lDQxIM8LeKz+o^5N5T*s1H-TzdIfOL?7~n4mLf-CXBdO`!MJyQ(Clvl%3mmgdT&__W4pvm36*?1+n{!s^{E+;Qj-mD;`9o)iI#I4urh`bijwbW{pOEf+4PPe_|Kr?H zXRls}|8ZWZizh?;kFKiM+J)Hl3qlu?&hP(3ONYc8FA8;sW$s0xi@ocF<_}zgyf$-b z=rUyaQ=;OTmqYCrdqC|MuYihY_JsOw?v+sfK`+>r^xp7y(yxMwbM}FXbM}Rbb6yP< z=j;a+=e!0g&eZ#BiGTvy+O3=fEJIu2`V0WGhA3bAT$KMCDj8% zgFHQm|8z^}R!@fbPq&3iJsILZ-5$EblOg`oVAW&oK>W9%q2Z)&D!(%{%u9#(Z+9u( z^q{>*zZ)tZIRbWtBN@-W?meMjkK|D(esa(cI80+>edUiz0S=%zqWM+Qua|j4`Q}$a^Q+#3@~f6w`dgu8rpNw2B)@8T=xy@l zSBdhgRzUexE1~=<>XH2qtwk=adO!3o^)&OnXY%ry?~AM}AB8@!b!D|=)|C%MuJa?4 zv(B1OZe3X`Qs2j+b=0T#yQ2Iy_4hmCho90O@Bc&Vt=$cw&q!~8-4SFG>G{dPVttUvd4i-(Q>FH=(TQeG~eY{N|L0l;0Nm z&eFGqz9;=Ck5RU*3W`)(E1sYOh3aSUzkFs~PecMby8kEX_59P%_u>yEYmuCn(3V++Wj~gY91itN1v*6^P`oo`OpRqDsLM;9hSl~ z;1Jl(+UNW~vgZ4lQ2zE=a85=0a0lv}S8=vc^9PxEeNMQejmJ6RPUz`*fuwg1pKIxz z!{?E%=Kzx4HQdG0yN1svUC*c34L|t;cp2>5}L0 z-e4fqzF`p5zTpWE5 zPWfzjN?38kXT#4^PWSIQsQZdc`qc1rWZlncQ1@B#3TH;x;d&Ieg~U5E;d0Z@gk7)y zka%T9cqX#uBc#5{@GMV;oENDIS0gXxd4SaOLU^|6y%3(`r9<@QhF?Tph8{%krSLq{ zdnx>~mk!aJAASY-UGyM&uZ9Ae+R=A}dQmWSU)-ijVXZ)JFe>8%W}^3oySn|>$!9^3tSn4_`;# zVEUg~zVy-KdDs;Gg7kS6n?=fhZnE-~zQWlO-b%X8S&MU>FT=!@?fF-HS>Jp4I_&e$ z=eo1#SGne|S)BP>(zQ?j4r-si4K8uN5AU#bdb`NHW&cmQ_T4`~?LU8n`aStiQ0I1H`MoJ_CW2ge}+}G{|nT)puJH0;9sHk!TX^0!TX{1!M{Q6gMWv`uk-#N z>UUIs(tqv04r0)2ngz1wwIpNTYKx3V9g{i#SCD(I>xuUJulfc5e|+n`$GMeb z3VikY(*K49z8YgIjx9Kz{PEnkM$|W@;yB4RzDl27(YOFV8a=x|w%=%4klW9n0JWcQ zhThst^MV%0+CPfgZ?}Znho1=bzbdU@J2$@|Ksy~=zi911+iwS<_S+$-{dO33cB2Ia zunb0EJ6K5hfo@E+^3eAEannx}6qDcGEfOssvM){+q)D&krbJ7J>>o=C+LFGcx^=-x zUOHs|cyhrho($PPo?394Cqwp+Z3<5JWXS&U4Ao=xLfcojgY5qc&V=m$3(mLu*Ri0z z-M_O7I#G`Ozeu@`CbR$d?q4TS`~QN@UcFHJ|AH=_47LAPz1A+YeftGa`}S^7`}PZ= z{_mzc4Dfq{i{MJqFNS*mdkNHj{!)1C8`ytX!9MG9sPFvrfZEqz0TYz(37b;im9RPU zs2BX4a=l@VkFfvnV5U#O)$}i(=_^|QV4c~^m`70OvaW&pPEdd7(w}Rg;_TPKQuq3T z8!123y+O3{u+C!U?@h3R=jdj*mU08&XubPYi>KPux}Dv;FvRWc@GC-B9s}5m5Wkk#KkB zo`U=7|EBVL3(CCyL*fVbDc!CI*7=)q4?vwmdk|`W{1DW6sfVG?OO1jJ-A4)@rF;{2 zv}om_#Rnea`RnVBDR`WI={*Xx{q_@3|MxQ%YM(p~Dt_=JR9x&SsQ>YK8V20)1rw>i zEHgp0`l0RjpMi=WOoE5epA6H~GX=&-e->)r{Tv)g`t$H8dQ+j|57VIH8q=ZTM>F7e z(1D5*l|#iPGEi{|7b-4M0Tm~h2^A-(go+c)f{GJVLB$EGq2dIyq2dHDK*b5>K*b5> zLcOnf5i0&S55|yRf{GKo3>E*F4;BA-1uCw!04mO+^{<@y_F94B0t*Y?WV|;zi$wN0 zi$%ukb(6Es8wE>Dep9q~0{N6%TCjt1yPUT~_E*abmchL8)dYD&Fv+>3vkNhIXX~i8rh*_?Udf8$`t$ z)23}NgrErsNip8+1100&yxaBG;dtnh&&%{Bd1eOGv67J4)lNd%(f!+w2!p2 zdd`$gJ!gs3)81tM|JSRhgVi&(qGRM-`mOnL4*F9nI!Q*K-~UnX@XUFU&Ts_0(CWV+ z(#7iUDw+Dv7tz1K+2rrN%_*MOClFpe=jz9`OHg1`r9LNsnvIxWa_(I zq`n>|^ZkFXzMfuvS4MhKpYAtg9`=d!wsGtexeC@szM6c0RbSDbKZsucNI%o-AGyZ# z`bVxquXWY6VvF|77f64vkK91I)(41uW8@}e%}0nlX~xa;vn(?pGTiz(P_%hA2x^`o zv){NiavRsH{U)USJ0hi4{*K7)ur~4#^!-(XMe8R-Z&+lg=?#nAX?nw~{?=7@iPlfG zr+xn2Q1P7+Q1g5wRJ`FHsCdl1Q1O^DIJV-x$b*#EeZJrB^8=FYKEoP4Dj$lBvi2Vq zTlB5O{*$if@)4-#WHi)s@+j2v`xw;oI|h!Zd_3|5U@M#S;*#X;q6q#TyQ3>*S0Y#w6&k^9olOsMY>Rl;}JZ_VQRw7;!_ zI%ic4wNA{27oqYFxmp~(8W$a@|Z+w;JC|H$h$U*3o;L0{{$sP+3zIC19E$Z{+HmPq+! zUisyst)p+Fr*U3Ee<%7@MphxKzv8HhcO&n>?eIP7(R+6B!5#1@=-+l?=_K+(bssag&Hqp($_^kMb>zI0yVCZS2*h<8|a6g8%SJYW8^c_ z-x%3MJ6iW4`~J<5&yh8cAoYC_+2YBNxWm@SSJbC=zl3TRnQ~u8zC%{KSug(^sP@10 z^vGwPZHs(w`q+P~e|uyH`MS@L=jn&YF68kQJ0m~Z^YoKso~NB6?Xdrc{_@?Cy{5lM zwCC?<)Bi=XJ%5nv+!y)P+SwQR!}RxyrvIDi|1R0|A@v`Q{0X z4@dr@y#AL7BL5vZLcMd4#nlxxqW{2k@L#wA9)+8sFRJIdMzm&B_4EE8>Utzka%x9w z!MU&jdRiaqK&=mTq1K0bQ0qf|sP#d5-&7nEZRph_&UKEBHnMc=e^mGVxajeuD{dq5 z{oiO4@^!x<`c0$%8^>uwdb6m{KY`!dG>45hV*g=V(pysBf8sid;^3>Ip*C6N0KI3{_77R6HmG`Tk$DI4XOUh{mF_(}j|;S8GZ0-q99nKh%zLeE&Ck7P88Tn_zp=`?_aGJ9za&i+6N{M>6L`&!wNW+)kqP6Iy(u zGd!3%FWQy-c&3YJ`H;BC`O$8qcW^HdEgiBCy)b$S>6^;CM=$cyA^Xsam2P^_;uV*| zfO}cA2l-{0%SFqFwm-T8KE}SNC)EDvO8T$&(!G$MNA3+9x>rT}Qof1XN3`;gIL_74 zYe?_z_7g1~+CH^E)V}vxsQun`Q2V{>q4s+>K<)Q#gxc@j1hwD08EU^b0BXNC5Nf|S z2v$_z8odRMn{#XQZksQ6L~pbCQW_mXKRRV@7wN|xCTE?&-h3G%5_cIIz0>O_B(NUfZi8nnG9qq}Gc+;b*$LfW)j~xT`zqF6TM>k>r;RnQH#zMty#zF1BpM=_f zKLxe_ej1j#!K6plSCNkgu7xCxIMcT`l%=dqy6(-LVN7eLU|D!5b8GV~_eE(m> zudj|)LB9WQGT;A;zF_6v7H$75eZK#%e0v`cZGSuuYJdEarN11VZ+h7OsP@ONL>G{+ z{jsS1@vBh#Lbx%y}OAW{Ct3Rr`6XeIrUy=~5*Y4+Df4_jcoGsC;-KQ_3TkSr5X)^!+7ya7qQ&zP77kc#P+vqoN1pL9C*X_~o z?0MZLndkL;k$JM+$ZK*kRHV$l3A4VA}#OlFPSRW37$HZhW+5aPJKhO|rKX5G6exMPQA9ozoe&Beh{Xk=={Xi2a zKe;KCpL_z8pWG~_`Pd@X9Ol86q-#EknztuH?E_lDDCzn1Q+}QwS@SsnE6aniP%P)S zLYv27sQI7sW23Q1O#VkSR_Nu&ynJNR_fV*PDJsIK$ z+^u@8AJF`ukr00%Rz`kz_g>NRq0axs9w43bf1;&B{J{rf4{_a!-$V0<9)|LVMnU;Q zk3jiDqoMqvN1^y;qNPK# z>l2{j;uE3l{xeW^e-iwUy_cPz63f~BXX*cc?fdhwa^#K9RFU;~nn?ZAP3HUmF~{U` z(d;|<*!N6q0p)f%u84h~8LNPK%zW`<5=UDpO z*o&q|{Gavd=+Swxm&liW7iHgHhO+PTq3pZrk$o4tEoT1@wT`_;J=(`Egj$#WV_z4O zFZ=mAlzn{z%DygvTF>9~$}RQEy#+Tq%VMi+e3pxh&)X*R|9`QSCa)4l)#5oNpK*C7 zw%W$!z1X`pF7KJl_kUs^nEq?wM*|55BiYyYFzr#A1`#n#xoUn`k;|FKBB>rBo% zpLp~BQ;~Iiee829w<)&4%6%r8avMd;Z8ACQZ1&21?v`?8aUwyYVYjTxlQrmF4?mzj<~EVpso+{SHgvA8-i7 zKAByGHFmOo;ph5yz(dqi#d9NB@AdzR<=*H24YmJ00=2LG$J6^4S^MOpaEa?H%q!G5 z)({zQ?0;eI970W~^9i+}zQ}pw34$ggT#a zEYvxQMuoY3@NvjGPjNidd5Xqxk=vxOWuey3=7miQb-gD@W0fh``TlQVZvAX2 z+Bu68DX-rnw1WD5Kt9y(1N>0miwi)VcVL{%9)${Xb~6lRHw&QbW(4ZHWl{Rc@Ba!5 zk!3eU+08hV-Aq9H{U1D-DK1RW&v+&&+Bm}8`G45ZEh#*S{3dQ|(efedUM=~;kY^N3cJ{Non3gQjn`R)9Vyo-(_W<9*(PV5 z4&Hcm6tOqw6n66Jh1i>O3p;x<#NM2zdaYe(`@OEPv)irkd{_oAfbC#+^ar{Zilz^3 zA9xYed;N={-h*EP^?v+Pm}H-L8Pt3H%b~tI*8}Q({S{EZ5AO-TWPV)<_1?Z0)b~?* z!{mmRDQ+N~g z@c%!e)dTH&c{fA7Cm#Uy{&pZV`wz|jGf(=uw-(+;y|Sy&>~kqRlDWNbF!k1Q?+~qC zh@Um2@LtlFR1Yn@(@Tf=S;GqN@??mgHN5a{PloteBML`)GQ`iiNA*~}(EPzNs5r-c zP(`!)bAx6sPhTAxIm_`iu<+EaYg)w3X%TL zG#UF}ILqWJ(fkJT@f)fO->2LzXSRsnFsJYZm{&f>4zG!}f^y_6_Qoi{O z(ENt^P=3QJmcF3yRnx=%7s_vVt#Bdv@*70?4U3@shQ&~R1NC4x-zZ#(Tw1lXa0&G^ z^Sx>E@|jCT*3Y*K-?H^!nPk?3qN7IpP;AnrJus5sBgWM z|EzF>wf9*e{!WcgN&k=Evk5)DC*BO@_k0fJ_k026_iTaki?%}TqrZfz_bU`@(H@KfgCQ>ufLFVdM3KX#Ng*jMI;Wzfxam)vm&yY}|L6 zynN;^k#YZ}aJP;79?6XR&m!agi^+Wd*Bg&tMe6yjaG%w)zwi+CE}!|ENIeG%f46%6 zkW4*)iqvz!WcL4FJ%_BG;hDb*4^w^w^u<;F-@?DG{1M5N|3{?!zb0p$qh5JmT=!+8 zQzKpny)90jh+a*TvreseZIkPW<|mTRIMj_FYwa8puNRk{t}mH(8iV6~RH?>f@`E|;l%>6zQ z%CBn$M^#||;pZP>|Don<0LtGBQto*CoDj17yfBnsSODekMWDW~9ECeR<@^N$ z5$#T!85fz?3Gcd!M0=lBjGoR#C!x+?r=ZSXr=k4E5-9(%HI)B&5|rO~GL+wV3Y6b? zD*e-UZcamfd2^fi={CN6{}*{wMceopa64>AfAoG1GX7`A&mvv_uO;d^Z4Y-=oE<;M z`rSdK-yOYvpCg+8*@=Alqvt~Tr=6jm>+_(VlP>h9fv;=)eCpHradA-jh4BkuDeMM^ z!0ui@A?M34ieK#Mi(hdcE`j<#vrFL^co|&9x_mj*cQSfFtqWH`oj30Zb>93+sOPyC z^)~hOj$ehW_mz-!r*FKE&6~dQt4Y_oAy$_6i{mH%&-=-1a`EZ+!sDZ+#HTZ+$49^Mf8nR(xg@?Cd@gf0Xjw-O-|z zhxjp%#UCfVmODnYbcmn&M0_0SL*22Wr9<;mpM(wFr{d$uZ{j{JT0S&;KLP6e-b5J1 z4|@i#=6vTQ7~^^;Gj4s|De-6Nr~E2N|E9*DgJtk}*bYvo{(afJ+&U*kgg{S~mCJ2O6udOEn3qSXWO>#O3kNsni$MN5bH?JvafCs?QEh?bu7 zFJ6oP0l*=I@)@7c<6qhMY>9tiN}Bkx0%fM|Go8byNEs75#Md)cE*3Oaz9F@ z+)pCqcA8B5-z&GrGz9`wpGKgai*-Y=q!$6jwdkXcXmDc#l=L%(Ww64`n)KBEvsRz{#GU*Kx4UyH}F;MMEUf~>@ zXq3oZCq(bK#POES{vUab(>T$D_H><){HBQ$JQ=pUe{-`0>!8iM=G3Ekr}a_S-x58Y zM?Dd0-nW99&peOzU3q_keLwrY08~6A2o;|QLB$`!^rMRO0;u=%5z=}8pD0eqk4hwB z30;4oWbS)hivHrw=Sea(sS_!tv@A+-1^-bYW+Tm_SR-jPMm_Q zbxPDaeJa#CeHzp{-3A`aoStY)`|->fqSXs+-EIflxo0NYli$HTOSF85eK(>%Q9DpmJV6}uT1nxvwOc z_4_K)buOR}aznRoq95g(xL1o-9@73biEByk?)Dcg9oo9j{R!y3<@L-Lty?!hty?!j zty?!ity?$K4?Rx?GI0s**v@_aktIG5t5mQBSqT1$K}uruV35_e; zk1O5QE#+(78Vj{_{Id$`_gU3Yzss6UJ6bPZfLbr+kiN*Bn|Q^>`{l%oHs13jGu|(W zjQ7hXWB&IJA>&G%!QT=veIUG0V?Zg`E=R1iN*3XrR_pG0*MEd!T$yw)Jub=OU#0%d~ zd|>(5fAr^8uTFgE$&h&AN2-_d*nis5^S>50bU#jfLVgo>ooM-x=l#>f2GYwi>qSe4 ztV5qAHjzHm-6&c*v~_4RTv+{i;ydz}RDY4!;^jl)W?K_qdNL$#_Eq9*Plm+JvWagz z84@@9R`po@(BgXApyGPpL&f#B!_MxHi5;*E{s7y-os=Kw{v=v?Xz{*XmcKjkGx;6d zJ)-49Tc>^@e&4;8Qc4JuCeJ5-$R52!fZpHOkS15k0ggHUn0 zL(GG|?%~8=-Z}~C_uq+s=tp<=h-m$Q*pYt|z9QL?qoSoli`UhFiqGaj{Z6YURQ$FU zyp#57!Jzv+t!Ero^=DL--R6m^}DBrP``UR7V39TjiA2!avap} zpN@z6{ZnJ8-#;~h`u$T=cqDT|QFHoR%WWoFf1&*zss+^Vp;|)O*At=aLMtdgKOgFM zNPei_6$PN;xIuUy48h%*aFOiwrt*TKh*v+vK1P*p?Lj+tR9NI|d<^B{@Bne81UwG8 zsOW#+OD2m>M&9V8MC?Oaq@EI!`TlRwNhY5xn*UEe{{JaO=TUB#bE=4)Xj60=%qwqW za@IM$=nN}&o@oBR^y_8XDSuR5o;zrM&{eCkT1L04a#m_2xT|BL)p!XymA+N)+PGXMGA@^!oOOB>U14%h(d;JqjK`HleQi8?7xl97=xuV=xvHp->Gu`QZlXu~ z{fe%(_WKpxP$d8Dx}s}}iza${6Ffa+(w`}s?CDQ}x^BrUoGC@mdgBF=pDTJEeZ^nI zHO|zcY4k(a2dQUz(F{+9$WBqYm1F;J`V~bPxZSBJa^a1eD~e{Kuj_=QR~A*FulYU; z>N=2Vr@Dy!hF#BWFaHIoe$Mgqv>%z^_H$mOzx9b1&7)pDA1}cS?@wPY@-?`a`#itM zSO31(iT{&+I`V=dU%j*7tFS#}y{S|E7WSX@N%ngY)Vj79YW;s5-b48}pzOmEcp~fF zn^5nkmO}XlZ$Yh#%ZhULXF0O$3-#BYN_|?_bZ!#bda;WBbYVSz2WmZd7iv9t&+F&= z@Im_b0qlw1YFPHxhgv6V`M6%5pBf)5!~T=5^=BcChij;JJJkOU?toig`_eJu@bFlwKx%cz?q29~?2G5`Sd(j{0={pC|-lP8s z^&b5I)O+-Uu;$!DMTb2-X#3f}px&qd4X>ShwCD(&4*!7}_%E!4zT#Z{(EQ&TQ2on; z`o2I-D1W#Xls{Y>${(%+FRl+e!UohUzxWtr`PU6$HT4|}yCXM(SHk0< zzL#)3)b|n^!zFH$;uDIsjy4rpZ#n-*y1oP04Bm)dbGXQDQ5-1N`kr6hvRLc;iIQ2T zTZxp*H#zJ0i*xIHK=j{6`5@(o!VuK=62kBvSO6b@5%>sp{Ah`BBxjxCD-^XkB~?<;PdFEk23C-Dt zEk4ck+KMgKFKbhLMzL>HFW>1RaqqUq+cIs7so&NaJ$GX(&MZFL>Lvbf^|qI6;tTA)oG)6v(Bco>pngYv zA=Lh)JJj#BFM^7%UJUg+?n|J4cYP`CugzRmd^xiAEu!`EJ#rT07AE>PMjb>d}nDv+z;mbLWgH zehjvpJ*N0^Z@gihGOp(dIDmS`LcNb42jyo!3FT)$1t(WOSNt>_JmoZSc?#?dpN03q=e_o!oeP)>&!_!q#lA5uSTCj{*QOsc=>G)z z?;vX*P!9E7feh4l09^7FKdM01{$?iBKA{p`Oa3g_(5)(-%{Vo2t3?|pXy+DQfVZPJ z2M&dEq4rNNLY-5X2lYQbFTus|Ww-^-hdQtD3fv7BKz;Y(RVcgt8r1oQg;4vgMX;Ld zSPb<&jMt&QXYmFM!X;4eQQm~whb@Jj-Q~q^!7{iEwu39Uj)CsmqFo0xzhWgkn{umQ zmU`ZS+CRMu^*xXGpuVf{KGeC44`6TP)lmDr525^wkD&JbYoN|;tc4>PSJoBwH|vTw za^E&OpNQ;>J{9T5dXuxxhT_jm-YD9>h{=ayu zm1~fMwl9+Y`ek1gXORc`z7|>E`Z_2`h{u{Zp>d)fesi&Fm50jVA{8Pl<9WFj#_U@o$?A;-eaXf5t*7>VAXYc+N zsqaYfKh)O^KTrIbeciwGhwuC)kJ@$nl6hSBK>kt}+Vw#4>m+O1IMzzmA^&<`ZPD@} z`3;hFEx%rpelwo+Ma$PX$$vfu%71Q1`lqyeEF4#P>5N9C>vxLBA&;#%KG_smzf*3^ z{hd2LJNHRwHjlQU8>5%loWPQn>(-rEzoeydHKw{MEXB6Io#^ITQc>H5UFpZ$yw(fufBV|`pS~`QJ?N3WZpcOyx;EA zgUJVMemt0bn0$ZLL!!+uh~DVrDAOCAe8ludCm%zvb=9My%`eHrGmj_7z!C5X(&cxF z>z9p9K1u(3`NoO%96-{aO1?PBH|hr8)1swA_VE*v6VcbX3P}5tlh0WDlarII{mIE^ zsmEV6MYMiG^rj}CGrg(F=S^>FayojgtEP$8PjUUS8G0^Qw;X#;wEiR4=+8XPzY3!bi!U1xHj?C9A1V-#LKH!`aEX$eM>Qa6hJ0%#qCf!2Xl3xXX)B zahG{eafz3p_NOmH?MvrF?Pp(sEoQx%Tmb7{{ z5t;8Mypw#Fe63^Rpz;rr@4-^|J{$s9+kC|SBllVHVe%83rynOjvh+2QnWt+-#^qy^ zv(7qio_-?Qd8tonU+;C+L#;C#pw^Yo;C#3dD!#G_u45m)8EPH+9BLi_zCL!4m%}dS9U>tS7A5h)-T(W{Du0i^ZhJZ{gCv%$$g~v z^!+MYIwXC6@^{j&@ckxQx;Sy>AIXE{Pn-Fti2XR=jpIQZ$DI|2l7CzNVUhg5y!^jK z>OGSDmwJ2o{t>NSv9kPV^8cQX%1hNqDPESBs+G#!kD5^T1DW*Nsk+FzFLj{qi{uqf zy;S{F?m31nuVb7Wz%|Y>sfMZC{D+i3Hr2?JA#t|jQjICE`+huBJIIu4l4_2ucA9$m zCqT8=%+pi;x}_~rElr>Jzt!I=b)w0wQhwUGr6OOn`7e1?MKBeB+hLgW$0|Z1?XmwS zeQZTRs*v>Y6|qz#rRO>-nfV(NO;7Zf$5TnuPl&b-6q$apWLpOy@y>KA1?R$(O}|7m z{nn;`l4R3|)PH*F6u2FpYUNH(odzc%w}Jlh(^F?qUh^KJ*EV$)@>J){R6AG!C2Rge z>T93sggoClCv~>zos;SSUq|i;E1>eF59#N*sm{oH9wGDjyp+GA)`u=4^>sB_`pEv- z#KSH~<>Ex$DEFUumf|_xNmtzGBB=MO7khe_K*f13g^C+p2361HUiltSaic3pU*z^o z^-bw{yDD{MN`6Hz$*e2AMaJzale12r6!RRpuSopp>Jfh*G zD`MZT6Uo2cPC}q5^euMKKqZGQ}$GuSJw#s0)SF!&vjorAPcJ!P*0QH>x=l#t?DZTrQ2xjwD8FJc zlwa{Wlwa`%lwYv~%CC6SyFW|4`|}pmI=T#M{ag<9e7}u;W%-KK%2e*X4aCmBn_2}+ z;X7~$+&Dqc9d>wv&mX7%?^FIi&$*u8)jX$4{}Adq{|M^2U*qYmg?gSpw&!_WYNL(! zhSVoE-k(Zlyw{72_Xd;s|37cMH;O#Zo4n_F^Z!22_I+8NYl|0dN#){{TcP5OUqZzp zzk-Tmd`&;rX0oYokQHwf6>t2O^uF$QscorTyboI3@q2hAvpw|#{j25f5a}QBf6{d> z<44%p-Ie+YmcgB{9o&QdKzFxj`jEKeT+Zz}&Kwbx6B#2tTCy6Hj6?@#?sdI$G6 z(bA#CAOC=*?w_fH^gi)_sNXvsfr@wi1NA$bf1%#* zAB8%9;7jMuAJl+~FXlm=Kd1>6pR5IS{-8Eg+_4VS`GdMp=MU<^is}aG`f%Kw2I=N$ zt=o;#$D}oX8m5m=>pmYV((gtlXPx8Hw2XYb$oZ1S=_Z!X`+xN3RyR$b;K`8lCCyZ? zT{pD2T?^V4R6kV2?)A#vEyO{9w{*TgLntsJy-AW3*IlS-G6AJ3#k%ZJ3#Tc=MZy)1K* zXz9?-g`5I)F62}gW8R(y6;Epe`9Gj^Tgr8J&k(H~wD?^+sQ6pX&YhL+l-9c1Uc}Cw zEu!DSWd8p*eU8bUM6+|`W9QCI_oCb`r?ZHi>ykbX=9PCbIqP&ypKs-QiDu`dUoX>5 z`DW*!*}3jecJ3lezc_t~=@I`=%g$YzzKnd?IZ<}*awt331Io^+9-TkviGH5%O4V<_ z>k%8W-t>lAFRvmWyPxi3dVSMZlir+su@3AHF=0-c5qC zcax#)-4rN$_bimXdk)IpJr89^r$X(!ra_%!nC{)58Q%SIpzL5dlpV}K*+Ccm%JPcz z%yiBULgv$~bft~YtTg*0n@_p(3$xSJY5B>s({m`V`Sb$R{6Z#uZh9WF+IbPG9my-4 zm(nkL;|0;1pMJ&C+5aQ2aTcUsr60OJNd9Z-g`Ny4zbL(!be(q)7goHUeuI3CH)MbC zW_pR0do!)`2TF%L&u^tyQJ&xbi>w37Megg{CiDBh^h%RgiM9@qPq}x}8!5NTc~@i| zct8D~&9C=O&N?5YS6jJ_qOAkcub25q`L+%~TL;!ctpguh`nvQdrpNn##`oyaPt)tk z*E%3-9oPW14txf+4yc~LHnIPwoW^-G{NLyJ3-a|`Zh?A^w?aL~UqU^{UwQgpd*!om zqw`IAyN$=UBIEI$$ysMx`g@bNi}sw6&p7Nz@3L|DG5v#$!;dCsouAS>O@EhY&l!5O zzbC!h+TWAjZ|lIX>7Q+$|00>^Yp+PVznYwN_Ic0Oev#+$xAY+^cOd<{mHR_7<^B{Y zcfe$R|L2uE~n6f0b^}uktm%zLMPYR|9Gu=0QDY zHKCrfT2RkfZ8)gBUP&ET3hTlluzpF-PlWdTHh_A5kAZrA8WAetEN!7A3w>m-(8D#4++k;u|eXT9Mw%ccN(N;%%Ay z671n9ox{<(wSIY^BxL1-qQyZV<-?}e%U2*;Iz*rM|Kva9#!3oHa{eLY`+RZfnI9?2 zzbq=r`Jcs5erFQy&ZJ6CDv{rpE-5L|edGK;^7Wb4N;etm{C~+Q=*uq^<(Hlc?fgHq z^Z$_Z|0QiH&-s7R%ER3Gf7sbQv!p%w-QBZ9%ZK=lXP0y&eW=?(v~-C7a!$#)q&IOp ziIxt{-|P$n?s+9$$uG-v5iK8@UvfT_UvdGIzugUXb}uTq5c0o&CEZ~=cnRePx)+O9 z9-5zWDc9ZCy{zPNZ(O1IF+Hr@6(v_vu7lfCv~m!CyjRIpq}OtLi;5Y@`JLy0bo;){jV1d3+?#ZtgEy_ZS+w>b z>*K(Z+bPHSf01?d7Loj0P3HW6NvX-Vi?*(kPq{lvrc-X0GgxF@9a=I3=9LdMIqTe6 zGR(?N7j0dY{`zIZOGY3M^xZ8oKl?e5^pPd^l0Lw9k7((T^fJ}Qd#d|Ho6oAJUgiNy z*L%!dy$_X)LhpLt!=jZJ^&ayPsC9cZ`E`AdmON(V+5eYl-5yi&IQd$)MXlRUK&{(j zq1J8cXB`_~@}&B+{Hc=h)N`}%Y0=t&DcWKx%X(Z(33r>g0d&oPCY>9wM72aDX?wtC=}7b7tnuc8(|t6%vUeDmti0 zIF@7y*^(vdHS_A^94fm)snbH6ilQXTC=yDt%M$(WkLSGlyuZJ{?ziW4J+I|;y{^}F zJ+5o6*K4p}73m+Zb$`?P$NcW|tbfcmoA>{^zhUX#6m7o2kAAqIdo6xjorNO#yk&OY zS=4>8*|nn0XT;NPOS-SHdcEC!snu(lZ0faKB>mfFbN=6}*9xoG#@dzLSCdaa-zw4C z3DV!zbYDyO`M!5W3x|ZS>;4|$m-*I<77lgaXS`2&mAMVwKeqBViq_5_K(#YA^TDR> zn@KO73CZsx`O#mun7^I_rITLV3N_Ds0yTeq3N?Ry1~q?u4mE$}p>*aKQ1jC^^40GN z+oA5`mr(uXE2#Nt2h{xZHPrmHlXN4q-*x{6R={uJXt>Lp{~-NoclSNi^BmvzBG*0G zfzV8e4>!MNBK0{`;QX%0tbTlrhS z3fK~khK#$m4+YV?NBGLy z{Eqe?W8v)oW3P3N^>?B?^&dz+o&8-r8*+We`Hv_4IlitU^&ad%_Tf+Rp8(rrPx7A# z+r#eWf3iq>bQA45A@vXV{gChf`9tOx6!9w-%@0zaus>??5t05;B3e8oeax@@`Hi)4 zk@!;4;*dCoqh*FOK5P~VL@3+g=S*--WB3w5rvAJnSor=AT=@>`f2jS=9MnFj3-!IBnNa82s-VtO&Vo8m`3%%~%4(?hm1>~QRXz)K zuJSpkbCt89&Q;EVP2IWv7pO-I_j%Fk0qtDni%{n(UxGc{SN$);O85$l!+E3|;l3tX zI%wzU=0kl?>2;{@AiV*#-}ffeIm-o5=PVcc3p)5MZ0*l3g4&;545im=q0S{PQG9Nx ze>vsVb(e`&9<+0kZ^JJ5zXNp+aRt=5&XrL6zpJ3mNv?)EC%J~_W03oIQxbOQnQtlXcgJ|VK+c*6HYCZKK)cX#bpx&3;47D%%5!8EfTcGx- zKZe?;-U_u({Rz}QHS>hMr}dfN*ZeESo6o7Az8jgxE+YO5sQ0$ELB0R59k#;$68?={ z(D^(3yGXam`C3F@?G&l+H)gZ`_kU;hF41&8@#y^B{)PeRxbH=D{tx~=q%X?;U^d_X z@&9P)8U~>0eEB!b{j7M~KY^yhe`UOv4*w0m2EO0@e^4KtCxqzmef~d*mkt-D!~cTP z;eSKvaPmQK?f2Iszl!Pu{(s4*weLT(YpV{3jPHj8d;yK`bpqIo??ocld5GD3|0hrw z-|LCCFI(U8Z4gjBwVx9Gs5+KmqXzO?#p51!~TDu z753`t<|5}DT8NxuXz7*PO2n^CptY6TCcr*!oh_t4xSxBZm)}uP`n)Yvz1l(P$@Wls zy#th<@95R*Xs=$!SiZ*wP9nadx=WxF_o20~v)Q#(T}0aHgurpuPF-cwPREP1(+Oth zofEzKo@Dhc@|_$gwse6&H%r%DHtGB#=>lfwouHSlSfqa8K*;JH4wPE@SRi8QOJtKi zDv~~CcHW75=}RqrMRh8Wu=*zhJ;A$B2 z&cJW4(=%`yEXwvYJMZ)goNnpP5N#cTAJ0keKwtc}I(IWfS#8}WCF#NXw`KR<*1fNq@>xF;apIVo@-`RKX67wWmjCj9=u z1K4Vp$x!Vgd#Uqa;34mRLGpPd@UZzm5|~20blniW`)FXQY|=sUdo1v{XG3)M6M<>u zr*fZ!Di@n{PX!!omHV_8KOL(48J-{U{7;D+$imo0H;{ur&vFAZEj{x;eoLLIz$|R- zvy1a)J`<=``P2_mpPGQ)|I>Yj^|HL57i1h-N&Ia5v~My8YP_Dy^)~Q5A9#U$HC{u; z>lXvpJy961p`Fux8GnsSuRx7kuR@JauR)Dl^GL7jo$p=8>u{6vMqrUWXK#u;XA8{E zI|~DEnY~D~=Ztus|_Lp}FjLiN9|C`awS1FD~W4b{JPLiMX}p!&hL_|M9I7ue-Je~{;YPhdB! zfZxN>kmt$Puh7chOSt;Wk5K*PC-^W#cNE_L3l!F8ze2qy_Z#I^qlhKSkP=-~S1p@BSSiAIAIt0{>Y1@0U&c|10A6pV@r>&uf3%A2)qfCsIJn9svm5Ct#y#7bx=d7bxm%cbf#81*ONEidH{p>y<;{%$mc4 zhr!9S4-d8vs=lp)&4X&E7Qr^8E6=qQN!QBkywf^J|H5t~vQ9c8c%+vvWSw+Wu&rl9 z)=BM@uayf~pL7TwO?YLlqiErf_0TcFlL%i>b8N7a7Y{K;h;O?f*}Tp}tcZf;x8)hSJXw zDE(X#Ea>|v_B8Am+?R_76Xe%5S1MY5ko846n1q!u1>>*`zY%UmG(Twix}5tu$UP<4 zgZ!o6p{_FIsdR_pvuDKBI&kYI=CS6_k zBGJ-8TSr_B|93uONbm}-cat+zM6X;b;(wXhd1qMgaj|q-7Kj#0S=85Zq*Ap*Y zFG|;sgBl-hfYSBKN9QAM#J|XQlkztmCBDx1Rte|8TgX@A*sW0G*lqap-Jjs?mTp2& zI(i{~2X*vBFP}T1=A*ly=A*lz=A(O{-V2!oHE-PuRnC20Irn?zOeTC>?!n*#a6Fu9 z&-awzL-u?>ESu;15s`MEVs_qn)O)_Cirk;af=}7~d0fQr3A6Lglfh|bKPB2cM?ClC z>0r+8%Z%W3yDu}$&O1&pYyLUW<~jUmH#azw`bmF6?5f~%R?nK?EUV`;vZ-gaNclBp z^Z!3yJ)aXvH+9Br{3>&Ef-jlhT+!O?dAokr`_yl#^P<9S-cr1D>&sB>_X>Okz6wWX z=LcVd6>uIL4PUqVu>QxEetiQXKz8xXN#cbv&B&JVlC9XxCClm zTng1+mU;JYxp)8GhMMo*ftv4DK+Sh6@t>7l6ZNV=r-L|04ODG)L_w2t67Utcr;7r1I zkY6?9i{@p0_kJhg+9&-6>bv&e!dG75{eL(g?tvs`<=6}McQNMjq@1y?-wIBKy)PCsS zP~YeO2kJcbez=GF{0nE0?mwt~&;#D}`HFq*`|i(L(`R=qZe8qa?7}wKqjDXKkAU~jJhHeQ^?i6|$Ks=kb#A|{ zY}%=#g-@T^zPN+=brc&tO?vV_crL)sOCD2P&^^b(Te<#DQ2TwIq0Uuyf%9sPD-MwV zf|{PvQr;y^2pSF6abk`r!TDR zbi^FPbqLgZ%|oHSH+w16e(+_m3D3hQlc<+5d-n&w3=({}fyaUD96#d$?B@kAju30>~0Z-Ux~z8PvCx)N5n zw-nz-{$t!*Mav)B{_pKj`_L0$+`XgtPW;mDMA7^p{qgSNyWr&6cNb5w{&-*UJ=Py5 z6;H;$Ja?~%|9xiXo%_B1IN9ru4-`M>7eb0S3~W)*T626`>ev<=Zfdx-^ZOTnm@GuJr`&0()He?)mQ~6lA(B89O z2=yI+x1jz9VG-;J7eoCILM_z#VhNOvUJ8$-UoV3@X^-Vl>yEdf#)WsF#)TDde{N;* zYRawat`e?APxB+UtxDoD!A3*)y z@FBGQf2eimW~k@>BdG5jZGrkd;$x_BXDigW^9j_r^C{H0^BL5*!+77~CZ2!ID`PhI zo$*Dn^!&Esos4Ijob4j(fGnpSQ{(te;X73bj9Y8$kzA0`HlHUAQWF4@p_&d@U zWp|mKcXk(lZ|NF@psfSs-!S)s;%yxO3+sR8C0qaF*TDC4@h{Xz`$dp-z^}!>5wCTC zsCB^aQ0ss{pw6BM=HsAu8zL#n@YGc;Y-5K7lIB3%2MjiJ78-URle z-J8PuXEqBRj-TF}J(PMpKJzfy){h`MvU#XAeygini0nhQ6xoMt<<+mX)vxobeE$c( z-sF1()c)>~Q2$$al;zVd)Yj_RF4Ugz;rK!FKRVRG!jBGhg!Qns{%K!*jA-u{A6y4@ zBAu?gGt@e$3)DL3IH+|{SE%*R@le-!0@Qo-Cqlhne-c#toD5aZZdPvhkRMz5idshn zp#GmC=(S_9*N!2=$K@iSFdPpPb|2%Rl92R3R5tf9CenU!v-3`=*G>tMew_@J^)pC4Mu#|OZ~X+aZW$Z8j_cETCrCawgswNg8$#nOpBq9qT0Y}N z%Ln3D8M?{*DnmD$UuEc4tJf`})l0V4o3}x&7jK7JKTUvI7v2H2E}RIpF1!&r<{>&tt|U+cR2pq~Hxq1JPgq1JN`K&=}e#Gmv3p@$&n|3eQ$&i{v| zSo^d8kF9azQK;v5D%7~~7*stThpNXDP}lJ!)N?lt>i3hUpngwz8tV6x=}_as45q&J@nk09`ah5=*wQyE^bFzpeFf6KHKA&2-#gbM3q$ae%@484TEz9Rq`4_^+whOPeoiuLzbWm|uT zyw^W3^tzQlU$po7;l#$iH$ra`um9nI{LjXM&_d4^znl41i1j!1S|n1h#a_J*{*JRW zv?Qc;^U~0A^40xY26g|i34c4Z0^8RA(ANKOsk1V)it^MyA?xThq1EQUCiE`l>V81h z=W9dju+_gH`K=GV=h={a-VbdcTpdW2T=9ECZA2AkFiyc&0hRRQ1#j3 z`4LY$ZVi2o{qW4sLZ4VWekz-G{7fVt_Wxn~Y(Dg*`F|l=yKgi9?Xs=iA=kAd^c9=~ zzcv4_Mf2Zj{@=(pe@Om&Lf^q1aF?aq6WR@@Vt)_YXZM7DAidt(hUB|9^dtGIy&(G& zKZSnAR{w;g`!)27`TZLD%?pR5`#tpk{QlJbRQ&gm@4@{Et+W3MdFy|ueTaXc_96De z`R>1=L&6#_>xBQa=k9=P#ywvcay@lK&g&J0>A%>Ah_(+=H>`b#df^7dSLW)AcKy)4 zf7cLdf1nZ6enexa`Za;t2WSelKhX?oAK=h%q27l<{hom?Gd$;{ zsQug4_^->g2_J#2^{FU5c_iV3+@r#6!-aJzG+o&a_Hf&WJ5ujHZU@oo4NY$z4V${h zggX)6!aY{Bc*y#vOSm(fJiALcXzg}F__(m<->%`4@aOk`5&sj+=J$WE-A)o&kDnaw z=H&-j|8x)gJsYzA2`FDH53*h>4u=UJhJl{|GlOnm@Gt zgaqv%9iGHaavxGq>+Uq1SCa{!LAnJsW#Mu!9c2A+O1Ot-L)IUshEMZs$oivaxR+-` z)*q)UA1fEyI<+^{I=ByfWCQDesP)8IQ0s}aq1F?9VF$Ng_#E=7%=H&7A86}|bK$<+ zdExVk@0uGRT0G>s2Zk>sJndc}S~#@z#vrKmz(r8&fx%Ggfs3Km1D8Op2ZliHKMaLh z4_*qjPPq(fT{sNx&RrfJNjaOdSA>UqBNT4sLe@oBhDQ-z*S$)#aA@n73aE9< z)llozYoOL;*Fvq!MnkR3#z5_FjD=e7TnD>Ao(t9+enI?1>5nS>HaWAxgP1qBI?srdUu|~YsR=)8^%*n+ zPOQf~NWA@yKb!Qb#~i5j!d$5J!t+q;g%_aK3ok;|>m?}N|FT!VSG@YYYV~?8yomUU z>es{btexhYU0e0KNINYIzhUk4rfk}2fk-_Unw@vv^4e*U*G`MWZ(F)$;aW?#L^kP` zilkd+cHUX;rF&bX{wu=oP>=C&t)*WRUTNu9$tL}3k@RcK&O7gV>DOBNit6{m>#Y9k z!<)#bw(32R`hO69-}2cYn|wBk2bi_-%DQ6Up~;v-3_q{Ds-uL|gX|Pe0lo{*wCX{z2@iGrl5yWo}3K zJM;fqwEMZ!+JpUm%311st8mjpir4?e?Sj&kyWvaht9*~2^vWLdXa2`u`g1Sw(xpE_ z>FS@LboI|ry80I={q!r8KK~6$pZ^Y}&;Nk>Kec_Z3;pR&I5PWB_%B!i|AwRCerspu zf68s_`#1a_;nIze=fD>^VAt!5)QJ?H1Bjk1iX4J1KT*$9U8r?KJ*fU$A4-=ufYRj+ zp>%m8(o07-juf7|CQ#2^Qz#wR3_m?*heGM~!=Uu~;iPNnYaVHVE!{27%C?N4U;m%~ zZ)+229gz-d6FJh${|GOCY{HLe~M*8kY^W_FDnPrTXzqSsE0oM3(@Mo#j=A?2PNL9dz4)$dEv zW8EV@JE!g^z8X6KrGJ8i&v%O>v520Jl1L~boe`GJ^AQp0$0cUxooIyT0y`$6%imq$B$Mq%4xb9+fMT|Ns3CqIvU_NI`$~fYM*5 zLg}y5pys8X)OTI3SLAeT=`T_G>kO#+l7X%dv4ycbGG-3O(k?uXJ*lc99f1Cam!i#$xZ{QsY5>7u2B zro$ZQo&T`&-MNU~?_~WCkJ!xo&-LqkctLN?ip<8|z1dqwf4x1i~**P!&)JPV&6 zdENZ@{XZhT^+x1P;-$Al>8%A&dTSw+-cml&L!!pH#jpj}Sqpp9zm|}nbkS0%@%iAs z=W^nuQ{INsG4DX>m=#buW~G;Im6vWc+~ll@yl3t7u1GtrH9PODi>x>MJ<;Y{;%T4v zBb%&!HbypB`)o9u@Bcc#*=FW{sQ>fW17~G_i0q9N<}*k-=6}LRW`BwN1S{ara5VhY z>dE|%t#gaNLFt6wp>)C@PB)V%d4luq~yN+)PMle{ddk4K8!$D_>7J8eq}_rIOU{Mf#P^0<#3MEw3YKORl}r_b(Ga!iTl#ZD#1Vvovo zlHdQ$iyFteloaO0z+;e{=SPk`t|b_W!Xj&7GuhD+k*A*bQoa><%?Q z`b!GqcmP|!dj(++x40xs`aW(*wDgd1Em9ICysld!S~z5!jFprUKE{oU77lIRNx-IV zvLsD>3pXWNJhX8=12wLfL5=I>P~-Y3P~&m~X~_uc zvB|kiWV|0HlKyhD^Uf6|!_6Kc+IUYq=|+~^M7mwhl_KN)sFJH-QFfHsd8eY}YD;&M zXyd*78|JQ6yp8wJ#``f)#)?4{1LCC_>72=SX;GRMMM|6{Lp z=9WB9dAe>${0k*7dN#yvPc!tA`W(i>M-dE@G8Z(LpT|BkD6u3#( zhLTSxXF<)zk`JsL_W!YKYd$R5bM^C{H% zozLL$eE;rqsPi#-sPi#jz?n7MOSZwuv$vP*vFrc3wR*w&KX6}upxxKy_LlsJt?^FO|5E$}L!7_+ z8R}fmFHq-;euX+;^c$Rr{X1O7d89v}{{Lwo+{yL+2{n%Y1@*nZzeRpW`v+y!$URWvix$RbXzPhOP~&|O)Oddg)H#m2Q0v2bQ2VO&q2`YUQ1eDZsClCi z)V$Fc-tb)C8BL(Z@1{`WcQe?*Jv4fFRP(@LqO}iXo@*X$NqAkig=pc>#_v{8<9BPQ z@w*MwJbDDwe0(I-JbDz=`H;4-!fhArKz?J~_M+tnnZJ&Sc7&DiXc&i`@EhSCE1Dm) z`JuDLcZqf-KJ6YST0GSJA3d3H=Ktu4UO3eJuW<8&%var_e!{!vx{DSLO&0{9bU~2& zp#Az{>>h3?8o|Gh8y3wUGM|@3rDIySQPIK+^H)5YiE92T6`8*hBJoMH^G+(7HajEQ z{6#$TS6Or@>2^8gBJ)>|=qa!$+r#XpQqUyMcI>J05C% zb|ch0c@xz7>}II-TP0LG+yZr-w?dsaxecm4ZuhQxf_L3_z+KM7=p^e0cSY~CesGuB zeE%#uldnP*D(pQVt&NWc&jExR>PT{7f6fZq9 z2WtH{7fKI352c4*fYL)RLg|8+p!CqoP4&26{;V;2BkaZLFtb9Q2OR|{6}UN zMBjiF@J%=xF0}Sz{>N7TeG97pE`ri$i=oz$wXll*wggJgErrr^%b@h!a>di%--haE z??CnM6W7Fh8v&{vqGG=z1?6(!bw}zVF$P=Xpc) zL#|8D^G4zy@qHlM@`uE4j&8F1u{rt?;d)NQZ#MOv@#iGzx2@5Sqta7bqo0zG+V2yn z_QNLpvuGY$?f5xVJIY?_d=cG7dD6iUzwOa4$yehn|dXY$o~2yx!bU!uQy z`9rSr_vmks-~Xe3c;OIxUljdl{X%+D`@MgWzrJ_(chuMLg%=C&^=aPR&-@`h_Ak_Y z`5)!3%N>aNVg(%{Y9F@_)O=I~HNPGLd$@ID^<$ck>WMsG%>RUIzHI>GZo^n(;?r&; z(c&TLn#G#HO4!u=n#B&oZ-jfOXnv4+^zc|K!Z&A|$69#dka@JF!p#rbyxtn_%e9Fe zNqpDb5u(Mz`fb-T|3m4GworPb9qiz?k9EYK^}lHT5PfiT>{!CbxW|YV4oz=#ib)@J zj&+F@^bs`OaU8bh>8{xObH~R{Bz;}?1kut%=IN7S-3V{to-A58JhvGwQyQhex?_oCcf2=TG7yj2%{i|op*SNu^(__72nrBXz z-~a8C=sPOCxlZ-7K2ZJaOv+uCJ1cfJw)C#3e%2SNpY?<4XZ_*s+&QuHxsJ`*b7SXu z*8%AV0~Bu81+Cu=g!^(A#0C-HHFu$C@sRs+QS4&E>$-zQ3y0j7OJYL_Z{ZFREgV|E zx)gSBFNGf-&`srw>emVxm-LbLjDL?IACtCTC=V)APJmG!Z8$=6-)=zJQdcJRh(#1D> z{j<{2-4?qAvi~2u6|(;yn?OG7|BIFnLu+=-%v!-M^``JenQdUuTPq`-S% z5&dow)OS+uRXDtl>-^vT`Q+FX>`l%CBJ=WtBKbaKHsAk`J!1A0(ex{V zJ`Xi7z5wg3c`5cHyz7ORVlUfs$NW!yG+(^}HGdt{d9UFo9XAh3=go&I?{z4>_XbpX zZ$jyj1yJ={=;im8m)|1uuZ=A>zuMS4F+KOoV@s_3rLuYMmxyiCMbm}&ao^X*HsH6_StpY3db9cepV<3mZxBt75l{PV zjBT-cZH|3l_4-gY_1YwoezVzm=OeFPTSU@*9NX$$H^lxV_9?d731WX1`y5;C1hJ>i z$dhkn?u*zC%Xgb-?YSMQ9kH2Dzf!pA1I6#;K7I{#KX*di-*4c^?5^0iumXMuN5kFT zeTCK!zlYLYd!YKk4^X;rFO)9)5lR>S1f@5AhSG(*YMP`dJW@4o&4)o=De z>6<^H^vz#TI`MD(XJ!A1?T;1q!65zbzu3R^H^kPsE`}NJ8bOVdjiLVMvI*2U*A&|NpLB!VL*pOy zEX=Er=l<|`8^Sj^%|-f63z7TY((Js`D&E@cHlmFe#FOrb_{pT(tF6^a? zSbQ{IV)4;dCxL{g*mt#m}Z( z>1{|o`pS>??q~jLZ>7`!t(^na&(DQ=KF))BJ_bNNALm0o9|NJDj|-rlj|-umt3h77 zUF5afV5sNgVyNfi5~$~62>v6pm&J#|3V10T4TstFbN&y%jkTA@hf~jUd{>CpFCgI~ z;#U&h-#1dUc7$BlRq+bKhx$f|77hu&I({wT=lQM?EgTX)IzE>0bA4k(3m0c)uZut2 ztMJ@H^#2X-RDZ%I{HAy%wyyJLsOyxy)VU>oEBUM4A%3^TZ?|yP z|JZAt3Gq89PwfhcpBTT>vmw`cSNtB*pX0k*q<(`PNV-Y!`z`)nk#@LGwE9ExnH+z} z;vW!+e^9h|$a&}~@rNy+De*_(aZ9GeANA@5Nk27S|8%v_WAP_Qf1dAg(b7Z0pHw{U zHchl}Xy=Qcj{EF<@pLG?JOk?dvjgY5+4wWo&#U4&yU(s{`uR+eeqLpE-kIg~^Jhdm z|6EP_1#V6JIqUDwiug1C6R!8dXTvp=GY3A!d*E}S_T!(2tC%ldfYS3XLY>ooiR-AQ zelJ7ma*ean%dav{N7JFU+LM9{q|ML$I64I z$Jf9f?z;H9uoA9?arhqoBi!|(`9pO6`|%G6-<;hL-{^%ybp8hlH$TYyvMIh9f6XtV z_H{q9e7D56;-7Xu7R?{px#v%4AFa zRjmJ^z7zQs)IRzSsQvS=q4v*rLhYY_1NY~?jqjo!b=~hos|U1w^xbe~&7S!8aPsUu z@jtEK{S^Pf`rY36FQnuBf01-Qna%tEUcdWA)is*=TBIUFUZCzp0JKj!~Z>4om4e&VGUMCpY9lwJrz=>_s(UJaEdu`8-eO2g#S+7~gqwyH#A z-Y+eUmTKOQ$)+F0MXs~d?7WjG<&I(}Me<9PrpZt59g5lq&saHSs=w`fiqfa2!1at* zJ>Wg;r<@A)KGtbmhvu7}Q1eeO!gY@Gba)j0XOLeVU!T(6mT#X@?OR_#_`&teS@`L^ z^Vv{(r!SP==?A5E`a|iVbD;KN&xOkOJg9mPuzb%i9q8H6>T!WruM6QWXHe-7yMKdA zFS7eL*lgbaE4{?pXNYL)6#QtHp`}-nUq$t>(o3zKFEhKgYM4knk0`y|+W89EwDWM0 zb{%1M-Wln&^OYj`RFqz2`HU(ZOTM*L6(aeJF1_0FxkfhmTq}~#XtVkLub0nQ%V%8f z`qJx2KOWv}>2E9@XX$T{P5SX7>2EZf^Z#D@n??G6W$6U`wmP?n_}yxD-np&xcC#ml zw*DfXcDSQ-l9h9J=|n5%PT7=mmq_}%&CWabc;!qINq2AQebiI;3t~^5aX;z!{%`3c zmhJ)3?(>6oJ^bF!eOl@~tZ>sMiq|>lDNwraQK)`66>5L_F{u6N$D#J8pMW}F{Uns$ zn+By5pMuhfPebXM=}8pmbsusz2u_U+1u0sPoD*30J?bf+MrlrL$lKd*c+MPIuHFCRR5oce@ox|($}%IUkrK9-Yk8?+WXDY1%&H46K7=?ma?upcwX9c$0F(> zox%8M=KyL;eeEw^%>F-=K3WQ;kCwst?()*r)(=*ezHQh0j%@nD3Xy)W(ro_!$Lj~H zMbk%XNWZ{+w{)G||Ft6i{Qgh)RP@ezC>``3ln#0y>V2>cP#U2}Ux z3y0{My`?`AFI^)_*ZgGp{9O7g{`~)+X#UW2&2LB^wd8Jw|t175m379NGM%)6m06YO|&On3%8wU>7ePd z4sc#g$HWQ5FQ_>>af}xa(ZRfB8VcA@{Ip>$J0FO?;FCNy7^i_90Nh@|gfHv9jH)6DKEnqDFv zz0@l)mUO$E(?#@B@5C9fDBIiYywfLfrllJznqI<>@#}2GPduA(p}>BL{ua*sPk000 zIhL=!e<6SEznll9rv_O3`H6v)t9Xc>x*%~O@zPVG^wc0IJ#`V3o+2OSrHd28u`8;F zCN3eL*1jQT*H#S`>93b3F17x8nQZ#&Fp+k++-%POdHr>`NPZ&{Bgs$uiV*wCLQ$YyK3a%XHnx@O)nfH4k3T^-6DzgVJ9& zkk4e__{5FGYd(Mz@Auu5xY@Hs%_o&m^T#dlYra!^tCe?K;&yD+6Ect7k(glNcO)hf zu6aaM{GH@`pYN{3-PkGzPQ2H5PeQs*_CZ~DFY&tG`=E5){ZP7YGL)`+07}?%#~WQ+EHJmd*W} zE^_~7n9cY9y!)3G>F>G3Gx%+FToJ#SX6K!%#4NL)5ltTvPd~3t%)x)J^K7C97G<9` zJMTP~m~H-ZMAMb{abM>q=25?j>K7Bw6W-eQg4wlIFN*ZHR}(K;eP5PMeP0o&$E#-N zo!7kj&J)S!jl_J*=k>&5@~y3ULnNQK5^q{Q3uKeeLXmvlGMoSZ@$y+LQm@*?GSaJk zmq6XOrBLlmIPuF9t1aJ^iMK7^cVv_A3XyzQn$7(0<-6L;cTHj~^*h`5u4w(EV6RK8 z_iRZ1? zM}7jO4?l&{f1g3=zt5rcUmoiD`U2|t+6JW~w?pa3FQIhgS5P`~hu81EhSGOCq4eE1 zRu6vvhk8E0qdv`iyAr!eC!Gg*PQOp=!PfHvc}{;w?DcGj4*W6kljkpv%>J7A8CJkw z;Ar@p-3Rvn@t02h9ZI+ULA;*xeNejbPpIeoFR171Zz%oz50rl152c^~CH%~DWFyZOrC%GvS=lDZ zrpbaHg^VA~lIT;*2ePkuc=E8M_WKS`wn!G*u{qQ@hfR3PWNU1-dn>4Rm%Y?!lRSd_ zw66*AJ2H8cg){$SuXWlc+flymA0)ngvV&(s&R29y9*wPbg4E;K~`B+0zZ^AQyZFYFsi2gk{OkXxEeBn!G1 znl4U4?JK6B_DRzCt;=PSW!Tc6;$~P5rGrm_(!o7o+&wkflX|7y(?lx|nhx#-d$_%m zr^8BkhWYnSo{9emw~uK45M6XuvM=G4xwAzJhv?&e$#V$rn(HrGI5a(cF5I0vFL?p+ zo3jIw=X>!GT{}?W<_~RO??TuUoihkZPhA8%ETny)bmGNOI`I-Hoj8PclAa!lt@r3I zh4X4IOIDEof|_B;%f0*|y6}qRaLC8Kzbml}Top~pe&b$jYb?;72qMR1)J))HZ zx&QYj?py|;XC_VbDg+G^^ZGPec%yv3Jbm_kXDQ>rJS0 zYYX6Z{1#HLNxrv|i?M5~7K!%V8OS)lBw1_aEJ-dUzAobwBz$>tnT0P;zD@WR@_{xE zAJlm(2-o}ZE1`7WDkz<|8fso%16AL5q4eHbsOwv2`L0iXX#IX;@;&SK@5`p&ZxFeE z8_nkZKd;|^DB5*x@~(TcSD%k8zb(m+$zSym$K^grZiVCFHY+Ee{M5?%Og80wE>ce3 z?7Z`ZSI#z({&*?j*m`L)?QMbm@C(~rJMevkiN=ey*$uqgYT*?DJI za<}<^FPa|2kNdqRId^KIJs|VS-sF$OYyN^ZKmP=EAAc5U$6sJK^x3a)WcH8bZ?FRX z4oAa%c73e>u{F>C2{pg}1$7_(hSD|vK3G~ z)Gz9$4uM6m9^vX2qWW2VI4j#A)i70<-y!|3QK|{ywN;Hp>vyu%f16@!Kdc$lJbozQ z>c@vc_2a`~hJMo=>byh?E5B8$rIp_*)tYeiS7`mR4b<~+1e88_eun1pwyC31n(y1D z+I#WsJb!G$JEV^G{5wL`L-tbVnAEY;e~7L)F4YxV?FY&4 z_|yrW4bc@RrcT0k@Q38nEp@W_bxU>k!r_ta=lfGZY_&@OsvWS8eEx&tRM-m-dEwa9 zFOn)DUgtx_sZJ~vh5Y|tDvqD}4W#_iR03P|g~TUQ%^a`Y(GQaePm|w4{UW<8RnRZx zQ2ON*sP9Ji@cd4N(k-VEKHu$`Ix{8R(mT~FCEaqmY@V+(M4p@8X0!fJ(W9`>6wxhb zr3$*`Y>{x&Ep}eDU&`0$w7COP{o(x|3`m_r{in|!kUBS|_b~^g&chy+8=!Rmcg|4r z*uYd_|L+2*{l5#Lbj~0sopTZOUY8r3x)@tJN0iRF1WM-&fzmlcA@BdEMsXdy|DPIW z*TL`q*u4Lry27&|^ZxME2+xMh`y*3VdNyRaA-Q|M#%gBsY>E`|6jCtXu9VXDBW`_ zl9m5^-Cx9wDrsBsT}_0xfvq-Ec=h^}%|GrjyEx~eKQ z%d;W6>KWy0$=a177k6<%!bY0WdC3Fq26=hl$DH2P~XFP0qQ%}FGA^` zm!R~|%dm(0O6oQ8?c=^GTE5Wq&phbqA3JaPddk;)0r|W^`~L5|<$}}_>`l%>k$LPb zk$e`Jop%c{iFCW1Wg_$0+o|QSDEqeA{Qqxig{9jhnl6%m!`v#x zn=XQ;i`GEtqIWHPZEBtQG5<4uA2_f+^&aukMWS@k`%t=Q1C%aOKGH!S*m(b;@;Ch; zUe9>68Qujyf*S9(zzXb-DM#zYtx)s9CpK?g^^-{W&t~VHUsAuC{hMgIgLv-K@2S7-KJ82WVfSgD*?H&B z)L-WRw`jTpKj!U!Qv0c&t`}nen>r+|@w-m?Kda{f+0@gQhLm4N)c60=g?b($l5XmZ zx`bEe>ZKc-UwzTqtpQZKVKYxPQn<~didQ=}foi{|Q2P+gpmfTiQ1|sPsQLbIDBaN< zO1HFt(k(5abW1C!dABu`ZfOIhTaJLY!Xu${&{5Pw{h%#Wzi0=g586Y`_Z^^gNJso< zWsgoDlP>5Nh~DXxJ{A_i&cv(Vh$FLI(_LT%JPwYA=ndw-gSz9y^a*Lrw)xvgm+8(u~m=mQ1y_#)Cr`6UVB08;&cdq&GRDv|C^3bo~|2`Pf0rJ*$_LHj$1nB zf9$DFB3)|XiF6V_wLe4`q|#|@-3N$YSvq5WW$9*4Azak?{!{SlIk#832l;MXd}_KU z^*i5pnuxCJWgM03l^*Q;Z$8#Ic1F4|ANPiuhx?FzUGB{ES=gF?Ma{owL(RW^q2}Ly zu!nnYx<9Oh=fF4|Kz|$Io+r{T+5abeFaGDl4(`D8h1MT05G@`ue-26yCVY&0k!azN z`SIfP5W>6WE)gvp+Wa{bHgzve4j-L+UurtCE;oJX3@f-=_2kEmV$-^78wM@7P!M+tA3d(6TcaQ_vq--DijnrEKGzkzRB z`YH3{_kW(-0|%Z?PbXgUjHr2L2Gl&`K+QAc!}DF0&RMx`y2|P~Q?&X(;%m~gEdH5v z4e^)yszr;3#Lr1TYw^!n{f7Hyd-Wb{_15!0mv}w@&zs*1>6ggoa^H)hReGi6yDGij=8?7O)oG1`Yh*Kz zyepE=TC@57Pr5LVtQYA=@1;MqezYO|zV)LGX6K!a=?^U3hoa42_|eXr(w|s4AE!54 zIUmWUoGl{dd~9~!+3J<^iIuZ)@u%s}$>)6EXQH(er2X>gZG>Ou`$DvENI6qyY$xB! z+?VNHmhV@hwdW4IUf$~?{ZeOV`Ww<~oe0VATlr1A$M>E2>wYMm=A+$E^V#=M^VuG# z`RoU%`D`!Lxc(#5eD)L6eD*W>>OTDfb)SBPnm2xfnm2xjn!opSBg*qd>GKh*sAFVuYdAKV8Ikl)6|zDyDSAAc@OaA@r!&dMH=shcUx zj}X6lnFjcs@2fAGA0)hCrZM3|eT_s5hlDrDFi&!Rx2b61g?0L2nL{(0zYfbZ$4}RL zIMnrG6W$`z3R~CR66(5TFLhdH+E9+#AL4gJ=12=?{>NVH9F=KH`D#~4e7j70&xX{e zL#8w72l_gS)aPgszs{LsEPdz9v2f_j&Y4cIeYSIk@ss(pOXhe>f1EgRfUm1)*8?fH zTjm6~1DhIEGjn=|b*|e>`W%yN(;N^}ks+L0!kqP}fljbse`r z{U6w^Fad9ax~|)yu73hl``rQcKVcK$7KRL;e5PWOyok0P6cQ4?_JO_7K$nhdm5GCcj5u_tmWbq0WOn3a?+p`XA1B zAIm(QQU95idEENX6SC<)Pl~knG_&*0Q(pghT5P|ae5aFM=f`Hij*$Ck`Zi1dd3<(F zCI_cOH=})~n#@e>QMsB-RYw00R+E_pZ+W98^GwFqp}wzL{jJWK%WA}f`%n#6&@Rtq zd<_S^VfoiTf_9vf@zwu=b^l!M&jk1R%nO-<-h)Tn>%OS;riVqHPk$Nz5c={JsNeBk z#cy5iwah$h>1I*;Tl1lG_3QBa6|Dc^zTBIcg|tW4+yc@1A2gl)7L?9j1f{bV!`->s z%yRrUXP0D_dj1eSxlG}f9-7X68&wfK#2-xbXd zqL0^Q-XpxOyI!<#XuA7-*wo#S`GEKq?ncq#q3s`i2({0*2}*x&hT1p!2x{MG3)H^R z$58u5TcP%iK7rad`V@9>Kg;CFzcTl^X!%3-jkaaJfRkr$%Y1MBYe#0g^{+28JMk~i zeI??*!|c5Cb*3;r?G)KJ`X=+Ommg%`=)24=&xY(9?N+{49yC3_hw^j|>j$XcBlkk> z%l!zoFZUDd;r^WYmGphwUqnj}ZJ+KpIIrgS%mLyT)cldz=fy+zDgVs;<=K#Z%D*%J zcs698a)0Ju&xY(%{-=B_f5`pwl@*m~{ZL1=aA^B_hd}M?)rESmxgOO2kJX1q!v?Sm zYzPCe5!8Etjp0%FH-Y+pwx;mwjjaFS1=xo|{SVt=unEu2;jk0_&EetLEuhvzEn$l1 zxfRqpsWsI5g>7IS9s$Qvzaydc$&P}0ucIy84ckGjPus&G*d5>>)UP8vgnW;NE#Wb6 zAUqa!!M_tciTZSgdat`nnbvQ|m31vEJkPNHr;O9bL+$sS0CgVnM5yzXC&^yP`XB0j zlWtJ&pLB=a@bg2RrwqWu83%%JC-KEl|6dn^J@E@eoyUwoox?1F<5qG05B`IH3f02`cdcUO%E+f7i>U(>qz@Hdj7@zKG$o$^3 z%vbLz?!#$i|Fi#~-n|H4&iy={@VoIl1N(9OdShRW-3Q(U&xCivv*1KXzRg>4zxtLH z-XHG=N0Co|c-3;w|I^Oe*E|=y34Z6nKiIz-0E@8ChsVHy@O$cU0i4GCb0O4w=!4*4 z#8VFI*TH3%k>4igVv%+4B_jQMh}n5(XxXJ^UnbhRmw3_*D|?W1yPV5K*1f~au7E|^ z;b!NZ5oIGS-Gid7d*$CSca`F8UliJUwE}9rdUcuRk!#AX#XfTx^S}9xE*oR%nE#1C zaA0iNb;N7^Dr)_DJ=FSj9Mt-id|9uIFPnf}QGIjSjpWnXcazz*RX2;wm$#KwmPv2j zBAfB-R*~zz&Fs8$ds$&Tn;_c0>m8Qw#IifdSLd@J<=jAbbYpKZ&jN!ZhqJ$oDB2BmQZ^{ct+=nQNK<;RnP!P~Wx5LY-ATl+Wl3ib^L4QKd)>)w#pN=o_`&x{onAe|4pd& zSpauA3(J;Re_d4emi5;~X0!iaR%`cviD>I<{IvcrTY=wJXPHR7tIF0}KU-V2+WOfV+4Qq_Me^$onVokwd-;4M(yz9ZeQxPKE&JHgZIw;BPejsvYIffF%uDyV zmo8uS4dqr;Z!i18>aor2+N$j$_4vB%OUv&o+2prFB)_lC=KFtMe&2ZceOvY&`RTqv z>b0wEH@2P^i2Z%p9&Ft&i2XyE&H?CoDVziNvFs=6q4g|eeE7NS7yLCoi0VJTLhU2` z2K9XW4u7IQ{sAkn_mN)b0{_H5;VpjuhdMX#H$3@Oe*Y(4=LPp;>;DP3?4{9HyKGZ%&1E}?OL#Ta>Mo{}0jiL5I znw0BYWYh9y*g6*}Y9HcIsNVw)gZe$-aH!|LIn;CC0#2OSs=OuK0b7?BzS{{oH`%8A z2*Q=0sPW)PsQ&>w3O_ynZK1}Cc2Mi%_R#kK@zc1_5o%mG8fsiPhIs8a9E+`SsT0(A z(wT6LGhMJXP92A>=dCNY#+~D##*-7E#*-7F#*34n&Ox3GHNJE!*ZATu?+%M#fN+g3 z;;d}2yturu&jLAL87dDGuKgrY=R383GMM%(q5P#zv^<7ieP2o}tpD-TeJF*x4+;1+ z^+>{9Fa_0*(r{$9ygUOdU>O_@nJ<|yY~Ex);?(jU<=Rg;wY;Zyy{AF712*Bk%Fn=7 zdz}u|uCkXpz03Ppy#_mwe9kIA)BMjWKbvyYE|C3;zUBR}RbNPc{maksY)C%mmY+ws zeg_dh-Y}s2eBwVRJtW@?$_HAy3(7AfT+az)pJq_`Mc66_lJDSh?T6_8LtD>YQtoU2 zJnQZua1DM#q1K_7Qf{?t*Kh0bVT5ZPe>v28{R*h{@o=bh_y{-{j)Yn#UkR1(RZ#hk zg37l7YW;mRT;N_)KDu1%k!wZ971sY=xnrRA3&!F%WX=uc*TL!VdYFUb;4C;Ezh}5! z$U6GQ@|!#xvcA5#ywbBF>*rf^Um4dXl;3L4^=+~l*KQXne}dWU|Cbl^K;e5~`d{EX z%YC*Uy$fpHc{kKL^d2akJqb#W-wPkBd9?gKcoBFC1c zO(=v)-{p!%0?6Xko*l|$n*yo_%eZKGo#xdfK7i}D&ty?F+1DT114(WB=Nus4g%DIJU zSOqh%08Sxae|NHI`5^zZ{9<7>Z1K{Ig*9G(psib{!md+aE_?}Axi1$^^U|TMbEZRm zXZ97S@667CjonuZU#FdX_chVlfwsPRqtIvT!y>v47f`>>UqJQ?78WidU&qXQqUD43{n_{7 z)%5oRxRCj~7;2sNAuMD*EP-8+mqM*$mO-s+mP4&uK7v|bt$>y8%EHyOGuT}vT079z z7i*x_S8JixW$WnYs?7SrkCCeKq+3uLVywm_{1zJyvIWTDm{%zxtiuM2-5{|4t9kvQmEk^X*XGUxvazc={@ z(bfl~Q|`yYLzLtHe?`^@+Y7fr{{Pox{{Oddr9#(Awm$d;YJKpl z>3=KSWBKs^_zC|1xA1q;wH^?)9{2-lJ@6;gdVqTHCw~?GjXag>gUJ6B?nl=99T53I z;X!1@ArSdr^~2&yaTE5$SLCbp1*`=XXXF*-{9J7)yI%+Ww8_1kx+3$V9-IX07s;Ze=Xp4=lG&FMYu8Ecz=u4jH$zi_Sr>>xana7M+Kzaf8U`7hPigD=50a`gfsZ`gf5?y9Flm z|G!@UE)gl$rRY-X(YQh6v6H$|t}1g`QNYSwF53Mlgt{Nd_)EX^7MChr^Pw0jeh5Ov zJt3(0sRUMYKf+M)Xem@27J-Tv%b?=LC{(-{gYx@vs5m776)z^C;>8ryd@P5Wj}>qY zyn=oy?&=0LAG<@vA6G)fA3dP_d{6TKR^6-UDwto>tLSR<8fVD-?OoItdB)^EM(L4> zhpsES23Epr;UIXujWhn=%HL4bAN}9e{Y2(TkBO3}y@>yZhhFUE+$fpn<0g^u7zi~_ zE8&RAw-ntBx58Vg?_t`7JU4@j2HAZXTyz`hdTvC%|5HS~cjo`jm)u!2q)741oke$1 zUgIznY8;T!-(6INtns)9YCI$_a)uS%>)l64+%&xCKFdG6=ziK!{~+<$14Sc{bzdO$ zJy`URCyQ$)k184ozk(0LkKrR$4*zfYA1!*^^0EJK`B?v3KKB1f-|9S3^fdi>!Fj6a zNjMow*7!r(A5-)k^6SpHqGv4MxT3Le9`dtrGE}|ANU%mpps& z#G*;$)Ad2F$0_;$WeeCC&5L{^+r0~P;F zh5GLLOHh9BW%$Wb*8foP$#kfAv`k&01Q0FFR zLB&^ZLhaklhT3P<{@5tpfD#G7j<=3!wbP zLRcUDd(4abeVqSCo`~OnA6C8lLDAwOUmc%svFyi)2S`^v9mv0g^z+xnCoP4lcNy#g zm&13kQy;;6u4e_Dj=U18y;bmKxEiY6HPm0nx3=gL96{;$?G@$YBhwo`m>_k?`xak{2l^5!j?Y4s`wHrJ zxv!zheFNva-xh5(`}m#MR`EHs->bfd`d#e@sNes7^xF9eDsJC~evZ4nh<33LKNsyV z`>|6pc6ygceLtI=b#{ApIu~zizxY?~r+)wW4JzK=L%pjqdy9TYR$L@*gnvNIuRo#Y z+djB2^H$ z$&V$V{8$pb;*7&_V>z<+Q!Ak2!z-ZT$8J#ZV|S={OMq`iEJ*yF?q0yS?#1#_v~2Z}FSbHQx6^#c%gP{V(Zo@+nTZA9+Cf zLH`4=5{`g_;6v6ge*Z_VPLK3I?9as`(C*VHsQB&?sQB(tsQB(Ns5oLYlwE%u%C0{F z72iE+{bTi$0sb^pge#V^D?_8g7nIgmYk7RnxuBYjooIsfy>vWKGV;dm%}_yUwY zoB;i<G|#q(bA#W!PlVd)9X<7=?y6RF%urh%<|8sTpjmK z(aJ%tXO4d!`iMJMG(E%~zU80q*+Xb{|cVutNWp7dT4enXNQ*gSJVCmXSs+S`bZ?-3X`+WO8+X8SBqwcNXHJX z@qb4-{{K(J4z2gEgL&!oCiDKE{}U_sooIH5e6>Di{%(Y~!%grN{DkUhkoipI%swgK z3erD^Iw$%Cl%3jQ>0kP@mLLCbcIqqt*QCo%iLz7QK-sBpq3o3ETL-toe&qWeeop;A zK+W?XsZaCwC#d;**luknUG{1Rl)c&sWv_NY*{h$ua=X29zrYR7ul_%59DfrT$2}%z zoxT3wP5whPdqq0q_osiqjo)AXeKvl7nVfb0_Wxt~_lst)$VdAJ{Rgc5gZ|n9*{fQC zf9?4`BpJKo3qabfCF=ZtAZM>?i>-P8FVM)!H3-xV$j;T1Ou70Z6Szf|@6%LCwe016t>G4xAP6)hWd8oB{Q_`k7F62)+HE z;@Q^!a{}ig>;Dv?&9C!peE9tzYM$lJPhJ$bFranKMS+XGd<9-QGWtsbmm+Jtxv|>YI>X3% z?nKs~}c5ARx38?rviGIGD3RKv9DHoYnJXh%FxK{+I zN9*oDHyfw!l9_*3isb8Ia@OhT&A1&L8!I@<;vY_o~c*z>UcAN22`EP3U{N0|S+TT$~Ec zFWn3qySD@eaeevjt)g8YG(R*L?#SF0xRdma>DvQ$cOtK5l!39tY<a54A3z3Ki$S1ob}1%TW8`(_jJfW;$$7 zI`bxfVs8F4eFnZ7$enk2jrpPd>DQ5U-i3Vl#hHP5=r=gCMEvQSBK@9ia@Ls>m}~Mp zaYSvN3(_g~R$v9?wmb7h{OLP^w_#rT9h3R~Phf$STOpc1C10&4=+Aq|^?i%1yuPO; zy`J9>pq}5wmi}R23H2)-65lTkEF)chQ>56w0rD2IWUKd+mJgmHz^6 zaJB@#vGM#;WIVGb^ZtL}Ym>hb&99QqIDQ-W(Z+FW;5!?~ttNB+FYtrq|4}r*NK`%N<1y3PgcN0uKvfUI)>2a)xiq<^7) z*FOa1AAQ9+|5yvkKjuOCf!a|1u@01ftPABI>p}gFUmxms{030J<2Qu5zm1^o?-5Y* zpmDLz0UTM}1X;h^Lw?6Us`zM676+u86*q;IFdq(r#}wy&mxdM>G>4i;#}?=2$#GEo zzAd2U+3`?*uO*b0pydR zJGp&vJ9uDL`{EAd&m%t^(aG1bSii^XI-s3vKDC(NfjQ^X32L9|G`Nd#IGujT&vl0K zb7!FE`#;6!7wf*CTYQ#X-`SG6@8^iz_j66=`#;6GIP828|9C+$_5%BQp-8@*f0Df^ zD9-t(i=q6}CA7CH)1~-QWcepi{;4a}dg(H#_0r|Av0GT|r~Q1lNVIyP`K18dktr?? zlfE$>EDm|;5WiF+z2%4arPAUu^mW{bXnKe}juyw!cXeZ;>7n_h1l*TN7MGLWF_RK4 z9oFl@eXfAoAG!j5%6ZFfQ2S-wVGGu=S3<3$dT_lx-JZo)75nV>PH1+z7p!!zF78A9 zgWcYu)erGkeT%O}UzNE=G(9vse;t(FzaGjj+(5nZ6aA3=?v2I$VHF$z3*bQN>F?eo zT0M|_mBqK9kGMCBricGoM-3{zlYVb-28-DJ+eGr+ZZhlt;vpvADVp6U9lJlY_%X_D zckU9g`}Y*z4fE3Xn4ER0iicUb$3(OH%HJS!pVDo;1kK*x4`uHkF#U+)2Q44|pZR|1 z&_l%|NteABW$zz`viGB)>^=4HTs*3J?VOu{>gMCDYCnk#?$0&N?r8?bL|er>VuSkZ-f|l1RRnP0l*gil>|W zia4SU&n4;HpBcq7$-moqt@u@#mwwIUtn+&D8hLuXvGX524xr_o3ED zA3)jv#ZdPDLn!;d1j_y|g|h$4p!~{mcp>-uBkGqOUIBHVS3+;S(rV^R{6BW@B=W66 zFMEjnGW|NwUat4jKlai;fwGqy(9d@_7Jth4Rb@7bj641x{T%l**}*gF__h>pw(I`f z>|D|ZNe!J}DS3HN>U-}x#UVcM+t1{mfe}^o4Dau}Mg|e65L)pt8 zU}N{k;%)RN-~CCn{y?*r+u@GPj^f>Kn>{0%bgly3GC zn!W4*WiLCL{*>UUmXH1apzLL*;Ay1GUW&4pr$gDx&QSJ}dU(#y44#Fo-{m3l*=omr z?-!5eIXM^3<9?k-{d$hhN7nxM1@N)Soc~AvUwc}BUgrfahO(!ZK-J#`Dn7mx%0705 zvX7T}Iw(7PJ=D10 z05$IY;DGdv!Tzuk4uFH;P1YXke`MXafv`GV8N4}|i#ws&*;}CO?5$9Cb`X@E9Smh> zZ-cV4w?o<4JG}ce#Jf*-LfP@5PdczD-r|Ui6wD!=UC5GWz?1 z_am$PaH#T<7da0EM|jr{$@gIJA=9(|M_%cS3_k4j6OukE_=qQqL#rPRK8F5$t{XB= zql4@Vkq`fm{&Mul_MYjJ)T{SHpMrW{^y#49D;*OY%l%&KJ|l9USpTEn=sp|VaFy=o z_~1Aj-{&NAKc5%LH{N94|MTwWhO3x&O;moO)i){lpE%jhbEbp2^OzZ^INgOh*Et#L zJm(ZR->nYTP`)bjqG5}Q+D_*-ZOwKy5dj0#~ zzSQf~!~6fiS&Vx(-%OG7zHb@_X5Lh}!~0V8pTmC7A^-jE+~7RVUPIm|d`tPvUx~86 zZ(}dz*WQ8JuXvYyt1=6M3z6m5M7_WD9@P6=i=f`$dLQb&tq-8y*IEqc!Vf9m(_Io= z>a`2&%|yQp%Fir^@~0m`y?3<&>bMN5I_E-^p+3eFSiAEpdajR z7flZ>e%J{WKkR~y-JgTMkT2ieEm}T^U;Q<>2YprMH_`MEKfgEl2l|eg-$m0yuIta> zU+BBK`$W@2;)%b5`_b2N{}D|OEpA|b*!x@ugTA`ycjJ@(h1HxxId_u$qc2o1Bzs*; z#INRwl&@`a)~OS!YjQo&{3_{`s~a@(B-B7U_|s3FWtH!?Zv91&`4<<1t(uPXog z1x-RnBlq_mB{J`OIS_r*P&4%XeEFj3A^KxfAMfoq7t!;3Ir;{f<4mvbgGgS#;P}u9 zgmVT!7yPxkY?|OP!|7EYwAzk+R zT;*GMUg!eqN%_tftscmAUKlDsf4%P_(ex1g#i1_fuk&3ZnjWIRG;|sI?!K;~=^^^d zL$Wj7e1#%iYJPp;)WnpJQ1S2`db3k->}tJ8Y-imYkd*X>Jx`# zVxg#&i-jsevX`k)Jft`xAsKs_6q#=+le12FC>KXmi1hP{P=IbU}y^!&|GSu7Z z>lNx@_4SlYeOHOp*URLrbG27rZ;^6iC-os;RiRedq?- zRa^k+M?d9be)YHfnzt%9vYP#WsCeNfD8D`s%CA>K`SqKj{Q50We*IS1j&g&b_TL6W z#Ra#~j>h$NsBygm%3lwG^4E7l`TL>dACSH$bQi3Icf&!j%Ep27f8<-ga9HR*`kV6I zE82aB=!b_MK%ey8FWPuQu5U!>A@tpR4~nLT=tqV|q3`Q^STsFE|48UD^cB8GMbks{ zqeD-iFZVqznqI6DZ-7p~>Xm?W98v%uA91 zQaB*}QD_;ggv;R|i2dMsHv2&wx+=7i|E-)3*HEA4^J=L1jEsJ5Xg#v#^*X3|EqRgi zap)84Z!ZUuZ$oIK>GA)_E1gZDPias6hopZN+U&`YdHs243*}S3FGTv?%Yl^pGW4~j zXGP}ySE5}Pq@Hg=TP^)tk@W9GOE>+3??XG#clZ4uqW@8(+>X#sR{xIBHrRLaj?i}4 zD!oJF!8z2Oq1~!?!7h>S#{4W=y^wzG4gCVQ!e6c2-q3IG*!14e9@yc%y`ev?{O=<7 z;}6lwL&o{9&^|aF?zen@i{$%9w0w~M{2Mv|S33WO4#E!a{Tn(&e%TR7d0$EH|2Aut z)aHLRD|~sPm521dj?#Ia>x!mV{tZt3lEx)^ejA9)C*IcCBu_EP;Gdb(DC^_EbmZFtY{_V~Q zB`1=9x6`_$70gSwHaY9GDQRo@PZaI>Cm;PgspJ$Zcd|&i_9gACTziu_|6kJ4%AF$G z^G-hccWMduoAx@1lsmoTG%I(y$yuj!$r)CzmjkUF`RsRtvuLk|I8^d#;@flhA5;B~ za4yvPF6igDm#QE5-NKTt zC3;RTvwjt3E*Gh%(CcSWNzU))_Q@1i2TF45iDIaDIS94R2tlncN@!!AKW;CiTY zt2aQMW91l0-y<2p{p{&JSn?3<>%B2(-yazX3*3iG9-*II-BF_T z6SDq!v}82;!R}+C>7ji;rX(PZ+{Z%oWWC2=M0{PI%hBj>YTwdQ0ENBLY*^s z7V4bAI9Qi{KL>YYo-dh5dmGc^OJ4BWgZR@4(p&qG@4PrAli=uSPRXD#FeJ}XEk|oHz|1V-s-xq1`1Cx3GzvM%c zmxyLhNoT#cv}6nAwmZv2?A%8s%VA#nBa^evijtL9Zi{GkPWc;TRx5pk)@jhcD8Ts>kn@c`N)^`>l@)v5) z-X9Y;@qYK0P`^iI;k3!@|HB#RzouQqC*M$x_x?)0wesJUY$bg^>7w5A`JQ}=Uw)v! z!+k%N{DfZXB~kl>+o0Ym&T zC4bp`{j+4R&DY;0GhhD@xlezZoOSkj^Yt&0>;AjsAFm#0*R|j4_W`T-V9CFvt6$=f zj4yl$4u$o?dOqreYlY<>@+8wzev7@CgcCZN0{7L zwEbPunKws<^U1&4IV#))=B1A^IqMu9Zfg1SMcdycAJ;Q>QZw>ZWsV6SZ|TiN8^>dz z#u1q~riJt)v`$mH?ng_gc=ZIR^UkfHey?f`b#9>z)VYPWQ0Ep-gqj~G+4Y|sZilRM zcw%+BeYit7w~q^L-gJZ`CZ8HU1#X3%=*Pp{e`xphG^lmm=}_ys&QR;ZGoa$vGoj+| zv!K?6XG5(E&!Ha0#pfbx-kryF4fmZNz5rSCO&pLe2ww;*;YDx|yx97U|EIj>^Cjpt zAG;uH-d+k7?{$TWw=W}I&%xzT=PV21C|Ja}*YX9zejEQlxEQ^j15xKHbLS6B!lAI@ zo|15>*Iw9b2N``N97Wc3lzHt*UgX5Waqm7s;@4z2VfmBc6!lM}9Y`Ej9;W zBHYcBA^)GyJ$xmyzS{tavwMVlB2Ptz)Y~h3m6huizS`46+V36igI?bi5NA*B8@`5g zwF_zI+A#anHcqgf?CbU6T>NtbR6Nv=dRArnhX)`l-Vqh=+z1u#+yoWx41@T{6-tt5I?vU_M^j+OMMbks#pu58N zpzoNuTQohic&7^b-C^PTNRPPpik1#7ju;NLuX;aJJn;ZjJTU@($UJxu>RjGKa24`M zD1ZGh*Wc3}6@Da~iw~grpGTqJeLVaatb(Iq0eq77`@2tw);=Uodn!BzeO2aZ(e%*b z$!DPA%dt@Y>{;5;?}+1&E8XY9<0&`TeO|P3kof6^@I>_a?gY{F@bK@3b)TjlC+w>` zmivrXKy|2-%@F!-^Hb}+~Z4_yDlgU})hCjD*Ur46h z7Ljsanw)jAUb(Nla$_fbO}?tkH{l;F-?yTT$9LX%AY%`{m)`t~(o141+eQzr=Kk)zP)vuG_9QWkXQ%e;Obu4XX z*V|q)^QnVK{*ESRol{D4@zALv-)reqdYU&r(9XG^4)xvG&ffK&fvopO&qUVx{4C@O zu7`1G@G932&Ci@$n)5s7L9MgTFZGSOm404;tabQ>Q1nX`y%h5WiC-y^ROVo&STa-Qv=ajaN{#bco$8DJ?~x z?}kOwLw*O0l$Lqp0L>po>EEhMtTc`+zbU@Yx;X*0PEA6st5ZnwUsph_udjew zPj`d*PGfi23i(Q??=$v*S|9g>1G&#vL48-T7v%h3X&?H@`9IP63He?P@Bc%6Kk*u< zb?~)N?~`5!-_iOX)?3EfbtBZe`X;D#?m(z@ZY7l8ycuep zdkfS$_g1KN?jWdj?qH~O?rl)(+}q*osdtp#N5AJ!9a4Iy*Kf#ra%kyYo(x$}-d%c+ zCqvegRi(o`8M2y zzw-BEk;fxH3-@Kll|E1Tj+y5~D-Ve`#+Ob&A8}t0O%H9~VItJN!z8Hh>pGU-EltBJ z*DcLJzW-A?h4Os=N3`FV z1Bnx6l+I$_Z*X1}i7#FgNq^nstn)_cOp|Ac7GID~xi?E!Qf|95TO_`iTRI2krRSQQ zb>@}6W#v|i7GEfTgUs7XxA+2DeDN++e6avtw`O7Kd){*i$+xKVeJh9mFIBwpLFr=h zDc%qjZ+r+9Z!Cd|H&n0I-OI?I=UZO-5wgC22a#8(eOt$hXYw4bf?8LtrXAb=M_z)R zU5ng<^mR~i%6jzjQ-|Y}Pmr}9-T)P!Y=nwWHbK1)@F~>$!Jk3JGn=9M@wxTmi_$H~ zDlaO|`O<4Y>$Ue4+~9m&`n}zkZ$$3Pw6*P`JyUj~%5y z*?4Y~%=58bq@EonXPuqi^RY|he*Rp#$L{AZrMvBZ{$g_0`L*;nE4N3qxQKj==ibu4 zt(|?Pzgs(hNT!`XMcUbCGXMYMwez<~xqnLc(@%{DL>@co0OhJO2TSuJD)+Bw<9f)h z2Y(-tpRW~x7Uw8k>*U%{>*G35_pL6}eXR#|U+cr_bc0C4NN#-$E&gZ(wf;Q

7U z6~7z_6~8orieHX`ieHX~ieH-2zTR8Nhk9S38TtX}kAVr=Z4R}bKNfadb6liFBo}|c z5uJR;M_QuSxqMOIp*R5^Pu$fC>V1dSQ1h$})O!$Z;ehnXkrQDhJP8hh?Yw#+?=S7ISEWXOEyDyAf5YamI!bk!2sGW3?xsB>O@puT6{7wUWV*Fb&G z{#vN-@Lvb@UHj{y;?EnPexKaRt z42tMEyjA2m#Q&q$I1Gjwhuf4N`F5yryaV<@9s>0}|2ts@4u#e5F0NB?NCSBg1Sy-76Wpai2)L!%faQ_eZc7$p1T+HX@?$-ais~5Kfr(NaP{z`$RZ0 zqW2~ri9C!vF!M-c6dZ?4eIpur<)51JSY+5x--!FTE@QM{_Tq=L?$8+So9-B}=hS;I;|gi#3-v#@ z{||%czofsilUXRc`4#$4KVtu%e%$B#Ch{$^?7Jxc@Ez25UAMx^DgQn7*7E%r`N8V{ zG4d1o5$GZMZ4u&@TFYy;i^olvvO{d+PTA@8w_=j~vd&fgOgY6byP@KeU!dZfU!mfg z-=N}|Jy84fd!erDcc^~+;r0Jd?|SyZ?ap73gLZ%aiTrK%_aBq9&i=>&8^431#TDdZ zeEyBpFVlUfRd&ekgRe~T!YQ>x?nB+OyfXQn+LE~sbwut%U6Zp;y|SF$s4r4aqp}8N zx}Ocpj<$LliPY1i>~z|ZzlF6Xv3~6gwJ&o9 z)O>O0M6!5)j)|A&fG&Vl-l^SNcY`Fb9dA3qQrtShqSx2XAj8B~0CIaK^o2o>iQLCrTm)bkO51Ja?gVps`-a1bo9 z@#6P?`lq-i4E0=U)7nsP7!7V0F5@tfDLz zPr?z6d{>lpL$Cfr;;-&yS9-EIVsg*29&jtXiuUz84CJ}Ix~!MopR3DyDI~&%LXHBoCZPNU&)J{+sbaI9?cub?-)bM?y&qr%I>5e z8b3(9Hni+6WZid2eRr4L+6;S9~UJb?z-2j$Zw^52_!?)N_B?L&)mK177+F zsQx_Y3q44m(dEgQ!;S7n|Rc@FXa==Hxu&q3|)Jr7T#o$+vv`$Ad9 zo@1wMg3Zf`l6j6NiIjIt=Kp`a`<4+~^=5tVQhqG;PKN6L6sZ1JLtWR4T!-ST8t;0h zqF4O+5>&kPGE{sz4Jr@F8g4{e`s z1w4>hS+<(=I_@gb(xL6ctbu-aec4)A1=qm>_zC&@yB~{|AKHH42B>rY8=>A?*aUS> z=ToS2I-fzk=e8MYKkjp={j@Kj_6xT_?YDgiwNIFZ`rYd*sQtRH;nENJ{U2(-?^{?- z`gc(0Ew)1a|H}6;2!DY3AC@1X{=elXsPDjSgW4zB4z*9T12#gx6CMS3LG5q-439zH z4Yhyy3p^SA3fnW!euLUq+5=m=d&~Y{T&gm^i#9IM_J99`+85pjwg3AU)PC^a%m?kC z{e#@t-CuT)^7-xo(aJ-{|KBp^8~bL5MAJj!#ahw&QTfq45kFd6B)yKw{Qe)UXL5bf z;!M&h*C2W!<+eKwMdHjOqK#l)`UsP=PUGm2R_;R4;!N^kUyoAyh#1dzj!mQarf2<+ zzP_)S)vNQZ%CB>;&7tDZV=eu-Xbaj^IwTG~KH8FW#i63&&=a8I&{j}!DD~j4+eA-7 zZq9Sq7V7=66JaqjdeTphw)6B5xqY+)vfhh>$Q`3+Ay?LPik?D0n)^;QdEt~!B5}_d z(bJ-epH7#I9qKGHj%S#hbDtG-0%{z(LB-A8q3*|(Q1NpQsO#`INxUDTv;aT%^7SqxV~V z4@joI5hC?HXmZwh$g6Lph+TL%I+}c&olzqB9x*xVJQ{t>1f82A^F_sWMs`Nh&*=E6#7?{sgAyE{d-Zg`BeiopOA^KUXtG8 zG^OkLn}&R^Z+i3M;TEK=`>UcF1KUd5YB>4)OnWiaMj9{q@Nx?afhz9PEPlOfOZs_1G@ z76+u)Mc2SexE2nA>up}J|4;r#zK^4ypjVtPj+neLx&dy5o9LI~dRVLVYWzR>oA^G9 zZbnx7qU_G+Q0t^Gpw<^#$d~W?GMe@BiCRB>1+^~untBx%e*+cwehX!vzJprVY=w%C zzo(ufeLqC?JGlA>%}@Un&BbfmpyIXd#Rt9^v~+0SS;>R7@h`PueOL!7KB)^2Wa`BlP_B+!U$kuDG}0)517B$^%)r#6lq8Oz0~(BhURP;tvqP;txAq$_S|io7F}A3K(MHl~}!j`8Y& z#G%clw|XJtbzJOt^j+N+qUqt`b3eo-C&W&o{S8hl5xdn|BwrhovrgOCi6);UT0BEK zvW8rV&%>gEuK;S2ANJuw|z5c@yh8?@k(dYpAkFL z^0EGpDPB1%b~fpXS471t=Rn0P=R(CRs>jFppHDf>(+i;H=VAYN5$W=01yFwRVkm!j z36#C+;+4D9E7uina4w4lY&!8^dlPr$p>mIAH za#u*ETsM(?-A&FqS9;}oc;&`U>Pfz;%vG_zmams+<8ie&9>_e`eWW-0t#s{^Tmxkn zuZ6OQ*Fo94>!IxN4N&&DAJqNm4`pWtK-rTUsaN;sCaC)}5Xx>;LfMs@q3p>mIrhAc%cA{JW36H$Q~(dT;(tsQ2cF#`NC&U9o$(-nH)CBICmT zKl+VsRqRar-{s-4VK#pEN@o1-6UjH+WcL5P@w5M3uC;GvZoPgP>(K{expn$OaE?1N zHrnpTqp^przEP5??-7yu9yK}ZJm%FmTD0~5yE0-Q=;`3+W+#7 z;ktiYIWG20%-7(BkH*EuA_rd?7kd^C%#2h1!@o1w`t5n1bG_$29?I^%Ks&246JisQ zWp_o{-APb(*MYLTX}B+wiA|>e9W$(S zFME23U79An<%8JcS7NWCAMDN$O%KiPz6K9uUXRTry^i~aXz9?-iOhofuHc(c>)qK< z>)km}>)p9f>)Ls6C->_usQ)3I&-M3o-;TZG*;!bx@iNZ;LA__c0Q%iUv4yY-z6T57 z2lS)A`@U%XfM(|xL#;zUgst5rv1R0|$}ANvA2d6=9BLi<5tKb&0cFoudiH!3a$|RO zY%S&U-8G_>hxBKi&4-A){=f6V{-5WQSnl_e4P4j%-dord+k(8o`BcQ7eRAwaHoMo7lHj?ibPQx$-y2Y*o71b7=Pb z2Pk{~qv?N&ZL@r=|IMCnkL@5`_FR-b-w9>UcR|^6>cPJ4R=u`=EPl;>{1rXl{f+%* z>3d>((QiaAu7SVPj_k`H@W1wdAL+9De?i&(zoG2@KTv*QKUDbxQ2W&fz4HHh^&NuS z9bdd|T;q}#uLbkcc_wF_+VMJZjc;Ai>^u2rr+&O1914$&%f25GZxENgYA6}I&`6}* z5hk<#kLT?Bks|l6NxT{Pc>hl%-_a)X{$D)bMH{yh?Rq%xAD5jzS$gviO4mMl zd#G{j0Oc1tLivSLp!~wAP=2Hnlpi?_%0HYA!M_(h~^eux9om&6NTCA=68f_x9g{73G)FkR!9 z#<>_po`91#`KjBX-@PM#C;f}KLqzKzG(R;I9?0AkzlZcX?%krLL;PD+ z{9g1OGs8sFL+ZOfejluY!(jm&LB9U(1ES@F=BFNnJ2DT&A0d5XdSv`zFCF6VMoDk^ zq3!EFYV|!9f1LEL?r71{p}jx(1l0M?C*dr{?I|cf_B0IQ*T%rc?lbXcDWC6-6|Fop zKQj)tcAtxnC%r23ylCmr;(-_7Nc`Od#&nufc(OuOSWfeq;vf|L$C< zec;JZ=QO84oeQmo+E;!NYCpIJYQJ|X)PCYYta1K`%r%E1Jf^#e`xve|Ja*DhnB>b zk}kg{%C9Yh@@vbX{2KLOUsuFGL9VP>9bZX3&3&s(UN~j7h@V&=Ut`bdTFE@8>qM?| zy~%w4-+N9!@$B~o_0#OPm|@;*f?DT)3dbXVMn7fGHbdF7&&^J5iGN}J*%H@&;!ET^ zyk5$B<-UUQn_olu&2OOm=C@FO^E;@0!L3mK<9n~2AG~&cwEBOF|4Mpg&5rmsyWZ_4 zFPySNL zy>k0R`u}(QFZwYQ9jkf47@|~DC30eC{kn24;(GJ<(|APb49TV+gCG24Oj)_w& zAO0Wtry2NvsQK6l%I}{B<@ZmA^81~k{Nx!>al@HVal=_qal_eA^ZOjA`F$?eSIc*P z;yk;~^Ai`K*E|;WzQ%?0yNU0jL;XE$2DM^IAafR~#iHPah|3_ZwlqI6H zr|X8K#}aW*hQtSnL=su!28j>K6DiAAo=|)sz2XD;{VNi=-&ecAH~F94?zD3_PSEeJ zJ!6 zA<^IFSwE5d_zTcO_L7z7m;42JR# zw~>EU=Jv!L$chg{#Ro&s_jK<}3{B+x8nig!E_fhwccO~^)p73;t$)zsgkiA2y*DwO z^serGqNPLPff0%OVHJG9@{LG5M85v+gQDewyoWF{@f7;`Qy)%@^7N4R5FSZ9>dBDz z5FSg6_GHL=2#+V8@MOq)2v4dWs~1|F@ig?iV-jOYkGRi>mJThhc$Vw6_y3Ufe#Uc9 z?+ZK+^?T}gxG(cUVj|@`W+sSM9@_f@lVD@lNn}XRchjP!L;SUyn1X(=J6SY6wD$+9 zq23>O5$b)88mRX%l`|~SM?{mz6dY|J}xFhpgVixUf zOuwFZ!)p%`PtBCx+K0S{F+1@l96fDzVv)_;w-R$~-p)qOdHZ!-Qr@rlVBM2mAs zC(hZJ_?>dwolPSC<+H@6FfaX?$ysM};&UtayJ&Ha@;AtAQM$!B(BhmdRGjmb>Ay~V zWBKs^*x5sezD;~by5byBan4q#IOlt)IEQ-hJ3l6VL9VRXp7@D+n)|kyyl~2P5x@C! zVu#(YoszjlK=0-KgeT{A?KL(Ck`OXKR~nV2a)Ap{zaC3KZN`+`F%;^A1H7-p>iwnrdb>t^cpuWnQ=E-L0oBNJ2dEu1iBIA2}^4O&O^l_3I-xebE9B*>g zX_@4TkWUb)r%kez)zdoJo_ZHfX(Lk4$;q}>&xw+$=OmGGC!3sg+IjV~w|a(TIwm_% zekkm0zwYD?<_L!&q$t2zRk{=BKgiTIqRIAJjdj7MT>Vx zXB^H;UTp1Llsw=9eE1NC%SvSP6^aAQ-ZKu>PlfGhazEj9&9gtWK9EBgtG`0c{_n z487u^C{#QYgNldZP;o&5DjrHg#X~8mc&Hp|-=zZTeBu>Q=M%d@&EM|SuXyH4WX<0m z$cj&TLe0CY&}%;TLRLIOyhD7^C)qoxIHXVV8c*NX%a4ry+T``fs^>bW`Xw)NZbB*4tHz#jFuk(1~SZ7f3R?9aisW?aDF1F)3 z4)1&1p7gbN_0w=p5Qz=yi_lZm78D9;owiRZ#m9!=TFD3$>4O zAJqE>!=c_YxF7a`4?yjE@bNR-_jnNM{ep+!QqDz=1b{PhCm^?t|%sJLvRH%^nF7k}CB3~BDmxM|hN44eqvq~2?&PEJN1 zn5j-qN%|VTzN|XQefWRBH^{%$By(}wRH(S^C8)UVWvKI9(`aW^W_t1!WW{Zw;pDZ;D*+Y?E34d)GTx#J|r=zU7T0 z#J|r^zU|2n|Nf5ZwQ+_P2QGlE-G#|Tq*rC$6D=JQf4!evj6ULiAetT$H+`5~iay_6 zBAOmr+_nrBxXY6(Nbl-?Bw9MOcxfe6ytE1`URn(mFRg)!m)1hXOY5NGrS(wp(#KHo z(kIaGZc1)|Rd6FLfS=J`fA>?-+JhD!ZYF(S=JVth(mQ6p5G@^A9P=eq{FsG`AHRZ% zAHRk>GT$V>r`*Q$x5@9ka*()etMpb6w0QCdSn2+l+(!Cf_b1WPA#w8dkYu7LWc86_5S_wGZ_tR2;UCdDqkZ zEBQC$pzn1-`@QHNsNakB!?WN4sP8);gxYue7nbw<9)da#=}YF*J+i2RMAzUO=-)c4PtKz;x0 zC}_X`!!YSh;ZEwwhl(ScL9L69fjTGI9Cn7s!ULJ(QpcyX?r9;~c)@y=)YB3UgC{`6 zpRM31+G`DWyutb(>YQd=mCqtdjYzK9IvprP2n~P&RraGtO&rcEY z=ckIa-^t{xb6VTDc<8;#lQx zkU3xJ7RN%1V=sh?V=pp&LF!`5$M63s#j%&9x{$6oR#Y5&DO4QW6)KKZJ$jG#a`NZ- z3RSWAF5-Pq-LB*Hl(Ek4y>YUycQ2pp;{q3H*I;HsSs??P!#eqE} z<0pEGng=FlonBtQuC{(DUhVDmtB=>OzSKJ;b8YGxI1~=Bdi$lWvwE+WOuaXV)Z5SG ztkd7CcYw$|xG{AL`8GQ@iR2q-a@MI#-E8tLqQ!NjbN_Em-9i4{&fwG_n3o=Ga@M&m zb-U%iL$r99eB7TQDaCIZuUz~#G<6s0ir=8cNq0l-Yuy8T6Zcd>eV=5Q(i!)Aq25Ee zk8(OkHXQ04*Zt^qPU-=u^H3w8#`!_0^I;D`&4ZC}+vJB+kJA4MQ$~s0_eZ>OcvKv5 zr0=oRX!7ZNl&E?1I2<$OiPY0p?n#kyPkH5@7A-y;Lq5fa&p^e8W1-@yXQAT5aZvH$ zb5QZ&^H6c&c&NDW1*o`i0@u~ZH!(E{S^W@0E1gu@?kD^I$OF=oQyEwZT{s9%@zNo2 zY<23zR4$H%Hg9VzeQN3@%a8wu+CO|5YCmq8H=m|M{eJffR2(@2Dvo>=>UnsL{Qvuo z*38r!DaDI3Q*V0dv!I?AWc0IBbCFfg9H@FEFLLIk-tz80B%XXbHQ(~ToqC7*b^jo7 z>AR@~$QnmTeG60Xc`~G)MXC4ED=rncIv=DyM6Z4>hUy10^(;w!gsgrn_0pF?^=G-4 zkMvq?SFT8{wEV39A>aQ^5!c#yD87B#?d7Z?-^6Jjr`DzvcYT~%hdeOzacX@^-#_^{ z_20Nl-=Erm-PJjdjZksdCaAdUQz*Os8SSsiY)*ZSthh^5-1P-i+_eQN?)nn$%Vbku zGyghfz7l089BA>;H?Xn$ZE7p&`R;e3r9Mye^zove+d9*vVhjN9PUqs6NYI4^3&3i8Ph{Sn&Q@?xlLgKtX zQh$0fB+lEXdaYe(ao68aao0akao2vRxa$B^+;tEt?)n!h?m7e&clpY5aaS!^;O3Rr zDOX%qTeSM2#aVSp_q+AV8;~Ax>x-5Si9;HeHzJ?n5NPq%5m50~W2kuRNGpGIc@tRW z9$kJEEP(mc*WYa_T7A&st!D5*=9uzhNw4EJ7cCtUZyi^D68ia5Ta+K~=^^n}%kmRE z84_=`DsSz{ka(+2d0S70#9Jq-9;+8xymc~Eywwi2W`DmuY>7SV02L>6go;m2fjcs% zmUpI}jpXjaw|b$)IcGq{Gt6^4-+orP=0E%YP=4?nC_i{Elpj2ganqRSl)&DH#--J)L&q7*15R+5|g`#=5I*H-&|T=ME>2*W#wIAUivbVv(Dw^ zg_gfaG=D=r+7Fcbt^GiGX}SDtNqKR({A^G%^EM>XZi&fRCtS`9LM|2YSCR6OPpDkH zyv)i)B~vaYk}qy@)=7BfMm|BgR!1E2|daZN2L9KJUL+$Th z3ANtq0kzKU3Fo+1m0x51?o-~&+P_*d?e`XGzmLgTr?1!kHDaqp)PF7I^}hdgQ0vm` z>4(;jHz2Ej{h<2S-|OE1WZVCT`W@mXsQ14HLamD{q1NL!L#@Yefm(;(3g^3n%5S4z zRhhve{bK(gz1GFIL#=0-CuZ-4FmGfB?}W00L%n%)7yanz-d%o=_uN73RaN=DR_`#; z>V;+(?}M_7!=dcr{m}0|SpER4f+Ju797*~9?n9!Lhh`@qhC4E&%14vFG5tvSqh2~> zzCR|t<%ihY$IG8Y-!b!qXnKgfeyaRw(q*s3b%D)Sh$q+Kh(N&4b*ybEgUnG^*_}6b?adeehl?~-6v4%+zn9c+>I~^ zH$klzKZRPieFn8Y+YGf2^EuSI?F*>&;uffN-j`78w=9(X{tC)|e+~cl`^2~9KQTWy zINyob*R3Mg^}Wei=ZEqiP5w!=bsg!f>$a6QsF0oAE@EeQmhYf^UV5j=S!Y-I&sMHM z1+;aY@;Au*qI6r=L0i}ThTYY=ZV&nD`}UUqPJi@%8)RMgNBN(mYh5R5UAGTvUH2E% zx{i9VzyFliroPIWgXR0Fr@8Nd$qT0(6tT;-D*m;3aY!=r!dC&g&RQb>2a#97d_b-( z+B&h0)myis9`$M+0%@myh5D`E<3+{a4Y@A)t42`%>In3D54!W&>eq=-{`VwLe=^j%vz>Q6?Y-;i05>=tD^91Mo1Ifc#_3d( zvreaq(@Z{HH2+IF6i5q~7yP z&N}CN<8guAkII^YiVLltiz+Uo-i1>NMC!S;;$o}k63NulMWmifP0l)9y?QRQdWK{Q zD=w$}P#CiE#T7+X-Y=Q*0g>{>CTE?XS3V>%-%Bc@IY|gz z5CsvDB(wws3r(>Q8=`=UsEDX2@AX~T-p}v->-wxRWzU{Hvu1Yl*ztH1$gDej(%U*& zcCB**Q0wF%RDTV@M>+ptsP%FL{)ilfS`Wvd?q9^A)~C5p>(l;F>#6}z>(hZy>(fC{ z>(jwd_b>9G)~OFdty3Rz`qL1nKMjRiR}F(&PYs7!KaQZ@ja(0Bj3k}bv5^b(j29_iKR{OmS)qavI5_2==QNH#^AbyFA0@JhpN8X+&%t%tc&L6~Hlu_)+kn|-P^U-Tv zEUqdl%~*h4?E|UTqKt)>Zc&ETwKlF1KkB=rOEO&PyYO2I6~`?jzf$HI;y8;}mpk$b z?21=kgKLv3Gv2WN{JO|>!2FM1apWqfIC3@A{gpSN;@~wx-$h*q z+pypB4%G9j>!IpZ234vpS1eYcs+_y3*qw_UXFn(p9u6+gd6KDvMOKI}%mA3)uI`Vi{A(@v=SO}n7t-yzCHpKU;hACE%-6x1paFm{FHIj@rT5gM{xhR)rsjcvGXApj^moQ-(((MCNV_9*QaLIN8hoqo@jc=y5o$@GtuW4HV{n@ExvCEPZc)G zY=XT`vax7(n0g~|T2rY1PBw!@#Jg!w_X(Oq-6uE;>i$3rsQvk~VF%7nOQ`z_=Rn1k zt)Sx0bD_Q;+ZyWovFT88ejBL&v$TbZN83TgneAbc`0zZq@m==+p}q@y0jxsq0QLRX z3!$D1?g;f<@I|mL`CJTjpYRf>_jN9Xy8m(+)blf!LwzUq3aB{rN~rrIS3%uZxf<#| z$u&^-SFVM5$?Gz2puL7AuNSSopvBiWLft3133f_$%De@?&dHla^MkC@Zq2*{{oaDx zGCMnZ$U5zI>CF#X{Cy`>oP8J6{gWm-T~MmpuTxB(pLzU_Q)* zonSWk_fNV-%OBeMEC(u%_du-=yl@Zs_@LHbeyH_V0BZdegj#=vpw?eusP$I_YW)?3 zT7Si$)?bVt_8s}$Ojq6Y^atc-YvF**n(ws@g!*3FAlm8wy|0v)IUIRU;z5yk@gb3V z4>7qqF*I|S$-_lkPhe*~F(UIt(j87bED~Rh${Y!66^t^uIx#wPjHP=~wDkmj%(IWk zK4CQThtk(C9A~oryCS>3pYa&f`r`3SjgL=cjz{jff%%_w_4q~Ela`MCf9$7EPt1G@ zyVe_`)*F+c)*F+d)*IwYJT@hB7II$cGnrG#r-f^p$z{dQh>Sp!_;$Kv#-kY` z?eLt*y#JrcID|Y)wDrbp%lG-rIpnLj4^qwxIv$JL#a6WcOHlF5%hX$O!7Iq)(a*)7 z@BU=Yvvi5f0`&Ky7Zvvv;;(ojiLCwdBI-TLRh-Fs!s35F49BMtX0&0Ennp5wUPJLd7dlGMCzGeMol}Nj+ zHn}?SX671`-x6(oft_|)n^|t{ygu`7Yv*;6Y3FxD(yuqUI#K4dbGfy1Ug^fn3OipL zGPhEnvf_;*=c_VvljXBnGWl!~$*0of>O_^3&sNK4WZ}D++ekkeerW06&)jb5cSt7v zdm`!IH@Q0Tfs_72k$%22^CSF@CU$4;g0%{En_QjPleyQ@eI(jC0zZ!TPfRW={#2y?)tR4J`JYRs{QV;3SDRd&_`)gwOOgD(%KV!AbUq>S?0MgiF2C?V z<`GNxt!U@-pdBakJLjn)@qOkY%2%8Txt}^g<5a?2DRQe4i&Hd4z=Dm0kz)v18Ti-5}rr;KVe7s7xhVToyz>% zj^|Y7Kj_u}A^rT{%+tt<%SC-p*Old((2!5+*2=2UL)II$v+5vg{UK_dR2OQUl#0Ev zt6o-p$6vJdKh*Wt0DB|XnOO~ym0lcB&?Ku7%!7^LP}np};{x+P@(TWU(+qaUKMnSQ z&9iFa`m>Nr3R+~HomI1bfVRGAiC*ihbD-8)t)SL<=aNqAsMb)|c{b|ZivQbZo$vUa=lCI`zaZ;E$G-#A`a*I=qGQ%Yl&|v+Sr1&2b+P$hl65KN>pVi% z8JA^Uj;!+r$?uA+D;*hfzwN55YsgRayBex~$fUbA>qcbN^E$_VJyiKOIDWEMByP&; zgum7);_SpNSvSKa@K(xE|AMSvZp-TI)C*$2J?nq&%ca++zIT#eDf8!DSvB9GWqz~$ z=ev=$zkUzYdZR1UzI!+P71!U3taVIxxHfrTR?jS5H$6nIH}3zV??(T+AI|4_#9mNw ze{a|WeIJpysxMSM`oY!72eNXqbRE01GOT}OO6EGw63N$XGVlLq(Q}b=MEicOhxBRW z(_en76%PPC83`2(_Q z)(-=r)(L~K?@fBCHlF{3ij$_mKar=x`-tnNLH(!U8K}7G zSr|n>9j3g?^M7z9>(=L>)>$)QC;G!Ic&c!A)*Q;KlYCyZ@}ND3^a4CVJ}<(PmCXN8 z-*0;vD(-#-YCm}{>JhrcGhl?N>@ zejR_UPv3xwXIDYRv-CIO!Z)+tp&#u@tPzPP-x5i`*5vBM+ga;Oen+%;5)un9Towvo>0~eWJya@~>aGS$5l>h890oLdB0&rr(;i&HQ-&KTGlA zyII?@D_#^8FYbVf7vF=57s-eD^#kS0{JksdL-J|i+G%oG@h*|;{-dnjcHQrh%yqw4 z1W7?82>(pAEVz7KZn)WHO>~yaoP9m+q!G+ z!+wQb@z~c;aoRUf@!J8Y`0rb&`0pUpcksW1isQa_$~)xbdl-FQ>5o}Q?6`i&`W3mX z_(zfBI+pd59oJFG9M{hx$92qP?*BW-^{XA%$im}Uzma}4{L9jx%=+EZpO8%YKSa`> zG`TwQr<49Kk$&=bmdmYva!SPSACp=CXPvfmE;qC|5^{@2`MsfJ>f1=99*s@r`G0rK z_}x?_zh>^1mac_6&C)fOOuDl~(zP(TI&rp>uBDT1_PlfO%P(x@=6vFJu4w14HPrb- zX1;7Az0KRQD^6$!6@Rsdii6I>t~l*{sQuFm&?~O#02Q}g2o;}ogo@8Df{M>BhMMOu zfr`&Ag^JHEgNn~Chw6`4K=sEfq59)hQ2q95IH2G<_cbsNUJHl9>#ZHQ|4)4yxNdOY zh+gp&B)+=I-N}(fJ>P$`9VhSqLB$KVqHoUkgl|LEb;;th5wB4NczgL{l+|}KEAAX7_#gc*^?w;SVwjv;Gxv2d!O0lIdSzk$w{~xjGSb>Jbx(YvOM5r+?*& z_*r?jA34D7I^&+DdG3K6&)mg%?m=$tN9MT)BM&ajlmGwiJ8IwIA$Lu@Fa#=I7z#DM z4}+QqheM6~BjBmRhux#7U!CMg(aMFBM^gT1?20SKK&A0 zL*~&J+^?YDTkxX$B}WgLM_-oS{Gjdo%!S(bnFqD+lc3!mrripVweM31weORJicgB5 z_I-+>;+YbteV_SI`&6YIulB7LAa_bGbT6jd&dEihl?&OoT`><~+Un>vVKHytW|Iu0t z^&hRbp}uRd4({Okcn5Z%-s_>_kutbyLAiSy`K?`0;ojin2icF_=-%YWkp1Y*?k$cC z*^jPtS2;3dKYFY3vHC#b&v)HB&<{&)7flcUd)~?R&)#>t>b^<6xGsoGK6HOXzuA-6 zDKby(5=pn)WY+)gy(WJoT0DcDbRWA9k?wF}pU8amsrwUHtKd_Us}rBOKeu#;M2lzS zU%#+gc8h1A#WP<*#WP=-{%iL)=EwZc{C4{E0r$7q70-x@XAVNeGv7hQGs;KLQHz=< z4#Ogj?+E#5y!`=cy!~%K=_l-pBaTAF89zhC8ONaJsb8FQzdGrDgL@Lk-G5s9{4UZy zCrsx5zwVPJ|0&u$j-7V-%YE9~<&^txYnM|dS10~)|7-rIMVrU*qx_U?SGLMe$*z~J zdAn|Qt!&NPwI$PU>xh(F*JQr`pG|*7t|u~Y*UxTj=^AFAVd)x3Cf%7Lehp2oPBe1T zHFna?p4SAw{KBT$EzGZ(Xzh_^^^ zJ{RV})^I3nWA$SFk6cpFHoIMR&HMyYR+3+PsCoT7sCoT-sCoSYsCm5u)VzKn)V$si zYF@txYX9M4sQrgasISiZrBLVnGN^g>a;W+E3aEVv=DU=++kA&t&fZJN+cX z=_i@lUQ3sgon`6Vl1Y~>k}k*O>V(Hh=l#F_<-;$((4QSKzkq1%5p>!Ene!2r-ujp9 zdagSP^_+GLmK4OZbDjPI?fmseKcHYx_5hd%2g0Fnu+z_=o$oyK>ZcDv^{x{(o!@+@^E(cz z|Lu8Bs+Y*KM$(^C!qR&fs?M#NtcBD|2KPqwMVf? zdz6^W|9`VfOU?a2 z>fi4|_3!QEtMju1>ioP1)eql?8V5gs8V5hbzocMi_Acl8f?QX7vvcLZm^>Z5FUnhBnX#UXF8)w2!$%Z+Nv3E{363q^Y^PA-~f%&kh z`8CUFj$i*|nrMEIb;VgZEwF1{A?kVIvmwv_=bVQ>&;RGNa{Qs5|Icad$WYJ!=d^KT zsOSH4+Bq`R^Z&}n%7eDgcRti}1Q$R(C(r?ot786#dd{FD)bj!tLB-z}L%j!i2@GSu z6ly>6GN|VUE{A#!;0mbc0Ir034&W-Nb<)*P>!fR-)=AfLKD6Gr4*4bI>*0~Y8**-@ zzIzL9%(=;_FJ%4GNqVb4Bo4nN=Qi}ilDCSchqf;247D!09co>42h_UsPN;R!T~OP>DyP?)a_dumtwF@GM>|)d|CgCmM^q* z`vB;?&%r!7C}$}Bbx&fj$o!fo;{Tw@)rp64hL}85wD}b~>4xP@Cf(u0aFO}-;hYh$ zR>8w2S0_g1jIwl-MVnvcU%zmS>^8qbn_nM+nqTuxKQ8A{^YbPk^Xp?dk7L*TDr$ax z0&0F84>i9kAFXGe#J`qnV$M^@x~~n9C#gKUPb%vE($i4y6;6TYFfLAoy5BjC@<+Iy z$$1vpp8vD-({pAZKZc*!9zF+~vEMWkJNN%{UO?VjI$LDF>3NZTp*c=}c|lC+N4gg+ zzn5}e#(x4bB>mi+S4=-QXCC@EdT8@d0%{&AKwowmbejP*Y}UBUVv79tnJ-N+?S z>xuu?ZKcTCA6@_zM=XSjD;7bu!(yo8Ujh|>EQM;fWl(X*t5Elsms|Z-DnIH736$T0DZCdc2*p7LJA$cKwy*th4Ly9m!mO>qYV@ zGr2lZ?zCrxNWa^VQ;FZv#HO5$uvWn)ldBV(bGBHzO3~sO{OAW&Iqz9H+jF*BIol*t z&buPzY&W?&vBN3nJ&|~ZO6m&{vJWag{sbyM{uC-c{tT*LeoneZuKhXH$l5m*2NZmj^99UA_L+Z# z+CTmYYG3szwEO>1anmuVxak+DcUug;dhY8tgu0#@!IFZ;o+h4}^*6NZzbVvp z*$nEsOoO@(iTAj#-NJL0NB6B;cv?F3INK>78T~n)bDes%f~v3NibQKqx~Hb!K;$-_ zw)pFQxwt*i&eNW9)XtE6&hwn_$PoDgPX|lK{Exh<=t56N?CKwodR^?f$oww$T;k{< z`pZ0*n*K76o)6Y}hBi-J;i-wku7ukEy^8#I6khGQ23hfqxEEdv6=z)s6=z)!|0uk{ za}(#SW8sY=*BR@7^hdFGf}N5#dv3+vIeCj{c1YZCo99mSdkZ>yZg=#MxZw`z%?}bc z+~v6&{jg*g(e%*bt$X09!mgfsvDZm<6U`1&o6#QKq4pi`gPK2kK+T^$VV7iY&;2kT z_JW;YU-Idn>?2w}ka@PBCj)(c;RB-SA@OOZC(Bb4pF)dU-BA1H+2|D~o>AB}Z;P6@M?=lqW1!}3tG!Y=%>x=bZY^gc?_7L0!MIq1K1b<6lxR$HO@A-}fqM_ZK}0?0XU~iJY&O zMb6hNCRZosdghs&5bbAtH|W)M6svD(ybKje96ClVX5qP zzM!42g;3{fk?9wEmY5&&zn!n8o@Ll|zC@j`SE0_=a;Wn~KFoiwDc_VIx0;;tD}0@N zbpGCe&iS%^z18?Bj(8I)?pOmAhr9(9Z>)vN=WQqbIw$=*kpKUBHrnx)d&=y1%T4C} zKhFj`-i@No@A#4bX3r+ef3xRZkK*~Qo-KBsD0d|>j2qQx)RX@{MjkFA`&o?TYXZpoChMGpX( zagG~WJn<>%@(Vxnd}--E7p=Ya+wrj8r#&hXUr2BLUv~BLub}$>*HHcT8>oJJ0IJ`9 z3)OEALR}x0p`_2VN@{rCr{e*7c;B?Uiujym%mEI^IhZ9$ej7QgcuYt7+t~I$jah>;iOV>rT@ksvl3vZO&#v^FsQ75SJ=w{R3;=R@U z*#Gxx{53ok{d>Ea z|GnPs*!N(E6NX{G&-6XK_oM$3eNT80N>=>W3%}v`^+rDRI?w-6PhB^C;s1_z4`A1L zmjN~2WkQX2Sy1Dh8>)WUQ0s{tCm)ZKj~5Oy3yV-&T&H<_r{Vgzwi<7 zeL%rv?^7@jPJ%<> z(^g;B|CG=Bf8HrpkEz~i*wr6IjgQYjji=8-ji=M0#?u*4h z^)2sOJKxOzod4Xix212tyv+8$&(AD+$Gdl~tL?#!>y3vt?ww2j>9~@8=5nvA<0@DI zm%0VJCpUSwklzQ%%_9Af{eO;6|DURa`u|iFeh+Nj>V4PB-6po5Nx6{!Pi^<^ zw0`}8cZco>-@jvMO-tzfQw0t1?L*Bp8=awB7tsS7{^MmE{qx9zgpZ-7oZ1!W` zUmQCmzhAw_t(@OPO9vT`PI`a0_B>(r=J`Jn`$>~|{?BPoA3e|2IMvmA9(KDwa?0yU zzjo_C-qTjkf5rAwI9{0k(i^pXE}tuX*~;3!6nM+l+P+%wa8+$zU7wDtj@Z5gf5`XE z>-$n+m#y`E_29O}^?eP@?+nrUALKpHGkuNF_fIwy?KmL%#=f)6zlpCY{;CJ0oMyf> z)`_US{3Vm_zm&Oh463Um5ye=)OQh_yW~>e#jp@w z0!!d!K3B{6^hcO}0{_cl?Il5bt-ja$ZgA=k zssD|>o1FSX>fcFzR)1*sfo_34$mdq5=h|i_Kb!I7{B)ceRi;gj%w_%!SVgG>7Pdc(P} z4=jXzVF}Ezavu<_zrplrq|1b}mt^^}&F&V>4%25~&oMjC|3N*!?}g2l_w$U)#PnS3LGus!B9>oRY`?Ue{eSd#V~@hqv`-A`eT6uj3v;3F7xsrGZ~)Z%5Ch>G zZ{+y~!7f|#e1qY(#d*GmEdK{ZyDp%;FEIqJP7d{r^69#M*f-4QBF-2tS@XY0eIGWN z`QNGkD67BjV~!@h?kA3cx^FlZ{zyF@f%*?YKGc5*#=+;;u>OZHz44gu39HZJqFpDD z>uS7jGWrSS6MRoP=NEGRC;FbkPuC;l{7;gfoqx#q!2A!lv9CP^{!}&9H{H@r^F8CF zgQR;_dP@iGzU&OxZOL=KS=jq0XNqQr>4!Lu+3;MB>v^dAnRDPV%6kFoef1aNZ^$pf z{rJBOPawYn|EiknOIW@Pe@?zIy@d8CfVw|h2vcDa-m;{~SAsw5f2W;GtewAFJm0qn zec$p@-vTEeNV_bQ-ufR*&*Hw)Vt5AmErH8vkEO5?@-q0<;#YkuNEhF*T(ska+<$(} z_okiyRlb#W{$H2O`F}&iZ|JSM4n^v#3OV;|Gsjim9X2AD&IEz za?7@g)((*S>hJn?So-Zw`W=>j&*JxdyUhQ6(Z>4^pyt~T;T*UVz5=nQx7)hgx7Yml zh<4pT#5~NnBPI)cTPG;y6=65oOFj%bn z-QWKamcpOV*Ishecg)iNEL!_PuFvDXU*NKp$9=!TTecqe{RR(L9rv9u|KCOPhs@`H z`2IBgNzsl6GEV;GJ7xO6#rEZlYcT!Bt^fE=qv!d5r(I54yR1#R{I&cp)(% zntbQdZ`1vHj*j&|veu7nv9DmfXs7y=wfA?RK7Cy0iPYzO zk>kF=DW`*&au4gw3$afv>gd13Io^xxcrTW0$1DBZqD%dknIH4N-^F{Om#ZD^J!{B! zF1i12_N)BYI{92}`CKE}@{xXS(RKdooqQnec7y*WYquLkYd1*!J1Kwaf3uZSR(y+d z-fng3Z|AM$6Uom0+x<2BB(UYv$vgaa`fK));N&61i+5pvZXx>t@CA4`oI$(YgJ1cU zuKs(eXKqg#eb*ra>U#*8a0JYP`W}QE<|VWJ9_lkJnIl@eLHkaG7wY>6KG-Sg_XqLo zoD7KO2iZ@G_(L!shRrYHkKxxp85PYB@_t#|-`|cqSG4O7@|?#&{{UEAHPAoU?1MzR z4q@t!ReAo0O#h(Remn1}LHoYK5IBzG8w&p@9OfT^U&q4XqLm9%KiK@Re-!%Nn@5VK zhpGEEkM@s6U%h#ZXnL5sVBsVFC#<}D|2U@}kn{DZ|1o5ZZ;)~7ars#~$nz%S{ZA^t z#02O3Jt?vuIMF`|eSYCnqWMGn{>EhZ+QO&(Q!W1~qO}X;xr%B2XDz>Hocx}({JJEk z`=3MKBRNB~{9x)gn`ioGqyK*MEYbAPz6f1Tt@qWQzr zG5Ea#Pt(8V!fTP|LH_^aFT|h!|A^)fZC^DBj}#X9OR?`QDE5~)cF2C}vd_4{ zztFjUAp5Y3{EJDieOOV?(=35{o@Oc3^EAt#o~L;g>Uo;wP|wq>fO?+hHK^xlRzf{b z^EzzB_3#GNe(x%nwsf_B4fV+_dsDP_hBeRsLp?vV7V7z-x1pXNS_ic+{0`LfL+h!x z_CL#zwLe@A^?i&AShQfHe*>Jhc%%P)8-FYPn{52u?B7bcy#FuK4wWYJ{=aixw~9Q! zv(5jm(@v1*ceeX?I5On zADsMuwET~d{wM6&@F>*tU_Zl)d2j0&e15@S{$Jpb#eeyKg(Ki^a11;SC&S-icl=Jk z9~S=Q{{!YBpM+iDpKu&JMftg9e~Z>%VCuFl|M*X<-M0KITDw8p&vpgq4_i_KwFB&5 zZmA`j9WqYW2{b^TTUIxa8mJlHAacDxePoR*ka6V<`B^$>&(EC+zo1^-M2m;_FCK_Z~=S(cC>n2 zDB3y^re4H(zX;}&{$kjHbeBMV=jKwV@8Vo0J@vaBZl!-+0Y9dHT?zGk;8k!K>92;* zFSsRe4IHxgmcX@e1iTK8f!D*y@CMi&zZ>BX3vUVB1oMzP!7lJ-I1b(#sM&vjsRJqJ zHh9KT5PO18-a0BhVF2t?Ciz z1}iuB2;2*2B6o)`!TVqW-f!*IQ?&RUras7V_JVqUyEohb`#}AVp)b^X+5KRX$_D~D zq;FoC5y*7<6Ks1re}k##S9$_I^cPinMbpE{E!hY3W7qrT0jU3_ z2jP{Kxq%S;Xkl(33~z!Fcpr?yaaFm27#t7d@F_Te{Q3UB)2{|tztaEJ2Vx(>@eG0^ z;b53tm=|~m|C=ix6s-e;<4VZg^{4ARkUxJT5T7@_QoisO9&VWb%7lB)=z2u1<`1 z@|$4!-A_JGlD;pT2qTqG1tyVh5Hh5HOb$GYoLlyEU<&6~>nMmkH82fX;{jwmct(D9 z+%R=0>8C4S+G_?JRry@tdHlvz&J4_Q{9xNBDrZY?>0s)_$~l1-(NC#-K{P!~olbr) zLH!TpW!P)++`udF0hqu)w``u+Ui+4i=Q|4mN%Yl;LLDdhBt`qKKoRztmBoPt*k7nD z3CwrOfoTzd_BZlHZ_f#R0QJ1|hwvEt6g%Nb z?7QGj#>w4`KRe6z1U@2Nbz-k`zCN<^<*M2j_!z%VOZNpn#hzRCiD>5;@;vWnf&G^5 zb0^(?OQ-KqRAblk*a4s0QoEU=G)Bwa2@;xrdBck!_Es12EK*)$%BFKt-S9< zD-Wj5p?wd*m9)!YcpLd0fmblE{{S13&yP_5$N33PSbQ{a%<}nJY=1`u^FMlh|Lzx< zhX1cn&zb)Q?|Sw3z;XCT;qQSzNOyMC3DMdcrnbfJB&b0Prd#?>Uk-iSB4eP=-RjI*xLDv;7SG}OF zpQf+X4>lyf^Qz7WHVD?#3%0$u>P+dao-p;wsz$*k=&!A6ESess-dNQ%n1;S{RWs4_ zFttln^I!|~_f?%GnjWT}z2@xTIp}*=wG>ScQ!}bs1zV%{R-G%F9K{_AmKS&qACQCa6JL30X)rDgFA+!_Z`+^q*FF`-F>SEFK z5dCGrOW_&NmvFTmUUj)>b~vd%^U*Cq*Q5tsR|T&j{ac%_7Oi|}_G{tUj^9Hytot(Y z%MFhHMoWKF@McTjNwoCvzx?aY!T;8vuA|$m9(?~-=LJ9y_Xb_fo1uYO{)6QqZ;^IVz14AQ-}IWy?BbXh^SrE{x( zq{|NGIL8g!*52fipS1%_tG~$?3|TsVFktBdPP(A<<_FWx+!PMxnqMRsHNR*u4v%e& zNsnJ#Y~E}W`~Uc#wP{eWKlK~z8WbD=2f=}GAbiO3863>BeDa*~9+ck7gK1Z78WJ4E z^;5?+A~-atd48B==H=lcej`k-PCOhOY4Rx1+7)~AYd1X-98GxxT#p3Dkl)nJj|9iU z>F_ZtKR-Cm${**H|ETm+G!7%)_2pC;8g5h+6SfuH$5Ai2J<&R8+-poeL*HoXvh5n25MwtaEaOTm|&W-CPh%z~QhE`+n>&?W;}2!6clru{c;{_Tpd(_M_Ng+OM1D2TQHJ zdH)~z?@bGX3*gYr3xkWCdcd^Wn->R{I5JE-WAn1$QuA9DeAUszv`(9s2Uj5L`haPk z&94PlI(C?ryZMda>u?ZcoUr2*&t%?Sji0_R`6fIIc?}F~d@J}i?GW3zRE3{ z4z`Eyz*=xU{HwGqSb;y!|Epi%Um-R-LB1QX58AjfScyHiY*TPE{om3LY@Eq0`%tv`2U6}Xlc$vJ z7SD0hPLSuM_69#=eA<)vNaXpNk45UU&t(4p8~oJd&qRB^3OngO4?Ymmb3pq=p0D~M zSWWs`1z(uV`ak%UrF$R*?fEMC?_B>)@LS~mt^*?btiA+9e=ztx`drs{qUj;}L%}2H z-LAu;?aPYimH!a@neuYWehmKPv?ruJk4kUt2~$Rv9SiUR=pROB9#jfYbL_J4V59&Fx`cTi2Q6A4DH3~Jbc04oG zh@7lRW^W#9fj!rCmS}c}{p?UXwb~**Gpvl=^f&_ZkOWfBa&a=P(SS58HdCl zdH;-l#C?{GkehsTUn!GxbBeMglaBp=%1Lo~LfKZHCzJ#0BKt^}Ug{NFUP^xA&h`FK zkb1;i0nz#qL>~%8&_`Wi(ew~~G!#egcEv=~Lwi0k7wUPk{@DGlfuRA|bBYIs23tD} z5^cW&@*T?uLwT?d9D@Dniibq2KTJ7UJ~T8OegEVz(eyB-e94H=NYg(onjWUKt{4>> zWBSpe>0!#z^0A?O(?24b9;WPGH!k!9`rNWdLyv`O`VFMtJTATY!IbG0<3p1;uJ-dM zi1oCO(dUZL|flTf3$ph=y}u6 z2t9{h{TkvoGc*fX{TfoRy&hVPTvq&sNV}{OEuHj* zWp9SwGW{CS^l(DJwKnvQrF&Z>-8#|ia6-_vK2%}$G7)>ZX#G_Bmh(4?ga7}KerMT7p-<8GbA2qL-zSp(6K6d6 zRK)MI&=>giaeXf0w_n7s+9~G?G37(XnJ=;H`)6OlX(heqeN8!Y8E?Kpo?3Ju^c}Ls zpKnP&r|6($J3h$q9S(hO?R7YG2-ZdZ4>LD#{~tbp+#u{~IkSZK|DeXphEUIUH-c*4#_({WN%*X=;<9Gp zrm$8)Gn1!J)eyq*LjQZx%lOloh@2FYzcLpp96KBw}QIPu`{o<4xblR zd$kLvhZPUBkxYBF70JJy$<>MWVOjwBJdt$ghcBbNywVH97f^l+R|k{JiZ2w&?~-sw z%kLt|VKtZ*C(XBtHak}Z@T;%k>k5oG`sY9 zr8kDJw|d+Vz74so_(qX>+!DUY>d{Fu^|)E29=DiWow(Jh$8A=R!m`fcJ1qa(Mav&j z{+;2w$v0=iT_WXo5p6z~eq>?S@I7!e?1_CsdAIPrRu1cb^Y0$M4}XmVka3`g{HO=d z|5^H8;rlIpuW%pp?=9N-gXG^Y+}G^=!fvxaAeub`>ilLxo!=~|^NXEyIpJ(emlO6{ zI*(}gXCQWe*k^WsIB52OX#1RyI4%^9pzogyi&kGqx>z`B>0;qr?7aWyv}3MFd-V?w z#-3d|K%~6}iq@Wkpyr7hdtP{m*&h_m{*Yrw=6nwg4>$WT(d>}xZbW#bmHV($?nse( zjSi2pdW{Z`wRB@d8^!cUuhvS`l_LdMA{;b$mEYje zng8nW8tm~6Z;EDz*w=>NGW*)_dhC76-wv;H?2!E5k>2_hB(5wASD^2oEEg>w$obh2 z-i*D$(v2eNHi_1MAoeZct!A$jNna&e`WpSV@ODf0u4w5X^?NV81CEBf&HjG)1ME8Q zka9i@??l#lhaCSd`B}b@`S7Fg9xMN&@LpIKc^~g19!Uy4K z_&w?Ld^f~z_Pj&XKfmyBnE9Fd9})3q|KI#=-lm>Ehkr8vpTkG3oHK0BcksSG>DvutnU$sKbAC%G>zzdH;Ocl)bvN#_LA}@(%bole5avVB+W?&?fVJM zq27Zz3;lN`Eh4QfpR*$^EuU5*`J5A}Sx>eSX_s>&>7>hYwHEDsic^c)MA~y48mHQl zZcb4<$yPp0=~r@IdWin=$d%~%C8ub5@!oR2{|EJ+)Yb3>cn#EhQrAMgKXe_`ds5d!y(e`8)O%7l zLVfq*CaCXTbb|Ws#m&%%{T8VAx^9K~{=#kWi8nh(Zl^xMGM@j3dN1`3sQ01ngo@AZ zf{NF=K)o+@H|bWE-4p3%?cP;vzlQXX^=X+16jZH ziu5skZ_)IS^-14I2KKVzej@1}5N%$Qepq={BonsWkQMP^pHS|OWIN?R{Bt56{56h1 z#u2al?7TwONB&62@(+mk2SqC%PH5~3M`C7=h}ff|#SxHoer_a=J*PM~GQjNpMXMhq z{lG|`r5_}cez0h9hV)y?ABsE(&)D!#WT@GPh&I2%l)dG{Bg0_r4Z|Z3n|*|6^@FUN zM@I5ZKPoaBy~a;SIb$MYk#*dV<9hdrhnQ=hs=J))W|c~`zNP~Ru4$r{%mBHrJF8V zx*1S$-E&ZJ-At&s4m<1f*^yVw|9R2;=Q#c^IQ}m>{x3nT&tHa$yYOe8n;S`3J?4p4 z56F2ch!kNjD=ri{{-kK>rLR{}5-EnwN=hQ7W}h#b9kT9U7+C;M!zE^4B$|D(Q$8~L zG)p6|TKUUFD<7sTE?ORW&C;z9EgfXvWMyO(_OjyFMe6m2X!|D8cdu9-S!4P)MN0?i z7jH%0wsO{rRt`+bsaO};VC%&4$U70Od)7-PJ}DFND>s?<|0Bee$QwlVB`PBuNx!?I zGO`KogPW_G6}haqQlx%WqSXUVxW% zsfiCGyDi;Lk#xI6yKba!Ie%|t53Ek;=Kk}vdRg2c&zJTg~$n4X975UceUq`-i@`2=YKzhpuGTwa`ISBi}L)f3L z_+B(SWWVijiE|)|E8`6(far|a-9)vX#NdE@;%e>Ybf&F zqejstrf=-%o0xuPanopvsP>1NiR=%hMVm);JS{}>Im_{HVg84T&W^S=|CS>D=R{kX ze`^u{a~=QIBI}>@XnX3{&(%hxAGa0pYZtAF8`_Kbofo|jzdo+>Mf@%h@$2B^ccGJC z$LOW_^>tk&;&-u#-zARUrD96s*Ds4+PCeT*|3cemx&l@+PhSZ&e_sU$7F`{^2EWIM zOCaCNzb<+$JOHmpukYoyi|4{S&jZpLbO;F$K?*#S#q?_U5qFbW3k#1ShtwzPE z$SJMx>kKb|x5G=}9UMnP*PYS3kQEP${Ytt-?};iNyj!$52ogVajdn*?{M3!(ol|tL zWb1d3IO)D<5A2GQU`hb?g!`4aJ{#?jp9Amqx5{^CXNG2aZJ9X_lWDB0RU_L73Z z(PjVddo>o1JxF;KiHD*?s7I=6oM`daQ2Z6=4TFmFhNGWZG9o(C`qRUrIML$3M@|1&bb_USTqG`iLL^QeFIu~c0}7ssJ_+;S zL^u?3eQ^ACKbG&GO^!~n{GN8MpD7~kG*#u%j?<<i7I*o_Xh4$8WmH)rlES{p>ju z{)06$I-B|^{+tCBen}4Bb{WxjtBq|JCSX zcmOW3bgxF2!r92nV0yu;(dDF9{}p$xUlCnRySrVliM0Dlk@8kYUx(Y_8!%L~I=afz zuU5N}&s)(q&Hh$&4ZN`Yt>{|vQydRTR~CI69)Rm$dO=zA9e6fe4=*e)i*B&;%SFz6 zg=ps;Qr}I{jc^I9G{4Ovep^KIgM7cBD*CS3w~7-oUE4&nL(*@L?lk+3==<0+TE}&X}t?s z=X@63kN@_>=c285YUJwZ7ua>ZLGt@D`jsO?^7%UY4SIbaPFz)VAo?Bl@+IGj#I*-S zJMWPC9*TZ%`5cP=V19>1{Emp`C;jeqKSh6p=av5y{RMk&+0p3F(VBP#GJhYF-uxl) z!LQLjs89R(zlr!CkN)oXL;O!jZ~l;ao{auYy0K+{iunH}TAT%`=ReU?R?mN;u9*D( z74bVQnjfS+Qet(n?<%S#Vy`V)oK**EeSl1U^a$Xnv6M+cMS$`-(*C z*g59kI@SuVK|a^gwU(W9>7u2Bl-o9To~3UmVs9^+UHaLH3u5O(zW*2NX#O2U{4NyD z4>BHJ6uS(+^n#1Ul!axNi1=M9+WJuXm1UR5uCns35V2n=+B#bL^n$Bn*WtIW>>3gK zwPO2n+6!X8K6VrKuS;$avEL}R--I2~4xM7Ra=bH3ZWgiMBDQ}QJLEWSi*?4XaYEc# zc6+Q#O!3eiBG=!YBJ;*wF~%ACRTq)*hxI?{XD7PG?y-Ej#(G%#ZX)x}y&~zmi=@9V zRx|JP5UE$sSYPwMUnE}YCF0*(#J`W@-`D(?B>KhN=Kp|*e};&Erig!*J^Mdku{El9D5jQJc&4d*onj9u^2o6`=g&! zlq-^+`~T>t77d8yp`TGSI5v>_%_$lrnf4njnxB|n@L+71`9CDuJTk=mhf22V7}Cxo zV#DDQINJOl7R`U8`Hzxp{*e5~#m2w`aIB>p7kdQGM$U)n1><6ml3w!;#P6}#c;uH8 zPsARFMNqQhCrEx1Vv~_qBqqh4G`~r)iEs__Q?LliE`LaVQ)5rVvkRuiroePK1N+Xh zX(IjO8Ikk%tjPJB?wr3FBJsj=u|~w*%Zg@-lt0U4<&SLd89z_@!WDDWAOG(^N_vmy z#aPXA+Al%9&-QZ6W$(AWf~@y@=0d&CGY>9!$KsZ{B{j6?l?usM&nqQkt~xH}jUwcH z$6mFb=l_t`!})L>&vBRHSI4y=wgh=2@^@rT>BVR8~3q)llDkcoXj7IqWr1-$i%} z>ihOzsVvfqMUZz5J48vCT2XXB%VXHhxt|CO+FB(yum}T%FkDoTtrV z`r70cwLkmYmCpE3Q~&3ZzQk6JZ_eWPV%uW;hXlThJQr?{>3!?>Vmpur7ryuZJAZnA z?gP$?zH9d()c5FjLcQ;}3+nvsrrtXW_r&%h>-|bm?=yac-jn<|wvY22#t+*0{{-eG zKaG9P@eE6TCfaoZ?LEEyuuZZ$_9gcG!Y@R#L*4`aD)tTf9?7po(?i}HJrFyHJ}vpJ zXnJVxXMP7eCBKgy#@;!3NHjaN_ri`qy+`;1)O&5oCZ z-}(#Gd!oO>h4hc#pxz@r4)vbr?@;e~o`8DK^AD%rpG4Mso`1qW3jd0oqFx;f{}!!Y zkmEcZ`v>O3e_5?8$9ibL~*_FiZ$sPDwrhI+5H4%BY+}7dkTJeb$c3*UE$T9`40Z-(ct!jw($`5|DO!4H-zU5p{=e_YUmNcf*Zs@uMDAZ+FXDfL$<>J)<2RYyNt{sI z#ri+4=Us1(XOZr3;uewTDsGG43TqYIW-`zJ$8WcES>gn(=j30%@J`w7c~NN3g?52@ zF7$5G-xKd@emwslckvu(xA?u-^&F_E=RmtdjeGY&jeF$Nrk1N`{C?zFw2P?k%J(vT z?|2{N?fhp0;@3Cc4_W^&gvbxXGm!PYbcmd(`q_8>#4EX8+)&@=&c@Djfbksj^TfUA zCt?>L)c8vMd%OJc0J8QKpv410WPO)81ogeRFkC~r2%HY1_$gkNmj39T*?v*hSTEFw}E2c~H;EJP6ee4?&eX1nRk(p-{&?%&FIKr`!?naN^ zf2ZG%7wK;k;*;_FB=Mw(-$awE6Hmn_nLJsv`{md4q|^X{u2J`Kcdd_ z%kXmKSD^aET-s0Z-8`o~6X*vNB;y4z4;I3qu*mA|O+Y(u#ZdR-N}%q?&4;=lR|>Um zTmUuiFNB)+7eU>RTTH#U?;l@c^;;TWhF<+p)IQ&e&5^hcKX#isOPfY!LIn1{V3wX z@_1QX@nv~@gQKs2>gUMlH^w(3tKBw1#lw;-5?kVxPWwah*&44h|E=+Dl%xI*iQnFh zZ%0-;LGs%Xf6tL2`Me+h0KL}N;_SrE_=o1VGrkKywTC#mWOsZI`s>M8TvfC;{tib;#;p${{{DAe>uj60XdH+%} z{q-x6{`$4a)roJM{(3;P?{$4k`nAb}@$d1^FZ@o#pZovl^&jy=P~TZQ%yE`d?h&ZC zi@3?&qx+HZUGdIOP;t&t>^lm7jvqr-d?PBp`2{LI`V}g!{SBTfJRUzmxpk7ii&ieQ zxaJRdr0`_?6!yIZf5!iE?2!5PZ|Th+GT;9bKaIX~@?X*Pka)qBTPs)bLW*d5XmL($ z*d%;tHgWNMd{%^M@7}HIkk7Y7F(hcN3`i zs43L%3#|2xg$zkI*^tX#!?EppG!by?g8Q{9~Bmat9ooZNFMFTb#rXyrkB zf3h{ycR|vjpM2XueP5<6)cg1CpyuiJQ1kS8Q1R&buwn9o+zZJ!E!jb|e4)+L9iigX zi=fsc7gH~NU*i(wyyT_1ikF8aFB2^tWPZLP_d1SaPvT0EarP<^`_(2_C$7o8*5vC% zo7b_E?)qFm=?*7u5SiC+%DoZRD!9qy>O`m9n=PGRw0Rvr#*JHLpU{hbTEot{x0{~* zfAsZScUZplslWX7KFD2A^L`hz-<^98<;o73_q*nH!>)N>)VzN$)V$vvYThRw#^)Zn z8OV91y>fe!PYc)mCiDEictssozuexripTm$=KAX^(hmJh=Kp`WTzAMBBKc+JW|5!f z3yAE_^&q!c&-@QH59GjmkkMoJI>+r3ZTu8_VGqD>S?2{gE{%I3WaSgKbdlVsBa3&S zkKw2BGtP0`@5;?39)(dZM04e@s}r+wXIr}GMT=|xKdRn4 z&WY;#|6i6Wf(VExE+|C=5o{EibC%J5WoCKNbJqR}(dNt3 zQ1b*Cd-kl-&CgN3=IKf(yS@tg)6W;Jh9S5HM&Vk!KH`7t#|uU4NSD7Ls^2e?K0NQG zqV-<7I4}Kj(T1X&9|6tZc?HVfc@@gvc@4^rzYgW^Y=rW6-hlFV-h_HS-m-pU|Gjy; z3F^7p4CO~`f$}3xoh^I6t!QhJ?Dw{!?VkR-o<1_^?-lLv%DwNElg$7B6z%fH1)j8r zarwaXKP=j9`F#Hmd9(9T(Z}>l{f5-{Ns;^m$*|7Hl*^(&&i$epDy2*TYqbcHh*i8 zUYV)wt8aRBL>rH~P~(BjeL6@`RU@c*bv)d~{b>y4 ze>Z`ek4>pp<9q_tI5&fuS0_TvtL9LC;7RDuOP}m(;mgfy$n(U0GwDa^%hw|&%lfKG5!`Ioyvy-obPxW?` z%y^zDGM=4G=KKHNcy<=?BfI!$kMTTPL@(zj%AYvbm-7?PgYpy4r@bwiuD%P9q_LFJ|o@heItE2zYv-~b_25f zu~EoJGdKFiP`;KsTD0;I|L!K=Eu=SbZx$^b{`db5_+7X8im88xbGwNBDH751naub9 zeF2k;Mf2Clr(DoCj&l2*kjV2L_Lac=blBvq6Y)i@+&IzvHR;#O#FcORFwp$51e8Bk zX6Z>^%Jg{u&nJJZ+*d)q{4r7f*jOlktP;u}qaL2$JAHQ{Yo7rk->r6RKSO+$?*reX ze4dB#)UW65Ua05oKJ;tkP4L}s%v1&>*y4y z`X3hQ$5gMKN4$2XS^batrjxII7O^Zd!}l0W!P)kl&GbEP&)E}_dCr~`xgRr4&N{Qa z=WMpfeVgN}vis(U=%r2O{ePcpa+PT7G5OrDxxR&Vzvlbq+5MVta@MK#EinCsqOHg1 zF^*697J1hLkr(@(wtg=6EwO$sl}taEiL}4m*v!V<)+Vh2EEG6v%WQ^_nc_s zxYDklc%S}la8@hb)>q~0zCEw@8P~N?>*@*_kFb@fH4b@(Nyb$C70`uZ}|`nmyX zU4F&8AFq1%<29&t_I0Rrb|cg}`v&^+(r^0S^43|%{Mh7s+pd3;Z!`ItAEH0K)wczP z;5#r1|7ZPG{O^0$Cp*2}_dfM&-n|Dk?~qB~;oF6*e(Z$mhvW^;2fh!zae(OU_I+gO zy#I&1+4$06g?W4V8 z*nj$pavA)ZsJolpG) zwg3C`f9sZ$XXjOie0jCgxpwTi{!Q(2zkY|>H#*F9@8>%IK(2i8i0@Bd9_LwqYF>>W zhF$rKeh9wVL@0aNoc6b5PV%3OEc+;GTw6em`zcW4T>$&Jr}|sMO4te( z!q)W9=bk27yU^@q8+aho)_(^1JJap_r+fJjd)Hp+rVlx9=;-eNCok&gzre1)v;R!H z{!ae0?fTCW(eG?>*6HG1|Jfqv4d?jJ_3DG1H=O4`-;*Kd4P8~QwFj}Q7y1iHZ=dNV zS~@hldl5XE>F)1Iel53$X!+32ae6_W zI^P)pTe<`NgQ>qVGf1@hq1oFZ&|0`NP?rv zxem1PmY&W5-iNv`JD~3SPUug6=-&lH@B;KH3iw~jsL!U$WLtjAoLwlh7p)aBQhrLk#)IKPG>MJOJ>T9TToo}Gdb-sl< z*Vzvb^8LaCa3t-1=gph%y?OHkls|J2%AffW%CGtf>bcCF(;V{u;+NlY$p0JZn&-bl z&3k0hfA{}^ta=VZ)gyU>bHx9rH=YprFaJ^Wb>1RwcK-JNL%(!gkb3_0=LK>yM6MCY z59Im-k!uEOk+1s!@tbM~>LBaBK>Vh9fx4zwFCf23>9EnMft){~|4BJEko!NH22lP) zL#Y3uISvkljiCNt<#?$7+i48-KPye3{$Hgj{i&wh2~d7UGtyVNCk6@v@-tclng`@( zoFtifeX_{BZeeoPIfb4`E)elES_X1{Mk|r@oSz{-;j}=`&u9(hU$mjUEt$4~cF6K8 zMEMn`lRnaIA2=hBvt!Wwiw^K`remNJ{b-*#Q?&Y_`4eZsLbr3^Z1Q`#T|~==_!;K} zx{|&#eQw}9FCF4%oUe4#gV>V`0^LZDxfhC-4$bZt!lRjs0zJsD<#rb>AKH5*J)yq0 z-wWz{`@NyQx8DcqJfttw_x3M_`rdv&sPFCfhx*?BC9t16C@=t4!hx_54xv4tJ6N># zpnZRTDAf1&hrtH!@W5s0HE}N$O%IwscR959AIg4S3HAN<5imr5u7Y>Kt6@v`n!t6` zQ<=F|w0a=@x;}6N=|kO-qNT%}eT5V0|BX=o;%M%h_65eM9QED=b$-Kqub3uf*X}gZ%QDjgkDC7Uz)X9- zp9nl=&-V<;Jl~ItjQ0~Jv;QB+J>N4$?#rw|#_r2(5xqGkXB{VyHaR1jeI%dz;RdSh ze#{M2+5MPna@Ls_m~Z;kqS<#H8lIWhIT76&j;SL zcGrqF?l0K*u|JRg2Is}VOY~p%6;l6(zxbHVpLz5a)O>my`qNtin_viThEe#AjnfSd96uy)YhWAcI-h{!2j{&T z*zU>VB<#$4Q2P|`L;Y@O2b6u@31y#mLD}aIpzPR(Q1*E@lzsjP%07P#HLpK`^U|LN zvVol4hc?eYgInqM=TOhV7f|+e50pLq63Q;;?D1EDeP-vr3VcJlo|CVk${}MXzYQEf zR{8x<i+fg(sP{t8fnUILq2kN)px*a9 zA1XfX3Kbt;!1c*~U5KprJ-flfnZn}k)ZadHk!bZp_9c22_kfcZ^(-E2_o;7jFS}2@ zi~FJ9H`7N%zpu%>|L@(Wej@u4{fjU0>Vxb{3@9Gx$&h`CL8{lBcncf`Z-t8MZ-ea^ z@7tmLlp?rtfv-45eQOu^ivwPLkbQ>Y;-Du(_8CIOC7uk~X9yQZJQ=dj5LG?aA839^ z9RAx#mh}zA)5a|KI8Fp@oH;l zW$`oC&a;wf=Q)w`D^2GA|Gaiqij*|AMf z_INXtJ>CLkkKch!X>Y4{f3`v0?{}f>*mfxU^&XVneINaK=^e#8i*t4x@?Du-#UGHa z@5(@aZ~kHNZci5d=}(G3f+6@ZjKWWCT#5hDKOQ@ih5DWhcD?-y`tx~l?*EU!fcjtL zJy8FP{G~|#UbxxaSNt{OyUqPd8Jh&`5UPJMgA7Oo$mhPAMJkrP<+7J{Z2CX z^LvqUKbV|#4tn?VN74S@_$SKi|BZi!gR6M|59!W6`|1Pc>wDbSqKi0p0CDXsWAf$gaM4kT!=@)WM z5qn)Ln6uZlMZ11z`|EXsIeT3X%3dD>Wv}Z)tz*XqWv?3q8zReIi?Y|pkv`IG6g)nd zv)9nVF%~2SM5I!BF;l2$cOE3T3~C!IcY!2d}06wF@o{Ugp&g zv6q(zukd7uy}U9w!jmEP@~Ys~o(!><*Qg%rAH=`8K6o9Ryy*Ji?KZD(42}%S54|Bc z2K~O7Q6l;`nw)h;d-HmXh<|fa@Mf<*h<|fS@K#TT_&2wyUTY7UeJ+AJm-0dR1%4>M zAOPi`@?2nlgTWZ{dxsMeu?Hn0^@L64{682qIVPIjCZBTg-~`I;cS=Rv)j<@b|sYEzQfY*4BlmW#Q#Cr?Yo2H$d}y~Ww-BvvfJaK z?6&HW-M$a~{Ji^BzwPgeKIZ*I_#}J)D$aTk)<>QMOWu5!73Za zbkMPJOq-1T54tvvRbtNmQxEn(I2U67gNtlFEey`L`BW{L`LsafJ}xvF`|r)CMWXC~ za0PnUe-XW?`Jt+UcR|go51{;p525^q-B5nRN9fN>e;oWInDZMT^DZ0w)W#_r{EU3fJJFxs6Z{;8 z;1@6o|NrkN>_CLftL#`>}|I`ZA zA$^-$TO^(MKa}%->O%QH^+Gv6<`^hHraqJ(b1ak}(*VkkX$a-V94FGhMqYW=&4Mlb zo~m&u_x?c>D1W9Y)c(W?=v5;(gYsuiBz=|JJk-*z=akS%A+7r-OXhl7i1hOmle12N zcRejd{FzoE+T(dSRkZ7Y_MS)UQ0_gCHle&@?!ZpBg|o2d?LxVA=X9w56K)^U?_06| zuqW5i0S<>9$-e-e8Op2I9d?2}AoZIc&^aV~i2dg}#<^#Q&I#rGAIN*C=c+&ECy6?j zI3IoeZlo)ee|3S%BVPz*Z@N)#OQtY%5wiR%QT|nT(nq>ILOs3uq4`(6;L%L)P+!KW zmfJ_P>xbrFT?`Lr`h_kbzkQ~^X!#I7VL)gQ>Al>6qNPLptHGh+r0+}*2@UnqA^z1c zrJEi!|LRiM(!DHn1^Jbk%SFqFHa=HE`8gw?{G6-kzx=4Hk+t7(4dnbkbUo!c{}-)1 z#IG3{8b$h0_Xg3@q4_a4Lit~#q5PRKQ2xwKP=46WP=3uVP=3v=P=3vAP=3wrP<~Aj zlwae6RSNc^C{u=ttj7NTeSnCTE?nHxDBs{zo(v^ZE(#KjNWM zPlos(3Ds-Y0lB{NP!d+c6fA^e(et?#qUk~AS7qpa($_AyBXp;i4)M3{3f=9=5Pxf2 z=pIjo_*>&c_j)qK-?~rrSiR8vo(WL@lR6Q~AASJJ|9ue3|D6Qo|4xQ3nBO~`Cq?Y-OcDKA zCTE@5p*bcyqWM?k<6osi&r)u`lM(T+s(3|1{#BL9S!Zr&o|Su6H2+Ha^)l7UH~$Kn zf3*4z&$-i0>T1vkBD^dQ{GARFQIh22;dgNa{jedUKGpgVG7;!t} z`W*ZXt|Y%k-s;dQ(_0-{LwYCH6H)g1d8qT*wNUo;1t@#Dj(*9mzDU1huU>+(U;p`6 zFQX^FX#

^$L`q^(vH~^%~Uv%Ii?|Z-nx@-hk@gn_hiydG)_ddRb<3XcJ7q?e;uu z3vIFI;T_354_ig<(>9Z{&b!|8uwCSSz8Cty?&td=dOJ+!|Nla}O#VPL|A~C=E<^0)qk@~8fS@~4hM z&5ysK=Epx!^Xp&Q)xJnxiTt6OB{g6O=EEqgRbug!18u(5hPwZC;KWt@{vXOetXGno zZ^t0ZudH8^n{UTL&A$dveo{jyKj}Cqf2|Sv^U}wcG%m^cYjAx1ye1`0N!LCPWS{4R zl4hO^c^;aVoCxzF{+c}xxpSHpB`252e`--uK>eEUr$DujOnS?bQ<2q=R#5$ryumrG zq&4m6oD3qjDQSzo{55g2)2`%n+ShnP>S0-%LjA6_ zo2OTZ{4(-IaIM?Dq-TldXAhBi%=iCD*LhAasP{R0!&BHd?F025MqjA+FfN9A52GK{ zdl>y;23`X7KE?p3^PquH=SPE}{IkJOzk?kDhr*#yzlR+LpMb+*U3e*M2rq+;;pOyS z{@fMFZIG{otK1PK*O$moy|&~kn}1hJ=DEB^JEnn%gtAf(E`e410_>m=WBjX;XKk_RhUccn$$^OMka(-SM%Fio>^79f< z|GQcS`?<-Ia@rf}rbKHGn!i^89og2i#pU&XXa2 zz&$17JsIK$+*@*=Cqw*z`&Ey%2hC5M2&)!6Sn>dzyy(G_8Fs&>luWYwHMwLe<@#nG z5-B&uWWN97-LI)4{?8*N)4X~i{?DT&(>)pD|2(F8tzC$}^LWXVr1x^45G@_zSIjJN zNZ*;BRWjR4hxng!lx}*^{LeHDxtWqG@?)+mT0XSjGtY(n-0G5fuoBLPg>WJIK6im= z`q199)HmQ${lyG*ol(EOzpP~QuA8p>~a2I{=&S*ZW1 zeGck>!dJp)sBcwC&JSLVtoO**K>a`I^HBcQT6jG5y#QPA{H=rfKie0f{?GO$sQ-gq z5B2}9FT+&xa)O$alLH+*xb66jK z0ToZ}fd$B4LcKS%7oLUwKB({Wd<9#&UzdDKKd}Fz^#j`P%=bgRzjOdeW(0z?tdX`!hi6W zYC-+~WNoPbldKcYy&qK<`B-Gi;a?vUZbbSHr@n|^eyqs&G%z{qGz=eSawF0Fa`Gv6 ze7Gm&_B)M5{PL#ZCNMwU)MUQ@8*XOhdWzy!}6OtNoE~9OJp26o6P(F;hfz%Tco~o!sk+-eqRic z&kLWAtoLn2#R*;QdM^lHh%7%2qSq~4h^+HZhn@1Ce{!c*x(?^~ZSLdvU$; zi+V%(MSZ;b`obXj7h5}*g!@_fOTztO?Yv9E1IaI_9w6F#LXsy{4GIrMmYp2Tb?25+a{;ZWaYxzy^vEIb1Ft?J7~zWaQI$akEt^u}d`jZ2NZtHW1WKdug6 zgZ^yl5g&s8#WB|*>-w&Ty6%xs|37sDR6H{ZDxSF!DxMh)^}G8qP~&!!)qivN7G%{U zs=v2F`3bi{-Iv>;;-n&|`{IN8zKWmzYdix`<5^64sJbK^w0RK(UuC%5>Z_1UePc!Ht2CMS z|GoO|6nQT13g3&~Zs%?hy>TXIoqNLLO})TGeyeHGMV__D>uh0=Y-R=tNRFfE;3;kS@#jLj?4>J zS^B*2Tv!{qn*4(5`J&Bth~87-1*Z2@c%kV%6<&;9m+D2Ly%z_me@S>L>6%{rip&M$)xD zya7}5-VDD*J^Ic!Bwl+vyoq$hYogYt&G5>3Tf$qdKktb49dT%J={Bgi^j)ZZ{_Rk4 z?|V@3@%vD5?+&QAcPCWby9+7~`v5BL{g8U~{OyK%{yu_=?>>f#?>>QwGe1S&pZ+|Y zg(3JEjKVK$9%28vj)r-A!e5fE>wwskz2SYxvM1uCs;|P|lCJgcYwq8Ss&6FQ^8jtV z+Yj~L;sL02PM$Dg3C`)Bf-=KT^rgsk@@#Q^!gLXFRF za9;ZN@ZoSSUWPTsR~-re0r$c`>E8tU2e~hQg^!Z1>w#R~-{F5eS)4Za-*A3J>u+8J zvi{bH!7}^YU9mwcp0mBcJ=;F46&c zYSkH$(;0^uRqZ8n-_H=Khy8z8knR}iZ2D)4HcvX4{#lZ3o_`{57@lwX=ZL0% zuIZmA+4Ldx7e>0mz3>7nR~WevPDkzr3(|#=izu(}yowu~?vWm(YyU#5T-`I$n|AbE z_JX=U$m~b-iS$L*I70e!afJN`dtS5;5hNb(AIZh{mq6`141n547zhWlz72w-DLba%Dtz>hj3&i2R{TC9_^%CUSk3o1As7@aEN(BKsF3BKVW6k5`E{ z4$$I;Ya+Qg`C6#>_&VC#lDR%I5?TJesPm5-pyJ_CQ1S4M@Ni~y zn_;1QOXN24d%3rYmJf+9Z;u2>-U!=9a`L30*_|G zktq4K+=yuT(ERflEMz?6upQ%93bikgfc@N5qzqQVBrJp#)Z=r@MXLuAmyC_vL3(AT zQnYkPTybaQu1GGffEMT64HbWlBVFe!_aHZL$4Bm?d=vLx(aJ;GzdtgO^r7wq(bA#q zQ*d9fL+t-EkK|uX()^;{$x!~%Lr{L$6ezp)F#XYUI2GzSd<5=rrbQm7{@u=_BK1!< z8T%iZVe;dm`6cAzcRUf9gZ@EhX5>kjpPp$lzyFWSHvKuG`5oxdemde<`{~Ghn~!rN z8Jmx;WaeX)NV{`Q=KX(fKF+swEd&ua?|H5 zMXxfmEb^@BEf;M(R(Ruq%=7k)(#_5*{|3Hy_8gQwSP46_&$^2I`gyA(Yml{`L$f2# zBg=lTg|ZJXK-tZ8P!QWbNy|2L0(bBCo>` z+z6xaO}l>LfAkyXy%l+zboB??ecc3gUpGUot6QMf(|4fk@K*HarME@ijpW&P3?b{n zcC#N*`hoo@7{+??KI_L<>~rjZ`Y!TLcsc32sHd9w%Dl66=tI)Auecj(efkKh{Krt` zKY=R$DOC9^{DL_CGdPNJpTo)U3#fh2Jy83gUqbDJ?uFV1-3PS~`W4hZ=+{vDvfsd~ zsP|i_?=SC%Yuy8p@9n;SC))D@ZQt_;sD00aaFzRGq`!OPa2RU6)%vJ?nj<`yIxqgydp`eyS|^V}?Q8sv{+7%?k$;i3UW!^T z^P;)+vIf+8nGgH9wWBp*C9DMtVcn?KojRgj7qs=W9$dNLm}pb-*Dk0ZJ=V*I>^C-u zHuPl3e&cb`MxG4WZ#+KQ*pngqjZIXK)el*>Pl%pKdizW>(b6I7a`WgZr0-0h6g}BX zhpfvjlx}*^*53knG}AJAD*3hCR-)y@IxV?>r$O!CwT3#^Yy-7_(-!J{vmNY6`sq;L zZEg?s-R3i(_HQ~s?ca5T7vt}p8O^P$osiF?+*z<2>BhJ2aG{_o|{E4=z4`@dI4M|d)1|Mx1@Ywbhq z>ow8qNRPSKik1%R3}T$FhuZ%e3EOdURbL%-|U+%u>B<9Z! z=YA3UJVE68CYqde9*90@@+8sr^T?;%+M$Q2S{a%H`*|(JExcTkQE}UR7+TBk|7lNlZ2@|`{})|C`digc ziNsHfMB<~x-uzx7*4W7Y!cx;;9$jYjFOROE+&b!m9v*Gi!FMn!nG%tT2@(ZNP&;M_K>_ueN^AeOlwjRnKdl||f z+W_USy#h53uR_)Tn)Ubf=q7uv-->Ru=lTuFJlAiE%!9W~&N^><*S$%!{%rQfYm3$M zPIN2vsvlxm=H2Kvn1Z{k{vFZnR{wjFssDYE`gfSj`M+2HE~|fs^Fj0z^maQRismc5zoej=@rJEn8eBJ-=p!~D%q2|#KL#f7-v8PZ#n1N%K>4-=RD;)+(lW_taQx zufEfu+Ce70O{^WV+H32zBYA^!daOP5X+I7Ue|LzTVfr0n9cfq34J2MaGu8=N;{vJg ztXOAHhU5F@b%~vgynb$1aeSY=b7JRuGUPs;7dzjR;rL#8U1Jwg&&n#^|AW)1SMpw` zTkInGrST|)>OV5=caQZ(R{wi=`8}b=tCy#z{0&Z@SYPzDPav+Wx;WO4c6A+)e)o_4 z&wc><17ZW|kFFoucP<7&&F{fb_j?G`yc`NOFNZ;h;6do8{r}<-{Vz)~ z>H0sGAXGdOf+}AE^?xm4sJJ8o6_-Sz>We|u7l(=~N}=M3gjatVl%Jm@eU+Pv-5Im} z|5&-r^9sqVn`1?uqe_$6|M#A&J4ND>yJB1q>)72Qdbzkk@xeW@T--1o>ivUzX>X)^ zU+n%^&ToX~mrNjiOJ-v10c6DwqT+`Kq4rxQLB$V~VWIm_>|y%V%bg-xd(h&Asc_|j zM`E+cU%Oyh>`^Zt5-&`TJ?6=fcwt8DaZiTC3s1zJ^khi9FjMtd{Sbe7cFZBYGBZcC zbcp|#j=7`{bu*%+LyHfp;DOBC*aGr*rsu`xd-;%fqFU*u56y312<5jw1qa}FE`oOc z5A{9sB~btWvJ@(QSO&KsFNZqsUjY?2Jk9uO|K%Cve(uWHv#=6A2Mgh9+V{DuL~9?` zIT5?E2I`#ud1&YVa0&f*0qQ(|9aQ}CBGh^GOHl6oxc}`L9Fyts9~I);Hkc%$u>d=~w&ATcY&~njgCfHgGq`-XXtAbk)tWzVNA6GpEqWR_0ua~K%eDlYl`Qvq<{PDV$UN3%(>0$rl^2h7Pk0oFJ zxF~NiN$BFWbTGCJ1$yUhMP~WNO)yQidKh5-8$J>yu|LqXz)u=jERdH9lRT%3T2Ew_gZ#{oSDYS7_~C6z`6#@}m6u9#DRNPpEP2 z1vRd{q2ho(P~+Oy8<&f{>*)t~IQ`>;nHRgAOGM_y0F$%M!1y4O2aD!slh3>w62Hvm z)v)+bn4cbIa@H9hztr?E6V1;?kM^&KUk+37+PLi5)$uFivd<$VvmRU}((ctJ^Z$SG zoS%5D$o;)8KHAESieGQ#MoOmK4I<@6nVfZQ^vaF)%8iNNM7tVSNIf^lZ$;Ml+yXT| z$fVyEza3fQ1Cfj3K4gtMWZo3V{gz%F55U^UA@U2VgQDGUh+ZUKVtSEy*z_WC{l86@ z>ZoYvvAO@biN{MBANg01a>;nY$|d7vRxTMYxB63})eq6Dj8~XmWqhpZRmSf`uS@kE zqSY^1{@7hm{@UG8e%d%F|Lh*9`8XbGKHUrTyxeE?Pl(@d^-qXTBwh1f^rt7qAAlkF zAdJGvb|0|+$a=mWvhokdr&#%i<5Nl3^Cij;d<4o5oCf6wJ__XrPKWXXAA|A(XF&Ov zkHa%L4}Aj8OFtQ(8PCNp(EPwzr0cnzjV%9g4wS#>Kt1ba_db0B^p z{`LI$ytw?|`SAswezjK~ne>J6MaZi6DX4ZNZ*UgJmw5LNQqQvZQqx}+UrzlRUxMx}Jwejbz{Mz^nUb>i? zw=Vu7>H7a1$auUIf7$e~|4{$yDS5iHA^r;a-O&>#RlOR2jr2aqkn4Fpz7bjRfw1~d0@zNpX-iiND9C7R!dA$D@&pTG<4e!F!^0vpZ zYYq9|4)eEfAC5^`7)+aIO1!d=KkIW#$W!^#c1(y4wE|s@=U%?e2qW_baG&zlN*aZ{k1L z`tx1nuLtG#9|Ie>^-CL+%Ktl7v~h(N zKQx2~GRKuRA%ADOQR(qsKE%&%taQ_d_=_i$HieTHoltsOsqDi^rOirZA5JW7fqvgi za}oWMOwKwdm*(t43lV?ul+psPK8U~Avb2>aL;S^4Rj;)N@wZ!-wk5rn+eWl>Xz@Wi z*wQ_{^bGPVGwnsohxXoZ2iVW;RN4_%!ZTqZ?2Nw8JxerwXy-Itpnms%Hf#safqC5b zbD_=^&VxEvAKnYj zrk>tVaYG+C0RO)))O)iRL%oOF59)lNKP-ZmD4+9<0Z{S4K&W_NP-$M>N2qTwvi7lu zz?BPzmR?PN)-D)UI^63IB(A%(^fFI|#C4aKUg61*xbDi*5uOZ*>#kBgc0JJIq-&^O z`{LI^`SsU9`SsUB`Sl~A{Q4W9{Q6N)e*KM5e*I`DzkUpqUw;#nUw<<^oVlg+Hrj2U zxmC1wA#w2SrA4%_^Am{w?<)GVlMDjyL&U(c%U2wf|o_pK|-1`$gh~iKP=@etM$G?EjZOXyxXM z7B5J@US_iLEna{YFHC`o7aq3ssilvY9`?Uf@xrvyN6A;bASzy%4izsv1{E(*5B}HV zr5WT<^~};IsHa)plP0g9J5ywRa7t&{`Y>BE>%$z8>vT-cI%#ix$cPp0Ij7 z`+AUe=BfYY=ZR}Mm#c;!!Ua(KuM45RzyB21A%9{Klz*{UdUHoPOQ6avg`dM^)XR4O zOP5>yD@vax{a4Z<>Ccp|LVm0IS&@Cw=S22JS9<+jC8D>cbhVXVQ%by0V?X8piyPK@ z?Yscx@2`XM?_Y$97hZyj2i9BpmrFMw%a8q!uORFCUxj*)<29)FWMB8LZ=-j8Z@~S| zo26T9KD=G}md%H^P0l)-N;lhhZxPMUN00G*r*s$fg{t2z-D>x3o5}0vzAJLyc9d?n z`}Uq>?%Vq!_icyC?Eib?u*>dSsCswl2UgFArJqsn`nkJB>iM+vBdh0Q$<*_SNIjpL zoOQBZJ)c=UWtlHZKc{>Oer@IVmF}_fUrMI@UXk+qOwKxAdF8(rd7i#0{T{vD&bK0Z z`%TU|2TH#)`FqjgBk~!CA4(5dJ3p5mw03@!Ogle`l>gae{{P2o=a5LbUrT?ZpSnK~ zdHS5+DOZ^}Tzb^X{UO@@K4RB{z2`ph{a>Y9JfVEe+rOdw|9_z7@4ryOGls{h|%AY?L%Fk^8<S z^5>6(^5+{t#UaN-#V3uS;*lnaoL}7(>bW`r%HM7VZT}x?-?usXdfrZgdSB*bsOxC~ zb#8GA)ccbKQ18dIgz{foK|PnJLcM=^8rLg-v^Da)belxmL@us?<2&ZHOPo%+-gAMx zhtocBh9^VbgXxgy=*i-=xo0Li)4y4BJBd8UXC)Y6?r&$2^N%ixb1naDk^FPK{BuQ~ z^YatuC3K(9Pjsa|J?D`03lkSu`h|&Zq-*_vyf0dqxCmM2D{#EtFU`dum@ z3#o5NVyGuW>KT?8PP*a;aj|o0;xh6z{*d_L^28O$OQ;Xh&WOa7rZ*ySm6s0DyE<_V zvf72zb8X^(;)(VP@n^43HNZiP{ZgWS8jQb4^wC{V3hWftO82YF0cijZ_ z{fe7O-|60x*fU$}NKxWeo7cBV=J~u`q@E&^vyRWZUwdYAzX~3vUjgc=rXK8V!2{GE zOyuH@5LCQT0#~`=L?WU3eul|Hsuz>PqlrN&*B-HOIQ?NfQ zhl+D5p!zWu4kf)3K8Ab;R6KMiRJ?E(oJsoKP;taKsP~@kfr>xIL&Y8ULd6~TLA~#E zKWqgjK*bpop??4Q092guAnXk%LA_5k87dBWh;h-m#S~=4DGx(^|9dLb`&W;6<2DU> zD)OW7RyZ9_hmS$MhdKks;N!3iJ^>Y%JqZ<$&4l;DS#Yg8JHdU>{=aDVAKLFi(+T|^ zbWtJ$?^v@a;WDpgBUdH#d(cIRxyZrHqQpEnscL>=A^n?LwJ1@|eVS3VKr;0$vh>+i zPpN+N7K!$IQ|_1jUTjGs7Z)srdLL^U^=!#3Ppm*z{3Pn!shG%`{!UK zTnR(&s>B-FkGZQwyB=uq*Yi;E*IKCf>jiiqvo7&6`a9DvCSLONA@S9ErCWJu@!tkm z=)RJ8jr?BjtD@yY{M^?QZ;)Qg-6&c*)c$|sZPMBQ7cCuHoU{q{b2lg6A%Cd5MYMcq zal=-qxM3SqT=OohTJTg+~W_F6yv&-bH^MUt#d?*s< z?M{5;wF8OsK2Ch%$&fhjQ`KwzfEK5GmdM2|pF^F$d_lV6iak(q#g|ZV#a^hmVjomo z@fB2D@ikOj@eNd5@hwzbu^%d~H~@vrdHiJ!W&L z_vKE4`rYiwP;qVxcn3TM>V2vL*pvL0Q0H^4pyIJpVV3$%gYD334fUQ^8>ru1w=Glr z*RJgJvRwQJ>x>}1JuFA>45;_JIzYwG9pM0YCR7~V366nhmE}!rjveZZtaz>qEP-dk z7(54RKj2)b{ebhJ&J)jv1F63&d5@tY0-BTr8Me->( zq%1_a{mxL4cyV~yFqoenZZhxxm0f1#LZZcs(yy1fLirXiLW>tiK*ft!S^Cvw*O(sm zzfAGswPn|luXs^Zym&oSyf_jnUZfuUr%`3MBZsQTl-)=@&GJT@yngN&5j%Wq*-d5g zUvHMoI&+K2b>3=n*14^WCj&MtK#f1gcm7<*wK)bJ7Eg$<&z3SiHP`{HL2Nf6I1ND2x@lf&Ny-;!F zeNb`W{ZQ9C0V=MX2o)zjK>u`I4?mnB6C%G- z_A0XG1!P`rEPKt;H!@++uwtFNKr+;5=b+;5@cp#4yB?g6Mc_dBRK_j}lWKIi{X@$NyWc=t!Bc=so$ zb>e5J`1}`Gk9H41#jU?Gev0dULmppsxa@bh7yiL@==Xlm;@=}MQ1xfoU!>nfI;?R& z^&Ewh;osC#KkuKie~}f>LW_Izl6f^wCcg&M`C5K57hl(edcJExJ>RvV;>9{p@nT)5 z=e!=&bAJrw=cVf>k4@&{XE^@2yavgJq}%&{$PM$3OEyAQ`{I@Jj!!m8>V7vC?RTPZ ze3QJU$rHSCuz7Y~vm|kCjXks@j$)jelfJ<@DapKMew{4Z__d%M|Nomj1@iyD$pXm# z|0c0>_Wl|@=V&%Jb;w%lswCmA>-3I*~Rp*|5nf0$#akuA4A6R+~j%4de2Xs?wp_OYU$X2 zjcvM;i(qnDT88|r%cczWbhU%%wV zrr$4l3H=UK^%rd(NgiJ{FgXD3g@Z|-P&G)Te&T=9CshqeUP}7Zs^Q6@Nv)s5B=g)2 z7fnwrNMDv5VfvSgw%%T0`d3P}=M-}NS0}H6i{bUAe~oDR*P8xyl1(3?H!^tx`PvtP zw0Bc-6x<7MwEUZrqv3SqF|Z(gQ&Rf~n!nKE!&{Py4}Hm7;T>yy$=hgmHuCLB#fQFR z5ppo&(>(fr@t)#^Kr$ES6+^{wL8$mH1m(|`(623-a593d_)paNSrjUMi$TS2aoEo- zO_p(eL*0aE*9R?LOTv(wN>-2`bIV1`hm^Y`ITlvJN>~W*LeJ;kDViQ6p13>tAn9ut zj7#3*r9;NNOw-sp+244K#S+nQ1M&_DvooZ;lw3wX`eqi3^ka$1S!b!%BjjZwaq9Bq3a_7#IQ8k|GoB2I zQ=e76b{&xWw=%h!^j_{N(b6ID{hH)D(s!nxPpc}28x(Bin)pyDRxxxI(BF`4@g%o~iW_a2)0y>Ib6=>4mnkLtPG zl-%sCi_q4=El_sw9Vk1v70Ui?gR+0`LfOCVPpR?zavoN_b1f&{RK6C zN1@vL8)_W?fx0jMQopV%FO|El8c^4h4|P2?p~kTm)Hv2oX&mdM>ZWq`9WsvfQ}tj7 z9s{HBf5wrxutBN`<##v@Mf~35MCMx~le5n8sm3NZ5iOo1pK?u8?I^e3IYGpaKQYw| z=BH0IIqNh}on+vzh0(=@-3c(7EcyH#gi>9y;bT|(I4-}o#mD5?3L>RcQ|LK zy4rZ0BQhT6nw)jcOPz0WSJC1C@)?HuX|H+{}f^eQvMQdgMXaM8x&Qg1wvnOB!9-TWx!Ykjy9Y95b(nzvU$&D*P? z=Iu35^Y&V(`*9uAe7_!QzK^6{-Jctv?$0Qw`FtbPd>#!opU0p-FMU($W^W!t=J9Q* zTVM#@3Zw9U=5fI&+AB)s_S=2%7Gyv5RkKb8p!T_oNnh&*Qzdr&A(3&y{*%uBe~R^# z`w&k>Y&@fq8PAxAUfg8%|22-t_Wca=OUhF6OU9;>@P;*GQz`m48@W6szhrEx0y&r& ztMdQ(CHCFHJ5sst50Y+n@2*tNPq`b)PZJeB>H*02|57t-o=izivg?|hnridpA(88tVlvEh&_BHHO(6zh&_BX zHQkdT_V6*)YvTva|9Ko9$UKpnP5#dGlc||rKE(dbQo89w{G2(d1*ETC;H1)CI>gV( zq+Cyi_&HUnxtwL>TVV-9pVqZliEgl6L+g<>CpU>ci}ZWN86$NllP$f zllNiB-I3ZwxtP0Cv~tk=lMkThpI|3;r#|C)cQ_x3*q4t*^gl5<>wKEZn*5n)_Jw@P zeV#f*x&6);BKGCW)E=0h{?g>Evp2QR${iBTzDU1b=4<7feSv0QzJ;O0dT z{x|#bed-7DWnV<{fvHo-Y=@(-p>$qZvQL1fN}bbdbPg&4z<1= zMxXcoQ-4^wBPs3w4My)jyYv_3WRH$Q*`vRq?9o3^_Ud1#dh^P2?bRsH)te91PEEMq zsa1YVxyGkXd2N`Vu48i6sasyJT;qI?oOlsmQjH1E10^7J{aDOZ_kQ+|e(Yb)BgwX^GCzn}3S{#SY~{wH1c zrvubDc7*b4&xG=8JHg(hp9L55etBmo`_=`@Zk-Kfx6XmGcjrRcyYryz-T6@Vt}B#% zya397zRCHW=dVHLOP})IcD;Sd`;xEuBKp() z%P)o@*bheG|JXm`=7Hq{%H^*PEFVn$njeFp+D9gRNck{i^OJjTc1k zvhvFE zI9}<{&ihAEUg!HaLY?=IF4y}3W6E#lK5uhx5}6;I|C7%7f4O)5Uw*62quV4ik8T&y zD>9k$e{UY;&i`A|UV!@L2ViII{5)8mJO2(rozIs*y@wn|PkurKS?>iz;aWFVUTX6$ zE?R$}oqs2w>Mw(BU=r&5JO$TMPdU^%eFf}D{#dBr4OYTc?j7ah?YS6Ney3f}U6Q$; zyG7a=XEN{qdDk;uv~&4;DX;H2-v{+Q=lh|~?T-OJ-{MBgpbEMEMufp!|zRq5O;K@Nnj_^2h0K`^*f{#s!)m@C5AV zK3P7C{Gskl(efd7a(206<2gsPbcnuNo`#h$0}J6?^n7lWXnN4>_&j(ZGr#;P@^_}I z%NKb05IU{JWsPoZh zq0UF2gE}8w33WcY3hI1xH7s=3l&_^9z1-(T>j$*+(ifo4OV`1W`(pWe^kVKyqUk~W zf|tuTl;`{cX!`@NK%G0j3Uvbo7EK>4+wLj7Kn=hMDt`&oJJcXgjL9{=~dx;^FJ zAn$O#6tO>hMf$tXWZwTP|JvklMDrua$B+27{Fn;a$^9aB^1Jc_l+RCpXEN{qm;Yep zj;Vm=N1(?#{A2k~tYfktknautEPealpz5oaIV9Qq45jP)wZEY+KjU}mshfAW{13|2 z<2oU6?2+<6$(NrY%Fp-<%Fj3o;G=Q=f4Y{6+@{X%$ zWbLv4kK7~g_=?7!3>k+e74l=MDgU1za{~GDUz$PrGbcj%G0maQCr^U%XHNFoYvHwb z3f%7$RJ6AH(yF2*%uly6IqRHSahhFMYtj4{^cbHu6`iOrRDF6yThg25wKIAB+|xzI zr(;EX8=o^IGd>+e#;2pnS?5e|d^*|qmr$QXN#0O$KP3ih@3dRO$Y_IgUDy2`de+bFFLJ$uDlV~l21ur!fg<$`GMV__t7nL4e$-I(i2p0D zG`-=X-M>q%f7p5M3-N!&6||>w6lmWQklqT;B}YK{Jy${bJy%2dP1jKF?Pb?iT!*ar zA^OudR9p{3a3thAVilvTzdY~AnwK|1&BxJj92^66&UF)%A9gd8A9f3rA9gF0KXMzC zA9g$K%AYBMn#VqGkIhsD4Y{ z;M`SlH}z?}A>V}@S8*ThXngL08kh0b-o2Kt{*sS>c7MeL@--fi`X^RA;K>mA!HP*% zKlUGauQRz~3bOk35LCaAspsK}N0Bv7Q@#90p!zq>(<7gLOs~*>r}w|*?Mvy`|3}rC z$Jt!I|9^~q--SjBNhwrFN})(fT16x+mYPB(oHKLI%vt6vGc6L?-gC||hDeD>S|k)% zQnpBrk`_xTrKD89=j%G}9^cRJujk{s@9SRP_jcXexzDu8S#8I_>2O!_#mSDf%h{7> zSUt~_OuL*V(k^G4oOb58?a~o#9#~2`ng=F`XLB++c`o6$B~v2d*#F0UZ}OHoWl;ZP zHV^85%*vtu$80{l1ulU4AG4RB^0kn7HP6)i?;+%uk^h?yYX0}ia=MDFJR*KC3-keN&^s`l>*G>L_^cy7Cixw}mdDn;VXkx?U&G_#s z-8lIp*B>%3+9Y?=huHlslRw72QgW+k?vVM*w#lF3-Xr;mXztMFUEATQ#E!|k@Nb*g zDVjet`@S3M9@A%V1m(O3>U?7_)I8#IsCmaezIRCSi^=;ZXXZK3=AUVpn>;Z2E8-uY z{8F^|A@jzAlMmtUO?)kyJGA-DH&FA4Z=vQD-x06oDc>XaP9B|n7<%Cm*bV+bJfo7w zM2iQa_v7TBaPOZyE}A>Ec_a14c?#$Mw13&LU!d&VuTXaHB$U1Tjqg&w`W>oYoq{`^ zKPLZ8ynCI~BJuuda@zT8@)?u=7R^rJk3IZnaz&5kDOsL>3CHjMJ(BtTzbD(H@D)X~ zhq#k|WltqI5!Up`9#r>K@o0WfRWj|gnn<|nCa0Ym9@-~zO%Z!g%hSNZ)$`Q0aCIaT zuC9n)J(JT;eK%YKH{8@Y4bk%^8hM(TUSrY9qlx7Qd+*V>)>Q5`uE}3^qB%Uiocn)J z?`P(i9{c}LvUu8iE=Jb7mZIL(yabk&cJOrcWb6a9`s@T%pO-?7kGxZ4_tY=yn4$W*)^oMxr-x+9{Th+* z*P5Jmdb;J_VFvY8;TFD|_GtIauk&Q?k6#Zpj`e}M@7-w(%~kjo%=i^EZjKJ=H=3_mUuw^ zHt&Wu?|uks-aXRXM|nn@9`@g(dG{F4!}x37Eo$EV2-Lhg7i!*3JoJOdJY$jdyDL%q zeTshv?P5G^!}mT8o53gGb?`|j`#gd06|yFJp0ao*dM4rC4u5FvW-`>c@ZWsdi@(yz zgBnNjp~ev()HvdYy1!QdHQp3Ls)Z5dZ=dIqJ5z%|r z=0~u?Udm%0)cvb+sNb#3hbpH9P`@{N32L8jA=J3D2x^>o8ESl33^g9SLcHDRudhPg z<5~jsd!yIzSN$%9s`q73?cjB*?-icq_B|^+Z{V)_7B7P<;bzveZ^A2)R}tTZS#NpX zM%KM5QSIj)*blyof9pbh-@d?^~<_A#wjvu0@ z@pA)Id)o*#ZhZtbZf$~^4{s*D8d+OBTM4K9h@(qC@q7$(;Wju9{{Q=nJ3QMxnosWV z>~iDZ>Bf(Y`)8aiz`-A&DUl70Q2{Mn|?@1%8J|OWN@OB5_+3OF z`;WVRC-Vo?KHX{ZrE&RBsBxKbw90zQ;fyCUAN(6?KKKv*TN3|zvb>r3ps4v^1*rL8 zHq?BuBJ7>4yrr^e=|YNqmp$* z(}T<>>v32K@o$?rOEiCI`*6)*i)3?e4*uT6 z*`oPFd*7-B)O%d#z&^|qTf&W$&$&?Z%JZQ18jO^U3qQZM~WKB((Ro zE`Ykv)DCVTo(rM&|1N^s|7#C5KfM@getHSi{ImnqzF&*O?FKb3y^{QCUfLb`OyVkU55iYUUM*U9$o&2quk3Au z9@rqiA*)f9!65??}QOac&Z^ zy92y8!|c)lCS(7-11;Q0(d@4Dt0iuezu8@AcJ~e_yL+d(-{l=-dYu1zWq0rP4#r=0 zSCriy0%dpafwH^AgFP6gc-h~$&wDTNG|n1s^6I(wiP(t;y(7Gu&)zSY{`i2%cRpxx z+Ih%JKSUlWRv1Vk#=$Yf+coQ9?<2Tt-3)D9{Ldagio5LZV^H>ZER-D{ z2ep4S9?A|s?uL89jrU1-#F^mrSUFDgK4s-N(d4u<$vfHd=@HEyqR01oy&>YuE%$lz z?0fS~UOm?*^1T7C-@dm%GT&P$@_hl5(@xO+-jGOqVQ;a8i+PJITtqVAq9Wm9Ca0aa z8?IQS-IREzptsj~T14*|lX?Hw`<%&BM6>(&Q$AC@&%=purlt3y_XSIDnq<LP{^nc$u=mu<8s{aso86JW))|Z7=+albFT-587>Bf?9vP1vTGz8{SBM z-hpbb?-IZ4^lHmD>whTwxdwl=;5rRK9F($#Je3?-~B06ek8APc6fKXB`4 z4^q$Dl3$6m2kbxYyOLjf56)J*`ObUDzV92!w3}~5^u9AW?R@XHo6I?&)<;LYSvhBs z?orZ_9X-VQ;pzQwN@Mz*6Z+4#S?Z4ivyv%n)>}`cS z+^rm-%?Bz%%?Bz$%?B#yW$a58pR6ugc!>R}nO7V4O37NHxkKz) zoxFOuk5ASW%^jM3uMcY_8{{>@zd^F0X#UXbY-4yWcC!g=NI9PcWpA58+0SNqveV7; z&L*F__X5e^Ie9tI3tPZ$@Lb{_m24?m{E+$3d3mky*Z!C&``Q}HzP5p~ujfOZ^R_{=9bzv#<#i?fozA5qG`EnI)m?5y;wC9aXb z*;#0IwkMRG?Pc!0^R6>J-v7yyoxMJ<5B{>VqU>y6C_8%tl$|9W#?2cQudTzxL+roY zL_D&OH$(ON0q`r_Z$ZC8)~$I1E!?en*vSgn)F-rku-n~u?trqFcS70EyP)jmAgJ}v z-LMwn2E%o{&ou-dWv@oC@g~(6k}Li zhpNvPq4xJ?z!PvLJOyXLveMakbMi9w6Iy$7C_mQyd8Jm4iM+*gGVKkr-kY13%99P=AwbwGJ_KJ*qdENqK<$FF)?8*ckn)dd*Fv~ zKimLi?>54@^t+Fs^0f)-oruj)??h~YdM9El><&MMdM9EV?7QfbyieVHKzlD@JJfp@ zJD}dN*a@|s-UW5MNx??`+F^^U|rsCOj3hI+^25WEn61NE-Ox3D?<4(h#%@1fS;hoRo(I0AJ) z<|x$tm}5})V}5|M;g2u@k3-#;`3dSBj-R34_c#GpB!9{K!}|H}dB0lwKPj1h{+r16 z{cdvFIpy~AKSa_wlXsf%v*DjG0sn$!@Nc)Aq5Xdl?ZbZ0|1WmwGS;tI`I&h_1=wq0 z#r$m8bV0@ZO8J>~0&V_K8OrWgfqMVCDr`gfR)cy!p*oa(tO4~q{hII+^lA~$mPGCR zI?^M&sQrezQ1gp=Q1grWFgMvCzfr#C2MtB5PsqKQCi#t_H`yfrEH_^ed)qX>Ir?oA z%|z3O%yZ7pZ;AV^(wzJjt~+F&bB^3i4>CV!m4B|q+baJ&*bTW2dZUu9Mbm>eKRF*R zpWimW6aK5_Uy$F<^@rRmzA*nHSBBgxZl8a#D?{!TUy|R!l_B?vJ1QQFAKLw&OQG)H zTn2R?=W^H)c7~V3E>Q2ib%kr`Z&yIwhv^14B3}u0|D`+BeW9!1nZ(uk*N|SNWDn8O zgWTWlnSU)TUf47L=6u<|>+^f%%l`Gw?~8uV#C0P2*PEPn`sCA6ko$_<-@YNgpBo?K z{`QUe{aqPyfBPoIYw5u%e)2y6CgCmcH8>D^z6Kb-iziF-whAKE?X`=EXgHUerN z=YFXB(GNh~i+&L5UeiNR_o7F_%A`9gKg-@d9F5HX|KvYH{QUoqXz@eahsniX?|wfD zwa@by)VmL3q27HM2X$|0Jk)zHk3+rl@C1AVJ_+^C!vwe&J_ReoiBRu6OoDpnVKUTv z9UgcUvKQ)|hdej}=0m;n;DdT6!VmQ>L;>uIej(KUR{-`-2J^#wPyb{{wC{m7|1E-g zM+CtDlA1=Xwt6osB6__u`(1+JBo0 zbuaD(sQYl!pzgy>hq@2uKYA|Zuy@4-Ne&4>ob#A&)p+3Zheuz z*T${SB{OdA6Zy_BOy>T-J8q>#;yaN4CGqLK15xjEdTV;$F$TL$<~jd?f3ix>vR9m! zRq*HDpRcOvRr8&g$$Q%5Thw}`hWXd_)inRwzFM$yR&8Hh;>jtmBU=6;@ig$&Grb1B z`li>w=R>bUc|+0Od4RSqY>c~)_?svm(mM<49J8r~Z{}-`tn@|I@7YlMt2t2bo3wy> z_v9R?^<+z^_2juw;m(7qhgMMa-x_ND*#>Goc|N=zy|!*STmV(i?V#%ULa5)TUS#=c z@4M8e_Sw;Qu}^mO63MjB4kGo@(d4w#$wv(!UnrQ(7PmoAF-F#gv zp01LK=L(T<-Aqn9SGw_Zw|L^It9;jxAGL$4(Vv#;A=%o2+>bcd`mV?QxYNtm6K0q8 zGCA$^_FZRs*Ne6uMUV38>+1t2!kaBW{e3rBe)>r!KR1fR-{0i4bCa8&n?=T<0lwSO z+w0sSqBqcF{{Po^o5{C}wqC}c_IHPG80qDf5Axk<<#CtEtLF|9DUW-6cU$^{C6oRT zQQv2B+8OGmKTIUPdws)+PwfKI?(X;9XX)JU8v!dLKZt)$`2(W0Pl(YF%G~{^-(Y zeNV$&_zWBepR;*a!8H33)6uJu^`dVEvd)#o zF{zopS)`};P9Xc$vwd@L*FLs*FX0`i_ghM#-a|>iKq}=+!b5N_;dTBEc^{_CHxJp5 z9<+1%a@_SE%Y3N&01Kd<|3kg2vJkxnS&MuxBP(5)d505O`zWtK{VwQLsQUs-U^BwK zMmn=ecPZ4ku?+Wk>UG~6$m+MtY1h+ID9Wlt{d4ea$+Bl#q0SjThI$8Q8`Svy30#8wDU^NL&i7rG zwZpd)S>*`%-d(=k$ogJL{eR}$`L z8dWaHW>0^BYCk_h*_Y$+9m4+-(SFYf-_Jhn3!U)&N_h3FU!eLGGVUjRzay)E{RY*) zB(HH!`Tiik8Yf^={jbAmxY_yB_ZRW2A49^Q@%`<}5cyx0IQ$5T>AH)jvec7ho}{C3 z8WL}Be=l?I?XS%|M0(KXUDp#%^PfIY^P#>_^QRl2=1={INA2ZCsP@ty?sRVQ-%9!K zb#4|Z{{bd*{_h`X@~xuTd;FP?+~yyI{&D9H|Lril^bV8L&Yk|dOn;DQ^AYq&f3W{< zOMkF`xL@PVF#iz0=2`bhWqr=5HKnR(W55xaYzf24(b&_BY$-7lGN4~T?& z&}7d4-Ebq_a8u`uLeHBR?SItt#)wuP54+`oOu6RD-TJ5eWj`N-vb$rU?Cm(HemWk? z-aZaxZ=ZlVAASkCUPLp$Doyz37*f=K1senSF4G9WLeFb z{$iM2T4HkAdD{Psg_|YXdQtk-63@xs){D^Ai_b%?7pI#03;t=QhyC|!y*S}ipxW_VH(Z$;ZXVp} zl=~N1dCV6nj|C>DotOLzOgQ9acDx;`9q)i@$2-w4E8XSa?Y3h`JKpR6 z4CcZ;a2))fcAQh4acdvp%h?BFAH>cn_WQHUJ?*+5fI1iW689C!ul(Ox`F-O*Xyx~{ zWXkW5NcnwZGQasKU;Ri_KguGU`cVa_ex!I*ZxxAO^;8L}o+`sil<$B2 zsVaKvPt~CMQ+25RR0FC%)pWzxa>Lh#JDoZO4f(#kPF<05sb@0x{|g$J+)%Xsgg@oc zsGymZN0WlakoSK~=KY_7rl#LawEl!1>7QND+|ob0;JgCag_Z?51sdmCNTy!T5lOeD z$!X`@f=qupPozJ!Drjfn+7`67aBUQ7fg^`{+>7%1W;-=vk1l50HL!T|qC%@Ba&WLw^5X@W1`a?*A8L z&guFRkNVdQQ2nSM?%e+`7-;1-prF5%+f9-wx0^-EZGg$xf4AHQiu9vf3o`xaHW5AR zN48IVM?vOX>Q1QpD|eCJmc*cfyODK{B<_NPq0W(pK%FDq15YJ}7TinvZ4<*pix=AY z)o|D?d0)Z(`1eST5X~QQZuCIGDBO3IK3MRO>kc_L8Yy?vgPc>1E_fLC@yRiwxkEcA zdIX+Hpr$mbf za;`C{z=OLtF_H_Q9d;&*wwkU-99t`=Ng1TFHWf0O1=X3q=bLwf|ob z#-06t(cIyGzf-DTll|sML00|W*}sUwy2vro{l9nNSpU<0G%l1tjSEjhjSJ5}jSJ7B zulD*JRC}EQcRJ4(yhyrxov9+}zF>0NnN~2}FcW5%&N4ae z%r2N?`i^Mh0(zvMC@8h`69whgPRk0C)=pEBX{U2V(k(MN?aWjAL@pN@7v>i%ws4CI z7Ff8KBol6-h~6TT)6UCoxW#U`sdHXI&zpF);C0hmB3gO8=9ULC{d1YzZCsGQ`uB3E zabX42xbOzlxUdpxTzC^|Tv!D)F1!Ub9=uI_D&KdY%J*HU@nAL7c<>(7c(4ZjveNep z*1F>WWE}XQU>(eb>)|-~zvF=J5o~bBfsIh(!bec&-kYG#y*ERhdvAd{_udM1?)@>; zx%W1x_a#1oy0`u*)H(ll@>NcJJD|puow%<^?kd=4<-WIIx0U;6k}3B+BIUl<LK`Wtfp zuOPe7?*A2J6=wV)<6DJ7+)W?aI8_nqT&oiNmh;!jQ0K5!pw6kQLcLp24W{PTD69^P z7uG0jQYgDyr?6(B>~5{Xdc@x|QClSbIwq%`x`mngswZ-uT)(h^n?B?`xnW@=SB9J? zH&(osKUn1y`8W&e+^{LsxnVP?bHnCP=Z0rPog3yrog21*Iu}2uFf$IeMAkXtxlreb z=fPUZR)uXyuR*f4Xz4-h$@zsB;NCXTRy22L<90i!bKwi2&WSIAI$vxLb-s8p?49gb zcnS2v4zL@%l=wy^JBbz_wDbGRpw6E!hdO`m40Vp&1?DEZ7Iq`t_~aF$g@bl3c_q~O zYImsL7hF{+dvJAO558CDqR`H_uYr13<65Zm&7M%_n7yFR6MMrmiR%jckWQuK^`fN% z?Hsi))Vc2sPw-jdH6&(m=KW-(T|M$Ct z+Y1LH?{w}Eu?KgGq<@#mX=hO3-6jtfZT^fu^XDOjxr967+#_Nah7}Hl*`>owX8m6{ z+`{FG0j+zbUoA00{x*MxHh+EqYX1D7xj$4m()2k0FVy^bRN-j+HGdX0e;xxhe|{Kh z{;YU(o+y4rJAIV!8jl}?8jt^*Kaa!T?*BvC%g3SYg#ptKie@j-BmHn;$kGoN z7F&Og6&6{4j!33IM@7<&naurvw?7w)*vpc_=PlfGg-=_!XCxEuS&?whnVfc}xZ$36 z!%dwt6+Lg_g~FMpH%+winC_MbGWKhR+|6FfU;EgzpzP&rD0?^u%8oiv^-v16@120! z?@mJ5%M_G-oeO1O%b@J*JSh8GPI{`p`B3$@0Lq@e1Z7VbLfO+r=$DngT)4O}Gp~l& z(sSTUWRNS?R5J{Xc+8 z_d{1t{%f3#h3pUh_xm^dz4E5Q%zFu&;mg?bEpT&kYvDHPb6fIbk$T7e(~9>Il`ZIzf#em!e-*dRgG| zKxX`aj2~SConbEQ0>{Ds89%JwbR)d|{y(7p);(}F<*+Szl}LH9{>Ob+vPU5E9zd_a zHCC?IN~T^A+RPv9of+3EBZX+JlJ==C!>?c5mXZ}Lr| z^)LJhcXQxg!X0r2h_s`Dfm>j9=|Gb?{}0?|;qDc!e@VYu;tu&+|AN-P?t{c9*x{~89>zZ8%5TZY4T_^$g1ulg7PRX_jPa%zw!k_ z7A_F*Tet$rgew#Y7ciOM|GD8pZn&v)!svMuMS)_|i-=YpQMWvhX}@u~TfdUO%C`in zUp*~-_zYBkcowRkJqJ}EQy};M1J6V5{|BZ*?*9j-Sw7kSM^=BE4%OdYgz9fIp!(ZP z(pUY>f~wEiQ2lETRR40I`d2CXWu=Kg%h{R!1?|3jD!~12@;etU zgfGWF%}3Tf_yth+9 zFJB6E4}Td{ystyuzh4e@|9%D3|G&QhmCj12d-`ue<#!ca0pEi9zxTJH{_p)AsQ-I^ z7p_XK4y>_yd{3mlS^wjH4*u`MR&Xs`kz5z}$lA${a_4NhrbBJfZ!of70NjV*WWyoK`1@J4_lHXw-g!;Y0 z*KjfJhu~}Q8#r$X>wj2E`0wC1>UR%W!OZU-DnR}2Asgy<4Hcn&_mCO?D+g-^ zHO^HL8UL$_w1;XYr=9A-8Yb5iZT!cd@xNB^I>H@sYKx5jb%S+ac4=LcvH!vP7VbLH z#((rGL?{=9tCnaaJ+lLH*E@(!pzOd|=H4{e%=B3Q2W1DE2hYY|c0iOJ$bqs0Euidx z;?e(KwM0KV>)hal$hqaMgXa-n(ayzf%;zbtq;vhE{7^g9Q; zAnV?msQap2UHvP}zgzH1l?+Wvg#maNnIE?$dFH#QSJ4*W4csK8AZ7 zckyGwkA>UeIJg^*hx_2;Q1{=SfVzkEB-A~l2~hWPpR)KS1}7owzOSfzQa2Z(1rUnSStp_kQD+-qXQii|^@RiKX{+@L9s=ls_X{dXVyYKKPvJJs+H6dd~;z zhIFrTs%ZBrq1`{3MtGI?bf|vwB2+!hfGW?KP~|xbsyt^ymFFCb-wBo?tG$c5Kb(M? z*CnCu52s*5`paC?FAL5?R{s$-?<+U=`N0Lq>SyAF#KPc9a3Wm9cge0p%JJpkV%*i= zM9mjpG51%4OOVyCM9nW>gX;fFp~`s~)PB(GQ0;g*RKHvSb?^8MsBvH=)P3eRq3$!U zB7ODCx1jD3z719X??Cm>cP;(Z!Syzttqs0s{b`M4#T#{fX=k1KBl3EY@&1G0 zCiM0?ABwndFd6$F{K(`@qRngZXB^!c+>G2fYfEqk^6I%;MaI!jgCASE+a#0jCnE8E zYI54y?xwrL(mmqr4DLnmxU)OB3uc$@Hktqb4eqgUdqtZcqep%03w{nK!mlj71HmsW zz5S9&FD;VZ0h80tmu`AriPYP{;8Dx}H^Hwh|A$OoJ@*@t{2vZ}Yw>+2nfSgJiSMw< zY3GO=-%*kNax8e9^4C4iAJCtc`cX3a*ng{!pMpP=p6mo9{S(1okYy(z@~^?)kk#H# zLbVfQ+pXPoh_!q2<{15&)<$sIT{~&r5LjRgxg;19D zvkD>IL+((XEn5G}+()hysvOG9>mlK)g{r`8Sk=N+3)P_C=9E_#Eq;hz?NCkAs~xIk zdbLBD{#{4>uYcRU+W)OzLusP#-csP)W+@T__5Ll?oSy3u?X88*06D9n`pTJ$kZ(ePEjM>P!B0kM;&+-D~X! zRjxNem1}>fa=i)4p4|*}e|7-Wec4-}?mrKNy61f>)IIOph*$5U-3}XO-4VJIchxiG z-tS$ZLCCrXEZ$ajcW8*!_h8ZPJwv@GAH}oj} z$}i-8_+z25$od`_sFO7=G~SgV_q87nJ%OzI+Txhhlc5Q?>s~vw``b@J-QS)FRo;`J z%6l?Yd3&Jd4PLk~l^606esL<_DEoxWed&UbA2uj22o>Tl_Y4D}5bmeTf+FMH;MtO8 zcf(NgkRqsgNQC^Wo}$RQ&mDuBhs1GLyC_E1e53^GzVy?$*Uow-^enQb`jbYW|Rfnm?qV<_~kB<_~31^M`qs?)*@>r8_^g0C&yr!~^)h1l67wLiK}1 zP~*(YQ1`nR!xZ|jK+UIKB|n#BEeXAbto(@o&Kv41g$q+don=t*y$1-}EQ9E?IRqlZ~z{LC*Tp{t(tW-bPRvpw}ZA`{lW6}W9S#l*H5A2mam^o zPCGw`PFTFZh?(;R+S|YX{u(+-c&%e$i;8^zZ?F>l9rp&fpMp)`AB4L&>#xvhV@lvGxG~*zhh_sH#-f(jmVemEhK#7a1&RCoL`+4Zi@U6{S6{F4>z-L&BJHoz7;zT z$ybYT4qOD!!Cn0ma?ihI_*`U-Q;_iIg zc2M7Qp{s{K<8b@%#iq~xKkjRsOTrzH^*aJ_k<&5U$;}Vse*UH5%aAqyfaJS#_;SL!|*OuxTq`Zt;W&5}(Y z694VtTi_u$(8Apwz7Zra4LKV>UR`! zU!EEj9*y2U>IvfiaCi({1RrtTA$qytN0ASr2hkfFe$4d7hR35Cgv z6T?rykKvPWJDdP_!>8arIGJ$D&m^dNl|0q)hCPt?|HB37$-d=5*|&Ts`{skPZ+O|p($T9fN(p%;*9^}mD zdyB*DpTZKTeaNSw_O+jZ+P8j|__aT){c`PZPQhLK<>%E}`xJz5%swyb@|3_)VyN;8n2iqPN0tyZX@1 z7v6!|4}KSFA9^*^e(-xx`@w6V_JiMt+7Dg}wI93=2H|?B{ooJaisXmkEoL7!g*TXe z*eDtM@R3OW-ehvx+3ebfEu!roZzcTjMW2R0hO^-|n1G+aGPvE%H?;P$18VVb!9BMVc?vEUH$d`9k%g+Qic{Q9~r2nkJ{6T1A=pLT!K&f8 zQ15?S0QKHZJJ^l!i%JSI2*l-;S|!j1nOOz4saTBN7$KhrxR?EytL?Y z^6gDrCR)BB_Xax`b;Z4ZvWsZ$(EexZ3b=fJx1!$oubO{lQFqrLa=-MdqN`mQa=)}k z(KW6NxnFv1QBPNf+%N5=cr1Qcr3UTpI;i)Cu7|o8*atR3?hA9^4X_pL2ldYJjZp6# z_lJ7_98vTD?v;}F zi{=jPzU6~Z_kkaRdbejJ)Vn>Spx*5n4fSr%7^ru99)^0i=MkuPdvc-P?RgaHe*a@o z@Aiy^dbejB?RZFXe9_}YS$01Y+Iu`tK)v7dB-Fb;6QJJjc?#awixyyy%MPVwNFFc3w;LaKJl|q?-V@;XW%{s>YbkF zq2A}23Uz<>1*rS8)1cmYnhy0o&x^1!@(ieVdS=4EaGwSBKF@5ZccA7#-EVcE-UBLy zdLJhNb^kR9i||iDy{9u5>i%pQ)O$LabI?Alwtidzb>8`g zxvwmG)AX?aMOr7WDtZfltrJC^cfJj^E`A4UT}(Xe*RC$wfSgQC5$*bqS zFEWmQP_)*@@pY0J$JdK|=LaUIoezsL*u6(Kh5K822FhpA>zHtaB2GyuD}#vd(EB@=le5#V=~zwj0(Y{AYZ>)@6I3)@6Iq zuaNb5Q5ye^<@-eTQNIw`|J?89J8k){ko9HJ0gM03qOZ_zMtq{q`wl{#^L-7K&LOCD zzkvggzqN4R6@8Da^EXI74;LLl*0~uZAIFN0n)|V$A8=RvqSl!|LhXkhhuWw632I;M zXQ+L(6Bhnt(JvPMWYMp%a@NVB-|^2W|4p?0b;;UqJB6%u(jUn2)aj!C&gcH*yQii8 zl5FD{v~v90;?IiwWASH2{UCsQW0juO0Y5LY;Fpf;#7F z40WE?1nT_mEU0s|rcm|NjC`p*G>6)cJsYZga-iBv3-l%=T1L)+6XE$0wfokQb0eC+ zoF|!f-%6z1TAQ49+C(z#{(O;fplzf*dV8G4F~IvY4*vAF4v~wI z8)sb->5RO3ZU>QcFN<`vbUR5V-AhH{yUgUYbGe&tXG`~p(DxGvJu^3h8&`RFa8cb&;; z=Xy6EeMG|bjSRH!x-oKteOEt|SI@msUoG&02WhDPo&y`hnN(d$q? zOtkhYc|zj8$Z$9jj=){(D@eNcM;^dk?Gz$E7}0r{#;43V*vQBzzE|&UK+=0SGTQVW zj*Nkok#h;3Q~ro(`GV+;jXY|4VilgM)IQ2= z*p~dyfjIn+2ZpYVrM3nGh< zXU%;{#J((a+w&rkbG(-$ubTg25&u_Q|5wfbwz4IWrB>driFR%!rpuN^UMGH?|A=E! z%Ofjr*ZB|R{O`@k8!#8HgyY~U>u0S0kpro>BX7Y&@EyYGd2J_Gvv_nED{Hf$)n{9~#wPkU2;CD6$bYDE}z334gg~xH+;F z_tRxtM8<=`vnA`C=wqn!mu*nzKc7II(|k%hP&?d?EW5S?xpvmh$S!2HD@Z%v9r?_a z#S>+FBYR+j^1YGI-SnaLlYLP3_6x#Yl(j#SMppZS^v5qF2dtfc8Tkr#v;XMT$vPPM z+SP-c8y$*#jOuNs5YWI@YIN8yP(abmpZ9l#e;`hAf0(Qn3I`{)Cp_N{SeeKat77y3J$ zTSewmw~3U;?Ix$4JEC`*e3xkJD*OpIC_0*ON1VGw=0iiGgJE{*5R=o+J<*{SZnS9Y zD(P2C+$;Y;)hyQS^L{vcsJbRaHsP`bdr_FlOp9Y z!Q`~_RCJ=rlSG?e;!inDj{2+|yit#pgV$v4|3~vp-zVC<5Ixc_i25!4f@o1x<4P!6 z7}fkYAes4EP$b=u$!RAX&CGv`MCL`2=+hRiI2yHZG0B9Bi-apSIqj6V;huKGO`Y=$ zdfvpd(HBhbInl~vid!DYw4bSRw|SQQRld`p=0($?*?(yEADaD#X8&OXz1dLnhdEI5 z2M22YP)hu&rvy|zC85TR6x4Vz7pnc1pToMK;;a-m%xh<;(^x?eKonik2&0h77^=a%bGYCN+Ke=wTa_x~DdALtO&zWX;& z`(WR~7v}#I{SJ;@_*3+I_yjx*C&42y0*}Ie=pBQ{7W@?b0p=qA2z$fhFc1Fh<{Pqa zc_R8N<<%qki)iHqZ6E(6)IR=iQ11@>4$mY`MNgw&Dfx$J`q0i1{)DxXe?|Yszd`bh zX#S9W=6|ADG4;cLMRSMjLsp1o$1?kn(Du_S!d?q2$11_53o6H|pr?9(w*OfbYX7?$ zJW6}04tpnS#cDt=tO>ipI;1x$SzEO9pzRyhh1yT7XZo!Fp?<&L0BS$JA=Ey4BdGnw z#!&lc&)5uVf4@1*O`aWVLAv9UIijTt$=^A#b8+vVY$=*MwEfNV zp!R!P!J~=Ru?x`KRoW(YzN-g0Cuu8p3kPkVvK`bu<%N`=_FpeT*7-ntsC~|hq4vQq zf!YV|0DH{u6zd4R$xg9L-ExJte|Z^fgWly(`>>tisYI996{O!b(N(ncq3vsSgWAue zecSKpyT`KXXOo|+h*!U>zZ$tFau29?TdskPkgtV*A`=d~+ADSg`a7N8BKG(?k#w#% znfL!=eNDbWG<%Fc;rhjf67Gm|qli7eDb^omm)>M@+POJ4z`_j`%^pj?T4JF51G2}^ z?D1_-_V{*lzaw_1>9PMGlRdsGHVA*&V^Q|_ZYX;^7|I?K5BBLE#cTTs;tty7Ft`Zb z3$;ER4z)hGkN9N=M!>!J-w$OU9x%P3&Vw+8`$NRbJHWA#7XPRi_PxS>-2b!lW6;z7 z#lui`{t+lUp9^K@ABCC+JO;I|H5O{0Y#dbl# z6 z--xZmUFm1|X6!B8PnWF{ZG9+N>%+I9)`#y%P7QV5g<7|+hFYh-2i5M@P;ND{-jA(C z);e1Zq}IpQ!9(x^($hWyr2TJ*eQ5Q$A+`~JwSUNc!;fN{-0+Zf`{vjdR~E}kx5hq> zW#&=P*2mkR*87=t>h{>DF|8A}$99sQ%4Y{u`5@!IEA|<(%4s)LIZ0mQ?1}9q9_`0L z)))I?pPT-^*cYU$?}MyU_Q%r5suxIn2V!5kGGsmSRqSixQ@RJC(nTiRq1gAxO7|Pr z|68c^zjO8Qr(GS19frLB8#`*@SpOqWDm@na!Ii~B&X2L5EuNoZ$1VI%CaXSiC%qG~ z-*I2!{1*Gg^nQ!|3RfbZH2vSqU;5~g-l^E1xGzrqArk(y$?})HJoQ)X40Ky+X%0u&%Yms&S+7sp`d&RFKzVXT4qQwW9cU&Lu zi+kHdAJN>Q-A}mz>Rh)U)O$ZSLY?FHhdRf<3F;jGW~h1M0I2i)TcFPK2ST0a-wJh} ze;Z8AzaxG-EM9m={61?(cgOFvc63*K2>Ixl7$lO9yG>3zgWYyCMC5+SJ@KJ#J|Xu@ zhQ;r7Wyt-K;fmM312Rt@5q|*p2Fd$HbBE0T9*mF1eOKv2@sX}OWd1iw?xqLrp1>HW z|6zI<>fNPBpyrXeuqplQQTQ$2_ZZZ?ZY}ja^nc~rT z@U!S=XFV66f~?=IK;-A+Q<3X2-azCRl)lY>#Np^ohda1m^CEm0c?NnFvS!6+n*OZ# zY}|vmLmSWMK#k}B&C^QVcoI`&A<4^;Ue1gU$yWYh8RJ;r2S~MZ$exGUxyC4JL0CZJvlf>3$U7M0k}8M4mclGvU37E%8rHf2(Na z{IPu>>wVH$<9s4_v)}SpeQt-U=N(Y>yc6>NZ+v$=Gk<_)zdpl#bm`~uJunyUh2!8p z`)=<4A#48k1=K#!eyDj`8fu<)0BSz)CDc6aE2w$eL8y7!*HGsohoH_yzJWRy`Ihgi zkoA51JNwS>MkG$FWBYv8E=zAdkf5!iEWk~ol@xO7`KC!qw^-ug? z{8i47c~gbrtYU?$P|Uo*+%-SA1^;kgG$z zb5H|nzEBftzEBJ5zHM!}!#X14WnHLr>OrMbA8J3T0n|O)hEVrx8$sQ(Z46f=n-u31 zYktwZ_^e{hFPciGoi`I{ugy(PJ7*VX<`+34^NSY6Ez$EP&Joe${-66@=R(b27-#K& zm0J~ORhYK0O>t}ZNTN+K?t$veGl|E>@wUa8`N#!O^N@Cg-;%hn_#$M@KSa$x+C%Nz zTnx2ua|x`K>`>f^d^AXQ6fGan<{g*9qlwFkyW+pA^z!1)u0O=?bdkI1L*_466kmyZ zrDQkJ+#&Op?!{N*-XnRHXztMF4L#tg#5Kh|@o$^BRy2QT_p*9H+3DV}8})G=lpVVs z_CW3fbCZ3G`w@P8@&?huL%T0{BW#iEUwkwE-o#C!`NJx@A20(~d}B>cJL8JSoBX(F_8Nb}Jy9GY+!5zV z5qteq@dTJ%`jp9OXJYXr3l|d2UQ54P!XtmP*U;>B9+bV#H+NsL-}E^DFP6P7C@#cb z_F9y^4nW!KAe6mUJRPX_Fg(npzPu&Q2QO9qF+|Jy?94)#?He)jjWx;yKuMje|R{xyLd19v*vy#($4m{<+WF2 zKJZ2H=ji3aeQ+GyZ{>~sC%)QQ>EZ)!eBzY3UlxCD@qHx{-$6INuf_lNCvwiF{Jz2N z=zXAXVQcsu;mR35=;yW$K8(B8$w#2<;Zdk?$DqRf0PX!BD7$zZ$}au{72nTpd?%pn z&@Z^JNd8)U+S<*j;*<6rze%Ru{4UaNPMMr`{&4esTEx!%Y2%kS@z?*3UuK8?W_;7{ z8vcPAH~)pQUs)xY@v%aQ>{xb5MP%7AQFg2n?n9E5ORAJ)#%pNytSUT{s8&*=M0TjU zNWQTDxF086P00R#Nge!qBx{T24;ioPm(+z`SkLt8mo!9gRI-6+dXV*CB^Ax;JJ#| z(t~CvTfyGR)+OiT-#^(#G=FI8>$b2S^>zW&I=dazI{QMXb@oM2cC0<+B|CF5vewy` zz}#eql1{`sKG{*Ucp-NA(vr(@Z=1MGG@HC2?5?@$w+1;Sl*;hi@ z@9t3R?5m*G*;hlYvwJ|Tv#){6=U-cLBk8T0-?OBbn;v9;qIb!4t_<0qxW1&1D?|1t z`j*__%8>nueu~HP3z^^aFS!}_2FaU5bBD}p29(@}`>xVkN(Q>_ka^9mayLC_>*?E} z*3oxB%|GshT1VdnwT>PHH4nHOY925cwnz>s8A^QK#66hZZ}T#=c{vMeUd}f6oWi?JkN5uyH81BD=Hah-S=79o4>d1OfSQ*TkJizX&`sar<$pX!$5}^Hpx~R1{Vcuks`2N5h37I1yG`{L#XQ#qUTa{wk69qbA3l zm>Yk!#lO{=RX7*D?apiwy~j;j`Cb01zvrOJ z^LeOxT~2(pJTDZkuy|i6d=Yomr#QRnrNWhkiFp+=Pp&Ck1vB7kmaoWe>aw)qd8)-K^I(K&_+Sf?7v!gjz>$a@*Br zw?5y7vJ19A*#+-F*#(Jp^Sg!H3bj6cxA1-3)gIr2YM;osZ!g@5tnfRa!b@K5d{FqI zTW%1&c;QFp&iWsDz4LM5C*()Z1M&Z~@H1D2gx^*8Iqq6Fi%YA&DEtzCl{;kJyu0u# z3%9#a>t?xY-MkI%CHx`#K=b@Jg$X<1TPXWrAC%sAPs0U>?)Q4JEHSo%AIL6x$S$2acyP*-( z`uA9<_3v?Tf3&gpc(3NUCZgpFn!V5z9*8#co`8RySaZ?*A$CLyZ!6rp$6AW!4w=VJ z^q!9U@;R-&C%NvBdF*6w8&`(RV{N^sxH4oOYv(=Hl_B%kX^O|LzZcuhYcPKmIN+>(w zDkwXl2b7)A6Ut8L1!X7nhShWWdi%hc^ZI&k@XG$`@4eb9`>UV#TJqB)dW}ea`kNeg z26z+p*R>+{*Ff)eZhj&5*Y(~(t_-oi1}k2B9*F&LqxUA!IZZ#L;{cQQoM$uv3cjQ3`loGscsfKjJm-dJk=KW;@j=x1;D;I?0#M^aG29;wdP_;CL$pLB9oGN2 zYduj0yT;1BmH2m$Rfy&f=`SH~74F-r!rqAM4(TtB+)WSCpQGMt+;d_v(cGc+_gU~j zbhft!|2nb9Me~QYKQ;%dAI*hoUr#`_uX(Un>`Cu@SO6Emu5c0YjE*f7EgncaUhI7u z_k!qCqPau*?-K7bZvTZgt}cbzuUh7gBhMlq8+*>Xobb(J&x;lwlKu+si?|Pny&#%9 zwDFqp9Q$>pcdfP0RU++kwTRvtlez!L`-;hHMYDVHC)}&v_pP12CelvVd0&S~RqITS zJ8yX3v~cf>X7@_JL3D%s&F+O}_ilu;dpDW;X7Agk$NJwZyLXHC9sFhYin4pRLfO6B zpzL1aq5Zz6c|F{-p}oMzc4xOeChqlo_Dus{SrOm-|O9D@$dD1Z~beZ_iO84-$iGRUD+7Qu53cQs<-2z>a8i19oG!Xj%yBO z2cCfb?5Y+;EsGL%EX0m&UDOI@z!PCM#9m}xGP|+XGo(kmZ}S9fQ{-v07`BDFkK+{L zt)btxL)Lv9($hU8ry=VelGCB=wlm}a|P6WBHf_Mp*vJLTnSYUSGncT16k$J6JCja zFQ|J|dPAM_^ntoxr7zSy)K^2j|IrWXz2R%1-WToOShBQ1^D+0(HO4tx)%c41;

f6qFM$m4ei!+PvDv~{%S(Jhth9iq)4`&voB9Dt^ z7L9_X$Z4=oO=i((IHP(@(KyP_SDjfjmUK$1(cQ0EPKQ0EKz@Ki`VjK>p;?nR&9{}CB4CX1vy#bkc}r|2G& z?-gwv$DeTb70o5w9_N0MaeQjg12Cy-s>yL@TG4|RZmwwKxbz!DAC|w3VUd}dK0{u;+cjpJUZal8m>948*e9e+_Jaz;(CC_p?dJjEujoD~%5 zZ{${?t(bM|< z75D-1ueJDJD|*%9f34_s`SZM@-YZ-OD;HlMiIyhH=}psrt7yIHzg4sW*7dwqvWYM`XEMM4GOirsYmDALr;)EA zOsZ;RGWY-ZjCSIo{U_dF8C8BKd9MYi8*-mrS}Rh@{)X&ADQ8{g@^Gl);) z0Hi$H`_4pGdxFRvd}kr6T|nfsedi$SUT;Xd?&Rxe?wx$+!n(*^@NZMoS+w>K(L3Ll zYrs(?!IoO*WH)sUssBU`j@>g+=KA4<9b4USKbSMwa?yA?Y9r^`i`|P)cA8X)OW1? z;2!$PHBjSGe>k>!fbUwu>APhyK6{|=I^6YLGn{s;=X&2DWPOh-YP=Z?)!%M_`abwZ zsPBV^Kz$#46X6ff?{_m<{u+y)yqJYre>bnqMZ6|AwB4zDdYB7Zs;f zPw`ELyI=w3p!c;!jWhQ^+0pkx+12-3J~-!x>6HxJMsN~@fQk# z{(Ar056|`le8sq{J|OM3#22)7TjDFlUGoi`cATfoSB|W7Mcp${0d?M833cBIJ^}KJ6nf@GT^q%Ku5IeuRwsBHvTUs)xl;^&)w-^R#aX&!_$k z?R)EI;Cg4NZyEVi`-6mk*7uw%L&81pTaLT-r^Q{)3g3&kE8Q2M(nThomwaoGmF`N{ ze-%{vt6e?(YrVHYV29fmH|Hpks^+w+o+u}#%GzV}Rjt7z?Xo9VwR z+1e>&|9!jfeaQa5??cnyA)5Y9)BixS=|kfG)E9@l;71njQ{Trhi2Mm`Q}wCuGs3I= zK*ptAzAsIW`QP-I|DnELmiyA`uY9}F)3^nRXRmJ$oDaWt-68RQ>H}%WjXeOC?y17U^Czu>}TKE(F(|(t(%_7oo<@dB%0#AfmPq&6TPdN$dJmqAl zb$lDB^=ezV8vRqC-q&acb-(DTP~W+p26g}E=}_zPGvM-Adw&O>s~~!&XwL=N7dXq` z*)RLzT>sgY?{g%R?~WpR=b9XMI=T7oEZRM$T?oH{bdo6t?F*a-wI4zGHdu)J1yMOBMyu#lT|E*3p5&N;bNWQK# zIqqEL?_qLJ(bkFhvrg>gzm0HvoZce#Twi}5m{ir*v|4zrlYa>B=9njvV5@34g64MXe)mhFV7s zg<3}{9-V{Vihh!3nBuqdRk0uW7!DtTw-c|%#XCsnG|!#>5x8p}5r^V`7rd4Bl7j!~ zo{|1k*I(?(bBw~h1Lc|q&xE6K*SYH$;?+1i7Ws4JbSQgf9PV4441bQ5d!|Uak2g8) zWcjmA&Jm~So^|}uzuQ02^m9e@^GuFA`ThwePZZ70$DjI{GGiOy>Q6|1{HoP&E4-J-cuGA*lPtAI7~szq3TUvh~<> zo>S-8k3y}#9)nt+&45~;&4gNa64y9-@m~0pA@Ye(W6~1 z^vkYSc_r-m#r~)8*L)9a<Ts z{@0@QJM?UP`v&Uw3ciIJzxF|mU*FL_4j%m8{{yndIZ?ky@S~;klm9nM=NJFamd-CG z$DLpO`z@W{L~Cd0+3yhi4)r?(e^~fG{homG`IrBIh5yUsxbwIFpoRAYppDB$ary5;26kz`GJOn*Y6WFf-T{( z0nfBkJ;w#quiHhN1RCQ$6gDNk4$v_%)t=*qWdTQUN zLACGGVFvB<45)tD9*(IxD{!XVVF#EEiI;rYe2ab7F>p>m_Eg6}C*sw(buLuh{ z0Ba3jczFOj4*S&XIcsm-aMyU!9csS25^CPP3Thti0W~i0JZ4Ar3M9@WdK16wl0Hy& zN?+WU#jXwvw0ap3=x6nEjb!Sjzeqg{FgfmA>(ft%g-0cn3jKysDK;pfN;mA5Sz8!M@ z9~eP+&i_RV4>|9>D=-pw?*A3d9db^b8c4%ECpJnncWCFtqv5f!F@bdao5jY8<`3=u z=W$T?@n*o5lxrqD366*DDaS0zb66}pkV8K8z6K+IWOst*@Ts{eQR*mg3&dQx+&k);e{wsQ-)tDRRtwfm^K#{$)+$NoR#*1?0b0<-bgI4sKEd>m@Lu7Mh_70*ucGZ%gY zpCG*Y`8=q8e(2nJ0sh+meGG3hw>nD#&sn)XBT}wQP3Hce zz_TVlC)&J)Kjry+;3X^16@leeo-0g_J1+!YH2s%En;+04{Z)aLmj0^1tJZ&C39PpM zyGAno_hpfEUokoEtabbEt0H#HYk>_G?#;mK7H*wn!o499?oE@q|KAO_!3`ITyoFvt zbYtKh)7vCkd2Dve1DSDbi`>mFlE22?t<9R0{G_m3@I_Wz;k@l&Yr`7@~Tc^CS#t3D5W5lGl0kaqZG;49qK z4k7JucVLezL)ziqz}K!Uj;Y!g_y%UcZ(%k(`keYT@~d%B{rCs^pWd7K5o#R#iF|B` z{v7xPS^Zty27iSb@AgBDcfY~?(cc4qQqCQse~8ov>wnxe{vCi_V}At>;@>^?w`l&5 zan@5@r&!}`t>UEOgga!Mtu1%cgN%oDi|gZ_6RRhhJGAkz0Xz^rrnnLQbz%)g^N01e z@O;NYy*G0l)cDsJ>b;pJuve^E@$s+#Hicc`3B)rx)?BoBAmdVt;#Rm9L|cmH4jD&J zEN)$#7)POvgC{|agD2yz_wU;v9~*01+>Y?gVyB1}9+Lj4#i!#wAa80i_bB+qiEwE{)~I)7I!1u9;cJYxYwn)Gfb-LVshL`E@eckX^!>vxg;(=Bk*NBuyf0KFt zulQP%2Z}ac;ZHeSSA3(D!=U2ptsDlK9Crp6-(dPTiZ))MNBTDv53%%bD!#2)cHphW zHy6v^8Y-D_=N6H4Z#6mY3@c99fwzf_SHp`_EZm6V+b!H3k_mUGNVpLu$DO;}a4BxM zU}PkE1<};vv8FdlwDL%E%LAG5YK+`%ypq5AaXQqvH4bXL$$%PfGNHz?@lfMf7SuSF z4cY%M&VlUz7vBxp|1Zw7{IdU#tZ^(KY8;zDx~j*CQ1v(oYP^~ZHC|1D+Se<9s^5DE zH@oWI;-mJdZQt#F{B=Lw1I606n_B!J&$}r$O{83S{~z}?Pd-%qu$vFaKHVe5+)GD2 z%qX62?vF~QJRcJYH^bz(Gt(_kyRVM=@)i$w_|;I4{W1H}NBXiS{jdfGie*<87gtz) zl@$jq{u0T=Un&xRnaOdd+>O6N#ICF?4qJVNM9V+qeVRzIL;SiA1@c}^RdLjnA@A4B zE{?%4tcFoI3(kg&#}*DAvhQtNo(eua&#$L&pEt zir3+u6MJ1WcgTHhZx+7+Pn`Q^@p?Bu(B_2=u=|{i#c#oa*v8^bu0OPU%Qi#ZllC^$ zJ!xB@-a~!|K2Lwz3SWfV;9j2RU8wovJ*fHPeb_6uvv@l!fIDDU_#ycm9s5AEd_vsg z#UJC|J@%1k?$GAlPoV7QPod_G&tR|EuHrAy9}xRoG=0c?{AKZ1_-j5EkB#jv-iuzd z*dEdJAoKCpYDdh+--zZ8nHTmI|4ckvo$o~ElkY|Re=s@j{8;>x$v=xWpWsipUyAE- zF1*M2Rb)Q-t$07-ld66*nfL#T|FCfNg3#s@={JZTkiX3*(B_lBHLfsD97M0a#}lk& zdffjT)O?Z@tc{-L6H)U?9jN)FF4TOYcr^~yhZ=_(;I4DFW8gj1S3{`%oJPc#a$$cN^i4j(PH@v};ilKp^iB-6GQAUnrvx=F zwF$Nks=uBjnQ`M}k#cQga@=VfOw13bh?IZ3V0-koJEw~1on~^}IX!rW$?Zj(zwoEr z&kT07az88B0VY+QWis=B@Ep_cDBApm9?yAh@O;Zxay5X;R zsXNrXb0yS#auw7()dOmt>IpSZ^@5tGdPB`WecW>I3pL+d4K?5Nv-CLshiVV~(f?ug zwZQ?fSYXmp}7A(`({yg zKv=TwIlBewocC7Aw7+3c?d~?Hb~qf)uDU&VM=)W(!&>FI-w8LPHv*>7zV3nxaA%$* zo{_2t(it60wS0^Usvq}=ris+sXp`g47`NW+UI_Mo#s$-Z+MgL0%yi2m1FC-@<32u^ zjjZy^f+|1BtDT(S-EMtB^m2oF=Fa?&yxz$VPEdZ)hxktnPI6_)IpO5sJ?K|D1;Ht> z8cJ6ALc-r0oQAyEnHs#$^ri;yhtDBD0IQ+=r4M=j2ZQV%QBMzvgn!s%`6JuC2h-8l z`-+r@oxe;dOPmYLAiVnPOsM``2-TmxQ2n`xaB3$$OPBc{Zgm2|GTQZar&y$XgC_I+ zU$E5VGST`W{`AB0Uxbx(epS%1^s9o8Tl<+6j9R_M zBvY@|BI(XDIquAM>-BMwepeG*VBzKk=UBM8k_q>ONVs_>v;XggTi}KZ>h}<---SWG zi?IF(ZGU_*RDXO*`GZeG^|vKZ{qq^9{q&_!`{>J{`r)%s{q{Mie)~LByIAg)>k7AA zUw~?7FG97mm!RyzmFUl|S`}RF_6JD+dnLFAX26$WHau#5YUj4E20b0Fr~Y4q3pf{j z9j=e93%*G?Y>K@hQV#6@q$@croD>S$^)96^$k2W_HFPx{F}x0iRKTn7rzhwhTQTRqq-R=?yJ(jO3OAX<2coz<}9SlqkE8j0o(?K`#O zpuQ(;4D}s*lM>m}$CorEe(i%o+b3uS^_^OCsPEKHfcj3Y1(bc*66!m(R#4xmoe1|w zTbG<1_F{O&l4eRqDz zrN~>I3q;1l3q|6&$mFZYA9< z+yK$+Lg_b%UL}9C3!&MCJ)!KvUgqArq>t$_|Ch)v>|1g*{;~^2*@gX}?80lH>_Ww( z^LWLtasFDU`EMZcwPAcXWba*%p5}=`Q1irKsCnWBsCnW>H~bJc{7rDHb92dURxU$D z%HVP%gW=9lH093?l3v-+*vZh^zRaFoE|YF>E=YJPecYJPeIYJQqdepJ7YLe=kM zQ1i_UsQG3l)O=Hj{_HAmNl{6{{(|H)P~w9b&=0d=v6UC^|GDji`3HNdw4|g&_D*R@ zIq@mIGN|;Bajz%|AuHWVsB|T-cETkQx11n)PDz!yv;U90-iemPNLSAX@vknK<;sxo zvrA<6=sXQ}7)3eNlqBZ8IdFY!Zpl3AYg6nAk$PqSA9u}r^P%2zT0lH@|3B3Hw-EPj zu|*|``ENb<8|px&ce3;UA( zt5El~y#|$^*Wt3*x{{67-ZzxIVbAlXWS(ceNIDx#jyrF;&$CgqeVwcdmJ&PVpAKgRvP)c2wL*<=^&WW1HV@Bx&) z@FCRin8u;T@sCJ_HgU`ee~ z&EK9lNFD}3vK_cE%7%e{ZpX6*KY@9=bQ><=bQ$0@7(E7cFq~FYpi`~2jc4< zJ5#jypxsAz7S!)FpABW#oCEc{1s$P&NBCT*-x2NvkE8u|h6kcuO3x#{Ih z=a*hUK4k~NdacpF5cY~)QhE_AfEUBAuq)w5$1W8uJTyDwGT4@Im&3E^KUYBg-fA~^ zI_}-!Psmq7-B)`R+=AQ#c0}$ecgBrgP`|g(8|wEK`as#)eWC1_tD$~pwI9^)8(#x; z&fOpCoO=M&@4{XSlZkgA)bBW42UnnfJ=E_W4}!9%2Ez@w-vD)=!i`Y(1rC9_FYqS# z1-u#RJO80j-}&DH2g6&T?g<d?k=@7vECg8Wv`{duislR?7A$GddoIB?&Or-ZE~(?b{+nN%PS2KZjX~MV%JS9odA=nCYl^~CY4UM zZ~@WmI_Wov7RcZ1I%w~8+zWO7eIJy4cfa{RP&(E0ng2^=-%Trh5P#WsqU^hepzOPc zq3k>2!_Jvr>POC~nNj*E@wD(fX7b8eGeq`Hib`je%5Ex@%=qOMdEO$Ea^ySNipK<)Qbnt!M?jQk1ikn@j7X%+c9 z$>WH2UMs#oYq%3dzm_Lfs(r|HHPs^D0n8G4&wsX?zad(`*Ls!szC&NXb2^9cdarRV zl->FSl-)WH%5I$xW!El%df)CzsPGHndbkMcUYx~n6Y^7*@25+jvvONjy2Q%u8OfB} zQjv07W^&wl*3H**R&FZ^|2*-?o?Gsg+X}b5Ucf!0W@YJ%RzEM5u0>usYo$p2yj;4< z(pfE;bk>NZ^Rmft=M^`dwU$nP^tIAg2|p2Tu<&n|zHZ^yNhbUoBH`aOne%@){05PB z|5oW1^tL-2Mf5hA9CtRCzHRar(d>5oY47ipzK{MsXItr3m{hgR3gRCzG!wk zdbG#wrJvgKeo(r@o_D9oD`$Nm^1L6HerWlPOD4Y`iR9yBljF`OZhk)%i7y!W484Nr zu2Sk9z0XCf=P#@rtUX{SepR}g^kk32TJx!gJy7=eUa0S0zJ|{te*;xd-$K>fKKL?J zylVH~L)q;=SiAkP^k?Ed$@7zF?N%I9wZHTim;rx<+3+`eF3$f6Cwu#MsQ&W@lwJHM zRR1{uWgq`VINAGuL)rTWq3nH6S;8K!1!eCiLD~DYq3r!SQ0s}hQ0s|$Q0s~MQ2n$4 zoDGkGdXKCjwEcgm{&p-JOL-gz^_^5>n1$Q~>ienVp}xy$TIQM7+|#VAIkMibfPC+C zLRkxBz5goiu5MY@x=j7Gl}LX*v5Y66o?45nH%=-$xh%2XfP6R9rmU?SUYu6luIv=J z3!X|m`d$k1JNqqV~Li@zK*>A?3b;>zqXP0RmaZcH} zgje}@gerGr+&h(ZK~{ZqhN=h2tDWSs^N3IF2cma=*#+j#{Exiexv=aa@}+eO#Q);5 zOI#Te{?f9pxNDsv4qtFt8S51r_o3Cp73gc+?*=vQcZV9!nU^};z;j0fqrna1~ilIc&^i0Jhq)PM^aeql0}sZ1dF+O=A*5Rny-~DuA?u8r%E&MM_|~$UE#0A#N%s~J zy<1J@{NGL2>c!^o;lzJrf8~y{ROGGBog(AW2$Ar2nH+ag%0`-;D%w1ZKlAXYGWNF_ zm(oPWr7>lrVN%r?ljF|VvUCeKL9}^T`VFEP^0)ecRuALdddM>O?6MrwbN6|dUYM5y+4Xg_5#{+f5DK+Q`9Q1j9~Q1jBgZn*p0aQDNl z&I4r+TRBV>DTiq$$DIeu9y0l1(Z*%`dHzSrX4>;VS~lID|520U&SPaWOn;_m<1%`r z?=35|^u1-lGSy$8tjOxmCz<;5i=-PcnfL$Q`U{GT!zE=Q3s+HAYT?Qx6Run&T!qPT zr_v1E59Ve|^3k+N#jb3`kTDz`k4=|3^KTmO^4#<^Kg#aq)4e{#OGvF3y1( z7w1B~XZ-}!csdViJe^Oxs-Fc=_46cDzh4N|?-xOh(~HrcUG-Gi)9yG08Q+(dErA*E z8JG=^+J|p)@>ur&%REimz~^9FsD7;dhUN56?aQyQ{`*4NOFaLk*oz|N#Qs0-+MifS z`s(Map!)r4>(^`Ce*J3M%T~^>xcz#q+pk}B`}J#XIVbwH*5~Wo{`>~iKE#_)_m`}P zy3b?-yc50!b&ttLsQrdbQ1_T@hT6AyoBU`T*n+Hmi+AAi*w(Ultsb|D_8hRyTll{R zm&M*Mi(C8nplrM4dxvD&$4(Lb4@{0bAG-ODi?*-v5#hD3@Gjh=|kIp*blqL zek=O}|L(EhMe~P*`>X6vSO5>0-d|-0(HkB6TQoh${zI*DPr3FVYLy>Xu6|m#JgHpc zd+qZ2w%8xOB=703(&uLiR$dw`c563EAOAp%qLu1JL zzq~2_tp7#xhxMA!uA0GW%CkAt`ynU5X1KS2?WzBkurKbd-~`I`L^u<T+d{2VPk~yewu7g@Q{e*qPlIP5pAK&!+!;{o==Ml|F2x@_>Sf0mM7Nn(DoHN!M3r^<;gs6L9~l#&kJpz;XIfTJHPxw{BvR#h~^L3 zr@E;8V*IsFWu#m#LDqi5rBLT6U7_}4E`!>Sxg2Ug<_f6&m~K$}G2Nl|W3GhSkGTrg zRa9)_ia^Im-lnsA^Ta^$ldgy?XL`g`d!Cs zVFB?Dg!)~_>!9{Wu7}zW7zDLXFc@mT;RdMvh8yA1IYY|tApYfZZYsaojUTcPG_?E{ zSBC5Z-C91(l_C2;x0MffWyn6z?TW|p2kmzv?}YlD$PrNc4|hTBZ=}Er$k#}y-&0J5 z+UFPrGhiCL2abk%PiPEmPq?vA`x5C;`y=DvRmd4|4(TvX*#5xy^2B~Z7WFE-BpX@# z1UXRm{Gf-uky}0)|E*4*h@FxzlK%-NbN_$&B$FqLW~bm!xGCj+!tHSiMC_D%%kP0n zRri`4ckU~{-@^Gtvs0wsAUak4W~V^2Qyzq}7aubBhsz%^J@)_0Wv5Ipe-wY&DWdF@ z$Dr(#8Blf#@i2cEmV1#KQVycdg^JAGr}XUp3~2LZ0BXK0#(g&N1>x@b*GEd=*RT|7 zJy8aiGj5l|R*#3vD`5SaaCxQ08!C?=e~JuSoyz+mkad1lxnurS zPlSi;s9E?c{@GA=)Zyq-tHoiV3nep{$k@{U?GW-AT__|c2K9`lRu=;$i{8_8d=S=4Jf6A9zxD}$= zUFcEnFO;vbbXJwWXz9EpnRHf)q_fK8xUWDo?|K+nBFlJ4J#7)g{0T0;#l0ZJ{5O4$5k}J zUHNScm0x7iJHFxsWaYQ1>)#A2-_2b;{7JV(MN2oIkbJeOV4Z9A2pef#-nv5f6r5DS zIBNG6z|(K4ru~FHP1=oR{;%*fIThk=zt`QaB4Ib53fIR@t2l#u2R6k{7is^@|G3L; zZVzQ=pGkgXKX-t#pU=X5TkPzL#Qg=GD$c2p-PBPs{q0?XUvpu_gq z_1a%FJNdkdg#COz{Dyhw0{9)gkaT39UW6>W`eLa2?k<74zwc6b^!(}DyZ;1pziDI33bn3FKGAwLD}_vpzcTL3wOh-q4L=eDxcRt z<)=T?{euIb?j^hyD&GU4&iSr`I-k5A>YQ&7)IElSq0awqfV$`JMyPuWhd}KY+yr&* zcQd>M4uv|WyaiqfZ-u%Ka2RCWQ8Aq7*86JE?kl_<%HF>NYCqymsQU^>z&q!sR@?={ zFa<{8NH`mga^n%TK1suUB;iIw-6J>#>ORAGI_!QJg%3cj!=}RJv1#fzjMEQ_*8ZWbiyo%mmCg%PJW`>15(5>} zk;CxO3ayU<6^|j0iv}uYz& z>nP-4MVWTL-;aG&S>dT)21C$Cy9=ZDKrB+>AnQC0a!*E; z!kHZ{cEa9@RV3`aYN+$#S+M(@$17&Tg4p8~HH1?;g0>!;1GS!;3-`e%pzOnWP`^Ju zAIeT#0JZ*m65frx5Ke-NV6WKI6^mg3d^=u%z4}STr>+cHuYRU@?KvUqkk2dj;l6y%7ZqQ+ z?vQoJR~5Tm8L|%9Q?b{TA?uK@E531M$U5X(#bfb8J2(CgY904I)H?15sCC?rQ0us# zpw@9eL#^X}fm+A?3bl^g54Dc_4Qd_tyX5E}6$ePKPV7(7(u1r&|Ef5MdqMPX(cB^H za8G4YrPkrKM01C>j;jr|UaJGO-mMFDo?Q=ig7slCYydBW$G}TrL)Z;Af?B^H3$FAjSlF^Mv0iP3oP~TM%!jSv z{qQ6>9i9xeFVF^kjT3F5#)(sK*M2}d7=x!mt(KMyukd{MC%gc*C%y|| zUG^O=f;!K>80tNiOQ7~OE`>Vx?h5t$c$dLW@N#$wyaMXGnr^Ts><;_FE8(^9DyZ}G z9#H!oJ>i|O7u0@7Z>W8%J}?vZg*otQsC}1yumD~IpN9S6vv2^^dj;3R?QkHB!|UK) zcs$Je&rzp!OG-hwS}?oJ!9lEqUGxB8m4D za$PwO>iq@W?Oxysm5Kd>iBRtyOoDpvU^368{e&sV+D|Be+E2I#>VDyS;gS1;@2`9q zefIxF)_YS$`q?y-+5fM6$mEAb+h4$+{e?#=pC#NLXS&G#!ef<>!lbIlOy>Ll%9$4K zS<&_vq~9RwmA~yTK-*vNLG3U2%{@?AY7fPY_7s{aa7l?=T zW<_N+az;(KvXXdOctR$xoD~+atD=>WO4;L%Wafn`k>`w>%c|qlq$i>JId12)uy%Ce(e#>!I$a+W?inx1iG92xnAps@y{Sx_@#r@t0P=E!oC- z$olx*%6DM>ns+O=+VgL#d=L3kWN7PU$-4LMeW-iywnN=}w*%_lyPdEp=gS{J-P8Ob z)IFMUsCzU&vUoqP`~>-ZoUt4_NR(@l8-&XF!{e1i(<^6r-cjo?m0L)Th)43tcHTqhFm^(M!iL2h{r7K!hM(2c~W zaS|dA3EhOOaaNpBeRJqm@~LrSDDjn6-y)g#nE%nQ|;>-vNNFeWoJU|9~MIG%X*>q zWs9Kpb$w9#q<*M<(g4(cYBA5J_iTd5n$Jq0=Ce}rq5Z)!WX)scQ2nn0ceVFQ!fF36 z1RHw7p$PtZUq}qhazZimLbIww=Ci2V?qb#tH9u9OH>T?G&@7k%XTxk*W9^sqKk=U6 znG>3eyXI4Icl8sY1s3l-k$C63@h%W~@94?ULiCgmm^lB3>W_v<6xE6K|OPa%io!msdo)PaE1j%dbM!|7%e1alH=p{?nydT<*tmlE#8hdtxcDgd;-tiAYA0q4CadB*QJoFLnx|bZ*`f~Pg=VSN{ z`~<4JKZPpq&!EbC7nJ?*Ih2_JsE0FZTq$4t*yLmjj`{Tp3c1e}@hts~jQsv3tU`!U=sit&t}w zT-%i)<44_a9hd~`;VwHx)c4o*(QoK!5IzQ3@ri1e4WasPBdGp+EY!X3$3gYm#!&NL z6R7#`c&PcWDb)Pe3~K&s4%I(TfV!u>1yp-)3Dr+pLD>~2LfuE-8p{4U3H}04hWb9d z4U}EgHmq})Q^K61a4uu#Da?DPhR@_Zw(ZVoBJK8cljF`A;r1q+t4z37XOvu-WGq4 z@KqLn50m3g&u}k`zqe@XH}qJy^$GVSobKg?tjAdYTRi>311+BZ;cG0O{wDMOU-(*! zXP{{F9(wk^)OAqrBVJGb4jvp79*nGYo~ZTU4RCYSknoK#EjlF3`j~y8o5D9+e7A_~ z3k{V!<#>x|_fP76nL3I4WfJdY5}x|j^V9D}gl`YaZoI?d zZ+cnbY-F8_iMyPf@ZIEh6zv!ie_lA(^z*_Ka35QpFWR^T(VrNejI4Z3g31>%@lOfg zhpc=Rxc>J*l{K4>a+d|na=|3jg_&>w+XG%t&`5(QYQxx{X`LNjZeWL06O+O&n^da$=hl6kzEU|Fq z;ZhhxE`x2V%EJ|e*Sr90#i}dAA>38I;w~o~uEM|4al#Q;4JB(_hUi7Zk0UR3W`|>@ zH#=MnpF^GntD*d*4{1j=;U|!vtezthey+*#mmGBFhv&ihZ~^)nkHkq;PlgwpJM+Kk zvHpj;*In*QtDg!#jou3MA@MvDUIORCrLH?fZ&~q@rd)C4dJ&aH=VOXKox{E#*17HW@J`y%rq~YA+7aYj_Ji=Jc3;)U;Sa6< z$0f54`A9_XW0QIR-|heQUZb7Men$8YiGLTohUfbnUJJi~x(DG)cmw>3eCQll<4{e4 zc3!#{cgbHvog01=)_LEz;h!u&KZN&Le!i1Te!dsU&krVZ|BsuWpG3~(eztL{Ao|PE z%qOz`jJNLPi(7d5IM&7Cz$_{?}|2*yVV1zOS?mPS+@YOIwS;YBts<@QFNmHf znm@FC^OK7xkEc2q&^Pq@7nii z=SPmnrIa)Nb^Qq*^&a~rk#6K`t8=M{-O^Pg-pfpmJC{eUFu9v(b_M?I-*%4-BHSM5 zN)h{_N8~D)RMo>|=Kn}93pYr#`Cs}CqJ89V`?t{M@2jEa>we~bO{Bl+vHu^@ygndu zE&iI8FWiZ=r|&Xx)QP`HhW?G5xV7$DQ=ZIMZkTN8jy-wttq%^J(8^Jk-8T7S#Ga z8)`o-hj{hecSAjQF68~c$Ygtte39pvU^4IjMJAa%S+wWCpL|V;+;7iuPo%)|b&tvX z{%_DWX?sa@_H{;fmaF!H5sNf~Y@IW_kh9%A?pVk22cFsfqT%{81`@ zv#X@1c2W+t|4^ZDuo7y2Aq2I*5Qb`35jY(>Q2P{BQ2P{7sC|kU)O=Izmj5ib{AWYi zQIA8}Pc=~U*c|j{SIvz);r{LqWZz&xWFE|b^IA^(M!i4UxAjzKx=_JM?TFvI%akdONZirbXY5yi2%kRa+wOnEp1Ad1R~H zd7f>e+4<1cGw(rtfAK!?*7t0W?7&~^6KLbpPRrK^kxwjN@yLgkueix^=cCBS7Vjsb zjdSQRZhad0jPM$_p#A>EE~wwX_#AiLXa5Ck3BQExqPrts!J%+3@$>z^NPb!Wg* zjX%h^*LLb6s~^;X>IafnJN2CU*c)2sK=c|o$Cx|wKk|B~q0`8<;~@UW%APx9*U?@Z zJIxtCw>wQlp8t50<4#kjnaRyX>ks&2pSE;PfGw+9IxS!u*oO4BI;}+FIZ-5@)+WcD zlbn-HZX;Sh!Jp?n#c2!Y!}b=wok;joMZ%wEGW-9|878+EEj<1_*O|__7OsOxxU)pU zoozDff2X6#=Ze>|6ws zsxCG;?p)$rYWiJ8>!;{ZPFFaW!Io85IG4jVu&2e-O(dQxo$eOTl_vB1KTZ#er>AKB z6FthQx6=#Ghy5*lACd4^JAEzu)h5TCe$F)(zQ1VU(W9IOID;+RwIboJa|T+t>r9S2 z*E@qO++flAA9|#BgW0WnoEt^L-Q*0ha5tG8cW!ouTDak&g+tH!`>jy+$S|n!N&5k= zdEu#R|M_vAiiY>Zz@uiD9JzeXW z-Agts8Mox(B^l2Qd?shEY^{TDywyxYd^}UDQ@3j5L?H_NSxa0O6y>^_vqsflfc09hL z^Uj7lzuV#Qgm&^$^-hncIi=aN->to~$LFMHrsWPv%bl2>n&$B|#{HV)QE3yCbMnVe zZsKXuFj4+ZK!0;jNy{5?-eHfHxDPh>QTe$kscB==GIP>$4|{vg#D7F;_V_L-IXRhW z`fumFl&n!BvnO}SO-mWoc~WkAe%cXrPdD_BsOP1nPC#Kwm$b>LX*v1n*;!pilij>7 zDI@c;GbiMyb%_jbIN}zTJPx9%Wq~w#& z>yq5q)37f8Od68ZJ848x|D>#>(Mj1!$t^s`Q1_>zf7_9A7@syOJtdFEl9oHliv3VQ zoQU4_$wQ{(<)@8L9+*BdHzjvUlOD-a8@es%4E&EobEpaAnSSTg?5zBh^sKa8kEi`V z^$ykle^BiB551h+^oc3?G_Uca)4QamWOYtFcv|PwQDal`#-iJSzjqzUz<+p-e>X(c z{}J_n<#$YO_JkZ1_;VV6kJ9^BeoZk?dUxwT9#8EIPiu-gCn+~6J!xW6N>YAO8nXVC z3sWihEZkD?&B7-)DbFfqtof%UjWTHpt_n9ksUI5INfU_AYVs~m!&^MbW2np)o^u*n zou5mh|4sgm6hAo~XW8`B9`%2oPi4~c@9`lkZ$fTnURqurT|Lpj)WQ!nGW5^lZ^}^* zG&UtSJ!?#tl=R$Dx!F0^B>xd&D*F7XUGV?ld6K$V1&)U)R7p-!CY97hPe~ove?7JD z_+R9s57DVjsEZz{d#mvqJq`PNl83o9ev8L*yPM9?|ATZ?V{}pdsh#)8~ zpnr`o$xZrSotrW~ZBlk_M&5LHuo*l!F%}&0IeHkfd9QzRpR|c-nc14C4h>PQi2u6e zo|>fkXXU5mW~F2v_R|9={3qn)CTC`+rer2(rjPuG|0(Dk-{i*RTT`<~rS+PSo|!*5 zH+$5C)cm}EsCk;A*Du-P`9}=L;NI*gRn5=+O)rloo_5$rIrQgKdhgYpPD>Ag*hs>OHN8&-lS27 zbENv~V|GlFt0&|#eP)k;kg2P0;-81rJgtxD_0F1*nJJ~-1!=k2uF4Pi*E{}`YYsoy zyCZsMXN^uDL!`1_XccC`BoCf2GBZ83f7a;iM9W>&F!g38*8iFE)P{BITzUAZ)Cvwy zp?S$e)L=%rb=pr;RdQnbwArZ3k-?KNM>3XkC}ZyAo%}z}NqyOdnzwKJM~-Nh*a~B^ zvh(uOQx7*J*@H)NaA@AnOw?PKBLPseKPvAd`sgKQh0cczpCbGR{v+Kcbz1&!3L`x= zGkd})%*(7%hjPKGenP;lAkgvEk7+aKRY*1<$F|{Q^u$Bx6W1n z$k_iTSBVZaCM_>NB{M%YC3S4tq0A)rmXt@uAF{2lv(DEqq5JO+r~2Vf?Ne;r9>v5o zk@+N_|1qN^xAB~O-enD&ds=v8&mW2MklmA$kEv>ZH2=E&q<4P)l$;rjYNd=m?=rRi z-e~1CIU<|B#?2cJ7lZoWSQ=T%f(6>k30+LMBf8gfn=ks}VbFL;?m1QDb`8AL!un@I*m5pY0M94;!TDDuFcdiBY5`uYC< zZ>_c0+N&y+^x^35R(Enzd#`zY>zluCb!%G&h&RgUx7rqLP~IZp@8pbvf^rT%qu&Jl zwhcL{dm{Vvo1Zp$d+Gl8t5tMboyf-H>O}eRU!_iTA_&XmBg)={MGzg-nHl-FqkO@Y z&z#*UHMT|L(XMbjm)5GSX1kkjL)^?2YxN$^U{${92Hq3Yzd$sz+h|_it5(28<%pQ} zq3IB?-s@CeuC7KCxy*D8RHMU(d9bSuwlz_D?@FuH>9yEjuG}I`WPx%AdqeC7#6Xn)?o zNhSBvnM$czZ#LNeG&t9Wu%p0KdifSLkCemrZO8>EgqD=>dqubJGOkjkUXzu?`zieR z^T~J1dU5mE#9ZclsRC6=x7GnyieuU!ELYpIp|jjjNV~eLK;IM+qGUYOkL|nhkc+M4 zy6ql#+DcZlE!k?L-Q3%&qql4g{AJeS2sZLG)c2|zy$PGa@jjvXV|-o9O(>~(jzvzpKX zD-+6c5D;;8$5+iZ!HqR&p0UTBl1ndTrPrKWV516n64im-DSgzLsF4sKIILZww zri+mB>y_lWy*Q{K+shR0ZEl)#$C1vqtM~Q5Kia{dZd$+PhEr>hCEZIpf;md9yM8>v zs~Zd8rUGfOUE72Px3b}5_|C*F`%hvG(lOWE0D9!(8xhGhy0LhM`cQA)2^L5WKHl?_ z*7Mc6y#^4cUU4Iw=yKnHf9~`KbWm?~K~mj34JVqW*PZ@iP*D+a>sFPb-gM2iOQcaR zwJMu-3j(~58lc6^Z0o7`am^gIUN}Qocu2qAim|p*--@4yQNItv%lf4Fq;9xE_9mEWkPXQf>yHub=nSSc^1M+{A3k9QJu(9Vf{=MJ(UXU4s@U8 z6T6`48cy%n&Ch!L(`4gd(lNkhK}pAl&QsJa72r&()$pwgN~Q7VfOS5kzLi&npL7GL z09Rx?)h>9tZGoWReG0E}3gnMm^+Ej~bjsbm^q^5Ez{6Hg?d&SRgh@R+SkxnY&hJ7W zCQLIHoobFuY`*bqud^j6tWiFA0T`%RTApAbV(qzu zZnfD4r_3+&!sb-VtsWbgD1UK*Z2KNe5S`ln)v)ShtCz_`wyg?|?DRJ6-xFIuHD~*K z`NYOcrZ63rnQ`6X+jOa3(>m&j$OWu+xpfBn&xb(qT3zg(mIE{(U z+m|%VlFz)gSreZ24hz|!4>_y8=#V@&s={g+;G4T#+Jz)l*Lw=)gX&JsX%4zskx%$# zqVuW+Hdx&t$m*4vEA4}5)hcpaC!3wu%zCvQn83JLg{6#}JlhbBhH!lo^-s<ISyHEJdcve4L3^fg9S8OUPAi>``OQAx)O9Wb!;2{IVdrMCh^k zfL+Z{yP{X(EVw}`xyc8z?7TD!Eu>62zu9bd0o7&&@;uXQ;45)Hm*srgb$IHN`TQ&J zd`X@I!1fye8%^*Yh3AX%oIP_VSXwEu7vo@(Ok?TwLzI>BjcOPCQDZk(s#FZCE%I2R z%CdSvz3Ms39A*Ky;H}V%+(J89DehFOnv{}Hxx*pG`+BwVE~SysA{5HoMPXp4C{N26 ze;n=HIQEuGBG9iirmJ9)Dr?ma6c1E#PeQEfu0nz}HU}zWAD1G1iA?h_l(CT8q#sCR zrXQ<_9njxR8PYsA-Daho1q)y8TK1XlLC`BKC)1EdJSAmX&!_9kTA?04^Qg?(c!>sTQH^>^9K0LHkLwpgT5fkepD$`H;_40#q+UAOXT~x!x*e|x(k)lN zv@a{BsjN^-4Oc74dgTFoHJlM^U!r~j^0w90YC9+ROyFoZHyCqER*;>*;Vm+bA=+L8 z{1`e;m+eJ~{$wmucH

S>8>y;8-irPMb|f3tetab`v@iPd;dPggg4zFEcStyWBV zDLoB6Q_?2)W6bVHJe@BrC9m*C^WD^Y$$shIlhEoNbZTzRSkA(+EeDk7FRLQoIhMKL zkE7UyXGy)28jiqG+HR&HTF!+xH1gZNK5h~i3KGE-w$m%6)GtW6f?MazjNbA0Uho#X zHd%qag^*C$d~hQBN~^F;DKV|`QYbs{N?NO5%dD+aC@E4XiO;Vs3UJ$vnY7y|+M=~Z z*e1ow1TLZ`M)brkI#a6PlqH*fmyF-j1E2LUA<4zQ^yAwXQo_5~m}+%^ufS}45yD`r zz0j0rA``Iad+N{bQM>WL;;W9`YgLNz&eK^4{b3 zy>%~_q!&+7PWh;nLeh@IPfgPD4}rn*nW%qojQY#fF3r(JP;E$BFnoDqKocUT9cLUM zk!%O*fwbZDHZ}r1XHn#*ls~|UMR<*D!Xt#fBnOa>^70owP3TE7equ^ws*1QJz^^2p zhlkH3WGaYUjT74LvK&Vo)=w zVgYx46~q+2IUb7Syu{8vmRU&lx42YHojcu6DS6)qr53+sa5QXZ`2b0xpStv>Mz^ou zI?{cIOK%sP>$-=>E?{C?uRE`#6Vc=ACNy_?TZV?JlR z9h$`VvCKiTKZDPwHfy%HExAssTCIR+?|IOq{em314Cu9ol=X6kdMW}eM7)leNHzgw zP>nVYSoW87h0*s7UH{js_+=`-der(CvBTVLoE{vmrtCgkwBi!h{dN`i6n0Eh6sO~k ziuPcfJ28(3^%GTmNw514s_1$Cy1!0EFB`P(?@`gu+I1iE*8QDkUOzi@UO%GZ=c%}R z)Vz*D90sl&;z-ZszpCiF{J9{xq|7aZp|`2%^(@B^^@C#>$99`@Jy&fS9<391w_%>k zK~YNvX&s8b8^=yP4$i8UPd@cEY612V(m(K^)y@OL6`dMU(Php3l0XKS%d+;)8OQxxkH zfY#}UJ!1B2%dj4lE>~-tO?^b3t3DAeb}!eu;>SYz@Lcu5XlV=Xw~*>~ZK0ozmMCO_ zA%^mXrG8AkDk|F5@>fbv6LQQ=8QL?(GWREo+BY{}0~y170WVr{#l@=o2l(5homSG$ zU_3z6WT{MBRcI(Jp#I4dhZ5Z3E7mSmYE7RyDMct70ACKpoG*}O_c~K0=M;uIq_-y@ znHonTqC5=gj(Xi1Dt5}`@4R#SyJ#Pu(cc_;ZXZ%HP|}NzI=9m}hx@=sW&FE_pKVQj zfTO?;XpDY)TvyROqzQ8<(1b@Jc>`Oi6F*fo`Ex=E}M?d19>9?D+8=mQ3Q_(L; zIZSFS(@gf?)5MM!we2z%F9ArD@Sgz$0Dxk*^l5nus*7Hwf|5C-Yf;oApL|4WUygsG z0CLS9_)17#I2I{Dp`Y-X%^AmUob~ zTzF41KC>Q}S#=gJCZ+W1Y5Tq#59~!Lc^&c`@HRf9UpX?w4?6x=6@Nj+zjs~XeHrAr z0f=7(yjS7kPPng%jiCyrhMY9*4e<$EZdxd{_Qa+ab`B?I56?Ey&fefwcyv-2Xj`YV5(MnZ`ByGP%xudyJcj6k{94;N512ezCfVNyeE4ssi??G=PY1yPD?^$PRZh zi*fQdoZ%j%x5*K{Rn+P#rS($qI9p2hXuDX@ikf0+3p|)NAMV#!X4M~Oey`R_rmW?< zJBG=fne+Os>Da76;>pL+={OIEe*(Ed#%8MP;%XWHp1diAz?TkpY<4YQu5J?1Llp`Y ze8Pt%YHp!VW0{jTBoppqq*9>{@pSWYgElQ+7hy$NtK;Dgd|r=x^e=|;3%{Y__p0~} zN8tyH^cYw&7%ftC43G6BN*7_6t>V8f>g}KegH^Jp<5y666orBjd_#l?nek`*gZ@z! zy?4+-|1%Z+A)l*pgAc!MC_X$f68}#X|ItzNeOUaFr2~T(#xC9A^gEBiKKL;(+*NjAu)Ywp|&l(qKcu2}4VvzssOS@XE}wP$#`(JGdYms`J9LOYXP!=sttNbk zJ>G}|p&s?dv3K_j;<`Ws2qn-?d>*FUxhjI%=(UtQUoBB;YZ#vMxxl+Octpx7)-*O1 zfsCEtGl`$e>G+gn>MqnJUV~K}F$DEivs2A&+29xt4}Uk#6ZHm}Ig7tfy+KXnPp!f0 zQZ&z}zFD1jXilr~wC?%0Z!Z*~f1WCBd;FutQ9mp?HcJH(wKN#xqHL$rPEAQE7Ddwp5mz?2cKn&8 zQU&&66sH(iMd0F!)=s%cndpwh{57bBvuwdw$L&Ha>PD=ChnWcWlJf1C7ynW`Kmbi; zu#}vPaSlC*B!4w3NW)tHO2SNj1ZP8PvR}S6NX9PPvSR< zGM@G@`a78V9>F!}c@E%%E^@~4EOZu=dz-zwV}k6`Ep% zOee#+_gKRTDq%F_X9tbLj)-IB=h67_`QFvlbp*RX!DUzz@?rh{>@H&xETAKb20$NhtbYx>+3~b6Ms5HI-6N&dN7u0C*>Xn23igf4y|yD zDXiqWQJPX1d+~5_|dX0I5@0O~WvoJwe3pAH*##oxo&W=m}4vxdswk!H`D2LDJTZi&t zFfM$*id#qVVaMlJ`*_IjQPKTAQw96N_YY#KVBdKypKCk&da}Nri6y4oLBBj-&b0mw zW_c9-jD3CIU`pnjkR9#ff{jakx4uS>O@vgtzFIE6BN?YD*LP-ZIW3L`)=2$TnxsB# zEaUtv78xfiaT_|IquP%1v&N{qfrZd;cz4qO;CW`&CPk|aw{pno2bO4`Jzs!uZs-}Q zwqDnBg_UBjP4#`T3P+>b_Kx$w7JN+xrn*o)5I&52B}8XPo}2*jeQ^znyXj^fyjA)o z-aP|9m!$sL)tR|z`1^w%B`pxpZ%caTn2`&l1f_xN0QLEiaU><#p=*WX5dYu8ingl= zL%P}9LR@gV6nwJL)@)%#y2{MvDMDZAK0x)ut!!pS<5l-yqL^70Ujx^WdpY0Rtcw*y z>dH99f3&bNUzi5sadl*`S%CUld`6#w^Eqi%Rj`dOA@RjDe#YZ(QDV^>r#1BPDjFAs zIFl@NBM<@Fsr~Qjb@I&v@doWzyWRy7Eqzm z_95F^*DuHhf#1My@El35l!1QXT21bU!-RP+7*|rKie63Y7=-A>Dou6700~r-AjBJ7bx@mt!=Q+`nu;u6AU)zPxX6L0d z+N{9Vr^Ts`^MuDPW(7xJJ}!_A_S$3EWQqPmcyHSyyo7lw+`8bzYPrx%PD=NcFL8-- zll*qyI3w#wXX9O{=fB4>Ev|o<49nPx_5tD%ynU2&;L10`#5_C)J{-@^ z6^nU*As1!VxGeGSbH1mV=buKtq2$`P78M4viEYJ1l_Y=_#5rKpxjG^jEn6yh%7?ox zBR1wT%Z#s?Y9sQdJ;|soj%ulF-$T2p5usUk@@dGyVEyb$@G))FD3w)H+bQeq6+;({ zf6|eSZ0fQ2IqW@L;U(P+%MtG#T24Za;nil!dGRCGy=Q|>0c9WrP%jnfmTS)zgQG00 zIPeDEU?c@yULQZW9O7!|TE5Yg=s>uY(+3GfMQ=Tz-FmZ9+d`{GK-K#20p;M>1#p7+#KQws`u`7>)|tu3|yuoeWL=iB2m5{|Ic&dt&3kT zRg``SZP$JeFH`YnxxOd5BRi9?MEzy>u7M$gXkARGr@)_nuJ;5y*DB(?Y(4VV>;C&0 z2DiErVcegwP*-xz5^z(ewhcuh+X~J>DM4DMqjB`(#mQ>NZaASbT)Dc_OXAAtuk7jh zgs5*I76d6Rq@|!A*ph(Qv1Rs5yc+d=`Y}=d#9ce3u0x_&V=5uJ_>R6#G&4&G$Y}sH zkfy5+UXy@x(efnv5vamtrs2>No~XTc3L@Oq=pvm>p?{sJZ<1T88TchG*tIkdPxz2Wr5C*SFc ziL;tnWgQPLks3uE<6CPm))M*d4(NYxde{7{zYp^gG>tHc7FYHTy)2Ln_HuRX9#*gi zYUmvuflGHDw(E84v8=lgzTUl0G>6s^!_qDC1Ay6t?t8V8_d@_$WPLMyd`8B`6Vde z;A^<9<7m%=|9xw>GW0ls>^{2M?Cw!Pkt+Z}UlC}L#Si8&IW=uu4WOp?1rzbZcVMJ* zB6JTDxXINjSSCoteJ30P#z**GSHE1}qGYTo!=NfNsPi0G{`g=kL7E1%9e63W=f#<3t$tI<+6#Zz!A7C@Rx-SW<5{_@(RoZ+L^;BN`kj5Vn#I04* z{i(N3^fhkYdnPah2dq_NlL6gw?~Mi`Kr100cICPJJ8gtC_9P(iR*cifKY4n)36ZDH z1EK959*f+Z^Xt_Uq+iLd8!rqXM&5wMaUDt6I>@KeZ0F{HOLnVOh$CiQLVe6!dB5H% z0*SECrEL(xDkz!`sbiI3y^B-S5iNT;W=y-n=ehCJOJExLDv(nc?Tyow9G6f|u&1x28E7qcu`;M_XstN1sSq1$P6&2uim zj8-_l{w%0K7tXoeml|d=^YNGU> zi^i1bQoR`*&iA*aw4mFiD>*XpG7k2)VuK#RbBIQhbuR4F9~--(C&%3eo!b}0InSvU z8m(UU*C%oxI_r6SvL*sGoA=iE*EvDQT3vzgdafxSPqiyL6c!feb{Cm(bqp(XPn}vD ziDNaZVkt65c;S3uvbgTUM;h%qY6#9|Y%Qtyd%O z%Mb8Bivu_cOd8MR ziE<*^bVL>y*g8@?LH9DM#a zMRU4_FrZ8@e$97rueG~G-+M1Vy7U&vBc49NOCpAT$lni^FPH(d+D%Cm7pe3ov1)X8 ztKgkwL#?=hhVTjYUynP7(wik@R&%@vdr#fv7clV>be|{HJTnCFTFO^yg04%G-=d)>?-tz_iRTM5{ z33)I)3ou_SnjCmK4-lU$6`=l7df(|3<3+R3;!+D>(BXzb-7}==A%W1p7zH z75r$j+#!CXR5mGuFE>@)Dec#q?G?FK!ESj#M-u#ETg(RQc9u627%o?a>1$GKCDaMd zE!J^XG`UuL5u6hZuN~+&(0KE*Ylzgu)6;8>p?fWU3|<~GPj8|N1@l{KGGR4?jIqRM zI<&);$TKghLJLiOj?2!T3x2TPd_6 z`S!he*Xl#h6S^$qcMN7~wB&M)nKZ{y_;5rQG zc7lIJaJGj6;~K}0$G^C8CNZpSF~Bb~l#o4&WsAwZ2p(TtLk>cD7w9|4KqR@6FoY2A z^fevqtIz*Q2LayF_;`{Wj~-fZJ_O9j#oB=ncrOq-;suWaTk=C@h~_mP94vWxQvW4xF=MDE~o$B#%4 zk3jj!S{o{^Eo3>id3f$j{L74=p*y+IAA0WmBBzaIzB4SZxsSfezPfUm&iqosZ||Ql z9(+dseyIQACsq7wD*pMS{1=%=fGHdqV99ii?i!o)n?V9*4Z$)@0jYyCy9k_N5Md7C znMFiTt|7BR(nkC&Pf&pGNZOI2)~#EB zza{^v_@tN=s6le#@LE_i%qZj;gs55BL~2t@m(_VLM(M$IKKW^2jMPd32Ji8_FC zlx7c`qAi7jmxI9PG=8Rx9|gZle=$@&aj%5*=8$J}g8`kenH_QEgns`x%<4vD*_c$@ zewK~PaIM5fbi8x9w+AB`YzYSst;AF}Z0zW-41;BgE~MjnuKJhArRe$_xo6;W>a&sh zOr-uaDudVDN&7oj#zx zKT_Wl!F+VX*e9H0|3|0ACHc)4(oV^?9|S|qPwjzE2R7PywZs>_9HOg;HOccN`sAj} zTe--PsQB4cc^F$_=kUPspu|2MQNn`Y!!8V zH1yw9bafCK`Uw^NXo7|$uU$0-uYFr9>r}#>J}$~i+tFQC8Hfi~_uRK*scI^ZMS6Cs zKaZa^@#1;ky8vZv#$YeLO`SnIX9b=&yG%K1j)$TiZ_LXxA%jnCu`c;Yl$%c?w`^_W zH=aC?EjT0v*zc?vr#~~=(~s!aUp_4lC#R>6y_5Uc)>G?b_l1Vg{&*nDnaA7@p{;tn z&fmU&o#LIcSTxZvKBCVYIG$t@c^rC!0+Qv@`U!$ZbqewEoA4{9VbHn3i{4fI%At1> zU*c(T*iM%+dhWssAI~5yJd(!3G^Z(kI<(@yW#>OTtvZXw_$Ymxj z%9Ax|oBM*#=;PF*PoF;V?E`+Y(Djp@+e560_T%^LFH@OWAffeUQzXxc^~^cZHP25j zu8M}1M4P?MYCSS8wkYkl%i^Piq{;GczO`8rkzWQ9;QM5rI&E?vz0(M2 zeL1X^LJ#uI>J@GKG=}7mf4N-IYaY;T$lp{p8_J&SN!Z89x`k4 zS5Y&t@ zV>|_cZ@LLuZ%cjmPX5A@M!zU?JAMF7yV?YuOiv=W#F%d`i<~LCGy-~c;4sMRD;Y;l z_Li>68=$CkF!Bl)eZ^9(VAbAL?gT zQoDwGCA&7$7l4Hhw|S)g*)XLA{ylXye9s8VAfEhl?l_cAb-n?eBS&` zh6fMxRsEuh-l=)>pEL8hrg+zDn~z))5{~@g#=CyPjQe9l_u(B(q7%RPc>BPdIL!a5 zuW8o7g~0{Q_o-+HBGJRyk{?$Qa3MIMh4h zK-RT8lTuxLH}^W8tL&9)^b^c7RTNoac;C-#Zk8)${E@HsuH;_6;J+rBo&qvu+tVVp zzcSyeYffgmBALTMlJZuVpDXv^49R@rC{H}#=q#^SOyq}@9I}scmDKsPP6@ewy6t_ zcNLTg%v4RK@EVRxOBB4k)tvXBugbq2RM$71^G)^l1A$ig!qxvskqB^5z9YvW5n%BjL&!l+ttU%-Y0TsQ&pZRYY91-FU zjD7| zWtP{F`~yHD(?BBHL*zaPOqR$GYymvB+^Qrsl4^g1@!WXk)M;F|SZxPbGCzhIkU6(biD7y`+%*J-#&sx8bpYt>8O+;5o0N zd43Op2eyKW0UmU`hMzND{(fSVI8z+7IwTvVqZd(AtS5-p8v2Q$dEmZmgsDUSGBvOG z&-*BD{9y%~5i;RY#i{e;_nl3gy=WV6k%(OmugmM6N~C`p2##hd$*Ru^D?nvLVkICW z9CGM3(L>)MmZk^i+`}urO&PNONkyoD{W>#|eNo;PnQBzE8xZ5uJB)iO zW%4;371rnf`g5QDXLNTM`~!&^LWHe7oC-~06PXyF8DF`>yqAvkvUswI3uSj8;g^hr z-!%Q!j@_>|Xs)CEJ^ZwQ|CvVd0A^2)2q~PQK=13aj4tnFm*N18J}E!rGx|d5mx=o{ z#jK-hNPcIfWn`a+uP%GvMOjTj$+Y&5B!`@>9E)EghWWK8c{A8TR|d#cs+@+n5&SV-1vK`F60F~QtYMmA)+0ei*%z-en7W;zlUAn)~i&%#;W>?2R{LG8w z9uAwOW=rzIzBjN3+>uTM6!80qvne4@hVx?$ z^nHUUrnDB=`_|WQ)13r;{no*TlVAVyzl6V$_KI;NhOTwC-HOR z*n6%d9S-Bw(|v2?1+IHqGzOoVH#Wjf{PuG}$x^GO#gcbhEvQbMo5PDYi2U>#f#etaF-hWDI+gKPHjOiZ2P)7;p?l+Z;SF9tK6)r%TOe=zs?WB3T1CGzh;8{_DnicNo4LN%Ro=X|Jhs-J zJ!u3@Udm$yPUN$F6>nzomnLMKuSwp#fVm@|?djx<_aV5HMtfks==3r3PZxBk(!R5! z`p3ZmXl6x&s3Z&!_#_=Vx3WG-^e4(&!LJ>d1??Qn9!$yKI&;gkz)%`KjPEtrSxKQ84AWZ zJ6CaL%D(syIpI3$M4G;Yc9(q3F{Gh8wYAcr`q+QKuI@?qPI3^ZAK7u!o;3qOv3a>@ zZZ4Z7-539bvCQRUTSN{^3tORihW5Bnd^h>tYsYWL42SSJIsEG}{+kYmhycm6{Af6L^5=oz1zTQCkUZogKqKr+yw`{in` z(7$4)>2cKa{5DaqQwOMEz7^V~6F({LdtvFYBMaP$_keSCIGoq&{!Sm-ln29TQtpX^ zo^S-n+hP{k*uVSEV_<;82YfYZBp}pvxGWx40#0r*ezJ$x0^7PRdjFuj8G=@5of;5rGVW+B zDKC9rjtM=NYVh%pa}~Gpua!5tW@;8A1~?880va)M>FdN@B=zluXobg9PwZD7hw2Mlk*^Sa~yw-Ag%#IxtLxeycd;x|7#t1I)>a`50ahFYtLfe*FB-edlU$WqX_? z4%O%D2f|cR8h0{De<#P1f%kQI^gbUkBu+~`0YCQ$f8MWVan3MqVE-<))aXAAmDB%J z#W0D!=O{V-+T_zE$fL9aQl(jk5Z;7L&qNH`B$~d^5ArJRR(btUc@_51U-6}M+_UoW zK~nlZs_3tcl&;k8U>$;cL~c-8jRw5a=-1E;-V9&!baM1)*>P|yX%$p^kP7OsilHiM zPUhwD6T|d=hcv1cJ6b+o*X=zbf#d5iN1~FzuT^jou2;du=kNiRoJ1Po+>8Ewx%QsT z9ug?SFsk#mB-z_Q0St3a`SZ5KE7duC8t+lQK3@UO)~O<>N;7{}h)V)~(fXCvw~Wvp zy!YZ}^mxZHUXL$yagAVT{K)no&Qit=(VqAI4C)#AghBX41mSZS=Ds{X#738rkWF(j zu0MkBK%KFSy9c%pjf*EE41U!nR;s`ppHjrO@nosLlN_JE`g#dmrT{bhBl(W9q#w22 zsGGsZjb$7gm(gK2r^eM{}D$lP;AH^bD=|S)3dY`|>suDO9w3Y)dcK z7HeD8RqV!MiE1yqPWd7dW!W!;ho{N@n49^`1@Xy!@tN649g1h0oiR5rI1t^C`X?WC z_y!+M=Z^p(4pUM79}b7m`={98w4(DY>O;%PMeJu31}js|B}>4NogIyBJ&pg1IVhMD zpFfn3=%~1?;-!#}Sb~YN0(xJ9u6`B2d9CRN?kfm2(f6q6qEFddG#d|a;dp?STdjW& z&#Ul@LjhD^GjXQ1e4@6k={ zw;c{nnVIytSUv=S=;qYl>3>JBhaVVB=lYV_hj*`D9lN_J93Nw$_wX0P4Cpx5gdras z-jAv1AKI(#9IK9|E*c3HRY?g#2aVn??>2molG^Y4io#=d3NgArQG z?SgLEU;ts{{#n}f?W?CAt!^Izoj(x*me1JGASfI6BV%-kLhv*RwMyBeJ{gY_OF zJ<%W@ICHVDA;bP!{Jd=23fW@yDa;?A(LWrDuiyj zkGN4d$a^Nr5c|DVMTjAFPE)YU$=#!&1KaPZ=r;`ZQ|e`Ao-Z0Y&npVfKQRJb{j+&U zd~Cb|pPhNJtfqXrstTSw-tc<#4IhAaY0=c;K@`;p$^5e!q&}bOc<%LG3thc+G%yE%>4aADk0Ew_b~`r8+sIL~Gs=CN>LGZUuS) ziGR!8*F*jY4eWtm8UkhY^T2*(cy4zv9Gk3av808T_OwEW^VW_G_+7;{O_zDumzKBA zc=y}(v3JJ%!LQ|yQ1m1z{X}Imu9bUs=ZN>K;ESd!EJ3VEUq;X18Iy1D;3@k>wH9#57ut@y`k4Q#S(#}w3 z%3xgjqMrn5y25)(0&h`N=4B~%^5}zbrH9Phlbx!b@Lm)>Ao@JtxWCqN@9;|a2RFRK zO9tm+U_lOt`3o*ULDVevHap0Ny$MsCR(ByFs=7x%(bNE_cN<)Om6vLj?X9vLD?g0O zhKpu#r^;Kel*D0;Wl9Oi_Q91c>;n_({WdFuZvFaD{QYw({&5xKy7D?Ov6Z>{9jOOj z34av+u7fr~Z|~u6dfTOV!UrkId7Ksa)gK>(z(1lQ$aLhaeov;QMt^JQyxyteH>&t0 z*Kb}ca2KCU+! zT2JTQpFAW)($@Fobgln+c7h+SX*WGQ`*yRRZyCCuKcwRCQ*raC{j`?57-t9fi2}#W z$__Cadj|Y%3H!!ikV+q7c&>^L{QY@}ioS2q;rU4w0fzuF1o`6`)&nof9jKm-H#*dk zaLh_n{sBKyh7Vz{2A3nGhL_a{=z)<<#4j6H0_elXf&stPDz$Odp0WLKDQRau=LnG9 z!eqr|+@fYpyyk5gl2ir;2raM`Za{mbtuonE`H&xR&EpLcF*ZRt*zQP6A~q zubsRx0b5_AJSdndJw=dOupqp5FRipjo77u>sd)+gmC2$#7lm=eFunN&b}ys@(w7w4 zA_1R_rP6Ph2L<~MB}b(P|NJn|-JyKRx5~VClLhTVPtfFp>1Lzk<;1k;q#mWdi2B$+ z#I?y)pJE|9^;oq?@3tmV?bq(FRyO|p0+OL4{U^O8QZSp4A^0gW)m;4QM~vM3?<$u$ zfhN(jO+uCc(>V!6w@ z(D=|ZBe5EZ|KFqV^zrXqhtR$Zv`qudV5ZQLa93`cLcXwq4ao3@X@nlrk5(foV4GPJ z%cdoMDnPB9N2iZO{F{pY!6y-4J`yR$f`%mgn?|Cq*D<18FyiaQ!@)qk->mDqhOX;_ zBk_wz;%AKu50|wBk>oNS-XoLlg;AZn$)t;ab6{d?C+?RiP|YNYBrxcr zlnM4nKWoV@X}25QW+nRn23P2yvoZoMTPAptd>IF&QyJ`o=H~@025dB&ObH1u7>T}* z8~F5W_U5Ne&c?4EiC#QtqaPZH-jZx|KzHl7CpZM`o% zA_L`};yb1epjt8Nj5!*|V|{Il7|Oj&0jTq^9UXOI`l0@tuZ^Y~U^De&e09wgNfC6Myfb1{o*k}nX$HMS2W@}zupCuXrmQ5Kk=O~lAQPAY_)yR zEmx+}2RS6gNZksa47+Nam##)DLjP8KogJfhuoOkWQSM3d_2ncVzI0jCV`feqTUkHA;2W3Mysq{bECIix89kB5w5w*A0w%ynf-@E#tM@BJe4y?1f9VYiDL)i;r(aihA0 ztF7fqj60dUxsAK1n66-BANf0(LK;`M;V$(?DDOx4c0)+G;D zadn|V154RX@aN<3-oO7g$OjF@hwkkuC^wdIeiKDNL}Oc&$FUp+22~97U`IuKKBNB` z{ga_`?uS(TkcwY(UHPXekVIzRAW5u&BGcSM+|tIsj8By`8n7u#XlnF|fEdD-1DV$m zL*&4EXpmqGTh4FuIoEUS7Un<1OGw~e>+<5v^z}lD`Ux*tr()cYC$oZ*b%ljkWPVI9`Ta9c zZY*H|L_<4kQ1oqw6?aHSYHh~ZB!(D?mVqLPRa4)1R^-iwXTu~yH@$6Ro z?4_0!_Q#!St)7L^QHXG94=Ip9RCA2Ggkev2O+Bh>586szeLzhKb18OoJagZBvm-b@ zigwLqSD;z$=rd~9gLY{5+O&^<^6&xzC#=35@5eITWcx(rV&eseR21VVSTO26J-CPR zw%5k}6FCE5NkZ8`zpU-ysT);Wy-ldO?1lvSYtw02Z6Wj>@H?qn`8Y-!13*62O{e6p z!L)x>PynB&;%6*#Z?YbP&KXF0DY-T|B@Jl&G?pnJUO(yDmts|4-Wl14v>z>CSoiE7 zX)Q0i{!;tr`m)=lo{9P0IQH_Dm^T=2=m1)x;Y5BrpA20xvd8N^-VX2H-<07psb|S= zHQF1-|A{VySr%!?WS%6-Z}ACoa3%wqzWHHZMbAV|5UrrNJ%+#7Sry+63GbqpUBt5$ zf(h1kA5Y$!PnJhd1yLt`dndOxYr#RwZNvP2SCa;fU})9=i5=X!CR?$F^?-frhGg~n zIzJi@4ro^0rrZ6pFQwhSi6o=$zgP0Y)cWF#>^w0ULy3nY4AE=JiuohKVE$y z@fBd>9GD>Q`rM=KO1;e#Vt4}Dt+)>NT7Eva^Wj^Yta^MN%zpiJtGw=YsJ1KiphRv^oG- zqt)?JYOs;3Q7er}k5%V}N4tk|Dj5vy7)jLKb`8XA= zhI_#@$r{hUZ;pPYEUuB)7o$oWQ6TyjscJhO6yw9vACm?DNVHZc!vfOwhkU@7Kc)n1bXg;4NkExnt0(oi{*jQFv_t84T9KR`GBe zx{~`3Zan#<6i1do^nYxmd$N{iKI-Vx`_}=U{pwp?_O;QaLlv}1YkFtMr}}z^0jntI zRpWt+A=$71k|0L0&pP~~?exjL&m5K3BnlBoYW3OWXNxm%RdeYB`~2l*nHJn!>T);X zF^Bcg_=VBsj0&B(g4lJMKZ)^Icyk*x;kc1>Pwb_pZ|c8R+;}xGd*ga6-h20YF#f)C zP~U9Y18NCUU_U0Tiac}JbLw|Wu3x*3hun&+!uv4=m$8F@udPW#(=ZzIN&{~mloMxn zF6ZpklGIbW?u~DtSW@r;AM)Xse7}O&FXI}f|AE&I(T-3s(u1+gkh}|Kr7ed41(e5U z^r2z=A9CTsIWE3(l%9oZ4tMWk9(p9IJSry^z&0XfC@%-wRnaDxLH>ytfjaKnO>07) zuOj%oIK3Wn;J;vyCdBIh{?v^BlS9YC8#&z4;N){+OGKJiTtO}4nV@?)GlK7VB9`Flg>`92lDRmBJjt7GMzA0rJjee-gY z;SBHSyT7e3jqK3f4X5~K6}{Hq$M>iRaXI};zu!^ONBR5(W_}N-_f4@H9ZIjKj`AE$$C<`|o21jhzqw zW|0m1mJ>IhxH;ZXl1jM*%#cO&D!xY-lw>{TWv-eLrygc3vlY@khw@Tlm}45=XU6-^ zVdI4*BgR#S_g|lL65zS;B-l7Ed)Sdj@H$}wv1tkm$ za+Rq;az$7?CGQbdF4VWu3C*fK^E;)+wox5WUxm-;(`0?+Dj$Q*`@x_iRuTqF=ZGGj zs-kS-ArSCyP>Bpwv?q)bBqCXmSv zM_mlYQ%9CAO?G6fsEH=oNk7GH?H%|}L*GXheC;x9;fT+X3FKrHNt(Sde@N2zVb-YUWJ5iYkXYF zJ2t`O5qbBj)xk^qWDl-JWDcddW3szro0I%xp1v?FmqUzMsoQln)gVsM zUXlg8a7A#*O`JSFB44@#7eG|feQ1x;ONkkz{p=f6?ai%(4h+cWZwn+4^#H~Il8b9> z+VPv$d70oe+;r^Sy83LlLfyDQCZ)+a-rq08?qCAK<5qFhbW&!5ta(BKz)&S-*z&{89X1$92`yu4nsqIkk4L} z61`Sx|C!GV`m!cqs$=fBLb*q%e;8r;N2r%l)gylPKHfUJ1tf%PRl#nEUmC8->3(n` z_twcq^%aG33p|QgeR!5;5as~X#-HM<9Um+*N;Oxi?AJQ*YU2|acf_KcMJ`Zg z6~iO;KaL;IE`r{2xTd38_8Vh4+K2BDzc+f(;a2MwRdxr7Kb@F$@~p1gP20^I;Kziw ztm`X_b)0(9;j8^tBdf#9&A@I!f7_|`sd<2@;fjc* z+W;R*(m&IO|F!eWd1|$ndD*!!+7Q@haY-7Xoqw-FW86ZV&V~f+BLL0@Yojgd)o*if zWsq%x3@zAe{jca_J0w;Zm|j}p?+M1>wQ~)S;*H&EwT1Yg{VHxCz`?;Cc5FoKmA2d_ zsM>C+d>;-CQuaw7q{n^3Ahm}B7m4=)-t(jNA?_*|VEGPnK}$YpGkU+8brcZ(d%$}; zL7rFFKP-{u-MwaWH+ODveWzF7Y#`rZr>KV`D65WvaTYf-xSB<`V7@mk<%V6^OJFn0B966B} zGSic%`ar%j#J~1W1iB#6EprM_!_Qczp3v(-aFw@4+SpJV4}s^T{_)|`0vOMkI~VOP zyv3ks;zg8N{^U6u5Qmy7=nX@?M#}felfS!^7OCENeho=o83U7Q3F6>l>H#kAw#Xv& zT%(E3@g&Vu%?&;Cvog-_O4hrtrNj86RAX-Df|pbFuXI5ia`dR>n8E9v(@AKgl$HB8 zlko}OOs}C?L5&dueMPHzx!MLrO6aNB6$cC{@ZaMd6;dbgSMh5~hiQ4L1MBK0BsQfu z%ULk)&?$+6^7(o`qu)2|d2O0(K3l%fXMPhOp|5{aXy7d?e~U3VCA94kiAOqF+qZi{i?J z3+ynES@7pM{U`FZ)Zo$7<_sqA6T=N_v8psleC*xNi7*g4-mjTC47Y@h4LZ<9SR2Ne^lNt!}xj(X7Pfd;V#7p||Qy zvR=zccN!057Of*Y^F_uVT4Y=g1bVQF;4U5ncVRh-6qn(+i^X+bDnU%o2JPtghdTYF zx*S*^WBo1s;4}KsVdpFUSw)ik10g*Q5B|f7zoi__^zuXiHnqH@FYSw306l)0PoLjr zY`&ps0(Ze72cx!Z@%)ZuZV&dsUlP5=k1_n(*AC^^5Y+v*D*hk;IrGOgc(?$rfyLWCAgv(h4m6W9X%Ci>F>D714BVn~<0LEO*lNQn}ppVV;S&rj-nKlHv( zphL^ZZwX!@o_FoQoe1Cg`2+mic;>T#eg5}LN9eTCz}2Xk<~NR0<%Y4pbiCgui-N7} zuA)tD>ec9Mo^HLcDm5D&1i*%FiC3e0AVDI|qf@P9!+p!o83HU2PS;vG24E#&yckGG(%6*WH=sR=(=bh8~{zc&_!o%}!ljGIO zJn$)b@1Vo;XDa$bK}D3O_uNLOOnSmL)G9efxr34$?Scl8bEt>x$VJhtCa}G#vxRtZ zuhxsgi+8=CJ%~H;By_Va(u_E9SCjZ;H=LCEUUufO_?;(TtVLl_Mx;s^2&Q~q4B@?U zu$OX1MwzGJ2YM=ouZzHJF4SJPT6XHClG7n2pqWZeiRMoeO&i+c`E=vAT#_sC3B1Q= z^kYNe>m39xWUUGq*=zG(>XR>FaOMrC!qYNYr`X${A4t!zufNhq!#`(ywL+qX{Go_B zweA{UT7J}Pm>=cv=g_lBOzB|H^=uCKC`JCsw$pJf?Vi)&g!vsOKkDz8 zef^E0`--GzKcV6mUY~tUO%HSPe7R!mrtIo}3uXsjv{(4M`m-iSbhxX)8^0*K`m1JM zzc_SWZ&L9qRQx^HXI@3@rB0wA{*to2^az1xNNT6RbHS&`d4#;)%q^UYy^mIA@)0wi z4-TEro0-HLDb23S`KuvUAOnPGs+k05l=%PjF_OrA2wjhx5%L4d84PD+{eCbP;%|p< zdQg4(qF{%{QF~__vYC}CS)-i%rc^x}-PWmXGde1ZgqFbfTQIKa~X-o9Y zcx$Cft(lYGndPpcl7u2>_&P%-aSE2lKL*AS>F;jO8b>~xwH=fjago;L6CB-CtpIv zpn23MNPE72$=;q(CUoL8z*ZOhrfWv%rMF&%Mjj6GrUGY3dODU_O*jm^M#cwsVP2r8 z((?l|Ye{qvUyTS9Wb|W9>e{N<{AVf%Yi`3;Uz@XSHOaHO?bd%4wU|q%f%|%AkPQ#_ zMl~D#wRHTZt7hpxIVrn;vrln@Sq|xuLC0<<;Tp7mvj!M!x%Fx z(ug&O@AN%yX;<_6m}4I=2a0VWFZpT}{g981pj&>B-$QKlA;V+Jgx)2;)#%%Y&I`!( z`6}*R?|FqYc);B2Vre<>tN0LxGx%x4+hFV;Fyp_D`v2qZ3*!oeXu~lwMd+?Y|4)Ck zvCOi?v&~8w$+W$57vQ z`VB+(|Al1Q;@a`{KM6J%n360IeJeC+Vd#zZ|Z(WKRk4uewxW8iE4Mal-Fm5YHM%elXS@M#klpDT>d=1T_Q9yPx2xSObe4OqQp<8Sk2d1Hh9hfghw0a|^v3_* zU3(Y%^2X#!(RZ}T?Uj0s@{Z59Yxo)xcPM@4GHcDvd!e#~d0e7Fp~x)na(7m=q$A5E z4-H33IA@%!Ublhd$X^ci7buU<=%C`t#RrSEGY_i2-t>D-=- zxa)w>l<>P_B438x;Q~DqV&)v#`DGL164LKKQW0Y2EZI@qzsn9zTt=8#ao+>wtz)y# z7jo{+B%EaqkO1O*A>sP9e__9$_s$WzYA04*4X?92c1>;2pTj&(suUyQJL2l2oA*Pn zJ)6U2i0s;-HJQ=l41IgdQ2KV`Nc@i~{`66Ba7}#1VBn$0D*aa~3@w?w;tRvdyF!z5jeUFPzsLM#_Lm6Ca(9$d!BIPGgg4 zHKYSrsc*BdLC&K+A0DS(cJs9PuF}n2%CAG6U`pEORd5n}zO$${dt=q&d&0hMs2_gFmg}k6zF7OhZAy zUd9g?(E;}m@*38fQ9jtSoz8#DNZ0|S0b%ZGaQtHx{jPs^vY8A=dEh9e7&=Inh{e2P6U*kJrnHItA$tQiAP6DuOKQ zI1K2o-Zcoo{zOHeNC1rb*fZY!8PxsJ+g6`tNCk1VL<(;8m6|RfXb-t;A^s<)UB7qx zJco;|AS1*CL@sXVciE?pO@Upq9mmeYF^+jSHp$4vh#dvaLIg#YY6_H4>i6Zh8vXdt z{l(_O^z(z)XMcS=$r84V`6mp<2eD7$RQj+#>^{&{xc$Wb%3VGo$M~Bng08|KjL(_* z{rS-O{hEs3LzCTq2>esW8h;35?>n-GF)%sE_Vj1i#Fp03RYoj!0Q;I4oApx5HRr6+zH{uz+x^&0GX zBu2h14`0#tw6y=73EyP!^}2+AR=jv&LH47Fu0GgFoeF9qi7wQ{@Z zh4!O{(R)&PSY2xJQX;51bP#Ky}wk4!k}DgWO-d}wp@WN zen*;5?4KJnT~;?L%;?qLn1wcwrqIF)^_pOQwcm5ni_T*@Sy;)e=J%i~UdAj|P_Ye% z0?y^qT6G&r)b_y)qB0LwF)c712e@G&v7dY^x@Yh&?pf_*VaH{DNZOlN`?l?ab~7tc zW$j+8>%UG$K>jMZU4DA2jUY%?%|p*7Zd+o%mvx(5TPm#Ro5PaYO7dCH7FJ~ReEcZ1 zw^(b|>%A=WFt}~N+`B976jrbpU0jJ!?`!9kCm<(&W2sU>B}}BcwJ3Wc)^E-S|wYmcCv`6;}|A7zrHAbcG+&bhe&2AbH2IN zy$q)aV}Q$Il^KsMlclvTQ(!X93U24B$-^0x#7%J0Ui-%u@MjhmccD|A9HW2{HS4&_ zPKRqO!(+126PHR1UWe9BZZ_XIQ)*YtAScmSp~Yk$E%;r^WM+^y0QnfCkNWT4QM;0D z=uWtHOe=r^B55?QjNmxWmdaVXLYZkQuWsh!dC5?XSUvexNOA()%yw65b;LD3Icx5Z z)oXEf+btMdSlOzz>#{iBsuXZ}1)W6qtJz;%vU#1e^=74-eZf?x+G54YlH{yA=gnRZ zH=7BHOjJHpz~#VLcC1_bdFpC3g>~Twr)yQSLKD@@lH37X$JCQ$JiFQ3&Q=?xO=Lrm zl`3aend!Be<>|}TG5eU&SOihfh zSNrC|PSqK}wN0{;Eeo!|6YUS#k0&&anS(k6Zo;`qsyC_?9ABM*h38i);}`uuTz${( z1_z#sY>D$NVkP<+&lgsVN?(SCCrZu8Z#DW%6+d0Y<4hIAOT)_emr_ARR1MH5gP|Gt z{6sc-3_N9ZEBKv`FBL_piLK6-L>*&FQopm%s{o!1=$Iif56Z$Oys4^foGJ)wvh-8> z0fjeypTRWXpTjERUj+QHw93e-B0@9ux%fER0e<}4d?Gmh##z(KDy*VxWqumMI2O7v z&2JNhA3eu#9%ic7Scdl;%A09+bk^kMSU+gV!CTOUmgIUC7MOw))+^^s>SH-~1?26_ zHW1aSgM?O6ZrNGgE$_%f=~~qvr_0tNe3M}0S2aK3jndQKIdV}(^!vu5w{6SX{CN1-zO#?EL3n?bhT}#y41~suEB$5Z;`hu zv+V4J<{kt3IU=mVm3*mHDg)*5d!f+bxS9TeUl(R^dC7r1(fDHCO7Hns&FLh&`uPGY zRoM~_Cp($QXO?e_2Cn%P^Y;vv1US@WcEZ5%nZwUCk&49OF2dVL=tH&vO31NH zwX55iVh@j@GZ5^vXSRZG=ZGK~aAj6Q>AXaa&dgjP#q`$i>FDoHT*`uu4pwWeDhN^o zR`gDFau2?IL_BP_xKk;&vOCQtfEu{C2`gz+yGV)uRKfVni{JKU4|p}7sp4vZ-OacGGVkZS?El%-nK^SVlJAlzRQjUd$fe1-ORE4kpulQ- zN``@rC2(Ag?v^=ea+*wy9)GZ1+F9NPTMLPC2{fpf1Tf*C^&}X2qVW3ZmAS>4;?-!C zCkomdS1OZ7IVpzmpJfWyJ(DXTPbP-5non4oWOs}oVPS=*8448c>P(TZ#m|ozk}Dma zBCkI6J$?8RrqS(2Q-@#GU{CFG&$#ihtfD+Wa<0slOzvGS;aoNHnr)KS-uj4|35cXoF2Ecn<$+6XSHB4&05p2Co7rhZ@c-{TW1GJ-{<$|A$1pRi{Dkc5^2 zq|Y~yrV5YdpwUct%K4<@59V1wIs!DLXW4zQ zH%)Xfg@>9e)P!(li&Y`AfVR}&JR;+t-t4tuVZuRL&dRj1m7b%WGrFypkjxnIVG8v* zp=pXU+0V{&z=+j_8NgCp$-dH5K@b$))SG5BTdhtOlqVRG?)+tkbe_zN-A%OKcNXX< zt2txGIjYFl*X0+ob-D z`&4RonU5#?OB0p1E@;}8-7eL88hZ4lPMPT%e7^-_&*IXhu4R8ZU=pfXeP=KmMUEK( zyzI*WhV1cdrP`4|WW%DYHn+Ao6C@ETlW1reYNGPSIsf|w-78MW7Fcv%eFv@?GAg?$ zB2Qpz2eGo*EqHTaV$`Sq@cb6cfSbT~vR>0kX=Yn#p&zgq;OpgrDqGSn0@i@}4re`) za1J*+k;Z3VHV2}T40Bqh%X+JwL?Ep0;56v88xGH$K!n&e0fh8PmjFiEd+xWO=E@3n1zoclViR!A0`nF(F)-hngXmA`UqsX1Jq=H5m;H{yGsNI@MSw}wT)UpK(H7aW>W^t{22I*euIi1qn?=0m&>9O=T(4S z`jf9pL>uaLSpKmp{y$ZGhRW#k&=pQ&ep&c^GitCBJu)dSdF)w!LB(?_{&p3AlY&*2 zs_&X~l!Y0M*^4*%42@_Tu70=7H_gCgiTLU9hj%m|`FI&>$84I!MI&Lm$_b6z0%wf(Ug|SSge(H9$Fuhz{6GgCDr;A86hm_X<7k5WYu3o8E zUN_ys)zsM+O@TDB;XHOk)S$CmHXJdwd5OD<4y&a)vfGp>1wgZW8E(w1G7rX2uQ9)A zw2@gs(nzfk?+MxvfI3%eH7jW(kvV5D52SUGo}dMgMm_9-J)F6M-4I$a+iF+fk1hQA zMCa5EiZ{P7H<64UmKhDYEqL^5^q4DxH!ttVp0iAW!`BBbvwXe)!wHwpO<+bmFN8H( z(_X5n{bLhL;?Ir~=|F3;TmASd5DU=j0Z11l3h-mOw_T7ErdP6K00MV|$!S>Dts`ZE zejzZ`LGT5)N(UcK?7#VT3NYL^?fs0)!rT{*WwwJOU+rqu_2tY&>8vCxk1an>qy_#;VFTbazq2fbU0psOP63<_MdqHtrN+@P4)U@rN!yo>B z!=@)mJ;{In*n;e_K``9N0?3KS$FA*EVNcp2*G&)*bEB-5zIW7(N7o6+iQ%naD)kIF z0bdXOP)_hG3X2$OH-!G8UR<;w7*MxF@g2m63+d(1f_UTY+Wqw=KqOhnX9w#sFB!uv z|H0Fcxd+gEG|X=tr_hpjuq>qMop}oW0UEdPJ0NZ#x4PKA8gefObZ zz8VB5?|Jtw*CbbKZVNY0)DN^aK$oLF(haB7?4(ei{eF-D_y3(LKd4#UXhDpMa{N#} zyyQ9v0+-xI1m$Yo$|lfTDA_tkP!%7h9`m(-PL!b>J94;B1u-uBpt!SIzz@Y zj$I!vJL&okNuv$XU%3g?eMZ^OE!d`GfAdJn0`^YSOu6W$m($5|rS--PcF zcMR`<@jQCn>$nJTGNR59J%z4;V)9Ar3pAZDxwI)^}YLSwol;=45+ZS)WY01E) zo0WY7$7%6`e=3Yv2y+txElBC~ZNB)+T$9TA(*MA_F9PTU>Ai6JERO+q>=bMVbY63% zxy0v$_e->(>b7J<1$w3qAj@+1HH;*%e)sE#5J+h*5z_fUsQ+}+C7YqI%K%hL2uZ+? zAx>ZKyV&8dU^x6ey&-2ZfZz-F}O+qf16Or zS4qkt?aOHRzQ4WAI+E?n4C#)2uPb2pOUp}%VBv> z?_J>QEULBf*-6?ayF!{?p@7{j7TZFyu|R2yNYW&2(py53QZCBw&ZSLgZp}{GhN=X5 z^c2wpQM{o?z-t?C90jGHA|OXC>NyH1>NzSccs_&m96?IkASK`PteJV=dEdR0^uo{o z|NDLfcK3egomsPH&6+i9)~s2Bw2)ran%dkbd=ld4p7xCp9}Yi<);U04x6#+I0UUoJ zdu{i&7P{>CfI@Jr0vcM4D)lzNa^z||_OiIyNI8HjPY@5s*={UdW40ktCd6-naw{-p znx%P>4?%Nu2roi}Wwqy1{qQq%jT5mgcWjM zIS-U`RbVcXHX8>pA&MJRrL1M?$0W9qa(x_+`OE2%*dseC%c+<{)-YM`3~Ps%;O2yZDSGaA(&lo_ZbrrITsSvj(jQ4xSFy-ybQWCD=TiluR$x+MNP?0Jz|QwTT?}K zbnh&;Ay%Z>%UU*zNo*CgGJ7DsD1QYlqMX-`$2V62h0xD+*;JGSYyR62+7ZF*keURF%R8v zoD3Qsz_eKR_;XHSTZ1w70Pj$JT*VqotcJ;X$+?%>;Z7>U2$N;14z06$vCr01-&E9S z?}iT1xfFw^40i;2h||B#?faH*^xLz@?m$ z8-A<_7wL=eDagMed>+OJnN}!x4!H<&eEjOb!RXvlwVFHK9?YZb^tdav^{>$;SqgR<5)Ehlq^m!i*@6*v5L$JoU zSEGrbf&jmhp728n|8Q*VJ{KLKnIG_)=|v4z>Rap-Oo#W4dd}+;3TLL{UEyoZ}sQ$=rN`i~7h|2ir@ zUs3T-tN8oF_=M>hJSimS0rNm&2FQaqLLO)xz89Q6EJ4Pmy zpE;n>SX?NF#uxnFmvm2EuR|d@WTJ*G5lKzdq5GmYWR}BDU1&CZ6ku{im~6_@fAd2v zkQVWW>Z(1J0!u||7R$$`Z}qn-K)mI*~K3|vsiU`tvC)^X#P;tcNyQ(($~cMk~T66_348ATJOD6 zzep$UkJR}Zhu;pY?phIa9$}(rMsVaB&n>Z#cS|##`A0i_P!8jsg+NA6BuRc5 z|F|gHZ0%!xEy>~zQRBYws+%se8J;B<9)A6#;0_%wzO)2_QmKs z)4INaag!4ooX&-zo@8tjeYliICOnF!K@@H1EvWz6@U;L=R*St}UpVy@ZLCj-8fvRx<{!T-9NgtVT>-_T}opjXgNu z+0~&(Lju=q@OE|cgwq5K9r-J*wYpV1i`7{3CT-ZJg-#oQVt74V>Z3sWg1;kjDe}7O zzA9J@#Q0`3Br%RuvmUIsu$t|5FTFz9i}7*xcd1@5GcG}1PBjW^G_L(td$&^8 zwg4Sk$E3U;XGV-^bqMnVS05*v%HeviIG!6*Id69rEl<}>#cSa#f{XRE1_$r+p3b;7 zoJ%BYYzEt2M;YJS3%o+l$CS_6?%Qhnc1_tDy|}wYeI|Ofb4P4EKozZYJni%MPp*fS z;n$W4-tK6<98n)DpUACu3cYgjeRMgrU4oB2FOJqFmutD6ed(z27G_1_`H}e0SbEL> z=W+NLFop42dLVR*a36IG7E6s##(G5vZ^bijrsg|ZlzHV-b6BCm-A#ze=Py&wjzse_ z#Y(t158%jbCjhZME(ibxI zudE!YkGu2SwINRp7doezL`GLA2L)zYQETG0i^?G_;QADs6=wCD9%pyN`2}U%`GWdr zb>Lo7LiOvp5%1IEr*1o`u?N6?(U#*Ja>N4bn_ARgke@T&8*gb1JAOItHa%nyxBcn0 zeJSd7`|&C#N4O7-C%fK0G8b#o-m$=eTUmN?e!*`a}IDVmIvjX4z)9alo zuh}cGF9rj**L7lN5A>V2)gk5o2mg+rbTA|}|FdBX>I;y*=#~@eUsGsY!BKxc|8K39 zexW7^$z)x=LO16}qU}D4Gst>&{*ry6_1E3ewLYn&=*OhM9noMunenCBGET44bb27PQPfGa-?Sw>^-z~DR??#$8fXj7`3 zK~g;XoTI<`xy(?bxnvU^wGo{_G*L6MInI&pjq?KN9RWLpC0*`iY8iHqb8}QB%wEaP zIx1@q!isRE_vA0j$G%>?Ov)pGsRiW~HkOHH2)s|(6uwAQ+5@M4oZ&%$3#_Q^Qp8!E zI~(Vgu1zwl2bsm+jggn!8^@|8Lt)T}>vZ@2P1B#5Gb1nUc?J3F!~Jht>j^-ve>2=~ zOO_*;xmL4Ige?y9Xe6h54OU}|aLxN#xS ze;4vHC)_Z99E~k6GoiKxa9zH?9=mT?A2jx0r&N5Z?R7Y2swHbw;7*Z_o>Wt7Q9eSg zn3IxlxZu0hn-JIn?gQG3fGKNm>H+@9))B+>KxjYNM-3%_k{8!XaKOPd1UK!(C4^W; z>XmJ&b6UafVX~a`S0_$5b>L_rp2zMlo7tr{&gP@+DbqUx=<5J?{G?C%7bUHzUROtC z^>Bj3>kMekqZ`uUI@`Xf)hi0)>|DTi{B?N-1ZOMJp(La|p5l!H9S5i}SYr<)tHoR& z>k{(oLIOWtX8m@9GnFmnz&{Q6Xy+aAu=V8~(kJJyiX$=vJj>VPU^b4vBTe)cpQ(-C zj}MUjiE}GsafTj!3tZapm$Kc?b;9Bch?LhU)}h|*ZEWUv@wug{NAox)0$(dUcAbZDr? z^=f#P`ihFa=q_NQk?1i#hZit&BGEHtm3q6O*R7+{YfB`ajKo)k<0^*tFHVSFHaK_2 z2#2zXJZilCcr+6K4GpU4!BS~n^=KqU*YrHxEai4eD^`pfk)M&id-2qS2(%f2j#vPl z(kZLctpM4O)k^>YCcZurUFTX3+9T0qCdazhxya;u_^%_#!vc7NY8(! zX$(Ezh`7FJDyVWDZ?SO&x#h~&_H!32t?z%YDF`p5!c~YA$2z7jT4S$$wj#N;W7A8~ z8qU{n22Iwq{|j@8xwn<+q7!>RX;fUXN`J#SCs1No$A9; zb$hg2W8uz*@IN;EboQv@JSP%Aq~gDSUHPfhSY6WYr9ZWM*)y_TnB5=?2VHiHM52c> zi9^Uj+#yB3hc$*yD@LVLJQ9cLGw=UT@-U;&I<7ecvQN)0>?vMkODh`19q%q-OpSmv zgWYqAE6py5L}z7^W@VA+Wu7!siu)sLWM|GO(y4g<%H=KHI1P>yZ=IcX6;-L3mq`Id zl;@OqpO7_@W*A4JT6u*^3WB&OA-v75^v2`zYJMvLpLflxJ-RQ`19=?A;0*as&S3)RNtAD@=m67a1OG|+*LeL*zstZq42FYNN&nvD z-m&+q5VouWF)gryftS1gj_6#i;{(cR z=W2w-2)@-FQjV|d1-=0!!3h}j)6dN@be#jsxLx`gywRiAU#p2I3`&#`I^0{02Nfpv zPOjkW{b%BjT3Hon1;NqoQK@5?@|X-!Sb0?o-0zdEYaj)@8pZD$@syn-rSk6GD33T$ ze_U=Lf5H#AM_5jz$Te%=>fXDoC#6Zqx68}w)?QUpvWCC?fT{V*O~VD5@)EC2tZ=2! zQ1=j@=?G9|jtw$=g@obtuvUt8+fv4y%SXgh92UhT(+mQNV>_if@Fy#&Mcivd>t)m_ zc&8)sEn~WBAe`gqliu1y7;6?@SPJ7|R}v~qMUPw$xaOijlC4_yF<37eY-%cjilY7O zY$m`K{4IPk7#YZUUx_>`9iGUq)Z}9}qP~tl485v#s73o~b)7wx&v=Ihrub_+@Vq?c zJ2tHhq+xfQeE_lIo(3j9ALYxQWLZcc2%Wy^&p{n_s_1)Dc3)8x&nCtAYPIz+fJW%u2)dZeJmK-2 zp~0pIK@2M;Y*%-0tvNfSCpg%$Cgo;_H+WxqPjLPnV`Y+tS6{T_#EW=ti|TyPp&);h zdmnKms12jTY9JyngZmEB<1xS)h5QULg&f)*4eh0z`xQDQBvgQnKk!f=KhN6t`Sj!B>!**V2Avr+%w$Lh7HKG%BjCGe+_3epJ_i)Ea$t{6oGdzL-ima zB2C<2^O6)|exc=&x!FDGoH~0Ae>73fT>wzhSH~<6QpQ7u|khLo`qp7KBpQg0M*0ovdG0)V5=L z1%cX9yM*?+GgZ`Cv*b?1Swx=7vtpzO$5mQ;p%xkA_@ARIor__9FED;>&aXJE=b)nn z(f!d?5^uS$+xH6L_ zaG;!knkwhhNphZhZsjE<2>egcd<&if`>nN9mdqO6yW#oE6`E&I#xB~b*VW@15D2z7 zM5?f>MX^IB)Zoww*~xqiIK6U)7d_5rL_dQOcm;xY8}1osgs5ilKYcRd2BfF^ZzRVW z=1Ht>JAx>VU4(dwpH4u|B9?FfD~&MsYaRa^8*NgeOQORt4^g|f(p>M?L7m>*2+7A8 zlkJ_9Umh2EXeo=dyYaz1TFPGf&U(+5;;1LCHRVdVV@JC|8{igJo$I^k)y(PUMq`7N z11#_cHv*n}cv2ax>aWrY?^d4&p1fkR~S$!ZJsh?b&ynPvb=LBwd!$RgPYoIgv-BpN9f;DJE zM`y3bhIz^pxT;hyBZ^b`wG!$PA}DcVODA@j#Z7?OR`%k|)TTsNlUd7ESZ*xRs~Dw1 z`~B>RKu8E#XJ_QEdY7Dv_C!?W*%RqsQz?3L2T||{FYugUiz0s1ATO7`M<+B6mjRCD zJD6Xb1GTFILjpBxy>C+hZyd(thlmhtNLa7+|<)%dQQC8t*{9?LNKan4eL- zi+Yl7^#~=~-6Zp>iHHygXjTe1PJHAb9JjT!I@A?4A~qQAO>^KILl?(WAP5tl`L`CI zpgzB`qZPqSL8OV13x`!vewO>ItTf)%=n0Bdg<5?pWTMj^HIg0KV%u%ci)>4Rj(=^kjeT zrxdQ0@a^fj4X&iTza~)99zKA9(O#Ve%fqS$xsl7CgKINPbn(Y=x0Y9p56BVA`4#QS zZvRc47!I{Hj_QgJe>uh@jgEH6U9+s0#=dybiq?*LTt(y5gRRgEsrk`*>+~C!Fe0&9 z6MYEB?b=$}{i;^lE=Le8(yf^jsiW73GTR$>s*Hz_OKM_xy_g}ZHwbFbpX=9NRnBM> zuvx9cP}N5BHHd`9>g(7YRk(ry%Txa?->lo#n(38hi1z`mOX%YIPp(4D$;Os0KVo!g zYmYWRUh9Sb3ddG1TF9De11yoyr;y|Yg1dna87BjWS+LVk)YvX3kIItUlGwgMS>VAx z(PMo%XUubGtua4rH@3)-ow5;6}+mer6FFj&daWfrJftT5;9K&75mWI!$(0b_eg1y zaK8k8Zh0P{G=#@quZ_?oK-TtL#~+Phne2pD)YGn41ddyJI3A*S>tYgS#6-}-@5s>n z9zwzIZ`y0*CA$~_rUWVcGp4=9E##9u%s+0trlKC4TThzCjCn3BlDooyy&X1vOO?!6(Zjz$3BP!WE>wU;4?r96D?AG@~H<=4sv?AnG>u$yG~X|;$bZo z4A>g=4UKVJYhp9yM677qn(TtNtb}Zexza@|kj^5-jlYLwwvH*^m06;3m7<-q(E=4;%QMh=R*IO`g;C5v*;mjG@q ztrpv0m^{}rN)A)iUs86639ETWfIA)@$C}AFE|0SCxOJ zGWc@kLjRe-*Opy!$%PmCX>7*z-j04-Cq}Hh0D_F#I|MVS&W&Xl+) zQ{s|PB5^FPy|2!>K`&V0l{K~cVm&{ZWlFBPI=`gsqHnIc^b-FC8&|v}e`Tn>D=+f1 zuy+ zRl1>mA}dc;TvV}e(Zw>smABIesVful!N~aI{8gQ5ZcB7FfOmy!lMQkJ#W__Y=|wQi zc;*Df{e1joFTncBy|2igg}f4{B5BQr*JgYkq9o3i9eRBpfaT_)Tnb*rZ8#sP!;8=# zw&<*QA?|Zx#Db#pYiic7_W~4*RNuO+8r0DSHyS$FRAyC$>T}ASf8mmnI~()bh= zjVLFj5asDc+iGeo#Qf&!&Fj|c;DM`gFCd0nBkqxaAxpv)7AJpjjk(zdXN;P-?OQ}; zSclzZH?8E#p+OuT#PV~czLREM^|Bfhi&-{`%j@5^_~Jy{Css7{P-SbAyvsWz_@bya z#SPzEkNdEAGlovZBxU!3S7TB*o0;4)+8dXjiNuAnY7lJGKhlkjqr~X&sN7C zw1HSlu69CovaG+6&hvQ=XVSi*TWkP}KITt0Ho&A4saTj9cSPd?86O?h3b<~6uiwgh zj1ZxhfdIk>6U+60_!KUR*@!c?q|Yitad|_yt9{h!lX6AS3R*X5c;oBPey&S(!AjnX zUa42{j;bN=W5BmU-gA+kUnX5eM9NcQ3zSUAL%*bJBz_(iw`PFrn`;y3em{<()VH;* zXe%TEET0L6l}&W>nqO^9<-Di0N?ebNl7&ees7rO5I9IMsU*}3lF5KnAToxI?cnBZ- zWq*4#yG;CUgxSU817v(0%euqnQ3w=TjHnbpBq*5T|A(@0y#Uf zR>HNvDr+r*2B8Zi000OxYdx**<$1&wD+#Jg+c{i(%A8w~}ngA4Mn_v)v96Cb6(1XYa^O4dux zy)Ee_z?#e#vO{A7uVHg@N2_+@!FyRRb|4^g6D{%G-g=S#Hj`XGT)hu(>d`mtxO8Iv z4Ey#Y=BNF2QXmdhP?=sWYZPCO^+lJ*b&f#ygyVrqBXqocJqUh@dcyX^mwS$D4Yx+f zB9;24vYvo}++73uLJ;QW9L9sTzv<-f<{%i}hajL_qo0q>f?zCnPH`O8ZY{0&~8pMsfu9hR2z zPy|_vTQ?f?Q+{+~W_qV}6j=W&s1JYHUmR8L!I}8ID&G7$$i1+b+o7Ueu9$;A@q06g zImBzbi|M3y!RttG+Vdvm`*Fy0|M?R`4DTKJA&e(^unWuE!fj6a5zsxp4W29wkPZ~c z1^MAPr;g==CyI@~p*vFNOSuM*pG3}ClZ9UaEeRsHPKQ2-zwF#m&u6@#;`>$n$Kn19 zdw`tCd9^s)Le^q-qmsM^-F1T_219*SN7wh^7X%{_`NEATbM28X{qv$X4mF@p@w}%MG@Q8pW(lzqW5NM z*bi0oA+KSSW3bDfQhba|toLTaM`w)6M=BBrEB!~9Ug4IX2p>sET<)H|&gY>R0Tw)o zgLmdQPgwGRkN)72ALl|}$VC2WktkvvS-x6t=yc_%bXpRL&yU2X{9kY$iuVR{7c>1F zV;TW{Qc9nVc{1v}Nc0@{WYnTabbh9jQEMa7a*x3D6I$!52xQfw{AHEZrLx#_BW&ma z9*XPYvbJb;^b0_c0Z(7k{wExm2jPq;xw3PdH%c zCmScr`27~8siXRQm8`R1zi-;!)DUOrBRd=E_<8C60^)SjR9jol`2!Bx-o(PNNiwDA z{Ruzno6J9>?jNnib(zasnp!1%k6w3)0_S@Yq*xf?WbfwQub1HZwZy-Ol|XUI!F`WJF*5zkNPs zltF2g^kb{vkD?cJXe&ljxAq4L?3|ene?@<19~yPO`mKs1RM@w|^7r+buQEj0mZQxk z%r<_vLzebnb=xY-RGt!Jcrk>I3(HoVX@10&t-n#xpJtM+_B^Um++`jN;Ql(20=mmjTvA}p`Bf%T zKzDhG>E`c{;fMbjl^##4_zzY5zT>0ESoVl85gI_Lwh#xblb-JqjgMyr8DG5-v?VVv za%(Eg36H7h|8krEl!`*1Ne{qqP(^X}{X#Wt+C4OCyAP=N6Dt0l<7@XR@WJasf`3=h zAGjp=y^21Oi3EpL6gr9F0I`n+<+~eS-jkrWfnEWBWqru?>CicUf6G?{x-Yl_vZycW zh`hiXyF?l5y`1kH0lI7`cC@$lvWtIj`uW$R_VXiT?)Y8dem)*f9Z^>4kuU2`{qy}Q z`W^~_b&v`S(vZ|nTwzZBs=06Bvcf_d?BmeMB{pI>R0HBSh^*5MT!$~{>$%>7?zjyE zBT&)yga$ABB(7gc=9Rx^^VP;Kloh{SzX~q{Z$pB4%bYjy?c1UGFvuL359ybu6Sa%1 zRb=K$`)OI?Byat*Ir&y{9+&G+Tt6Jz$9%M0i2l7Sg$=abAS3=V;$=|aAfY`JJcnC) z3gLy@TqxeNNE83Z!1zkbC1Z^H<3Yb|ZAH-=Tz+TBc*VKP@>*POgG-R)mZ_kM0!T{b z;-fEz)D*e^&y(_f51%ylFqv&l>yh8JgZi`z9C%nA-@Mfi%YMAU)RNH}|pZPcc=RB*F&UEs_L@YP4qOxr_pDD56i$`R+Dds+`$ zo#Xx3wAFyPPw2Lzlnii3DGm?FrFzT23(Q!?7C6g2IoH$)2bT_9S`H9qUPyZVn9lzu zvp)n_O!np0Xt^lfUa&0FBYQba(u|#FTALovp3XI>+w#cEEbCMbTDcIFRGKB4t-s7k<)+O!`Lx8@le zzP+&!1_%k6sA713Z6&-!; zHqn!0lfJ&uV~z|~hGj|K*wMQh;by!d5PlN?4|7Ai-GMtF&!e8()|tKj;{L(-f_ty_ zs`e*PoztuAs^BgRPHTlSh$!Z{1MqpogO@hYj)TvoJsygHsP`=k@<&F~vb6AfxDECt z;Lsk?+3m;KAs@K+RS4yoLCilsAJA@rN}ARCer~P z;`!U@f!gVN-J25)7$yFl1I}hl3+|zB@Ha0j;aVTpwOXuWfPbwApU}}vlgB09+mR32 z?zMKGJi`tuM{JeFl#sZ?XX~MUXfA`sueAMZ^Gf?>axG=sUxd6){7YY-4}09eU)s(! zgwOLDU5MI=gZ`NEF!B)|h3Onu=tCP%vlRX;wa#VY&Q_ux`jj7l(?aM3K)rjl^wY+a zzIj|@8b`WgcJqqhPE`Aw^jVHr06b4&nmFgBuCAxuZ&iE8Hbj@%)KuDm%gU+G#>K-A8p78r;tkZ} za0*B3;D7LA)&0iAs(V6W)%`?09#ub#UY|h{;zHS)CVj(w;`0^kSzc9w1H0~(C5Xjk zF^6MsU0?>ZFXR#qqd;=KvM%#@4z&C^-R|k(a2<#{U2Cn!7QQwrmo#*IuFCR_eWj)9 z6F^cUpZH;PQ_!kR4y(}}JKi7Ak&^yD7jF8HStj5^+YmEv^T= z_Je*s^c4%&B_QV;SD%A7wvG{mV~4u6WcMrmILNEzT37ACw^Fn`t)`lhKtG%-9kw^D z?Tr)BkEQqNe+50ZyF=b_e2RCRIZ=2mo@;zK_Ek}Sjl|=%C%@!O=|x2GTARe+ix`n#%St5$7nF@1mT&3=Cp!ux111H{PtuVAT%yYtBkQLf;6O+ip)l>?HL>Jt-d z>=oD))i`0v%L={WsP|tpa5Kj=|0dysAp5w{y)b2*r6ryE=BW1_Y-?(%@8B&NE_WYC z-2JU^M9xr-R2$Wws(YJU@ffaA+p}7{X(Uaq<7_DJ3K;=iMSZm(-}lE#E58v&?af`` zYR5iDNT+K`)=#8^YPjrpk006mR@Og@>Wdw=zTB6&?j_u8K@u zQ78DF+PSDqP3JjdtfR+`+)-n%qce2{t&?s!n^SWU)W%7oUZNA zS=LFGI1d+KJwq`pi>}})%?E1r@;O*Y_v9y|RS4ps!K~pq4;$o6tCi*+(YlP)vQ^q1 z=Es|p88&gqOYpSZtYwE5cypWwH6XG(NaDOJ1 zDGUsWh(GFU$-t^KV{U=P{GunC$&b(U+rnRV_h@>7#QaV_h_MU~AH3g?_uPrwM}>-B zfgNAHlY4D^y^5~n25>2IB*m41P9kuAFqh2J#&!ih;|rYoS?tWLyA8cF`BOEH4x0Ab zth+<|u3(TB+`(cZrnJFUU|jhvA;!`NgihKpbDa9L$?S|h5?0TXj=Wh3n?ol;c<>f7 zD`ZwWCZJIH62K_P@AbqD&oLsq%{OCr{v395uN%0K_y`c-_(6O`VXndJ(+xO0Ag^Sn^T zawZGMCC+mF@K%+wF$3nLYIVsz4?Choi~S_}5e%A>?<3*H%{vRn^iq6!1KrW7 zcQ9L9ZbXn7zd&dWZ|wTsK-GG{zT)@~lGfy(Vai=sS;AD^W1os%xkjQSxOjQPY4Y7y zInzkSEF5v$fj{g)5>JUH#nw3YED+kar4!p`8X6+kyW0$b2IjAGn&=pnDBrHdN-;nJ z=e-q_3sAo+Cs&l3yWa?4724}jT$eZ<`FpT}+?Yz}06%!M z3zy_aOZhur|7N~1kV_+gCR*apqu*;&C;fQ}M)T(}nJtD@lK<5FZ9*W4 zR@lEQ{dl$M2HT%-O;*>1FcY)(i9 z_CI_l8aq;>Wt9x9dn)SPig=kFjOi@gOX=IFRwF&&Kj0Y8yfCc3;DapfZf)7r+#L_V z@edVVCh$5u{Uj5(40zaXlKEt7XM16%HmQoAfnUA<2Gz(P{oY2u=OQSlZr8=KZyi-G zZ&C52imwXG<$ynAdZ! zE5mqYm@ndM40dQl;JkCAieBep*R7(PGGS-WMQgm|T&p;xZoH&u<0Xkysug{a(7nVZ zTn_SWgF8O;XurRZ;@Er%>LLDvdGYUf{#$|u;#w8mTd5E|Y&)&H>2aR_{())7!=v`s zmlTYd@tcpMzc5#ykl%QmuC(O79ijHzsiHXB>7RD{yo!E2Q~!QfMR8Y*Hj<((kDK;9 zHfnpmtm2BSP2uYpKVi<~+dkT@qR?N`l@*+Y__k@& zPfdINj`~+XI><7Y0Y!LU7&Ng{)xYMNa~rcpJr6e_5 zNr@q@0?&DLf+M<+n)y=6ZBl~Np!vTY|25$kVQj?*S0KiJXZrp>L;QS5MR8`q=jWVA z^hl<@xA%kTeoynuTc7N1XttY|TNyrFhgb9#Ag0`SLuWNAod;F?*DC(~*N4t&;{Y`D z^!AgbXFA7Oe|bBI{!2xFor#b*p9z{G z`PXG$J*n}N#s~MCcsEvDpuc5q4R5wux)}M%ad4fl0J;ZD^l=h14npS)R@Bz=9IIU= zrQJiVLvA?lDW9D9QQn3us`ih+6m|Bbnpg9l1kdqeGRm#?@q>b@>*Tr_L2Tj0(J8KF zdX=eUU(#KFuMT9AML5E%ASkFV<~4x+8{1kowk$XCJ69tzX%mbXdyx)%0`9ZwitoP$ zRx&wLoSyST<*S=E;lfAOfd9+sYtV#1O9dWu;Yy2QHL@|r|N)tYi9i$AV?;9h|J<2smU z1U7bb)weWa&mRq9Uy(2P?pA#08%nz(O`r77rHzyJN%9CxLQ*I3VHuWXIoij_(_H`1 zW_cz)Gx1@&X#1o;FwbPrJ|4q|PES3G1lDyC|f%= zH^q2=L@G9KZsYtI_&e6wf;t5yli2+n9959NaX4 z09|-&(7w3ffVZZAh6x-@oJ>RJs9JPQeN$_9%y1NHgr`KWO4TbLqZULtg!2oka6p1g z8FSEm8Vzi-5a)pP#U&VMsJRy|-j1US(gO)>Bq#CG9DsC2y}_lB!LC}m6?}(bSi@GS zn$y$Xw4K5njYB8G$Q$d%&5d)E5v>Z2WUWo&4Fpde_+Z1n+uYIBa-*2N3lT7|xx28V zo+mC9uOdO9yiLg1jq(g}zQBBAGUWZ2_6c_|z(0<+^e86=dm%UkVqQD4;=V`3+aq5s zkbessnmNq%@0Jd5sQH;n^)wZFLr5p$VCH81t1a1ym$C#m^ApEW49qtE zEYzFv`XvTgqp6%f3x&GG2xP=#TN7?cBEkKn?KoZ1WuM8T`gaPkEE<~iZ$u&Y>y$9a zrV9C8h-jobpMKN>-A(ap)H$?}5fpTSh$811QV%n+lYriV|E3{;F2gX5DK}3~yH7%$ z#WXEdm}-Y(Ct^qgZU3RrBI+dJPDnWa2Xe{&Xt%<-IYyW-Yzg(8ybctb61>FLBtp;z5<43Jud{(H*0SCCnGW7&0!z2K z8S!YF>;YmPgNj>BGjcGOA#X5oTM{GFNoo$(*xV*;7r?@#Y0eB34Y6qOo%CoJknU#F zj~Vi3szjG@T7$V`s|L(pg>9)#(js{Pd7OvlHg!Wsy(S{%7-QKN_F!_|gd-K`e9Wh< zDd|{FfD07=MedGNs!-2Zg*-yk)2Uxjw3|Hqi6P(6)X5!JP`|5N1d;%dmsDQqc^G^Z zW=6^H)&ZUp?hI5+h0|2bpNJNU+6h?WC28Hs)Mh8m&Vf3Iyp-wP#P3<)1@dWWm+by~!ofNjbNT^nZ;~mHIj}Ga?3}eAoFE*NmMA^U`Gsew7uX-t zKkOQ?!+f~ed*E8YFT*FV7MvCC zY6@g5#AP7e2x_RMi>+1)@umQ15vgGQE;-K|OhYb~NK4!}LNX=|GDUhB^o)l}s;Q^3 zqYxLeDv~zYs01tdTXeVs3@fJTBs*toxdAXf4jPD?u83l zTepY5QdUD<8e3Cxb)v3nRr%UPZRNG)P$N5HDQKRpQIt)o3*WZzqKhwCbm`(H$$EMK zQL|%X5*oax^Uy_w>S=i8pmiB%Q33bI#zwosun$!CR2_holVQ5IcdM@Mjr=sCKI;Jj zEwIq&kou6I=087!S$HEnH!g{Ty}8J0oH$&JUhZ;Wd09{f%9jtrd%+`vxDl_b*O%kC zLl`S3@LWr`$XKUXTGbp-5&@*pR!&}H7-)zRv0Olo^V)iZb_k{WMXC6w)ZEl{a~t0k z!@Q)q1h>dVZK9i$q9%X2EP0|p&D75nEPmeJ4n_AJSOB1-aA^Y6Oup!eQhHD?Guf`V z!X}KA52rd?sK%z2MpYh{`?11z2%x->O~6YJ+Yr1LZ(oNiO%co+YQKewRZ-7;o55o) zSzs-V$#QQgnlnGP1Cwsv}1&Iv~F!`oPU{K@m@Z6dmu*(wC$!?8%73Zi}`_9 zTj93>;a}g2rJG**0BB<{58kscMtpC&0rwJ`MH|;OsA_C$o@{EDEeB9qdL{o$$1At(=QgxA!ZS0G+A4UQ@|z_nl*rjn#|7dTI6EF zOXR{qkb3*v)H|%GGo8VOGDEj-#@d-W513DwBW(@ugWH@;Vbo%(6>lC)j;Xm9UgU}< z)Bi=CoHz9-jkPtkb#(Q{AW6-!NU0y10G8M(#(Iyzgv0MfH&3!VHn($*lcS}5E7s_l z@^s_wQLIxzSKNr%0Pbi~Vtxya!*m;7eG=dr8^LDiZ2a~HAITA;7>TN28qFrqd=Sr` z^+lD_skBbuRl5&m&fL_Ts7D6hOb|0oSsL4h3yv^0#585el_?*Qv+~KoZL}hR>|wOS zMvNG`iWN|=w1$lsi~-3_rhAM5!cIG}d2gMYdTR{fhhqEzVbeo-67%3{GfNcLwd+o^ zm|CpBQpQ9CL6?GzVGE&)H*FWPd*via&4De-mITu_0cH>A57QJ%b#%)5gg=d}VaLfU z{hVPuVcO(78d?hL!IqmD1Opb5l#|z}F5Y@Uvk1nkHOn9dKW7gyN^zFKog3Ol=C=iF zgr@B(;DU(Do0J{HG!nMJSjs!D4780{(NjYLPVxg*;$Fp}v(29$Q}sId4!BPXj9N3& zIGTN78=D7doiLPdOi=WI(B3SYs+W5kJfRRSYzihM7Yf=+tg%q9#;h!vhb~I>G{9^K z^vBMf2{YQ=u`H5)piIG2Z(BX>b;hf+u_d{w9ZR~FhDLKgv*MZ*O9bOsjsmaz$yY5{Iu~%a ztGPW2d0?`yg<2Eip=sQdxDBH`rbRzA2ogV$!s~gY4YR>-cvDjh7fE9zjF{832MZ|E z9IaJ4TAJ>8x${M|ER}5A*n%5eI(ri^bcyYg7XWjb5#~(IgMC(Pw`yxUr+c!mpT<{^ z%&~3FP3`-JIx+NoG^eln8=4YO8_lN?4?i8V0>tXfdhwq~ktqGuCnv)bv#1c#S~ z1}T`eVGQ;rV#5+kV`w1^sVHXI+sYe}RMzGT&0FgUlt4`>t4Cq>>VQGm+M3-aYcDnb zI(k3!iDx{}B1J)VrbXoOTD?#~QA&aSRF=Hd*m>v0W}~;0?TO}ODj|zWs`s3T+F)@( zb3jAb8e&PO5En>PyO;)m!Oq2E!RuSFWltv;XN2NaYDbjj5f^X^t?;_r(Hb60x6diR zI0)R0PH0EPSRc}$ZN~RVc{R5Z1!%|+_b^j?xQOtLq3yAzw)!S)sWryhds<_-&=!&q zaykVOX;}%?#c;!ExPvjIvHe6MG&On}($ZKnk8L6xVN=7_CJc|wEv-&QG7W!KIW!mh2d{+dF*u};4~B-8dp3xs*36nr3vP8?1hr1$`7|= zld$omn4fb^H8NpK7&NlWMI%I{F~;(4R#MA?`#xmt*gTUxU54|uEWqZbF7W$vDVrRa z;o3TQg^HE7OYICn9+I6hj8{27!%>6zlcum3N106qVL?|c?E+9`zafxfOmvOGeD)-C zFcnKpUZNh#%R$l`%!q?|xZ}F3C6$(pm^V$}{SXM`CtJ4lY6T*#6pa;)HU#1*G!ZJu zI#_4{T>^u)L9b6ef_UtN)vI1KC(LL}n6>oM*jgFzUC@P~AL!>AV(m@aLhu{_M#mK;1@K{Pia`=`p1HB9t7GJHLIqgGPpS;1Vk%Y-M+IO)xrPRy zRAV;u9ofYfso35&%m7dvh( zupN25a$K+(v#;|MfSc9{4nE^zX4A_ZA2J#a!G2=Mg<+g<(_QSmajkW8Pnr-hF^pwG z&jpaFc_H$hLL)JUta>C>B!F#-Ay^jgu|EN0raMF6A`R}PDv50bGH-FRaU6iGG$@9Y~>g=hq} z2K|y~7?`FEIy^y@&T5gHyJ(;XYR>zf_OWtsJ&e_enLa!iwsL=cZ8s^fQ-$p__`EC^ zYB-aUErXjmqochQ7AswoSXExLHc?Z4<+}3PxR;(?lTUS$_kQD@kS)sIO zl&VGmwzjUMaxFX$PYq5P?o5!s;Lv#IXy^yX=oSglzUbX+64lD z(GWxnuP-KjYY^54GS3p^1u&4*yN|RJgam?Dfj45{r9u_oj*kRH21YJq9HM+;1r3jZ z9&DL3#wZK?t2oaa8?GS*4u1gr9j9dBi{5~gt1HntFP zLvbNzD80eVD70$SwvAXcyf^LbEBnOMWvP5X?9w#5^G4)aslCq-n6bo)>)q3a?LWh+#N| zXgfV+T>49&rX1H+haLkTfDz-0gAR4@PM|mvT3$UddT?~cph*|`W0sYlhTuSxhCfIrVxm(*1N73iW| z>;o8ZDe3Htt&lZ!shu*lB2OX_aUWeQPmJ-vSL;|+Z5_0^+JLzLebs|{Sb=TqNTs<` z%>yOnrFB&`*CaHKJr}s(DuU*hF*+%l;p9 zKzJH$x5FRC1G;@9tcN*EBZAgy0J7W2VdpQSsgpXkMPtHGGt`{~)C|Ul5OlMICjUcG z&{LYH{2o`0Bf6saMui0n7LZjrXK9}XOAO&MSXYfNv%9gm)XGGi2c_rDZ3P!#%-i3n zzyi{HxG<WEvX|=fEU065Hsa{*;ml zZkQ$67Y_8%`O;J%nF7E=3W2s8!33|5DVbGEkl+-|dIC5X%S4jJ*>yGjCsPBb9`8_% zo=&35OF;Ly<;;}Q0o!*h+0~Wo#ZpN8*Di>m1~|XMwX^*KjBa@K!rx>Q>`FvL?~A#H z8sSF2-{u)>7AGHU7NVbE7jt&njM!>2X6RF#)4Unj?hc8CTqY!c`W&OK6OfV4IVsP= zQ&n3lz8lgr#>DT^*8x(kh0&h^@4GO$Lfj21d1_k~f zpuq5BSx>yOY5bm}i3xiSug~3cs48#Iu^rJp$987*zmz?0;81qXz{}ZcK&ieOd=DMC zDKh`riE8M%i&XFMrTAQiPs6yQ!_Va$9d5wqxomvn^IR6bvyL{uz4*hkBH0IrpNkxg zoT=*Oy_?UGgZG}H>TW(mU7V--p3DX8!`Z6;NVZyt7&UjC@wwCcKaB7-gZXOjfeFP! z^IzTY6v}M=T!E_l7Sf;3&Rwt|S8ZvSuIlEGQ~ilZ-sWul{!@1GP)SS6;@mt{P*K^u zIC9Pz7wre!XS1gcJeNIX05Pxb?3Ai;8>yG_iPS^W|#tO@RMwRMoAn+`M@6I8|^r@|O$`*BwOr2Z1x<!lhmSl`H_P6vfQ@fCG#e!`}d8{y)Ac1aql2tZZqk# zZdNZA=L0X`^JBcPyj=AH=K|b`Ddn0^SN8|r9m_5l+@_Xn!u#h_#Y-L^r!F3xpcW!t zPda{YQgwd@e!GC*yf-brH1|w3nXn6i=brL;w_Q;(`(X1#RX3bcON1V074N-i_WaFr z#;Lj}`fUDtCe{8A=<}17&5J)6IqkL&f|eh8F|qij$Z4B*B5cryBE?JiyE0qVt;D+z z=CPl04?g$Wa2@)1>LBpjJwaWv48Pg`gQ#aPd)C4w#NGDq1gC%ToAj)7`Zo{#JFg(C z-~yC6g7V;ng6BcM+}>HWSVtnmeZa4Bk0$OssM4Crk0$hCcC_cdz5-Yk1O`PvT6AqjL-f@vJ+2l7#<#e)3M>!PXFpx_Mk5{ZY99&`@4zDv)NM?+})*?BqCV{>+znn zJUTo)-{-zId`Tb5>{?XZn;V%jan~Z%dk|#~ zuYU+|f!B^K$Q{N&*|^A0wHk8VQwhHQ2Je&D}BUGX&AK-iHi zb^osM>WNvAX$L=x_A~>J7Sy96dAD)wU+Uno8&_Ry0GwvQW9r0a;BjonGT=}Gx<4lE zV|)Jw+z5LJ-?^%INp1wPDo6F-bI&a`(W&aT;+yB)Hg8(-;@!i;myjk*=l5`S))TLG zWTEe}(T6#JIS#PLqkR+h9D6K+_T_-~*#k$=hQryBfum@{aF*&CJWIWh`)@0Tp2zq6 zCsqtyR_!hRll zHS_=ZuC6@1o2Bv&KL6IcXEOibrFYK+4@KFpLB4dY@* zHh4$%9|iBc1m1ZWymJJ+Ls*F4cIW;qb;-vt=ANmaFh4n7_1^+sSav`8X2!s=bJd-X z%uz$d5p_TLf%t6&PON9&oZ_KbEf+0*>O3{{OpV&hz5=fe)PuHnXQ`q6p!u;KrNChs za47+O|5e6^D@z7}2iq!j?mMslz=X5VKe+?XpkDCWkV3tX?;p<1!S7<#9~swI^Dk&S z>(63+Qim^FGPV1NX*0)*&~8|T1%$NFeW^=3v-ycQ&eQ5V1;KgsC zy_7?&a~ImG+c|Y$9@=@+DD6BRTpkMGGRw!M&d24K4lcKkfXleo0hhZ1xV+iNC1;LD zmv1<@w2pwwv&eI*blK+MvYT|beRQ>t%k2&>l_TKt@aup}orBBZ1gDSo`M9(?xSTfv zE}tF)mqUR$Rt>xa-fvzC*>|Seg88E^54!FA{-XYQy}KWz98!^4PjA2&d_Uk)MjYFr z$H6V)nRxUN-@LTl};iHQ%ejhx2#%(ihFFtw%<7@x;;-LeWXMcwDdr;RAj7#+Y12QIK=Rzi& zBQpCx=BPWN;}2}Ze4PtjZV+Qn@@zO4a5=|J9l(WSckUmrhVB9FhNEg|2G$&dn9rM$ z_a!`Ye4lCL2k0sCY8sxc?3#?6)-eOq$MHI?z9;t}A7%8#&{+;N zU>#Db`ky}ZZuSl8`4DM>Ikgzif5h+IJKuR! z^bE9bKH3Le^e4Ns)dQq0=+K`@=C9AXr)Kz>tUXxo?Io-OpVRBAZvY-~S@i1gC4)1H zL9ZDfm=&3E@X?{+xV@;b4{GYu7;EzU$a(!19%0>LV4Z>f-Va(m3)(!lQ}zF$ zRP|H8+H!38<7~$n5xfWOAcy;(Yv8+S11*>7HvSrVD9f@hy8(~+wzAKm?`6`3tR6H7 z-q@$q1NUHTie7p2y#BLL4&!yG4zNCk@2Bv6258ED~Gd$vN>urKyOPV9o*n1Q}I zg#O+I*-L%D4>I-u8i@^D=ao!;ZcN+TStze#krMNqw`mp7;^KPC-U&yH@SFX)^Sr zKd7n=x7_mfo8AoigGZWIs=Yn$9k=JBX#Z~DlbeVB0Uq-EH2gjt`LJ%tn_s+_Yv8>3 zYVU@uNI&0W9oGLW=DZ=`I}Lb}PA@}NAa?Ln&NDs{9extRODpG8@=3pj0oEZap{R)Tf>2H=Hzwu#S^&8JVhZ7TZq ze)L-(`tKgldb%neDg<3Q2ET>Ag>Jj&A;Dqlz<2O{i0SCN2QbbaK2N=P;Mj282Jp+B z)#{F$r>_`#AKJQMsU9Qi_(&f%YTMo4oha2lyLu5i+~4hGi-HPD2{=C8NcAUS|7IcB(0R49^<&)B*nHd@J=L z|6%Xlv;p$}t}OMFThWI3B}@7jV2)jhd2hk7iTl0`T5ot(_0L|a`|~nSAM^W=^g0{; zDm0kAV(5yfDV^Y_&fd}P#dYVjl^|j#{VcsL}hucjaCa*!i zS_1yQMEJY-E&YE0T+3Gi&k&Gxl&CX-Whq~Xd(-1 z*KDj|bFhvc2m4o~-|EKHAK30|jUILwdc}0eA<~lb@%>0Ao$iFaggVD1=)VJ)t2r;T z+|Mr5@9Qw9fCoj#O`**G9NJO{W7@zo(8CCWw#Y-!@eX5rJdN@32>5fY$DdONuEcNZ z#?OCF^ETfvci!_ib%SUBv3SpZ=mZ!aPc}kEntr^P`8j3|K+kvJ1DO-OlG8W@zM>*(I20E2ujSt(&&WP9|WUhMkEz;IWF%9Dp%ukp@p})@v zkEPq}SYlm-Pd)Xk;Qd3GZ>T?nZGG$q;&1!A!1VVNjIWn~BV`KL1bdPG2xy#w97@8JqNeu8$uFuoj%tT#8Z zq+jGna!Eh#1>Uj61 zL&kC(>@hNSH@@ZB$l!f|L%U`Ya}VF`gRZa(X%#3l4P#;VYgv1M*Fxw9L$?0!A7^_G znYGR?GZv@6wXcSI3%j6WJrA2$-f!;if<64;Jj_GW59IU5#|8lNwk&EKSREA0h2s18{dOiN8WV9yra3ZRsXD#$cy(v55H-F8gl1v z%B0UOT`}}Aw4-^TWJzwpIg^_QB1>*ss)lY_hP-ATXPyrs&(>?Bdv025bfx!BpMTT! z$YbVo=Gl%sQ$g>WZXk~2_h3H{Kb8X>W)j9g0c6Bv*r9V^r`78~uH!C6-$|Qjd)|rh zKk=-ElpS9J+<7tR%TuzpN1}Z-&*B~B!snq^EAZ%B@E-Xli=K}$dk&r-fvkHLIwh$ z&K$_Q(~*{scazW-w5K!&@-7EDsJ1z?&&kKIXL{}E0X*uNu-PsdY*2fT{O9;RFJGaC z?w+i+K3$GxLR+T{U@r%_T#5RsQEwIG$6Ck_jnA91|pfBf*@EEjf!9M7} zoZ~Kl3}bur+IZ?fIcU$mf*gj7n=)`U)>N7L+?|j1gC;Wp2X|n+_|k;CXReYmzC9*= z{)!B+?$c0)y2plh6c5>X=Pj83(C1Ii!M9t7ra8)?3}`*D5BRa%0jyJO*=aI&`g8bj zb`EUKr=uV9VgJpRy^))Kjx{dy4!8ftq5o!20{@vl`6lEpWgOQf$97bqZ_p>%x=-e* z`)Vrw>7Tl8Qn{Ofd)>ULT(iSQ1-&zg=i$;E>|dOYGN^M0cnIalx5WQ8^dD*K*8RVc zCcJYNcxRSc^3qdk&upxfH7-*J?f@>wc2omi73}iB1N>-lBV9Aq$GXmqOj_jPb}#tw z;Q1o_0ifWG+iT+dE*&d~>+Q%~H3 z&$HQQFFb&8{{rgUf382)Z?yEd2>pfnU%E^Uy}U^c9mq%fkdI^KT;Q>L=euYlx^KQ? zBLdGpkV)?BUJg4B_~!8XAm3O$i!w2SJ|n(Uv0udJ{{bEwROh9T%TLli^AeuJyj5j! zHGOvgZL)pviW&FaGR~(Cyp248@ostT@OsT_Lci>B;OR+_PX*vZ$oCynFrISy?feHC z-sjWs?4zW?FHtx7@LT6bp12nuru_(M52wyv?9%f*i=(0CVbT)v(&~uVdlenc%A*Ou z)7akvw9OT|aBivvjy1sbN{koC_Uv&Y+p9q1usqp|wC-y4Lf<nf27V9!M@z=;_?08 zhn_J9dvEMJ>a<_~8}@dLE#d~~oE+zvheWsdF5qkcTy^!l{@P-^Lb~KDj`zRW{_eZ5|1A8b?(hZ7eQ3|c zlIM}P^%IVUdr|*n{3c$*JC*eD6|L}17_aK~<@MD(pB-6%d!FuCd2c~~W$&H`=SQNq z#Uitw-VNDGd*cDvl>XQ0`g?LdZ8=#3b@*obiv{|7_GJCtXuf|lML+*)s{ZbrX7Wwf z-@nDTowMi6PhB+!@8>4z=fC2axSTOlO}+0j zHMJUh6<6c40iR}kI`P?#5A3kRyYRt0G5iU9?!gCp>cjtv&#TVor}+H~^ZZ?WbMJ$D zA%Di_5Iz;555|qmW3Oz=hfb0{_77)IfUSQ#Z2gqcS=fh<3}68@5W50<&aY~n;#cFS zL-?}ueDH+Kb+8i;!3Sz^;w+KlM=`IIoNnd#l!3Q^Z@E_6mo;MmHktd6!k+tZRBegS zUI04{Ro^g0Hom*Ow7T6V=%BHgl_y6%Rvi z1y{5zN~_$*ZYv;{tVy4rH@QRFjaO8A>N{s8;)z;V_m@gDY# zU2{~wg1(?Y3;GqzJTe@h(X-%pp$+!`Imf*M+9Xf&Y4ba*2mXd~+`G>KjI&-IzJ%@H zhk5vwP2WLZMIigKAOo@Iy#s4@*wcm|JMD=>=&K{}N24CgzM>5&D7Vi#3SW&6pPBW@ zU+;ll^+nK1bgs{3dwTA7fSdH+*Rz+rd=vU_Rb=nsFRP*1IlvG3NaF{9A8j7{vd;Vf zX!PO%tbO+5-5uxyraujzrTynl@L+xsFkk+QUV99lpSAbsS&^aVu}*t_R%B@Kio7L* z-!9oZ`0=d0QU}Vhj!&C99)#`w+w^e&pB>H#!o9=d8lSL4-~;v%z;@w$AcX6q#1(Zk z8CE{`!Yk zs2g0DrW;gDH2X)7ore9RGW1_5`f(ZhvjqJ41M64wNPgEvTT?v?!xWxfR&diZa{mrMh%a<2>Hf5zY+f&Z76!MCLO zuZs%qo_YA&k-gk+dj8>YOLnWlMbBW&CBeIcsS?@qZ&taN!v0b7KP>wa*426H#W~P< z*}rGl{ymEQHm84!P`BH^htLN?H}>zP=wGLgOR`Bj-N)w|+R^ss!kc*<@D77t4xo(| z)+7V#5x`ng#yzw2b%86VBB-Moa}&qkff=(ro$0HPYvJ`kX1!J0Wn7qlM!kd3zeI1P zyu+Mmb^MPD+;lyB#POUx0pr=`WV2gtqma4!(vy zc1x+YCI9j?uFL&#{;0r!{MnhkWFB;}!P3ZHmc0;Vr^AO!;O!^8=>xOQ(t79p6DjMp zz4=+B&q3Z@S<|ua1YICoePeNP-(QFDo_mFJ;5#{g0{vCb9QYIV8WT6GE%P8(b9cgr zZtjoof_z_e1bY*(llKp2O&6cXw}Wr_dl3BG0G?co=LOh(Fx{pSi>k)BncFZXC&?Cx_8f?bTAbisQkNADOJbanMTQ7mPW_$Hc z9r)jvFYMaEu2V%<%&;D|_H&nS-(q==Hk66@nE6lYp=}8BIO*}zQ>-V-da$1-R*kj0xmobh?JUCMZJ|}R}*S90B@1_AKuH9e*4Cn&S0Pb$|6LIBOX8T`5 z+Wr)L2=M!Cl-vK*ggwdewhdDT{sDE9e?VL8$7-44uI1=&b~Exnhxc5+zyLM%c>Di5 z4nEB_svo}AL(MCT_rlkAFZbC7F&EzJ;WBj~IRZV2!=nxkx1InFcO3@~2OJ!VN5J8D z+x%XqKJwylDcU%}(i=W-Bf;O9*_KG(Rr=v^4&M(wYxR)Pvm8A+i8?txt*(3oy0Ybi zeO;RFzkrM@@$i^3upaX--FTN1Nr9|*i#2SHWKVHWY5!pdGDJnKVtj~oOIa}wn=7^ z!HDUEyO69M9Nzef1Dm`t+k*|>1?=K%t&{u^ z`LJFR+az^W+IV+@KM4G4p=jpZI z7mtv~DHE>;uJ3|v=$)|pPtbP%F=+fA)N`|AA3i@5jmLn|3K)+%>(iMh0pq$5jJ!-R zO4IF#Bk77O0MGIx=NH%lFR?nsfr-AY@Gp>2cHD;Nl1HT9a`I!wCy~+|3aBbpKa^E{LGEe!2pxE z=FWb4W}ezz^ElQ(@G*%(cf1%jpeyMQUk^QruyMyX=RFMJfdW75k8f-;ltwWwE!Ps_q=0k#4 zXl#$ccmEC;F5kWTBw#!gg0cA|V0oVatX+VGvm2gl zUvv^MwgE=c;hVW90b?Uz-0Q%YdJ-_!0Y;?2p98W_0!CQ~#$O?G)7H9U@Y+RyF+11C za>9UZ@qYT1tZ?S%IjCD~kY>%>j6Jzs>XAh^JX^f?Pd|hI`>d=b`&7lEmb;33 z=NGEU&wnJ+EBVjLg3VGbf)D22!Kc(-!T;Q>B}wij8r&Z;xOb16_btNRr#39wa0~o< zVV9#nN;c}&>CKBaeBVz$c7;vvT(lu8%gcYnOW(d|!!kepMK8S%@cs0IBc%VAN#Ctr zShV4@IUf9HknYmf)x9#U$!wo)&CsVm1uVBuZ+7~0Tc}UJhVpK`;XWOSm#)rG@7F^0 z-s{wRO{m^GMydDJjuG}Yc1E9gS`+5TVb?tL zCD>Jvry2Woq~9-~1DB9zkVf6&<}-D=t3UQ?I7^OFf5iBpU)dn`1CGwfT5=TpIrw$# zS%6ms7H!%_PiZ%>q#yn6j&Yz;T{{s6L-Kh64_D{FrEX0wnncxGSUHCtw zoq2qe)z!zJnPHiPovef<38|6LqTf!>6zus6Nw^c*wp0*(7;so(?c-o?L1_cQi5enGJ%iHF!45B$K{ zuMm#*r2oU|BHt38xVo{cixjq^*RqG39K$B4XAh3A?xStXdd9$!ZzXZxUgDd_i@uIt zdeedZas4p1$IiNw!@rKJyBke>ja>AvlaT{DeR`6@51V>=$ni^hw-@b2_mQ84XD?b0 z+h9xG6o*(tpdkl*^H#$NY{SD3QaUP?c(8U>CWEJy}rp4Z_rs8aBL;xmfmgZ z0FURy;qCg){NL`(e~+7A?V7#UPBMQ2`Ez40XFo;jQgV~8=~w(G(*FXDMfl{W_F%bP3l68W*V!Al~{K?Gj1ly$ESUNR+{JrefX zg4r);yfUhmbJ&T-#%K1-+<83@xQmC4p)J8jc@uJ!HzBcHKGy8Fdo(oN&5O;s=-=!C zP_97smTlrMspVA9>W-07y{ z09&N85M$a+m}4A=~^Xg+Kbt*%Q!OAX-1%d>nR-HU0z6exupj z$KSNe-)m&YdSLXB3!|#<;0xAzBk>;6C(3_k-HDFhHfPFa$QE;Le`_6Qmy(m%>(KXa zGl%l^cmUXHKb!r%0_|mMA6qtQ`QpzbkKunj=kq*^^Pw#{T`;~E80+kT;R)=`?}dIi zd$qd?p5*IWm$8GqT0?&dj8xA(_#sEeon9Oa1SdxDc?kN}e-`lv@2K-z>muV%Ax2E< zaOk~I``X?--a;FO*01I~F6q6knKx%U_@Mol{p>%h%{pMOJ$UW;zYN^s{Q-mctl^t+ z*!6QYu=}Pwv4Z~f#uMkn$-f8TXWrV_ZT;$HomQL#&%ZAopO24gXAgAuIdr$UvyGJS z`*CgbTz?Oh1!UKA=v=rF^fk(=* zSN``qO`cl#q243B4*=#WAH2&c&$-Nsy1orFs%~@Mvv?0CbiKn%D&oi0CvIG3-+YPH zT++FoB!z!-m~kC;kG?FpWgl{>))X(+#HJo}Qw!a^27Z|JJPy}dnRg?nt_c+HsX?y9 z&t~rv@D=jBknHZ+Yi~zB4x|as-ejE>zlx`ezpI`ctGEN2*bhx?lAOwXbxcA|mCuTN zYw%gQ7arsIUO05}l3SPAKQew4PWlUOy1}!@kzb#1<=1W;= zy#1fbZ5peW{xIo5;#$3o{F{jUJB3(4d4bWxgTB$j$7Yw`yz~I)r$=(uB>N~kxbXT8 z`YgZ0&808p*!4O7E%H|soIf}lpBd_1Okd$JcPDAUmor6?PA?+F-gwZVLA9KG+Qbjeo#8QQySwVt*Q zCtFq1=GVzqI!n`A`|<0FWUD)wbEmE@d|O4^l9xRAN{4A30IvgIq(3}@Tq8cC=e3{4 z?yu>0qvF!!k{mCnq-wt+E+{R&L1R&E8H^TTlK@O6_Q7EW?lUB zd%(+;MK;IFBJ8KRJnQiKyz0A?`gG=F5odkBDc?HU8)pxFt#yc}k0gh;!*~7{dQ9%o zhV-Y_z(^NolEW|jSM@vg$$0tT0OR%WQFZ}O=Zu%H9{V5L*m<}%I(6~n@STTgNwv@di z-;NyJn{S(EZ#wXU=kb;G;WK;anPv9+w|qdXmwmuNvI#UEckU;nBbH-Du|qfQ=RB9r zrhVUq&&)*5nO#cU9>#JiW5U;ZtNi&!vVM=^|6G6ljL)Ins==d79EN1h``<$xhI@!J zr`Sb7{GE%54Wn2f@UMcM_+!7n)8S(}YkbPbvHRr*-jRb2Mc&qpz>x1d*C-D>B;WB9 ze;%1iaYe9kHz|GUFy@MP zi|}d9VLXbD5*QgC4&A8z7M{0}_h!mQ#_3F33UO#s+BL6~FA(nI^VJ+lDrv4dkN+CZ z*&ajO4eaRKI%4Zq@L$3IBlvZ$9LG68&S=iX-(B(ObS75+lF=21PW(vk%F}}X_TFOY zt4ZOL%p9kOhcmW@B^OFx>c*q6VZfs@!t&ebdFJ|y%S-U-__OhouAn~grk?tSw~k-W z9LM8oU&h@@+i&)3j3FaCehr#~~nURVcHo?JHZ2U zwnYND`IgTb-YZ^w!|_b@+U&6&$FF6d!T#e;N8Q^7(DgA z@kRC>20qzw>u~sRW9WhVT1&P;Ct7P2t0W$;KALQ7N^484BhYK%`MvnBeK5-5jr;y3 zTC)uA6hAq{H{%=5{VTL-&cnNNUlMnI_WHw(X`^`QQ2ge)&i88{r~4W@x??7Fi*HDF zmu!EpJML?B?tgBVY|u!)R-I`gP5Ry}+Ldj$?z`4-c%t<5wWVhqVXKUMboP62x*a%~ zGVF)3Znl(Jb}`??gMI^i0^+fx6_Td&w>{Sn0a#r zvo`!Md?CL_-K*m8?~SjhyXRW&t+VCC3(q{lTCf@$QUbBYcTKFFG4%-cJ$%-rN^nrR zoZo-|JW3PXCq9e0tuOJ6FiQfFQAvs8Ezx3`V zWW;^QkMH?QcPqZd>#VhkNzR$&<=Ma2nPp;34tD5-STjwEtLVg+NDU8m>);%Fk!aOR zmoH^4_^$e|W3NhlVL5e3R#fa0wSREYX^i1iY#OKFyX!MNeJ}E(^itLH0JNy`D_9Ry zUi9-By6RrVTU=J!sI=P$IAho&9XeC78^x28!VUDRmG{Ik=qAKT36ZYv4JTuF<-4ih zEvtI&rtWvBThBk^`9+=;FR5p&Bu}0w=PYzQoPXfLS#~wahSCpO83!`C(bHezyZFpH zV8I^iR>j*9T(6@o^=B%uQQPryuorizL}$kpcPP^;cy^E@ug%mrfx`~cSZ9D2JkxCh zJFjU2oi0sn$yV@z#8wLL1CtlXy#NvP^;^GF3>}bisSH_JElO;Tt-hmH~Rwn(nH^*@4#@Y`VGz+I3c$tw=j3XTSE76=Bj-TI?SGnLd`kUsdZR;Pj&tL z!|_utkl%zwOg-cb^IXES>K{j5mFFG<;s+(P%SJtcdNmL6?HOKCM&CwCr;xAD=z@#f zzG*xm&C?_&7T#Ob>BWw^iD%8?A% zo^&GOR4=*&_+AX0F9O~dq6c5Vxp>FFUE>+1`ZN~ea{GuIuC&Xkvjy0SKZU_7(GGL6 zIq32-?V(u-p)b};w?{t}O{`k!+p+^&ll0Ru?l>obqaI8)GVk8A%F8bI9BCEkZmr-? zJ>`dhBkOz2o6d?nNj{DF^PGgn$gyVZ6OC`zI6pDYhML&_5%w-3lll~^4e6AEdEsCt&4Wqmm#ACX}AdVsLsQ-#3+gb(pIHf`Xu z_B*$~v-UuL@WJ@8JnMeD@$(oa`P!`wI?vjUEe5-eVwpy;S)NUsrhVxBY+#?cA+WoJ zxz7AkV0SiqZL%M1Vvc1qN>#l3xV9g0>wgwILxj66A~i$vTIqwKfi*tHpBh$K>HPZ` zFG_H->T7cAyANDyoyodPUh$I8U0mYun!%;x=+B$1D=K>o&zkS;>La$M&>;Fa!nxZc zb2Mknx#Pnb2R{Ao7`aEKIE^+9o`{c-9)S)cjDMIr?p$D^v->Jr&a=*p>RGand|I43 z#}r7eG|!4x;MVWq^2Ldqr}bMCBXfzfg^x(2-H8pb3Vsn;QIq*Zr-+ygE$=TEx0p!H=9xcVma^LzTF`JU{~_r8x~ zO%ZsoZ%|;SGv_J92Tl#&#dq;p^>zJcu|f~7{eWxb8~rB|^VFk`D`YF6CruBgz zq`^zm;i)6wtr_sxk*r~?V}bs5_w@@K;soe_jr5$+1+UYtfvLN;YTXzP9vPWJvIVqM zrGNOGWDxP22)rS9@Rn`4(3-}gGPAI~Dkie`E_@IluM!_w;@ix|^|jO_x(cs};CS;Uue*9>^Iw|;J5t}B4Ak{6W=8Rta{H~ui(koxMgp2=j00Vw1Us|&ncbsyg%Jqv6VjcO3QAa z1jC-R{13|PgDyoo^Z1^nb&B;x_>uOnTefwoW0#IANLhkvG#uXtgraXX9LCA zOJ;XCdiw|y-}`L(C>v+x{NpE!*PFGa8odeFIQ%FjycQWq-=znHz}x#Mb0PdoeJh6F z%nk(GmwXwk=$z;N$l>l7QDPpm=v}NT-pUrno%2$Sb@~*4`XAHQw;m0ARPK8CS3Pl`Dc96GptNyEfcwn?mi>rZ zUi@nhG^x34GP-0+xKwkPW7#j0M|$92^iSW;7W@q?x?-w&dJXU`_?-Fu%6*=)p<4tW z@m}mdoxHDc3H%v%i&!kRu{F@w)oFv_`LwHj+_%7C@eb(_k{Pr|ludu5(@UDCjIOdhj0cy7YostYe1PiN`;IJ_#MRJnZtrZw;}} z=DWeaz82!0l^oxG2RI*j(dG3!``SNrVe|@R1S4Xp^Pd*}v;LnAMPK6IqmfF%@plfr zJ+`*W35))3o>FM5g zViQH4RR5j0F~Wmj^oMsxp42`Z`$^W&N!kZeyo|Sje=vHh`St}q@VWR8Hk0Pf#dF{d zcg3Uyqqmqm7ec?AK98-NGQ?T{PpP=>^H@`~zms1)S9^2p(QOrcjuzZrbZGi&@J>8) z;-K#9PQyTJotd}yhlq9y+E@>SL;JZSu45egn5*GeE1@gmhD84EZ)`*U{^D_8qh$9| z#WPDDYDd>tjlM69A2xKA9u{sVAlu}wqU?B!buw%BrGu@C{QlNCv+-vuL${ccgwF#1 z#e<+ZKX;2z-p8FG5$5yDHGb+JRd8TU_ja)V$Tz~Q3Fx2E^MIe$i~plN(PPmkv8L8F zec^Ha?429?GM;4iZc@V6f8^YcFu5&Ov>iD+MxR=9`f`~{hhv>kjqj NdchIk-o#<7HyeS`p4htc*cXkxlinD6 znAkDkp=pOc?4yjS{{wJ?x`Mt`_8C*#=X@5c_%gF3dSGU0v-Y6xX0BW4legZEqMT@9 z|C+vypPy|-1-Clx*P8=gL;@r7k=>W)?H<@oFEjRor;+<QkaB_lgxHG#(XwQw(W3op;(4ioVY@h|aituK$#FX8z@`l2=NM*WWjKR@X7 zi|MRe_quG#5Ra4(`Qh&tRK3Z-(32ZxMY`mMVWeLRy!Rq!YJD|uK7Sar=GYWJ2)c5E z=7e>7Cu^d3=nne!XLlUiUHi&r;3)m5Wv3&*Y;eDOV^j<{JuAM~pLmwck@*<@mgvj1 z@GsvgYs=mwXo}xo`Z;)sJk#vq<{jYUbYH0WSE-@NcY&iv&%1K+6TSh{sz+N%|LPxV zuJ#SeZzun>zM5 zD0$ZIvIP3`OO10(0cR=`8GGmw^y8RAM;J~*zgJ8rdqp~V4JJ`MBhdie89Ko z3w&E<2dws&iTRjLTqBAogy%T6nI#`7F~?f}=UnfPEZcH!02q*=4{E_pO9{G{HGwW2!1p}E`+ zUzs8Lp&jYVYUd}k0mDy@PkW3s?Q7hJ53SOb@B40F&V!d@qlva5gC*SBpU_*~%Qn0D zQa_3nRh61}@7?ZC+OM+QDb<#Vyjbe&2M9--z`uBW9PQ!j`x<+i3zL-aIA}}rm`ZwV zBx7Sd?Zp0n6#733k{1u)j4OE4%P{b|XhbDAw@I>_Z^A8<)9DQSk zD=&591>6(k@&d<~V&AMY>EjvnbvnB9w9XjO@~x3f6xj*Ql{oO)?6!M@ch3`gw2>EC z%e8iYLSKce>k?dh<#O?e)PldTei-?Xbmz_^?3HDjUwqo!Itg}GBt1l9(H^<>QncPL zbm2ZRD0x0Pe4=;_bSQh4$1`q_ZxeVmnD*t@q&}z7=c>UYmSyw}MgM`$P(A=%kblWl zUqU+_=uOGMHF!d(xmFz=L(FVVh z?VuK4{9phb^h5SEsAhxa;{cs9?L>tiy)xVD!t7t)cCCd8_byu-gYmL)9isuQh z%Ymozw~$}!Z#B5B`F!J3txGB4hv>r+@NYWbzfzCbs54=Q;u;9r_@L@`@$Fr3#>2P! zNEfefT_XNG3VKcs&mc|scAxy+;NA4ON#hW{`6#P-P`}<_o@KA7Wn6!wkJ1GWhlh1T z9X$LxKPZD==<>p^^QcpJbe&@T0rwK^5q&(&K9+WccYAZJXbRtUEGcQ+Iam0V5FSxQ#_*w>x z_@?zv<6n%gz2Omj)4DYa`LO|5=-W@#N7B^C*n5r-n_wkBHr-Dr2Z}I%2>7S8-nEOh`cPZ~T(O20*s?Z%oZ&lC=_+7XN+{IR9@chC!JeU1L zcw0a}HSe-N3#Yl8i#^8F@KKrz-i0^ULf68rk4Rg<_Xm!Zy`vv|GZ}uA0?$l^XQpAN zOvg^y&sN-=?mTm3$BQ+^jUQ32eo1mZF!&cYrTDw^M@Ng^cd@s@MjP3 zGPrZ6lfII4;m^6GugdXnaqvDhyn;G3C(p1~T)$*ihxR7cl=-)aPb_!8p@S6F2hNZC zmJ(j-e%l8h$%anqFZXTv4&yX!t{-mey@q#-J7TE6K=dzoi7$wjJQ(G>FpAMX;m|?; z>z7>65dx?7QNBKKLC5!Y_Ac|~q8ke42N#_W9A^Q~^MLEQ@c0Vsqy3CsrjEFkncRc7 z3S5xf`xdr_^fF>;SKmnd^OUgg%|dS5kG)Ow9=p`qoy{`$HuI(TH~AM`UQIsfnZ&?q zda-6=5!C?B>4;1FRybvydIbRlS!IZg`y8Ch6!mP&d8eT&eJ;2TtY z%VuI?qVsUKcvx|r=5y!M6d(J8zNHVs(;2KIu&0> z4}gxfci$DG)3f)P`pT2de5|8B*2_YZ_A4iCt=c$k6L?Ydi8He<&YI;!Aa>e3t(Lc`+a!Gp86!OPdF&-1csId7S8M>+C?v3oKfqRC+{ zUVC?6=^i-w(1=DJ2X5*oKkSR_88Wx(*N3F5o!6OH)t&1LO*A@`o6a}0)_tLO`lmbz zx0Y-x^ks5RENJq!@~zH4reG=h@=||7K0ZPVl6^}v*sE1Mkx6@4x5ZoJgCd^>)&DwW zR`|g!o^SK}6gyRxhR|+(zE$)y_7yAh ztwLxI-$8Q*cdPn4%I)il@xX|+)T4=#W2}m|g$siB(OQ3#!k6&gf`5u|rXE~i{~#>i zkPDU0_Z|9YeH#m3TLpdpop;S!vHI|B{#hbaR0GRWn(4 z1DxR&J*{`r_bL7CP!#^PIj<<)#+PGvuCMN)&U|~Ed><>{)9gWe<-e0|>itmZthd2o zZXH{CspA1BulR|{J2kGJcb#vq^Ud^Y@(5G!X5O{d%%oq}j>)jkgHJp7&UFqRbz14NgNIR8u?h}p* zCamGckLCTHJ|l1c<~{BKVL#oiziUpc(RLPN)jaBMxkJ8RJ<3k!`?Y@VircIEUAbo& z{K@`RmOY$wBfowUTc`89G42li5+1nWU$Kh2>C5Nvk*Xht@VQEAFJWy}*{w&LyU?pw zA&ZMRXTtB#KyI9l+~~xQlzgi5bNZJolmINeJ)7k` z-vDi>{iA7rf^35HuO!ov5%qi`&(bxNM|!XLhSIN~tmKwG$Q66Bzq5y2Ab%MzpZJ6H z_q{(krLmRu_E})B_9Y`dd6YXJ@FdC7+Rtmv2}QH{kNH#D=fSTecS#nMPA#2hwOi&o z>e8IvM*G*A=cMo+@dM~G#QO`R6YqvRBg3a6>;2a4lYAjW8)n|J96o+Cc~#dn{MXGV z=8A9Vq`K7F=5k-hB<^@Hb9))zG=AB0|4Lo@7c3>~==nU>aeO<{X41cb2e==FUj@Gh z_+7#8QGUExdY-bq$6`s-XrMxE-mQAk{iD(EfcJaFE0D}re9Us%SS#Do|*c6 z@F&)h6t|u|$gjdLANb|9Ur*j00eHNd=R@XDW8jXOLu6RNRr19z#+$wBLT_y9+dk4X zC$B?C!Uw@Z|F5$zB7O1<^Q3vu zzCQ8+_zzx?r#>*+=)aqJ7C&0Ig!{mRd#+xZPdV_bfHl5&PqlM@TDIcpl1Dnx>%iE| zA8^q7}dzy>xBqr}Ax=-6uJGBlBR^FmPw5+jqzRCOLdQ?V|hB zf8|XL-;iXjko*SD&JfPD0DDi***A;(s{)>{M_>AqL|>Az-K5|r-PhcsDR?-1AVa#w zjJK&@_8fE1ahd3v*yN;zh`nQR|JcvWxRb*_&_DebKYEIJH}k<*ynJ;gA9w7wK+k2! zbnYB&Al-~NJ>PC69o^xno^iEb9Af6bfI%g<(g(r!0?K)HFW^};x=D3|r&D=1cad7w z1V^t-4!=qoc#2M)6#h4O3Z2dnuAD-;(he><7g$uFE6v20xv$X&eKyVeS2 z*g@tw(@Hk$m0&G@qzb;RD9teav-pmjWZKglE~XvfO$&I_?S8X>?!M~%-Yf5%q+r?5 zBc987oTb?AKi+;e$G@eX-wwqXVgBdSPRAN#Wqw}TWu$3ec>RaIvloBlKYPdg$cd$+ zvaZ@Ozu`oGwVt!D@>e&U7{nHz>GSROv5biyU!E`6Shizp%P9E1`!2hS>?xP>4onT6 zUf_Pa(97et@1@^{>?AwOxp8IA;8}j=$Tyq4Jyyv#LHxJl@7B}3SqFY_Hn{7|%Z-#f z^h~M4r*k`Mw$(u=d;9xdHS>`=%uf9nU$)fslZ7`wHLysYzTTg^Ogc>w_EC?I?whr- z;j3bW?K9`v{n!Q$jRP`-dd>c~Y+mkt6%Fov6%Fov73_r*FWmLnWj!sRjOcn_nH9ak z$X}`9Y|`qdap%Uhx_2Wre6rrTb639e;FGacX&jG%!-tDK!JHLvzZPdi4j1RI>yFv3 zv807dXseR7O!(Y0j`^Fw+>2xG-8mcIpT#};(=FEC#=w??i`Z9N60ptsvVN?6Y+PH~ zOB9}YJmL4WWq86s;$M;O@dVMh7i*vU^n{!6Htvqx7;yd9zA6q#S4^?^wpM9e-r3P@ z{p3$Zn~DdN8vc2o?)T-!$M=Yp`599Xo44O?%qh)dFS=mYc&mBmMt{dN_7kR;god?G zvYOxD80gq_y4C#A#y%apmIMoSJ)W2s2H&UUof@5ntg>rk-;UPHEu9&Qez4P8_~ABR zaa+!iydZbKR{3kMp>NGCHNM8&%Xe%Ie)6Z!BFKEY%R#(Lw03Y&Ir6^W9lwu0IrpZU zbuWi{%lsWXC*YSt+lJ0)H*&1ioJ-r0vH&)pK*vt{_x?C5+Sz7+He;4)GgoaQL;6@Z z1-Fw-o2SAfy>&#gZP$J6ifsa~+8m^vpxRJ>fy)lyQnmUv{AZ|}bz&;@XiVkQ-;(2N zT&#OkhDg34mK@)--bZ48;I6rq*HkGc7x&@iLNhvhk(<3KW1dwvL$LC)iy!H3?CMsP&k5ySdqnN&*0Ke2 zG#{E@-Jz)G_t;C}8GS)Ef*FyG&b&lU4>ec$p;P8XeU;q$f9U=#nIp~l%6M5I^LFdE zRg592)>-@Nln;>eC5s4G zw{bTx{JbgI%Ir|S2FeG0Nv}5iCt(xLsYOm-y2n${`gdrbtnh2}JsEvXYY)DWj(kVm zg1y#t$ph2L~)OD)rZLT;$cbX z>s5ol`&=Hlkq2&w57mP^d4CPhnEF%aT|9!kQG+K{N7};s&i7A`v=eFjy6vIHT*{PF zMtG|E)wn(!2dy&J2JmI+ZPu2=gR?hH!>2Rx;DAj}Fvq>g{_(i1K5`b$=t1{T&vopb zsBZ3Xb@lG}JI)Usqx2Wa5Rzl0zp$4IP9%p5U3kJ9T%ARBHAik754{+@OT3#j>@@ca zXSGL@z<(<;ywb5L-Cs+elA+T|cxRUmtU2t8@#^U`J;zmv-E}tbsUdbuOU(Ky+F^@Z}OzLc}g8S%ung3(lrLjuQjDsG_!=gW^l5SJkwN`Gs;Sj=UaZ} zSvo~RRb=uMpRam7`L%bO>GQYKuL|)NXHPA-%*fQxN4(xEypw&kYT(q4DtC^xego@b zt;Lcx{V8=Bl|MeM@%_1$o$?O{N0ZTY1;4qgIfGWl+Q*tT2-~ahsR^5rzK!#;o*_1CY~20rRbxtvH_@i>v$wS=*hjP^ zTz$JoeC`DHT4zNg_^Pp|6eO-2aYZI#&thEi%ls30j84w;k9mGwK3(*+O=thO zOEs6fRIC1`viP`<@fZJ-{>$F-F8@b^``>shW50SVJa*i8$grY`@yr8`W=!mVdgIDtT=N*0WR7`^OE7MeT;~fpW8UhHd91(qb$84< z1NG^V8gtj3;RzOdwRyxu0AI%+4LuFA?A*Ta1=i8qpcQan0Z=hb_UA12zUf`??LIPL!S&~}$wwEGj%#WTN8yYu{va~N%=V9OqT z)6@75%C6gF?Y?yzI@j{-hH>`a4IUWUg`T<+|KVrIJIz<~l**kq`s%0WQ^$FutDb(vKVq5M46-j&m52>`P{J~;ouV)K zFDBF1dVGhfXxH+MSXOmpNn<{|Y(DVuFPw*;Nvg>=hc#b^H_jUx8gi--vD8UIs6&WXvA#-hMEa<~|Il=g8X^8HwATOfHTpnsN3KVe%7lQM}M!s;E!~A z;myQsaOQ|m@p+@uCrlh*73Plsk48IqG>dtSjp1Hr*2E6_4Q(wC_Q0dRk-i=r_w4_Q z$I&snjQ*Bl69SeS9a!%2JMiDZet`C#7SiA6(L*oXd6M1E9ul^or=wa#gnRy7%(T%^6e+(lpB1P?h*Yih}&MaE{`#<=QP#~0yyS_3WZL~hp_ zJbBRxH}Sq;F?m@V%$ju7tNPx9aju7|yE59FJ^l-?!ZlQXA;MUtgz1Pv^`TWGQb)KWYa2fjCGuN#1%dPUG>?asY2jAg`=qbe1 z{?Db`b_MeDFY*x!ihi}zuQP!28NPw}G2#P{8n!eeIcdd1`-d;hxNz8=84HI!X!h|A z(5H;g(C&{5!gO&Ol^-;2!xTrr7B-gc}(nGKXIa z{8ToV^qK&B6-oC#6kmt(?F5Gc;82diAtz3w?mj&)!CHabf9M(o4uOYFq7V7DRkB_J z*LA|5O7x;y#_Y(hR`EZ<8{w4lRw1XDbabrv^$Ocz!2#O&YJd8m8)MngO+_o(6EXPf z%J0E|6-D1&XLwhiW9{SU&l~i`j29e~UkP$j#ikp4=6=te%s~VGiVeiBl24oPO=sMR zm74s#wSH@zr+swwDJDR&6zXvO7fTGr&!$m9&Gn-wJOFBvkqCy?t>S;=O54x z4pc0o-c6Llb})={R!@2L)u{YttHN0ak#$)MuYiv_WfR*Q|87;hhupB^Z^(8#{Pr%+ z9^A2-wf|WD|H%J%EBezNKKl+o-^N){F08kAMjOXHyd`p^K*)uC5_dqs8V zHg&&}tpWQIch-0HAr#eI6#tbxf5T=wi1=>Qm-__%jTb?8S6daY^b0-3{1|;<$IDj5 ztNxm&4kts*t#Q4K?SelOpZBw=jhO=&&o8Ws#n>0*A5+2^gj!%W9em6J-+cVH zfUk-zWYrQ+AxFMy#F)ajq6j;P;1u16oi|Y4SO?u0oucwMdoT9_*J7(sy`M}7bSsP)gtp_qTlLiC&Q`(Q%`aF*o0zv<%v+`}v3>0CyU$zhysF6q!TE=wmzuzU_Qu~? z6|;RK+uNSkoGqGM_habs=kPz~KXV~xrWY8$*9CJPqMoa*NjQ}!FNNNxfGZp5>r&vj z^g(=08IN?yya%myOEXG~mm>ec%eLOl*yVHf@Lz!M!_r$7zdhI}_zTYRHG7pjg0bf2 zPM#lp4)~mop8rINxqC3vcjIS~z|xGmyL}5I&;lMI#lp*Yn7+)Ir$FDUo8VjE>3qJI zGuEl|=1tB;hFyAh$-)HoOvqDhoo!XDWE`TcW_a0;{VtsGYs|g}I6HG=))CfE2j}=! za(CCah;0=a+U%cM!2YF^hk44jt%`@4`-hiV>)rw$&n?GR)E~RfV#+T^=k6a`C|gzQ z&x}v|^6Wd0vs?O)EEoqaF}83W_L$rkSTi`!xr21c6yN5oxazEbTy#7#{3v->lJ8jh zR?B?JUQ|dQYVUBKkKN=IOr`|zqlZz)$5?>H6E^TyRJsvn4+W~krS9ryFgti8&0$c9p+ds{* z-=#hSEA|?90o(EM_5UQU{-0P)|F|%&{$GAY{m?)4uT}k9sqgw9SxsKQZhO?h`QCJ$ zJid8+s&vhN&!?(>g{=IjRaorusod#RldB$;tT`f_^+xReO$!cets3>0&w_vX?Prk% zk9-!qWz)k62g|nQ0hioC<;&8o;Hxe8WDQ|X8wRJFvwt_=h_48CE%~!Hklu2-RjBiM zH?u$A1kV%f9zHS@{ge9~#aHZY=Fl6j|K|>zMBADN;k$VG`YEj2w?IpS44+u*tUb*0 zBx}-pZe7Lb8-J!QwQ&K@8+rD4?1q~i9$R;F*V@9GV%C<(LT63c11`dYI_nl4KlqTt zgW3!aN@({#U{$>A(&YKjqv$f7K5|D+L1rLW-HLo6e(+Dm9$(k`yDxRXx z-k2}F_waL^z&CG>$FBJA=eQhrzIv}!c!E2}Rm^euz4XO@Dt>n(+bv{_I_{uad5oi@ z-iFMoald^x>rFm#9de(uFElbd2A`z(G1XGW8gH#b#!QY8bFuaqhY$Xk`r`9Na!QNK zbBS?7KIK`^OM9Q!TFJRbSxvuY&A!a*6EWS6 z;<-a-Ai(Y5kyg{g!=VGOeekv9atGgnmxE)}v5B>|fjVlDm94uSS-Flq1<5i;xG;Cu z0E2&T|Cl*Sl|L*0!;$fkf7F*Zd%({6UizfEBTI{eH#uum8*K=li)iD4;ibiofQv1G zQQ@)RV3Y&`JZM0EF@fH)Um$oJb z>pz=j-EQJ7wjr;mOfqd(B2Oce;~%0uzERn@P6ZpFFRNYMEHQGbxSvSz_ zTkQ|K`X>209?x{%uH_uZ?|zBf=jb)`+3VX{r*D~V-$duam%H5lbwJzdU0wBpH2W1;!p zKO^iFm6E?hvK90nA(q;^j5o^p?OoU$j->x)Tq&W2inrqNoK>fF=Q*n{>*6_*?X;F8 zu$BZ*w1$gEWuGd#abR_%H{bArnlPR>e^26|AMp*SfH_j_-o?_em2!sq3+y_dYlvJl#oKS=$_3 zFHW}#FPbb`9vRLD_g;iYdUNl{$M6Vva?&sd&zom6->0kpR`dWgEWCWzr@KiUIQFA& z*qJs5Td^}?Cu}$|ccMj`M}uouFuqINz6H@Sv12cY$LsPF-1%P6eZGaO$5ZZQ%GaTf zCES`mGjkT20q6G~#2&E;7*!QBeqbjVGKai|j!)3IMugAcUF|5JXeXOFb=Dc}8Jl~P z4NhK0yc&*gn7M35R>D@4eA^86 zf`Hf5K>D+@X)6aFCS5E$NA|B^_@BU`me?K2vy}8KAF-e;Y)0cblf*gW_4!ssHt@@~ zj&r>B9w?R?(Mb&>=nxid$Tl%6>d!x`;BOv)|=fO=eAfpg`+r!Ry>f z93edjjckIqGme4>@e@!x(x+m;R&)=pMKe#biixXCA4Y_KNV>*s^FJkE(IqGSCO3VV zn;s97Rqw_s2D;_N&oix&)!I8%eZ+B*EFT@e-ND@{ft2<+$h!2+@N&h3-ASJ2G>1-R zp+7wDmi?~k0w3br3cVex*zJCApj`a7%C}-gyZC142fCgk`N3V^a+9#{LNgu1(M36n zCEdV>&EMlQE8OwW30Hm$~Hp&pOi|WXt&eG!W}e{ke&M(;wEF`2Jk|4f^vjlxGK6@Kia{Og%jYzHzMN^M?+&h z|3B_n^SY0)D6v2K!=Y(rquu7&c+= zQhy%c-@qPRX^orjVf06HoN4*nYr)mS&GVgtKWn<$dW(26<KIES~X;Yk@;{R5c%rM=R83uIPDiYe4<{-<(@yz$B>jPwG z_GVWohE9B4tFyc6Ds$@+@9nL8#Ao=w>96`O-qM`y;EnO~LC$GY48~z~4<-6i!?ION zPOCxozI4pt?bHc;lbu?2ec9iaq+zS2pK9YhA9iWhL?rvpewIFI_@WZjW27BY`bgSZu{_;~u zY%k@R0!{hYzh;wfF*KKt&AmEM^OS7wdF&;RM|OLaH9QZySYE>V3-fLrI&+F|Ky@}a zIlm!RC_dT&9Ib{}k!+LkW9jU}LTGL;`v>%4m$5k{wqKeI{OHFN`r+q!;hvb&5Ayo< z#44)ESH;>npT5XvVjg49r!T;eo(R*e6+$ft(^Zt8WKcC(i`l(s@Lu ztoNPs9Xcmgcmh5%i#8r#tl25Q-OTG-?IMtW1Yzk-X1^bKpE`4aKZ`7;B$Ri7Z zS=P1qf=k{wrNGYOj`iBB(1Ayrb#86;^3nFC+>!Jf+OE3_nd?gJuSgdi5pHzTg7|V| zUMXF9WOx$oiT>*Fp^JxK-S$v(Lwl@HI`eJRQw}|kZI2n-_#HjQlKCz00@;M|CI1mR z_iP*=auz{&ExGnwc%#;1!6n3VJS-MP`cJAux6WOom}SY~6QFICD~5m8P76gp-fZkh zov>^9Fjh1eTooS2_qh)+%%69|RTMFo*u~G8!aO(dO>#Q> zW=(ehmy_xH&-u>IAAe6?t=9%^25Iva@0~W)hnu|jY;3{!R(X9mi*&WGejtzF7s#1Y--8(* z-7ALmJg@A$V{OGPyv%!l<5>G&ywBlXzNhe$72++j!%4SajeHPB_I}l$7#6=7%lmx3 zOQ(9x|HG%wgf^!`qn`u@g|C7xj^VuSmGHSIWZ%UfDWR`baV7ppFH#o0uHp>xUIqU; zYu;6pUnBoj_>4HuLnoYxf6}k;8L7r+y`eB zn_kWT8q$6RFDUU1SXPHmL@xVLiYqmUZw7yW@0%)@6N;_|*YU4Sd)_U75&yEmDYohW zzMX+Xy?(#n9gA(|!0iJ#+7ll$ww~XKyzBQq&lg8xu_}Jo@w=Vh3Vx6BYvR|Zjkx;! zDmbX?{l3RLG#NXC-}(F=;P)uMwfxR#kHykI<~zSiepm3jiQnz~>iJm!Wgx$yUl6OG z|JOf>#qQ*Q#&=u5%;@5}tqdt$tPT_Y3zbbw$q`!nS+q?Yw z;LMiH?>qdi=68tSmf!44VyI#0}k#h7*hbq(yqg&*PM4Q zlV5HC{}Rsd1ms_0g>wfY`}hLw*w?u8zV9-0_Qu>GJa*ySj@Bjk!N8Y^@3K|=Erj1m zCVp({cN=wQ`RX#H*WJ!HgCiTd)ANO-w~*J1M-(e_{I_&wrvY3OOdJ?+k39X32keSu|-=>NaL*W_jB_Sg6@ zHsTj}1$4a>zrZVoTK3Vtflpu)t9X&}Rs6RO@HJNY1};lv4V$)jg8hD()|CX-l^{MN zeUXV0!@u~eqg$zOlxdc)WVtt9m#3cMy+fDr{4Aq${N4SKV@v$_gZ9M_ryu?}{qf7; zY}q2t1(oSc5O$Qf^Pik&j>c;IjaB$+Xn(TLh|-%&Sl?UM;4{3eL+1qr5ekJsosVYy;6c z;`PbjLA=Lnm$^5xkB^wrE!4;QTX2NhrHr-kW@4?4DrhDBJGxgek+^;)4ypWWQo?^A zEkxQSzz%${b?0_!d|BRGNiQMIVtuSi3^gap2cMWsvweBhb6D5%k&^~oGIVB*FTc8# zI4b!k1!oT6SK~{pp2K^hFD-GlFTJ`R{LjN)6O_#c``BV)xZ)q_)HlSbuN7XL$oJWE zrdBWJ+0;$_#G@T<>IbLts5{6{b1(v$fgQ81}D6 z6-;HGvi=iu=vQ{79>D4SKhzf){U0Dr(B zuu1@CiNJ0EFdPV+1_7sl9fc?D<;T(tVz$~7uO)a!8t?hk=d4QJbi2U6|Y9rG1yQY<|d5!*{S> zx0ALrc(25lLp(B<^9>__uczGYh0f&|~nhoVD2eqaE&PVXo;fjrps#Lc<~NNH zeVqwzoB@tZ2Un(nGgI;B>L((71Q6?j|5x!?J#D=aL}0kPCjU(P_eY$qkh3baoH=W zceUOr+k&4Mvd!A;Q4=VWTCfPeMD^qM*fYMQU&1rd+D_6G1B^Mrr+!p;v^o2o6n@g6%!k52ez|6GR89O>8srSvW}W_t&zt~oWH^y zWufL)>>jG)LCTLX^^XW&>(y`8Nk^C6!S_w2$cN;48$Uwnl^cNHJEVn{c_Dy62FN+y$PF3V)w;!NGy&sBjkJw(y~jf&-!t{BEM}Yz-|`-p85i zmKrPXG<-_sZ~K98jCjBwEekcW9~{o*4%_wU;yM?cL_00uONhQtq(5IpAMjigzm0Xk z;A9zV#uSxj%{z&I^bF>bzS6$#dV8OETsq7D#pQjVnZD3YKWGSFYxit_G|(^n1w3{i z@}~Ige*CZHhb$i1I@iIQ8rlS}*p}>yc_^Hh-1anbQ?%M@GJS8=Y|PY`6R#C-1A|m5hb#*|Zegei^u!x`q~;`Zv1Yk^h`} zlAUsYAia+Kx$vOQZ-vG7NbpzlQw}~Qz;|UgfKDr>u(tZNruGdj3}TlGA`fXzi(JlL z5$k1SZm2lnBO&>EOa?;KZr$QSN|64%c~^&i>XG z+kXXr;$;>umWH1gKpoB9p}6vtX29Z8{AOZtjw^QEA)Ln_W4BSiv4j@ z7WzBWEywz7{97it@8#@A*Zr{soe?_={3*!!%cJxS{S=v{shqXn)WLhMTc!cKQZ9D5 zvFoG{ocH10ciuPgK3MPcy@7SJ4tSb& zdH3oCMokgYWjivyzr0rwL&D^vohp1QOdGc`e&H&zhWX|%StuMfV*=lGr;bTyOoFL& z*SZhce+P+jz4~~s0-k1GIHwRVpBeaLp2&4!BlsW1dDKeU-v@r^zCYdXSIMuI-vj&_ z_`SsMU49?)JHT%sVd6&dd!64={7&Ro!S8$gdOKS#9t58V@1ren&5>1dEc@TQNBTRm zND{ILaIle$cUQ4C_oR&+d`RZr$@u_i^fAh5O-JEQ-bp=93>4>Fe}C?Ju4k`P^@78u zK6pj%^<6Q=)Mrzli3bObzQ?oTG9B#Y%(i0V^>*$|eAYWxz7O1&JlT+lJV{;g<9(WU zZ@kHjx6U1J1N_U-_U#kwlc4+47?;EiHk6R_Qp4U8wCq>4&vH@{K9NB<-pZO*jI(*Q44BaB}%a!DQ_ok$+dpXBRV zq$5KDzqIg$JnKAFgl}!w1}3u?q5971%#$A0vt%Bv`HC;@$mnU|b4YKYE#)V6wEEDD zQ<`a0I+ScLs<*+9+|0K+{)Jmy+{oN027K3@;QsTY0XQ?|DBloO!+r0^TBI^UWE zJH9pXu6-}r5LBlZLxX;qb+H9lXnp+3b2$Od)gw#o?~HNd3u8}`z8V+jCZmIRG~A&w zQa1k?_y(#(l@|N;;j^~_{O#W=f z5}A!HMf(5Zpe@-yIBe-dx-V{5b*Q<00&5oE?)*c7UBkEPVRt@c-akmNR|3~Nhu`^7 z2YApv!QZ%RF89L`Ga35aZ2c-|;wZO2?Q3j%!s7loD{9gs33dx`l6{GDeG8soJgwu1 z%WU{gQaDL41jbK`N0qT>sQ(ktjrqh_6)mdNe3FiJ%=CBG_5z8U}fbJHbj(monmf)}qSsL4d z@%sYjn}R-MZvG>)j9slzxOO{tpNU^#2U+g>PGWsCtP;Q5PF?gp zd;$6J?Q0LPu21FM&C);uv8+dOPCkwGBp5!2d=`Fs=B`1vOz-&>vo{z%l{~en?)q~e z(f)m0nVcSN7#NdB&lTwk2^cYj?u@~GS(^3@J;%dHq--yT;kz}|X149)n+qjE9k*W#XZ(;jIzQ0^jNkIz(l zE_bKJrdZA5iTlxqBmNPu)^ZN2tNe)YzbRj-nEZhe%+ZKfv2icsOkPty|I?UXVr6fc z?ar@hW92W)B9_zN%%#0Jbiia%qccMiv42uw6(!A@fjiQ8R+Z*EBzVya+o%25*q)pBi7WsBew1f=uGR!V8$j|8;TsH zd6K;=bKVJ)_n(d5B=lx|>a+WjC&rzX8^q@ZOcif5>7r%%EOq7`=(oQh?U1~rFC@Jl zU8ghexBa%}`jEV&UqyO|`vyDnUhKEu?=3Isb4hOjMxA*d@Y`?qmY4MNNv{>}TEclr zZvb=DK{+kfe;9@0-!J@IVx^Tq5I3NAKb#_aj?!*q}A&s*8KU2J1Vue#*CV1y_+p+j&5lc6l z^h)V4?l>Yl@!!^1X(N}t3AMRj{F*w#Rq5=;JzHVlDWXv9cb>KDXdbo^>}A zFjz1h|5~l#<><$rd{K)(G=8=Q|2x4|4j_ddSIE{E=N0`>vXHng5jEOf!V<#OWNaqrB0?u*IuB_`%3 z1oMO3Khp~Ai#Z3Qyf<+l^?vfjs?oiTUdNs8%)60&;USLftMx23oV3ZU9~rEr+Le7@ zAAsze7EXQH`Sun#tZ#eCtGNGh<6Iv6)5&(D#x#ZX{=NPa4PHSf9gIUV$dimsGNbw< zII7+sGbZUR!qdOO|90?grz<;Z|NgJoOEnJ3S{m;P$>+jP_(^bgfBP=l!q7*nz_8a`D%(7v90u6(%G zlMi+GNgH{00pIb+M%CPjG8@@&zVD8Q+QuUT&NMRMTB~KCeHrD2A38gHJAM2a=YI%sS*#))aT@jZB)GEBy4lZ z*yxB`y(pEqnSE`=5$Bvx_zw1(rg6q!=g`B%15af9Q-9Pys{it({i7EDR^^Gzv$LoF zE_El9)^IZWq*CUVDyY_(1!H2C9*N|kHLg}C=>H(xXP-I zPW*mrkevx!utR>D9U5wXj_%dM&;KoKgQNqO88;A1j{U#o+W#wLj#uOlw>R9zo%ht8 zN8PgTu-`+QDdF#%Hn~HVfAObH{@Kr|EzNyj>RaEhJQjgN1B@^tx-$ab@r`4B!Dcz&w;q%sPQZFlY|n8;YS=j;9q(M4+bd!%cuq6@uO z@-Et$g`Ii=zZ8DlS5hFD529U-!S^F#lJM_edOBlC3g1AwXs~LAKkxc~_!C5DoTw-vYlExmRE zd|UYmL}vWpSFs*AeQ{zk{uMm%%J=MxVDGhYq}!Jy`l32zKPMhbbuIN>%bxf>u79%H zniJQzkuDtK+c-3qrxi|N%%Y(crG<9=@H3k;tt7Ko@14IWqs~w)R_NIbyg1ti7l)nM z+_Uc*yVv*qlvO^#F^~O@MCPL%+N~izM?L+YHyR!l7!aPv7-YMh$9U!g=c%KK-NkzX zaCdMaDcpb!&#TuP(~cze=*e$|EPE`^>Pv6-R^fAezqYvjN~T{c=+}$=tmBY*D(Vbu zQ>rV`^;Xaqj2G)VdF`GgI|G=0j*U=0q@rEHC1yt`s_NLdfZVD$7fO8)6A^(;gocF{g2F)dh zuO?4DcQIU#Z@Oq!xUDtS*(Y`4sOi4pT6{0A=RB+OfX{9o=WbHPTGM^Q*hh+JpFCp< zR?!FD?}_jGic2#{V_#Nx6Dw^JX`1)oy-qBaRlwHJ`-7)*MzMB=_8pb)Xg8n#=ch;O zNo&=fJ?Y~}cVN>M>lHdWgvJyXG{pQb--RuazU%oeJ<~_ z)R1LmZtpE!bZ6mrX#R(~|H&c48zQVHZQ!pjS-y@5^ec#5%AWg@-eZ~VbN6W#*GcON zGF6lMa}NC!UzDwNI?tkq*ZKCe`JNJvkQNjyu2=ulfuV3a$-qQ*>rL3*_Hh@B@OvkD z>jZBzR^t6IA61?2PMIY7xc?#}CoQ**I>sIeF347`{U_F)<-rfWZKL1qZW~_r(0lxE z;(yQCR%09S(BT2gty7M*2UA8iYsWs^-M`w4tJVph^e*^t7BEdRkpnXqUV%g7_sVa` zTdVJ7Z4mDKlCd>tEK3CkCuWq!r*Dt(P4b28*}zXSB>Sz$+3%AsAJg9UcuYS`--6-y zdg<4pyvpg5=I8(0`xfXbi);TcCxM(0A3&Z&FbP2n2&ggP;fq5+2tq-DDpD)qp$$Ui zAtDbeQD_aImJg6usRThy&ZU-WK*B{0k7}x|jc6mHwFv}0D7PZd1cBV&Z)SgC&fy&N z{%^b1|E_h;T4(J&^UY(=o;@>r_PpX%-Nbq4J2b6wXwp1)+CT)_z&n@^K}L0(g^ZJC z=pT#I_`Up9*7n(SKH@ z;X7fv`tJ5}4>fd)px<_eN*jHdllFjM@zr;?_vwp#!`;ui{)O*sFM)h^_KdNObOA4v zJS+a{af$ph`8yf>Wt~taIwJgB$ZSnC-!nPi$Flu~DsRn2=p~{};j{Y$k zdS&3<_>gDJ=hN}_+JfD(cF`5@J4fohWbCW(2%u`?BVZ#taW&RjU=MSj9sXef`f}ct zdN1rxN+$9XmHxTVr*+aBIzjd`XxC+bm*AZ%=|I@CnXVi1^CQIV0C}2Uk_bDQm4&-Q zF^1~5nM+`|X5UhVI~{1ltNj}KK4dE;3cAnLRyOZAgk2WzWa+ojU~?LFa*maSdFA3Y zaoKhXWCmyHW?^sR)Z)&b)2^7Iv;Wiq`x!k6TNdVH)j2|0PRk^M$pPQMOT4GI8VbfmbLAy5!(Hk`B-jh0*KpDhsH@lX9IdTIr9x^4V2yCS<`3rkd#XSeZ1&|f=@`3)g1xTC!_;=rQZ(sdZ)?+H?t zbD*2+dundq7WW1sT$_vJ@w()JJ&HPybe!`_lRTg=c!K0X-Z**WwLu=#e^9O!=WzD# zB6+Qmyb4n!uddjmgR^jXD+V;Yh4XOhfU|7mX$1P9^dNb^&3Zxk4nYPcBv?5ERos}b zcR&W5zKd(5p?Eq+Xu!Nmm$w(rIJZ4dLm#BmL<9ONmMa0}nh=DR^#(1t`?HCbbfl+f zk@&Qo-+?qn21#QH(xBah_2tH1ml+7-$Y4LF&-Q`6>>luJbBeY3AN!)Gj)R;bt<4|9 z4SV6Ym5{leuDsdGwi1zLyRKik+UIh4vBwQ#BJZwG^7g|W4{S?6hF|Y!lo>i{V4H!S z?AK(`+d9wj9qp$; z2k(|8?+)oRbGV;3!+rw(n}wdB=@#mHXM?8Ova>xE@m~r|x8Q1fBK+6Fzp31pq}VIr z7XE0uK1;Ew_hMYq?zFb{qX^UZsa1+`N5ZtTr@^l&OjN2p0%`joUk}0G=jhCblk6ez zcjW5{e2Z$p-YEQw@ZW%cGR|gwbQX)5fR72j70@Sm_IEhzS2jFoWAmVn7R<)M{UosER29E6prH`={VUzRD2w~9_qg>NeBNW|Gu7P1zQM7X zLFTgTT6{;iB~D&SZ~Xaf>h9!Pl$*NIaim`mFh@EbEWJ%P*ndHKN(abC8DTdC|M!$3 zonpL`UK5SE33%$2u@YSOQOXeRfdc5*C3tV`guGzpvF=uo2eReT<@2!MiHEfiXow0`y{7#I(`F^@l z*0mUuVJjJdyN0mNY-lGQk&QDQ>zac+{q0NYE6^j5VhmaM#)p(121Jb~lu*v#FaV z=6L6REdN9IFY@=qoXua_0((ww|HE~5-V;R&$;V1pJkII0ScLVUg|760r^mtOrsDrd z$IqZWXdZObah6>N9vvKR*_T@;oLa#40SX>``EZfe8Uptf;_xF?+;M@u6%L9MW zN725yY4ek}*mq$rs^%Z8tLS!Fb5K{*c~^i(PI*5@9K|d20S<4mAFhd4+z&{70*3|_ zuUOB_tFz>VBd|%Tji`B;e&gpd#BqbCm5`O=`>ax?kF}hJ*Jt;vck+D;@l`yVdZc~} zl=C+=CqW)XY<}By@-5B{{qlYo61h`;3VSKg6=^3^_S4s z*#B@&bqL|j{>KbU8kOF4DBJFh_hZvr;#>k`KLcsAE!G0R9Qnq9|7+Xh&g;nJEH~a} zD!?9FAM}<2c@K&G6viI*5!vLyZxEmMd(JV`K409S!FLhd>DC7YmjQ>)jdj*pSYPEI zx{CkVE0adr1W3ySwBu5=?FU^ruZMNnJ~#(RoAgBV?_+S6!5Ho#jIj#cDD3cd#ZK#n=mN@|Wj)G0ds+;4cE!kKT^?wEx?)+=q7(eIfVR zQm@6l<6Bh^?Q)<)=sMV0r{~$MgI7?8@sMk51T0_szE%2MwX1YFc)gT&5`lNrwcc`B zvtSG7zx)_@z;8t;1K%Ah0{vRf&fBZ&NAFhaf1Im*3_2Tw>~n-%tGA8NX4N^rbhIb( zit@p>VYc}(@E?o(swtv`LPyx+AR;_apnO$84Dhf)^TV%{qWBOKME}L``}ZNh4&}{524I0z%TH1 z(Czrnw$mBw&1gGQI{~uokYCuJFm(*l%cVUV@$wL#?YjkN>Vz=8!6)uxWBuhRH{SZ; zcm*EBfNyLsc?Qo(7u3TbvZv4bP;cd02gY%`4m{%7cj)CSEZW1tn-cOHXFCqTcHC(o z?w`fJ0op>F_y_+${;@tV!A8HV&k0;8_eS1WFEaDSyDKYTmnuWws`6(V7t71B534#B z`#J9H$JvR(J+upkT94pf-4i(X#D1ay{RHjl>;uV1*44W$bY1VIo@LPoQ9DaR2WkTDp`(Z7+FZxQo&dW6m%DcnEujZs?&9!h>0O)Kn zVO&qFHLAL1nERuwR+JOkZfP5=Lz^yzTpa@c82>Bq?;7mqnTWb$UW|it>j>XMg+GXR zjI#!Dg7w$OP#1h(m3{Up>9aW&-wz%@K9r4ub6W0i`3N$C{t|1h7xuNRhmlQj;*~v@ z>l}e$cd<=`SmO^y3-xrYr`kAIr^Ybo>E&ry@4Fl2rM_|!utf1+_fr_hR6kXTF~f;V z`mZ$Oqm7L~Jj(cMfNVED=>G+9v(D%aTu*Y=<}Y?`!8xnNIo>kp6-5{)@&KR1SepPi z6MAU!wa_Ecc87vj30A@);)8)ZI_Z`tix$!kyw9o~hq8n3Irz@8GzWcv8cXl*uI5Q< z?1}1b4*|_5u=e>Qzy!oSbvbpi1aEgE-BU=HXC>O;tsAC)Exz@Nv=rXO2-kjI(ZU0e zAGBkPA9|0`b&~%H@)o+SoB7`@W8X*J?QY1IXDXj;o?AK^`_)Yv5{$GR8WM$u%kZt* zrD=#Y!tDgD+77Pszw~1HkLY2uJ+n-;qyfAp@9H3XM?eet7L@MKde}Vs!ZKd;j6?`o zJuYWAopwW8q0-~W^IT*?)=yzeX213@>U}G8d9M8}Mt*Eldj7>Vfn;wZ`mJK{74fw$ zQP9i29_8tQafp4=Jc+}8mTipZaE>BQ8uvmvan{^ucOVbczQmq(BI3}EITq4L^iFF^ zgXe>p25gU#FXkdT-|aUk8;kBc^cw9`5(YffVd`$SsrRmfZ18PXruDec;sbrhGbCKi zEjHc*25;lM>%fQa+wXGWIOV*B9_Q`bL_60j_1fvH$dh^)_^au1_qIPler&gFztm3x z$Ht50(b>sEouAfutTOUQ<9cK!bd>)^9<7`_)H!jTM`2(d<0I^szb}uzq0bdN{SV)l zVjmQRv>Zg#Cv~?I^!IbwtB27 zwN8dyCC`ntaaN|B>mjU%H$gk+sjp)%Wi4!!Tpy`hs{1RpsfTbM1;3wyocbP58Gh)2 z%Z7i|9e1tBnGUvxNyxi#Pt^6iJB4?Q(Ec5Zdxjpx`^?v}9VeJ4(@tzO~BfTWb%HjwCP7$|)LkTha6KJDS@=;Lo_Hk!Aw&QSGLr znVkoJzFoxm^r=+#p?dEa*Y2JG?^GWHKe|6e*jk|hG_M$buCa`9r-Sc}&{f>v>9I(x z>w~8rj4`i~_h=7+^I`KGaG>qasn6b^ll|CcwC57exv>sS9&;|P__MdUT~dpAacA87 z%kOIcfd1|R|8hS{R&@qh*mK8snva;@RB@k21ne`Hfwn@V?Y4BuL9}k{vehAb#0Wr?|S6TKGDqk8@%xpH1Eo2`(fl=*b(zP(1!A7J(p|s z;u^$5ooHy~**L|SwgG?h#5uh8Rx zzkT%L=g(q4;F|a811?+9ByU0GMMgCAz8UYmU{2AyC+?HMoW6H9)(J6x;k^~3*W(R1 z>{;Zx^Vi#TTY_$yvu<4E2m4_MVwsMiOqAcdq1WDy`((J5*(nA(EXqW?QeI@Ah6$)g zzx|axtCa1MQF=jQ4C;cw=$Ji0^p+LcAA)(=yKYJsBfQ3o!0RLiWeqdxc$# zyfM~h-4A&pKe4$y$McS-L4B{n_XE-Ro|yGh=R5AU`X}y&+<`yk6?cS})n4mq$X$=M zp?Sl57PNwW6g>V0b+Qn=QR(>FH03i$(phn`G3PU+@p~s7+}pr(m`2g1I*l%;8dpGf zkFV*0HjVOVT2itO%!{;VNSRmE<8DWsWz*lAgI0VW7imA_d_RTny`AsP^!L7z_5;p$ z(82QrI)0S?o)Kx^=X^hb?*p9gtP7+c8ENzVHS%l4@y473Kk<|oLpG@wvLE4mwH*DP z;t%c$$U~o8BJ`6tu^1nUW322voKw{P&Cv(Nd7E*}!}*6i^o!cRneuN$T50r;b^N20 ze`|!#kA^?=a~+=NcH+EOF@4B_+W#L5TM_E86!aZ(bdas>?2kY{Xiz#}E!rpJU59uq z(`xv0j9Y>G7b#EFm!_hgI5w*BAU?(3jW8c$PDT4O;~qeLGcNJY42!yKjc?=3cq7`{ zTLR+!&WP7m;!$>sYGAvDOnDAAmi-cVCS;eioKkzU@Ww6r%l?L6U*Obj%{xK%Auo=L z(=q%-MB~tMyXf^)CtHo{eXq8Cll#m{ zeI{aR7xY!!D}r%wL;?1OxN%m`ib$>IIa!r1&dB}}>GEtL&dp~-=fgM@ul3$DX?7ua zk!nXwt-*Mn`Wztc?nqq~F?9#-Ra5aZ&<;Q4o0m9Ci!u6fwA~t{U4#DZ&}7_?a5dHq zej71$9qxWRl%efwP3a%bq-`f&rNi+Zw3LDt3wJ}X&YHqa>0sX%5N<8P6{@uuBV5f@ zHs*jjy#TsK3SGsJ4cr}6%CxywpXY>^{1+hI3Y?ws%iqedZw&}H7vVfcIPP!EK^TXB z+*e7R-!Glr={E1lAg|9rrklz)KEv)9%>Sbfb{hPf_$YUOU%OB|a z*QKM<`DyEHqG99J>Rhm&-_5D^jgZAP(Bm8#Jc2ij(*7&DN2M#_J(gAJD)F7s4&%Mo zB5YA&VR<%XpCd%x0DVv^BSzH z#(Cp0uCm|Rg8k9dHJ?quS%KK!4tr_b*%bNEr2WE|B5?yShnZE z>njFZAE0l@Dsf%0$URWL!#>RZmgk}84z>P}4*U9NxLXza8tvc1Q14lNQP&^CuK{V# z7z(@Q5WLe2yC3SeDjjEp#$vo-9!1Eb80BHy?ai(3b!ZdWh>JeEDtVsUUV-t$*IBJK zeVdFsw|ajXJv9TmCHG)2Mf#K*zKu@Z?5*RCE4WvCHQcy+4}E2d_vb8wb;Y7tcq>}T zRvPXUMcki2z8JR$&LNfzLA%7-ubu~`K+dpd8}XDI<2~I!hWpev5v3=v7Xvm7J$A0V z&OU**R)cwAK4>|KbH^t@2lYr*o`&ci%D!}fGD`X7+qsF}zGnTR9Xs_qz^q^RcZ54h z>?5y(Ud{=?Pnq9!v7z{@`%jwuO1jz~kRH%*GwAu7@Hp7rk!L33UZ#0^50TOXrd(_9 zl(KY1+!K&nu8oAUZ&P+@6LRj-Da6{|Xz-u*p_b$opbuq@N$~XKnfb(s<+v{mZhZ5> z7S;yupsV_5tM2CYp8C74k0j``x*m8IzK!=ZXhOKfd^d&u^gAkL3 z!am`rA@bW6kl(6*QGVk?lw{s$?b3I~{TT$0u!fnourd$oc-fDtAP-YKxNs$}vcl1M_RhVGZOSZKBF5 z$g;~J>r|>I5{v6-cx569jllXQ5YZh292-?51e{HHu$iR4^`yj2i?@)F+OPeYO?M3g}zYy{2^n6b4L;8{F~e|=l5Z(D1(k5<2!8> zN8GD&8!DmuDSSt~eR`;MWYmEk_7#0B>f=?Xe$~saqzwXlEXF{0XJ0_u1^DSLK|PL5 znk)Jz@9K18Eyv}By*vX{eshWD<_Lm&S$>UK%qBKQ@c&CVHzb=2<~H!Hf7ElFrX-wS(#-+9hF z?Bk)`_51qLwasAb+ZFoGr-QIr(x%RJLFfDk`S>WuA@rf>8_B~>&e%?cWKa7$8_{G^no324El-$ zjHCIoZ^MWAF#CdR+{acV?cfmFNcvy6$6MPP*%k^=j=8s5<%)KXoAZywFHT9d!4vFV z(`^Gf#h#yGeDh1^gY)TBI5H$W;y!-pSQqdoA2f~!jo@APxw$xd2i{}dtIB;afqQGY zU#7L1gVBD7?|%9H?R$v#k9^bx-U0Jojz3t7cRt4be_r>K{)X|C8U*dtzz<7<3 zk+|0_8fR_XSnrO(x_1klr;jZ?yUT@jc74|=*Zd(n-kQFc$IG2uBOp`MKM$i$*uGB3 zVXXmovrw<6|KsRaDJM!th0JiA!`fomar|MA!g^GSYV-SGPou7tjJ^4fqW|;_!5&FK z#dBph*SunwTIA34hMk5!4qFb|?zis9RjaYzcB-q@%GGsp=Ya<}5n`G;{A*9r7t1sBM$wkuN>iXg*&@_VF zUs_6z9UHaug(AmS29aaPdUjx$A3myeNvz3Szz_C6eXzH29R4h89r}ag!b|oIfB&>` z#Z1f}{b*9Me!hG@^ogo`kaM*rjK0pL>Q%i?H;P{-I!#5 zDc?C}-HG}y1Fuy%3_0hTy`n?;IXp>*E;$JDc01&5AmlF(bG!lAAFl7I_M=<1x$|^4 z)r-^Kio0D^vs)+-#g7x2RM4n1~hdqJEx68xt8J_mmDe&_=jQ`o0*Uj*;s zUIYG8j#<`Ug1?R~uG^IV8bn}TC(xFtgD|~#^H}tpC8-J(=ZNW>iGShUTibW z`?%OECPCLzJmEdD7qk_^cBi`oo(P(0~=}WO%Zk?`bO#^`K^_`U|2HV4Ntzo zWhY|Hsy>%yrvQ%Xd!>B^;2hX}+XAjRm2M{hZtm96_N~RtOd)@phq~pQF#v)y+eH2YFQI z=V13mTC->;NQK?E5Av;rUEz*z8&?cu|G+#Een0Z<#(YuNZrCs=V~#G7k1>tsxSmE| zfiwSpancc|rn$A5^qztZRrN8jlX{$R0d(zSc$Bq}cVd+!S1ro3@|bxc5AJP*3GZihGA z=3M-Y7TU3L;}vzRZOnH+(B+=c!;68(A<`uAqgCz_X@ofo0j zTP@75Aa`uzcq1d;P99^~aadP<`0-opc;0`L>$V$)T2+wsO`AKa`BxR%#ir^l@%DG{ zKZ8H!VVh3fm|$c7=Q3+vYCZac&F*>k)q}t26XLwk3*diWJ#87wiDPWlZrrB}cMay} z+MVbnZ_($7JIRZUOkCg2anBoFU-W6Tx(k|k=3k?6)gtst;CUZLqZ`wB!N<5y=&3&S z#h8Ct;7hQ1%bCfzD`uCrXF7Kr)nGiJZr2rUi~0-CJ=Ne|fwOb`??Q6I{WwIp#z@x( zC+}_sK7+?|aA!U8IlnK@$~t)s_kg(See>K|zD3PDf$xjmoz#0B4ZdBG_4@}Ga4|g{>#xPWRM5=>5;UQ=a>NH@k{bD7#D#2LzWz0e=L0PB_PU4sqCy z&dwPC9`uLI;Y?wqwg+PW@l@J$d7dK`d#ZO}-?Z-^u>AtBg$~ntJ z27QlhV6l6FzPp3-%#{eAkMS>Xo~iHQ=3N|d-a=RJYL20p)Z_%FS%ddS**2BG8jtiG zk$j>*b>L7o!;9@TrTvFzrC1h4^F2;kn|UXKX0#_wGv=k7lj2-6^qlj1anzh1w41g= z?)hhX3iRVVC=}nh7uk_*$L3G{9_RC*-(y?@E#%D$kP%G-@9)t2e>4qky!pbvS>T@= z_LxepO&~7#uGW{U!NdP|e(ALc@`^f?Kd+*^Y2+1XRrM>p;$BGd>K1%sSx5_Ifi`xW zAzW4n`r>fD%RTXto}e|GVRI0cb#XV|+GRh)aRo9gbGr-o`d(~5jLFYXb$k@|s}#r& z>DvogcI38A1Z+=`;W@GW8y*8(b9sOLp8OMzZ7f;YC_E^$va28+%F13q(5&WH!Q|v1 z#^1S^FLPcwTg!Pl`WMz$gS*^=`>xrJblRk8ChnZ!*nhFNCxgqkKIh4~GWSS)2)bBr z`Hv?L=R0N$=zmM;ew9VQMH}&>-@Bsd0A3F2YUwHIBoSSb|Iv?wf?VyNl-uX7( z`R2@j;=S0juIh0Gc%s^@(Ldy4%x1k-qF&WEqdfo`njQp2Ag;3G3r7Yu|R_} zHktCt@n|_@>_Ynl-Zep<1uSDL)`wFrw)68g4al#Ocisn-2HPFeaq>}e^b6gW+yh<| zJ7F>JXTA*YjE8}?5fxYF)3+n;QpCkL`mGOlkreO^3`vW9F6+Xi3ARJLd)mWxL4I=) z&Vzi&7t*G_jmfqx*n9omdi-wseyQ9`#I)80PiqR=M9cQKHCV3HYK3<+@NNd4W#HWn z{6+)6)xdKNyuX3pZs0=gaENdrG^ z;O7k7g|h{YY&19U)&`zv;3)=vrGd9M@Qw!F*}$_5yt{$lXyCURc&>r>H}KmH{4N6@ zW#IQ2_*esfz`!3g@P`b1nt{(S@Yx3bxPd=u;J-5Pg$DktfiE%e}gmHt-e(ewl%{Ht<9PPciT-4ZOX9cQo+M2HwrUvkbhuf!}E0w;Fh^ zf%iA?+YNk(fe$nAy9|7kf!}A~V-5TP1AoxKA2RT120p{UXKVZptWman+`ykS@Lw7D zLIZ!+z?T^Kasyv&;LjWQ3kLp@fqM=76$5|Oz_%FqHUodtz;_z>+Xnuwfma*&J_G;U z!1o*Y7Y6>7f&bIMj~e(%13zux=QOUyZsa_P_Z> z4M+UBznW)`6j*=xm&)xc(cx?U-dDws%IT-+dQyZ{Z-YE_91r|r@^y;ECT-Hp(@trh1)0cHu@d^dryF|Np|FMViPabip zf@#0g@hS#rdRN}2;l1zb{3->Ook>^WGmmLle^kTW-)U%_*6=zh|B>IssPJnh>wJr6 z2tAK#SU*$4kqb0DGF9hyhs3WGI3gofrBj!t;dp@?1-2Zc>0g;IaOQIw77W($tE8T-G+obi)jFNe1o{LX7Fh7H{=VsD4d+kP{K)%zPnB=B zPs8Fm4GR;r{pzs;+I@+9Uo7tJpK1TR&o!KMP{SgLw?V>f6#wyG>hCoI<0ZYy%p{fn zr1+Z@tZJ#@U~x~nT)Qh;YdHTh4WFLUTZONDT*I0tG(0{qQTh9B8LVK1xHAW9|Ggrw zHFGrIraY!$)iGV(4kFhxyK4Ea>!RVNwHhvK+fJox2`p---EGAkf0=gw`Cy8s<5KM& zf2D>;T4~raUc(M^biGe`Ov5e}tyR3_V;V*YoH8m-`ClS1&4Cg=^DP~|;*KkHxH~o6 z_zMj;jMVT*hR!#;TDxm9G@Vwu&?WHRH0`dsLBqkR8fH51CpvzWl=g?ls?&-jNXB3!n8bN7S$V-J$Xe`~Pb=kQajA8^k|vaq#-6 z3*rB-q3YkC%0^q4>-Z84pI)lr-evyfeR{cem#q^2)f(O_aQ7PRPW!EfMFQ&t{<}+( z`Ml0|lfc~qv)5|>Jb|I;*c$LXxmd@m6WDK^c5e_EDxIhobhvzh8w6VGwSTC1j{j~6 z=iZ>h4;JWrUmW0e{6oPr629e&lAgd&;g867_e;U)O$*^4D!qS~|II>2p}^e&-7iZy z1+EnMnZUFX{e8T^5`jOI&chP^x>B9abb(t1o)PHr>hJRfeqZ{P67G`!(DCjN_ z^JeYdF7VG=v^#&RhPwr3mTR|@P7~aw{rheA|6UT{cEV43!#|wkUlrh={iY7LQeg61 z+PzWWnF{UB-=SfJzz#dLyGWpu{{L_A>0O#mhpv@>)b29^9slWX`-j^q?)Z1K|44z` z1twSehksh!M*{o@|4E12DA38T<-7jz9seTnuM=4Lo`1NFf7WjIUo;#q(1{=QzV`1Y zaHr^>?+V-}@Pt6uBCVgc5ST2mv%oxoLj;Zzc)!5e0_O`{DR8~OR|HlFd{5v$f&V4& ztiYJ3H9ZLe+Y9U_@D_nX1&$UtMPQ*oTi^zPn+3ijaIe6F0_z3FKBM!$Qebz1y#)>u zI80!Hz=s7E3H+_V7Xijzj>?JTy;JpH;3tTMlMS&FpKM{Cb z;5mV@zt-s|3%p8TmcZKt4i-2};6#Bl1TGc$iojh0|0=Lf;5Pyz7wdeJ1YRXDTi`7M ze9t?PAs$FAqNad(dTy({0_h`UDI>Eb>q z?)KuoWP?sGBf#wmaQ6vt4+?OP3vhoM;65SlRLQSF+}*`}PTWJq9U%prByN|u9eVxt zJtA()S9Lk8McVEt$ywdSzwl{)|A`^|*M{(~4&i^vYdYT}0qGA2;XhCOd;Z#=o?RjQ zqsnyp9TxkC?{5OfTxUm2L literal 0 HcmV?d00001 diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/logs/.dummy b/tests/iPhone_4.0_64bit_10.3.3_14G60/logs/.dummy new file mode 100644 index 0000000..e69de29 diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb new file mode 100644 index 0000000..74d4e19 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb @@ -0,0 +1,546 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/OpenGL") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library/Extensions") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/OpenGL") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-"))) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow mach-task-name + (target self)) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl* + (extension "com.apple.security.exception.sysctl.read-write")) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes")))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb new file mode 100644 index 0000000..7e058e1 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb @@ -0,0 +1,1609 @@ +(version 1) +(deny default) +(allow file-issue-extension + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension-class "com.apple.app-sandbox.read") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone"))) +(allow file-link + (require-all + (require-not (subpath-prefix "${HOME}/Library/AddressBook")) + (require-any + (require-not (subpath-prefix "${HOME}/Media")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))))) +(allow file-read* + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/SMS") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") +(literal-prefix "${HOME}/Library/Cookies") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd")) + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/Memories") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone") +(literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPad.settings") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPhone.settings")) + (require-any (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.AdSheetPad.plist") +(literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.AdSheetPhone.plist")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/dtracehelper") + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState")) + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Mobile Documents") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal "/private/var/run/syslog") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") +(literal-prefix "${HOME}/Library/Cookies") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd")) + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/SMS") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${HOME}/Media/Memories") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone") +(literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPad.settings") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPhone.settings")) + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies")) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.cache_delete") + (global-name "com.apple.coremedia.audiodeviceclock") + (require-any (global-name "com.apple.chatkit.clientcomposeserver.xpc") +(global-name "com.apple.companion.camera") +(global-name "com.apple.coremedia.cameraviewfinder") +(global-name "com.apple.iad.") +(global-name "com.apple.imagent.Embedded.Launched") +(global-name "com.apple.mobile.deleted")) + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.dataaccess.dataaccessd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "PurpleSystemAppPort") + (global-name "com.apple.assistant.analytics") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.accountsd.oauthsigner") + (require-any (global-name "com.apple.passd.assertions") +(global-name "com.apple.passd.library") +(global-name "com.apple.NPKCompanionAgent.library")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (global-name "PurplePPTServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.UIKit.statusbarserver") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.ait.client") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.networkd") + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.securityd") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.CARenderServer") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.mediaremoted.xpc") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.librariand") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.imagent.embedded.auth") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.calaccessd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.sharingd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.dataaccess.dataaccessd.active") +(global-name "com.apple.passd.in-app-payment")) + (global-name "com.apple.twitterd.server") + (global-name "com.apple.assistant.settings") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.webinspector") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.nehelper") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.eventpump") +(global-name "com.apple.mobilemail.messageuiservices")) + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.mobilemail") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.fig.movie") + (global-name "PurpleSystemEventPort") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.bird") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd") +(global-name "com.apple.WebBookmarks.webbookmarksd")) + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.pegasus") + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (local-name "com.apple.assistant.contextprovider.") + (local-name "com.apple.iphone.axserver") + (local-name "com.apple.accessibility.gax.client") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/printd") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.da") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.coreaudio") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AdSheetPad") +(preference-domain "com.apple.AdSheetPhone") +(preference-domain "com.apple.reminders")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.CoreMotion") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.itunesstored") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.Preferences") + (require-any (preference-domain "com.apple.AdSheetPad") +(preference-domain "com.apple.AdSheetPhone") +(preference-domain "com.apple.reminders")) + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (require-not (sysctl-name "sysctl.proc_native")) + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.statistics") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-fsctl + (fsctl-command (_IO "h" 31)) + (fsctl-command (_IO "h" 32))) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb new file mode 100644 index 0000000..13ab0c1 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb @@ -0,0 +1,723 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal "/private/etc/master.passwd")) + (require-not (literal "/private/var")) + (require-not (literal "/private/var/root")) + (require-any + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/mobile/" #"^/private/var/mobile$" #"^/private/var/euser[0-9]+/" #"^/private/var/euser[0-9]+$" #"^/private/var/[-0-9A-F]+/" #"^/private/var/[-0-9A-F]+$" #"^/private/var/Users/[^/]+/" #"^/private/var/Users/[^/]+$") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (vnode-type CHARACTER-DEVICE) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal "/private/etc/master.passwd")) + (require-not (literal "/private/var")) + (require-not (literal "/private/var/root")) + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (regex #"^/private/var/mobile/" #"^/private/var/mobile$" #"^/private/var/euser[0-9]+/" #"^/private/var/euser[0-9]+$" #"^/private/var/[-0-9A-F]+/" #"^/private/var/[-0-9A-F]+$" #"^/private/var/Users/[^/]+/" #"^/private/var/Users/[^/]+$") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cache_delete") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.fig.movie") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.mediaartworkd.xpc") + (global-name "com.apple.bird") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.adid") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.modifydb") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.mobile.installd") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.pairedsyncd.progress") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.voicememod.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backupd") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:443") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown/checkin") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.ids") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.statistics") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-fsctl + (fsctl-command (_IO "h" 27)) + (fsctl-command (_IO "h" 28)) + (fsctl-command (_IO "h" 29))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb new file mode 100644 index 0000000..3cffae2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb @@ -0,0 +1,306 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.Accessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "hw.machine") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb new file mode 100644 index 0000000..f7e917a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb @@ -0,0 +1,808 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/uart.log") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Library/AddressBook"))) +(allow file-read* + (subpath "/Developer") + (literal "/dev/uart.log") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/wireless/Library/Logs/awd") + (subpath "/Library/Application Support/BTServer") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.logd.read-only") + (require-any (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") +(literal "/private/var/wireless/Library/CallHistory/call_history.db") +(literal "/private/var/wireless/Library/CallHistory") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db") +(literal "/Library/Application Support/BTServer") +(literal "/") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/BTServer-") +(subpath-prefix "${HOME}/Library/Logs/Bluetooth") +(subpath-prefix "${HOME}/Library/MobileBluetooth")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (subpath "/System") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/dev/btwake") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal "/usr/sbin") + (literal "/usr/sbin/BTServer")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/usr/sbin/BTServer") + (require-any (literal "/private/var/wireless") +(literal "/private/var/wireless/Library")) + (literal "/private/var") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/usr/sbin") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/Library/Preferences") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-read-xattr + (subpath-prefix "${HOME}/Library/Logs/CrashReporter")) +(allow file-write* + (require-any (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") +(literal "/private/var/wireless/Library/CallHistory/call_history.db") +(literal "/private/var/wireless/Library/CallHistory") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db") +(literal "/Library/Application Support/BTServer") +(literal "/") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/BTServer-") +(subpath-prefix "${HOME}/Library/Logs/Bluetooth") +(subpath-prefix "${HOME}/Library/MobileBluetooth")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/wireless/Library/Logs/awd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/hci") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (literal "/Library/Application Support/BTServer")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/wireless/Library/CallHistory"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write-data + (literal "/dev/uart.log") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleBasebandUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOUserEthernetResourceUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "shm_pcm_audio_sco_write") +(ipc-posix-name "shm_pcm_audio_sco_read")) + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name-regex #"^..:..:..:..:..:..-tacl$") + (require-any (ipc-posix-name "com.apple.BTServer.magnet.shm") +(ipc-posix-name "shm_notif.tacl.R") +(ipc-posix-name "shm_notif.tacl.W") +(ipc-posix-name "shm_notif.tsco.W") +(ipc-posix-name "shm_notif.tsco.R"))) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.carkit.service") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.BlueTool") +(global-name "com.apple.BTAudioHALPlugin.xpc") +(global-name "com.apple.BTServer.avrcp") +(global-name "com.apple.BTServer.map") +(global-name "com.apple.BTServer.pbap")) + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.suggestd.contacts") +(global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.lsd.modifydb") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.networkd") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.BTServer.airplane") +(preference-domain "com.apple.BTServer") +(preference-domain "com.apple.CoreBluetooth.cloud") +(preference-domain "com.apple.MobileBluetooth.debug") +(preference-domain "com.apple.MobileBluetooth.devices") +(preference-domain "com.apple.MobileBluetooth.ledevices") +(preference-domain "com.apple.MobileBluetooth.services")) + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.icloud.findmydeviced") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.BTServer.airplane") +(preference-domain "com.apple.BTServer") +(preference-domain "com.apple.CoreBluetooth.cloud") +(preference-domain "com.apple.MobileBluetooth.debug") +(preference-domain "com.apple.MobileBluetooth.devices") +(preference-domain "com.apple.MobileBluetooth.ledevices") +(preference-domain "com.apple.MobileBluetooth.services"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.wakereason") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (sysctl-name "net.statistics") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb.xml new file mode 100644 index 0000000..1b2c185 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb new file mode 100644 index 0000000..b321bc2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb @@ -0,0 +1,546 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/etc/bluetool") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/AppleInternal") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (literal "/usr/sbin") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-data + (literal "/dev/btreset") + (literal "/dev/btwake")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleBasebandUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.statistics") + (sysctl-name "kern.hostname") + (extension "com.apple.security.exception.sysctl.read-write") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb new file mode 100644 index 0000000..8b83698 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb @@ -0,0 +1,163 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb new file mode 100644 index 0000000..3e2d8d0 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb @@ -0,0 +1,683 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Media")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow file-read* + (debug-mode) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CPL-diagnostics")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/Logs") +(subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL") +(subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/Caches") +(subpath-prefix "${FRONT_USER_HOME}/Library/com.apple.nsurlsessiond") +(subpath "/private/var/logs/CrashReporter")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/diagnostics") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (subpath "/private/var/db/uuidtext") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CPL-diagnostics")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.logd.admin") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.configd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cloudphotod") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.photoanalysisd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow mach-priv-task-port + (debug-mode)) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow process-exec* + (debug-mode)) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (sysctl-name "kern.proc.") + (debug-mode)) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb new file mode 100644 index 0000000..357cec2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb @@ -0,0 +1,294 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (extension "com.apple.logd.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/System/Library/Frameworks/OpenGLES.framework") +(subpath "/usr/bin/codesign_allocate")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.cvmsCompAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (require-any (subpath "/System/Library/Frameworks/OpenGLES.framework") +(subpath "/usr/bin/codesign_allocate"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb new file mode 100644 index 0000000..7cc6c29 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb @@ -0,0 +1,328 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/usr/lib") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Containers/Bundle/Application") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/tmp") + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp/com.apple.LaunchServices.Placeholders") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath "/private/var/tmp") + (subpath "/private/var/tmp/com.apple.LaunchServices.Placeholders") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath "/private/var/containers/Bundle/Application") + (subpath-prefix "${HOME}/Containers/Bundle/Application") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.modifydb") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb new file mode 100644 index 0000000..debb274 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb @@ -0,0 +1,514 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/dtracehelper") + (require-any (literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log") +(literal "/dev/uart.umts") +(literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/cu.debug")) + (literal "/dev/ptmx") + (literal "/dev/uart.log") + (subpath "/private/var/wireless") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (require-any (subpath "/private/var/wireless/Library/Caches/com.apple.CommCenter") +(subpath "/private/var/wireless/Library/Caches/com.apple.coretelephony") +(subpath "/private/var/wireless/Library/Caches/CommCenterClassic")) + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/usr/local/lib/CarrierBundleDevKey.dylib") + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable")) +(allow file-read* + (subpath "/Developer") + (literal "/private/etc/hosts") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.coretelephony") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.coretelephony") +(subpath-prefix "${FRONT_USER_HOME}/Library/LASD") +(literal-prefix "${FRONT_USER_HOME}") +(literal "/private/var/tmp/CSI.scratch") +(literal "/private/var/preferences/AeneasCustomFlags.plist")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/uart.log") + (require-not (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log") +(literal "/dev/uart.umts") +(literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/cu.debug")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal "/dev") +(literal-prefix "${FRONT_USER_HOME}/Library/SyncedPreferences/com.apple.coretelephony.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist")) + (subpath "/private/var/logs/WirelessLibraryLogs") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/[-0-9A-F]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/Users/[^/]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/[-0-9A-F]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/Users/[^/]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile$" #"^/private/var/mobile/Library$" #"^/private/var/mobile/Library/CallHistory$" #"^/private/var/mobile/Library/Carrier Bundle.bundle$" #"^/private/var/mobile/Library/Operator Bundle.bundle$" #"^/private/var/mobile/Library/Voicemail$" #"^/private/var/mobile/Library/Preferences$" #"^/private/var/euser[0-9]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$" #"^/private/var/[-0-9A-F]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$" #"^/private/var/Users/[^/]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (require-any (literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log") +(literal "/dev/uart.umts") +(literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/cu.debug")) + (subpath "/private/var/logs/WirelessLibraryLogs") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/uart.log") + (require-any (literal "/private/var/CommCenter/spool/loading") +(literal "/private/var/logs/CoreTelephonyTraceScratch") +(literal "/private/var/logs/log-bb-live-stats.txt") +(literal "/private/var/preferences/SystemConfiguration/preferences.plist-lock") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist-lock") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist-new") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist") +(literal "/private/var/preferences/csidata.tmp") +(literal "/private/var/preferences/csidata")) + (regex #"^/private/var/logs/CoreTelephonyTrace$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-.+$") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.coretelephony") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.coretelephony") +(subpath-prefix "${FRONT_USER_HOME}/Library/LASD") +(literal-prefix "${FRONT_USER_HOME}") +(literal "/private/var/tmp/CSI.scratch") +(literal "/private/var/preferences/AeneasCustomFlags.plist")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/wireless") + (regex #"^/private/var/logs/CrashReporter/Baseband/log-bb-$" #"^/private/var/logs/CrashReporter/Baseband/log-bb-.+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/[-0-9A-F]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/Users/[^/]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/[-0-9A-F]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/Users/[^/]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist")) +(allow file-write-unlink + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name "com.apple.CommCenter.lasd") + (global-name-regex #"^com[.]apple[.]CoreTelephony[.]LogChannel[.]$" #"^com[.]apple[.]CoreTelephony[.]LogChannel[.][-0-9A-F]+$") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*") + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iqagent") + (require-any (preference-domain "com.apple.videoconference_override") +(preference-domain "com.apple.cellulardataplan") +(preference-domain "com.apple.commcenter") +(preference-domain "com.apple.tethering_override")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.TTY") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.apsalerts") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.operator") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.link.generic.ifdata") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "sysctl.proc_native") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.statistics") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2)) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb.xml new file mode 100644 index 0000000..bd4ad12 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb new file mode 100644 index 0000000..d27b886 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb @@ -0,0 +1,974 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/WebClips") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))) +(allow file-read* + (subpath "/Developer") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.DataActivation.settings")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (subpath-prefix "${HOME}/Media/DCIM") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (require-any (subpath-prefix "${HOME}/Library/Caches/Safari") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") +(subpath-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Preferences/.dat") +(literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.DataActivation.plist") +(subpath "/Applications/DataActivation.app") +(subpath "/Applications/MobileSafari.app") +(subpath "/AppleInternal/Library/Safari")) + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (extension "com.apple.logd.read-only") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/private/var/db/timezone") + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension "com.apple.app-sandbox.read") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilemail.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.OTASyncAgent.plist"))) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/Safari") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") +(subpath-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Preferences/.dat") +(literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock")) + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.DataActivation.settings")) + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Mail/AutoFetchEnabled")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-deny")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "IOSurfaceSendRight") + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/asl_input") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/printd") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.keyboard") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.DataActivation") +(preference-domain "com.apple.youtube.dp")) + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.aggregated") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.da") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.telephonyutilities.dialassist") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.mobilesafari") + (preference-domain "com.apple.CoreMotion") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.DataActivation") +(preference-domain "com.apple.youtube.dp")) + (preference-domain "com.apple.mobilesafari") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework")) +(allow process-exec* + (require-any (literal "/Applications/MobileSafari.app/MobileSafari") +(literal "/Applications/DataActivation.app/DataActivation"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb.xml new file mode 100644 index 0000000..8f5f4e2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb new file mode 100644 index 0000000..84cc200 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb @@ -0,0 +1,297 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb new file mode 100644 index 0000000..d4d0f44 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb @@ -0,0 +1,217 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.ids.IDSCredentialsAgent") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.ids.IDSCredentialsAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..0c26abe --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb @@ -0,0 +1,541 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (literal "/private/var") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.marco") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (preference-domain "com.apple.conference") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb new file mode 100644 index 0000000..71cc190 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb @@ -0,0 +1,387 @@ +(version 1) +(deny default) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath-prefix "${HOME}/Library/SMS") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Media") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (subpath-prefix "${HOME}/Library/Logs/SMSMigrator") +(subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS")) + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Logs/SMSMigrator") +(subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS")) + (subpath-prefix "${HOME}/Library/AddressBook") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/SMS") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.search.appindexer") +(global-name "com.apple.searchd") +(global-name "com.apple.suggestd.messages")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.marco") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.imdsmsrecordstore") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.message") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.suggestions") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.imdpersistence.IMDPersistenceAgent") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.imdpersistence.IMDPersistenceAgent") + (preference-domain "com.apple.imdsmsrecordstore")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..4d21e0d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb @@ -0,0 +1,545 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}") +(literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}") +(literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.awdd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.conference") + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb new file mode 100644 index 0000000..7ec8c6d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb @@ -0,0 +1,788 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (extension "com.apple.im.transcode") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.avatar") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.avatar") + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.im.transcode") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.marco") + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.ET") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.MobileSMS") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb new file mode 100644 index 0000000..939af6f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb @@ -0,0 +1,214 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library/Extensions") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb new file mode 100644 index 0000000..55c87e2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb @@ -0,0 +1,1299 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (extension "com.apple.app-sandbox.read-write") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (extension "com.apple.logd.read-only") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath-prefix "${HOME}/Library/ConfigurationProfiles") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/AppleInternal/Library/Frameworks") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.app-sandbox.read") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.MailCompositionService.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.MailCompositionService.settings")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${HOME}/Library/WebClips") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/ptmx") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.MailCompositionService.settings")) + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd") +(global-name "com.apple.WebBookmarks.webbookmarksd")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.springboard") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.audio.AudioQueueServer") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "PurpleSystemAppPort") + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilemail.services.xpc") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.mediastream.sharing") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (global-name "PurplePPTServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (require-any (global-name "com.apple.suggestd.contacts") +(global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.bulletinboard.utilitiesconnection") +(global-name "com.apple.suggestd.suggestionmanager") +(global-name "com.apple.dataaccess.dataaccessd")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mediaserverd") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.librariand") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.networkd") + (global-name "com.apple.sharingd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.assistant.settings") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.webinspector") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.bird") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.nehelper") + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.trustd") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.pegasus") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.da") + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ZoomTouch") + (preference-domain "com.apple.EmojiPreferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.MailCompositionService") + (preference-domain "com.apple.message") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.TTY") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coreaudio") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.MailCompositionService") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Preferences")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb new file mode 100644 index 0000000..5d50517 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb @@ -0,0 +1,9 @@ +(version 1) +(allow default) +(deny file-read* + (subpath "/private/var/run/mobile_image_mounter")) +(deny file-write-unlink + (literal "/private") + (literal "/private/var") + (literal "/private/var/run")) +(deny job-creation) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb.xml new file mode 100644 index 0000000..c2485d3 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb.xml @@ -0,0 +1,21 @@ + + + + + + + + + +]> + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb new file mode 100644 index 0000000..d7a33b7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb @@ -0,0 +1,1268 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath "/private/var/MobileAsset/Assets")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/MobileAsset/Assets")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache"))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes/iTunes Library.itlp") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/SMS") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (literal-prefix "${HOME}/Library/Logs/awd") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") +(subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") +(subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") +(subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") +(subpath-prefix "${HOME}/Library/Siri")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") +(subpath-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]" #"^/private/var/[-0-9A-F]+/Media/Pano_[0-9]" #"^/private/var/Users/[^/]+/Media/Pano_[0-9]") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (subpath-prefix "${HOME}/Media/Memories") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (require-any (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.mobileslideshow.plist") +(literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.camera.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.camera") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow-") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.mobileslideshow.settings") +(subpath-prefix "${HOME}/Documents/com.apple.camera.settings")) + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-not (regex #"^/private/var/mobile/Library/" #"^/private/var/euser[0-9]+/Library/" #"^/private/var/[-0-9A-F]+/Library/" #"^/private/var/Users/[^/]+/Library/")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.camera") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${HOME}/Library/Siri") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Siri")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") +(subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") +(subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") +(subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") +(subpath-prefix "${HOME}/Library/Siri")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/SMS") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]" #"^/private/var/[-0-9A-F]+/Media/Pano_[0-9]" #"^/private/var/Users/[^/]+/Media/Pano_[0-9]") + (subpath-prefix "${HOME}")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.mobileipod.plist")) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.camera") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow-") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.mobileslideshow.settings") +(subpath-prefix "${HOME}/Documents/com.apple.camera.settings")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Siri")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath "/private/var/mnt")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.coremedia") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.EmojiPreferences") + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.WebKit") + (require-any (preference-domain "com.apple.nanocamera") +(preference-domain "com.apple.legacycamera") +(preference-domain "com.apple.videouploadplugins") +(preference-domain "com.apple.youtubeframework.notbackedup")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.cloud.quota") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mmcs") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.da") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.ImageCaptureFramework") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.act") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.VoiceOverTouch") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.WebFoundation") + (require-any (preference-domain "com.apple.nanocamera") +(preference-domain "com.apple.legacycamera") +(preference-domain "com.apple.videouploadplugins") +(preference-domain "com.apple.youtubeframework.notbackedup")) + (preference-domain "com.apple.cloud.quota") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.Preferences") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.appleaccount")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb.xml new file mode 100644 index 0000000..a149983 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb new file mode 100644 index 0000000..4e59497 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb @@ -0,0 +1,216 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard")) + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/ptmx") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (vnode-type CHARACTER-DEVICE) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (literal "/System/Library/Frameworks/UIKit.framework/Support/pasteboardd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "sysctl.proc_native") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb.xml new file mode 100644 index 0000000..edf9b5e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb.xml @@ -0,0 +1,49 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb new file mode 100644 index 0000000..29c9f92 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb @@ -0,0 +1,301 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/db/icu") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath "/System") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.statistics") + (sysctl-name "kern.usrstack64") + (extension "com.apple.security.exception.sysctl.read-write") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb new file mode 100644 index 0000000..7c82698 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb @@ -0,0 +1,533 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${PROCESS_TEMP_DIR}/ScreenSharingServer.log") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal-prefix "${PROCESS_TEMP_DIR}/ScreenSharingServer.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SBUserNotification") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.ScreenSharingViewServiceHelper") +(global-name "com.apple.springboard.statusbarservices")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.ids") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb.xml new file mode 100644 index 0000000..dcf0787 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb new file mode 100644 index 0000000..b1db37c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb @@ -0,0 +1,254 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb new file mode 100644 index 0000000..d0ad1e5 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb @@ -0,0 +1,229 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (extension "com.apple.StreamingUnzipService") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/db/timezone") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.StreamingUnzipService") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.StreamingUnzipService") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.StreamingUnzipService")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb new file mode 100644 index 0000000..5d942b0 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb @@ -0,0 +1,213 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb new file mode 100644 index 0000000..655750a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb @@ -0,0 +1,163 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb new file mode 100644 index 0000000..aa12504 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb @@ -0,0 +1,1244 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.mobilemail.plist$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.OTASyncAgent.plist$")) + (require-any + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.WebSheet.plist") + (require-any (subpath-prefix "${HOME}/Documents/com.apple.WebSheet.settings") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState/")) + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (subpath-prefix "${HOME}/Library/WebClips") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/FairPlay") +(literal "/usr/sbin/fairplayd")) + (subpath-prefix "${HOME}/Media") + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/ptmx") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-not (regex #"^/private/var/mobile/Library/Mail/AutoFetchEnabled$" #"^/private/var/euser[0-9]+/Library/Mail/AutoFetchEnabled$" #"^/private/var/[-0-9A-F]+/Library/Mail/AutoFetchEnabled$" #"^/private/var/Users/[^/]+/Library/Mail/AutoFetchEnabled$")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Documents/com.apple.WebSheet.settings") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState/")) + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.fig.movie") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (global-name "com.apple.mobilesafari-settings") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.analytics") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.parsecd") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.librariand") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.sharingd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.assistant.settings") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.webinspector") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobilemail") + (global-name "com.apple.audio.AudioQueueServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.bird") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.certui.relay") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.eventpump") +(global-name "com.apple.mobilemail.messageuiservices")) + (global-name "com.apple.symptomsd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd") +(global-name "com.apple.WebBookmarks.webbookmarksd")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.da") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ZoomTouch") + (preference-domain "com.apple.EmojiPreferences") + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.WebKit") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.CoreMotion") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework")) +(allow process-exec* + (literal "/Applications/WebSheet.app/WebSheet")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb new file mode 100644 index 0000000..6860711 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb @@ -0,0 +1,550 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.afc.root") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (extension "com.apple.logd.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (literal "/usr/libexec") + (require-any (literal "/usr/libexec/afcd") +(literal "/AFCDEBUG")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (extension "com.apple.afc.root") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private") + (literal "/Library/Preferences/SystemConfiguration") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.afc.root") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.xpchelper") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown/checkin") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.afc") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.maxvnodes") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb new file mode 100644 index 0000000..3469351 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb @@ -0,0 +1,501 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${HOME}/Library/AppConduit") +(subpath-prefix "${HOME}/Library/Logs/AirTraffic") +(subpath-prefix "${HOME}/Library/Logs/AppConduit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (subpath "/private/var/db/MobileIdentityData") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/AppConduit") +(subpath-prefix "${HOME}/Library/Logs/AirTraffic") +(subpath-prefix "${HOME}/Library/Logs/AppConduit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.misagent") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cache_delete") + (global-name "com.apple.atc.xpc") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.online-auth-agent.xpc") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.nanoprefsync") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.modifydb") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb new file mode 100644 index 0000000..290ed27 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb @@ -0,0 +1,441 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (subpath "/private/var/Managed Preferences/mobile") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (regex #"^/System/Library/CoreServices/SystemVersion$" #"^/System/Library/CoreServices/SystemVersion.+$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/Library/Managed Preferences/mobile") +(subpath "/private/var/preferences")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath-prefix "${HOME}/Library/Logs") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-any (subpath "/usr") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist") +(subpath "/private/etc") +(literal "/private/etcLibrary/Keychains") +(literal "/private/") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicEffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}") +(subpath-prefix "${HOME}/Library/Managed Preferences")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/Keychains") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/Library/Preferences") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") +(subpath-prefix "${HOME}/Library/ApplePushService")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Preferences") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (subpath-prefix "${HOME}/Library/Logs") + (subpath-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") +(subpath-prefix "${HOME}/Library/ApplePushService")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-inbound + (literal "/")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/ApplePushService.framework/apsd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.statistics") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "sysctl.proc_native") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb.xml new file mode 100644 index 0000000..bd4ad12 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb new file mode 100644 index 0000000..504f9d2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb @@ -0,0 +1,328 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/usr/libexec") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/ptmx") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.logd.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (vnode-type CHARACTER-DEVICE) + (subpath "/Applications") + (extension "com.apple.sandbox.executable") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.spindump") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-task-name) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.assertiond") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.assertiond")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow sysctl* + (require-any (sysctl-name "kern.ipc.throttle_best_effort") +(sysctl-name "kern.memorystatus_vm_pressure_send"))) +(allow sysctl-read + (sysctl-name "kern.max_task_pmem") + (require-any (sysctl-name "kern.ipc.throttle_best_effort") +(sysctl-name "kern.memorystatus_vm_pressure_send")) + (extension "com.apple.security.exception.sysctl.read-only") + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb.xml new file mode 100644 index 0000000..d261902 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb new file mode 100644 index 0000000..d93ff53 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb @@ -0,0 +1,661 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))) +(allow file-link) +(allow file-read* + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/BulletinDistributor") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices"))) +(allow file-read-data + (literal "/usr/libexec")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/BulletinDistributor") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.pairedsyncd.progress") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.bulletinboard.observerconnection") +(global-name "com.apple.companionappd.pingsubscriber") +(global-name "com.apple.sysdiagnose.service.xpc")) + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.awdd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.marco") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.fig.movie") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.nanoprefsync") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.bulletinboard.settingsconnection") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.bulletindistributor") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.MultitouchSupport") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.persistentconnection") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "bulletindistributord") +(preference-domain "com.apple.sysdiagnose")) + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.bulletindistributor")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb new file mode 100644 index 0000000..b3f00f7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb @@ -0,0 +1,20 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb.xml new file mode 100644 index 0000000..941d510 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb new file mode 100644 index 0000000..afdd5db --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb @@ -0,0 +1,527 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/SystemConfiguration/NetworkInterfaces.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.AssetCacheC") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (local udp "*:*")) +(allow network-bind + (local udp "*:*")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote udp "*:53") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AssetCacheLocatorService") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AssetCacheTetherator") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb new file mode 100644 index 0000000..1e7b60c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb @@ -0,0 +1,213 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/db/heim-credential-store.archive") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal "/private/var/db/heim-credential-store.archive") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb new file mode 100644 index 0000000..2396837 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb @@ -0,0 +1,129 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb.xml new file mode 100644 index 0000000..cac2cf8 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb new file mode 100644 index 0000000..d8427ef --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb @@ -0,0 +1,399 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath "/usr/share") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.ocspd") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote udp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb.xml new file mode 100644 index 0000000..cac2cf8 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb new file mode 100644 index 0000000..825953d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb @@ -0,0 +1,1048 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-not (extension "com.apple.sandbox.executable")) + (subpath "/Developer") + (require-not (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/"))) +(allow file-read* + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.app-sandbox.read") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-xattr + (require-all + (require-not (xattr "com.apple.security.private.")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (vnode-type SYMLINK)) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (require-not (xattr "com.apple.security.private.")) + (require-any + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.revisiond") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.fig.movie") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.bird") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.assertiond.expiration") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.sharingd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.webinspector") + (global-name "com.apple.nehelper") + (global-name "com.apple.librariand") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.audio.AudioQueueServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote udp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iapd") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.keyboard") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.voiceservices.logging") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.da") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.mt") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.CoreMotion") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (sysctl-name "net.statistics") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml new file mode 100644 index 0000000..cac2cf8 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb new file mode 100644 index 0000000..58337f9 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb @@ -0,0 +1,695 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd"))) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (subpath-prefix "${HOME}/siri_recordings") +(subpath "/Library/Audio/Tunings")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (require-any (subpath-prefix "${HOME}/Library/Assistant") +(literal-prefix "${HOME}/Library/Caches/com.apple.siri.")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/Info.plist" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+/Info.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/local/lib") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (require-any (subpath-prefix "${HOME}/Library/Assistant") +(literal-prefix "${HOME}/Library/Caches/com.apple.siri.")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.imagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.awdd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.absinthed") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (require-any (global-name "com.apple.BTLEAudioController.xpc") +(global-name "com.apple.assistant_service")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.marco") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.absd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.avfoundation.avvc") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.AssistantServices") +(preference-domain "com.apple.assistant.token") +(preference-domain "com.apple.siri.backedup.encrypted") +(preference-domain "com.apple.weather")) + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.AssistantServices") +(preference-domain "com.apple.assistant.token") +(preference-domain "com.apple.siri.backedup.encrypted") +(preference-domain "com.apple.weather")) + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-socket + (socket-domain 39) + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb new file mode 100644 index 0000000..ca16964 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb @@ -0,0 +1,786 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.librarian.ubiquity-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.clouddocs.version") + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents/")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.quicklook.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.bird") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.bird") +(literal-prefix "${PROCESS_TEMP_DIR}/com.apple.bird") +(subpath-prefix "${HOME}/Library/Application Support/CloudDocs") +(literal-prefix "${HOME}/Library/Mobile Documents.") +(subpath-prefix "${HOME}/Library/Logs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") +(literal-prefix "${HOME}/Library/")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Application Support") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Application Support")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CloudKit")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.bird") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.bird") +(literal-prefix "${PROCESS_TEMP_DIR}/com.apple.bird") +(subpath-prefix "${HOME}/Library/Application Support/CloudDocs") +(literal-prefix "${HOME}/Library/Mobile Documents.") +(subpath-prefix "${HOME}/Library/Logs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") +(literal-prefix "${HOME}/Library/")) + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity")) + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Application Support")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CloudKit")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.revisiond") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.nehelper") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.cache_delete") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ubd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.librariand") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.networkd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.FSEvents") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.and.xpc") +(global-name "com.apple.bird.ContainerMetadataExtractor") +(global-name "com.apple.lsd.installation")) + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.ubd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mmcs") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.iCloudDriveApp") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.iCloudDriveApp") + (preference-domain "com.apple.bird")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30)) + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-info + (info-type "hw.uuid")) +(allow system-package-check) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb.xml new file mode 100644 index 0000000..17402cd --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb new file mode 100644 index 0000000..9140c5e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb @@ -0,0 +1,132 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec/captiveagent") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb new file mode 100644 index 0000000..4576b99 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb @@ -0,0 +1,679 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/euser[0-9]+/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/[-0-9A-F]+/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/Users/[^/]+/Library/Caches/CloudKit/[^/]+/[^/]+") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (regex #"^/private/var/mobile/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit" #".+/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type CHARACTER-DEVICE) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/.TemporaryItems") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") +(subpath-prefix "${HOME}/Library/Logs/awd") +(subpath-prefix "${HOME}/Library/Logs/Ubiquity") +(subpath-prefix "${HOME}/Library/Caches/CloudKit") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.cloudd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.cloudd") +(literal "/private/var/logs/Ubiquity")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") +(subpath-prefix "${HOME}/Library/Logs/awd") +(subpath-prefix "${HOME}/Library/Logs/Ubiquity") +(subpath-prefix "${HOME}/Library/Caches/CloudKit") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.cloudd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.cloudd") +(literal "/private/var/logs/Ubiquity")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/.TemporaryItems") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd"))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_com.apple.cloudd") + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name "FNetwork.defaultStorageSession") + (ipc-posix-name "com.apple.AppleDatabaseChanged") + (ipc-posix-name-regex #"^/tmp/com[.]apple[.]csseed[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name "com.apple.AppleDatabaseChanged")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.fig.movie") + (global-name "com.apple.nehelper") + (global-name "com.apple.ocspd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.fairplayd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.datamigrator") + (global-name "com.apple.absinthed") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.SecurityServer") +(global-name "com.apple.coreservices.quarantine-resolver")) + (global-name "com.apple.fairplayd.versioned") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.absd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.AssetCacheLocatorService") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.protectedcloudstorage.protectedcloudkeysyncing") +(global-name "com.apple.windowserver.active")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.migration") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mmcs") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.purplebuddy") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.mmcs")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb new file mode 100644 index 0000000..91e58bf --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb @@ -0,0 +1,276 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Bundle") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.message") + (preference-domain "com.apple.mobilephone") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb new file mode 100644 index 0000000..cd92d4f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb @@ -0,0 +1,975 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit")) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/homed_") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.Home") +(subpath-prefix "${HOME}/Library/HomeConfiguration") +(subpath-prefix "${HOME}/Library/homed")) + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.homed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.homed")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/homed_") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.Home") +(subpath-prefix "${HOME}/Library/HomeConfiguration") +(subpath-prefix "${HOME}/Library/homed")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.homed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.homed")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.cloudd") + (global-name "com.apple.securityd") + (global-name "com.apple.bird") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.awdd") + (global-name "com.apple.wirelessproxd") + (require-any (global-name "com.apple.Honeybee.event-notify") +(global-name "com.apple.PairingManager") +(global-name "com.apple.corefollowup.agent")) + (global-name "com.apple.fairplayd.versioned") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.librariand") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.apsd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.videoconference.camera") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network* + (local udp "*:*") + (local tcp "*:*") + (remote tcp "*:*") + (remote udp "*:*")) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.facetime.bag") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "com.apple.homed") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.VideoConference") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.homed")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb new file mode 100644 index 0000000..4b30196 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb @@ -0,0 +1,676 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (subpath "/private/var/containers/Bundle/Application") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (require-any (literal "/usr/bin/DumpBasebandCrash") +(subpath "/usr/local/bin") +(literal "/private/var/Managed Preferences/mobile/com.apple.networkd.sysctl.plist") +(literal "/private/var/Managed Preferences/mobile/com.apple.networkd.plist")) + (require-any (literal "/private/var/preferences/com.apple.networkd.sysctl.plist") +(literal "/private/var/preferences/com.apple.networkd.carrierbundle.plist") +(literal "/private/var/preferences/com.apple.networkd.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.network.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.networkextension.plist")) + (subpath "/usr/sbin") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (subpath "/Applications") + (require-any (literal "/private/var/preferences/com.apple.networkextension.necp.plist") +(literal "/private/var/preferences/com.apple.networkextension.control.plist") +(literal "/private/var/preferences/com.apple.networkextension.cache.plist") +(literal "/private/var/preferences/com.apple.networkextension.plist")) + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Cookies") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (require-any (literal "/private/var/preferences/com.apple.networkd.sysctl.plist") +(literal "/private/var/preferences/com.apple.networkd.carrierbundle.plist") +(literal "/private/var/preferences/com.apple.networkd.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.network.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.networkextension.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/private/var/preferences/com.apple.networkextension.necp.plist") +(literal "/private/var/preferences/com.apple.networkextension.control.plist") +(literal "/private/var/preferences/com.apple.networkextension.cache.plist") +(literal "/private/var/preferences/com.apple.networkextension.plist")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.nehelper") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.logd.admin") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd_privileged") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (global-name "com.apple.nehelper") + (global-name "com.apple.networkd_privileged") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network* + (literal "/private/var/run/racoon.sock") + (local udp "*:500") + (local udp "*:4500")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote udp "*:*") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.net.ipsec_control") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-any (control-name "com.apple.flow-divert") +(control-name "com.apple.net.necp_control") +(control-name "com.apple.net.netagent") +(control-name "com.apple.net.utun_control") +(control-name "com.apple.network.advisory") +(control-name "com.apple.content-filter"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.operator") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl* + (require-any (sysctl-name "kern.ipc.io_policy.throttled") +(sysctl-name "net."))) +(allow sysctl-read + (require-any (sysctl-name "kern.ipc.io_policy.throttled") +(sysctl-name "net.")) + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb.xml new file mode 100644 index 0000000..7836567 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb new file mode 100644 index 0000000..848b95e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb @@ -0,0 +1,626 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.vpn-plugin") + (subpath "/private/var/containers/Bundle/VPNPlugin")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/Developer/usr/libexec") +(subpath "/private/etc/ppp") +(subpath "/private/var/containers/Bundle/VPNPlugin")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (subpath "/usr/sbin") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (subpath "/private/var/run/racoon") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/run/racoon.pid") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/private/var/preferences/com.apple.networkextension.necp.plist") +(literal "/private/var/preferences/com.apple.networkextension.control.plist") +(literal "/private/var/preferences/com.apple.networkextension.cache.plist") +(literal "/private/var/preferences/com.apple.networkextension.plist")) + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nesessionmanager")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nesessionmanager")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager") + (literal "/private/var/log/ppp.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/run/racoon") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nesessionmanager")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nesessionmanager"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.UNCUserNotification") +(global-name "com.apple.neagent") +(global-name "com.apple.symptom_analytics")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.ocspd") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.CoreServices.coreservicesd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.networkextension") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-exec* + (literal "/usr/sbin/pppd")) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow sysctl* + (sysctl-name "net.key.natt_keepalive_interval")) +(allow sysctl-read + (sysctl-name "net.key.natt_keepalive_interval") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (sysctl-name "net.key.blockacq_count") + (sysctl-name "net.statistics") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb.xml new file mode 100644 index 0000000..3ed5fb6 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb new file mode 100644 index 0000000..4c70b8c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb @@ -0,0 +1,388 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal-prefix "${HOME}/Library/Logs/awd/awd-networkserviceproxy.log") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/awd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-networkserviceproxy.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.awdd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (preference-domain "networkserviceproxy") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.GEO") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "networkserviceproxy")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow sysctl*) +(allow sysctl-write) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb.xml new file mode 100644 index 0000000..dac6097 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb new file mode 100644 index 0000000..c54f570 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb @@ -0,0 +1,605 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.quicklook.readonly") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${HOME}/Library/Application Support/Quick Look") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db")) + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.quicklook.readonly") + (subpath-prefix "${HOME}/Media/Books") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Documents" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Application Support/Quick Look") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Application Support/Quick Look")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.bird") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.fig.movie") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.avfoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-fsctl + (fsctl-command (_IO "h" 31))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb new file mode 100644 index 0000000..c7c0db6 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb @@ -0,0 +1,551 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/rtcreportingd_")) + (literal "/usr/libexec/rtcreportingd") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.rtcreporting.upload") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-data + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/awd") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/rtcreportingd_")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (extension "com.apple.rtcreporting.upload")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.awdd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.powerlogd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "rtcreportingd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.rtcreporting") + (preference-domain "com.apple.VideoConference") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.timed") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.rtcreporting") + (preference-domain "rtcreportingd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb new file mode 100644 index 0000000..4add1c2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb @@ -0,0 +1,68 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/dtracehelper")) +(allow file-link) +(allow file-map-executable) +(allow file-read*) +(allow file-read-data) +(allow file-read-metadata) +(allow file-read-xattr) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.sandbox.system-group") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]Sandbox-.+[.]ips") + (regex #"^/private/var/logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/logs/CrashReporter/[.]Sandbox-.+[.]ips") + (require-all + (literal "/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.cfprefs.")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.notification_center") + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (local-name "com.apple.cfprefsd.agent")) +(allow network* + (literal-prefix "${PROCESS_TEMP_DIR}/sandbox.")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/asl_input"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb.xml new file mode 100644 index 0000000..7e675f5 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb new file mode 100644 index 0000000..90f62ec --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb @@ -0,0 +1,456 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.webinspector") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.siri.ClientFlow.ClientScripter") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.assistant") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.siri.ClientFlow.ClientScripter")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb new file mode 100644 index 0000000..5d1bc85 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb @@ -0,0 +1,171 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (subpath "/var/mobile/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-register + (global-name "com.apple.snhelper") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb new file mode 100644 index 0000000..538a3f7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb @@ -0,0 +1,501 @@ +(version 1) +(deny default) +(allow file-issue-extension + (extension-class "com.apple.tcc.") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/ptmx") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (vnode-type CHARACTER-DEVICE) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath "/private/var/tmp/com.apple.tccd") +(subpath-prefix "${HOME}/Library/TCC")) + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.librariand") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.awdd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.marco") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.backboard.systemservices") + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.ids") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb.xml new file mode 100644 index 0000000..dcf0787 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb new file mode 100644 index 0000000..a767605 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb @@ -0,0 +1,22 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-write-create + (literal "/private/var/db/timezone/localtime")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb new file mode 100644 index 0000000..8b78f42 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb @@ -0,0 +1,619 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Application Support") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.ubd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.ubd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-ubd.log") +(literal-prefix "${HOME}/Library/Collections") +(literal-prefix "${HOME}/Library/Mobile Documents") +(literal-prefix "${HOME}/Library/processed-Mobile Documents.delete")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (require-any (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/awd") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.ubd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.ubd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-ubd.log") +(literal-prefix "${HOME}/Library/Collections") +(literal-prefix "${HOME}/Library/Mobile Documents") +(literal-prefix "${HOME}/Library/processed-Mobile Documents.delete")) + (literal-prefix "${HOME}/Library/Application Support") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.FileCoordination") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.awdd") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.bird") + (global-name "com.apple.absinthed") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.absd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.bird") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.persistentconnection") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.mmcs")) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Support/ubd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl*) +(allow sysctl-write) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb.xml new file mode 100644 index 0000000..2a53d7b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb new file mode 100644 index 0000000..fbf4de3 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb @@ -0,0 +1,68 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (require-any (literal "/usr") +(literal "/usr/sbin/wirelessproxd")) + (literal "/usr/sbin") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/private/var/db/dyld") + (subpath "/usr/share")))) +(allow file-read-metadata + (require-any (literal "/etc") +(literal "/tmp") +(literal "/private/etc/localtime") +(literal "/var"))) +(allow file-write* + (require-all + (require-not (file-mode #o0000)) + (literal "/cores/"))) +(allow file-write-data + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.cfprefs.")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.notification_center") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (local-name "com.apple.cfprefsd.agent")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (literal "/private/var/run/asl_input") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb.xml new file mode 100644 index 0000000..abd16d6 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb new file mode 100644 index 0000000..ceb977d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb @@ -0,0 +1,4172 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.usernotifications.attachments.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (extension-class "com.apple.mediaserverd.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (debug-mode) + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Caches/com.apple.navd/NavTraces") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/DCIM") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/CallServices/Ringtones") + (extension-class "com.apple.mediaserverd.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.InCallService"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/ReplayKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ReplayKit.RPVideoEditorExtension"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilecal"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Playgrounds.ExecutionExtension"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Media")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/System/Library") + (subpath "/Developer") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-read* + (extension "com.apple.logd.read-only") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.security.exception.carrier-bundle.read"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal "/private/var/mobile/Media/iTunes_Control/iTunes/iTunesPrefs")) + (require-any + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal "/usr/libexec") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") +(literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (require-any (literal-prefix "${HOME}/Library/SpringBoard/.LockBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/.HomeBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/LockBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/HomeBackground.cpbitmap")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Media") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.apsalerts.plist")) + (require-any + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") +(subpath-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (require-all + (regex #"^/private/var/mobile/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/euser[0-9]+/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/[-0-9A-F]+/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/Users/[^/]+/Library/GameKit/Data/[^/]+.gcdata$") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath "/private/var/tmp/com.apple.dt.XCTest") + (require-any + (process-name "/Applications/") + (require-entitlement "get-task-allow"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Fonts") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-wal")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (subpath "/Library/Application Support/Mail/Plugins") +(literal "/private/var/preferences/SystemConfiguration/com.apple.AutoWake.plist") +(literal "/System/Library/PairedSyncServices/com.apple.pairedsync.mail.plist")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mobilemail") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mobilemail")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.safarifetcherd")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/SpringBoard/LockBackgroundThumbnail.jpg") +(literal-prefix "${HOME}/Library/SpringBoard/LockVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/HomeBackgroundThumbnail.jpg") +(literal-prefix "${HOME}/Library/SpringBoard/HomeVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/OriginalHomeVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/OriginalLockVideo.mov")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension "com.apple.usernotifications.attachments.read-only")) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath-prefix "${HOME}/Media/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.restrictionspassword.plist") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Library/CallServices/Ringtones") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.InCallService"))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))) +(allow file-read-metadata + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (require-not (subpath-prefix "${HOME}/Library/SMS")) + (require-not (subpath-prefix "${HOME}/Media/Recordings")) + (require-any + (vnode-type SYMLINK) + (literal "/private/var") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/GameKit/Data") + (literal-prefix "${HOME}/Library") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (literal "/private/var/run/printd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/GameKit/Data") + (literal "/private/var") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.safarifetcherd")))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.restrictionspassword.plist") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") +(literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mobilemail") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mobilemail")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2")))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow generic-issue-extension + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari") + (require-any (extension-class "com.apple.webkit.camera") +(extension-class "com.apple.webkit.microphone"))))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOHIDLibUserClient") + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (extension "com.apple.security.exception.iokit-user-client-class") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (require-all + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-user-client-class "RootDomainUserClient") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-user-client-class "IOMobileFramebufferUserClient") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (require-entitlement "com.apple.private.amfi.can-load-cdhash"))) +(allow iokit-get-properties + (require-any (iokit-property "IOClassNameOverride") +(iokit-property "IORegistryEntryPropertyKeys")) + (require-any (iokit-property "compass-calibration") +(iokit-property "gyro-interrupt-calibration")) + (iokit-property "IOClass") + (require-entitlement "com.apple.system.diagnostics.iokit-properties") + (require-all + (iokit-property "name") + (iokit-user-client-class "IOService")) + (require-all + (iokit-property "name") + (iokit-user-client-class "IONetworkInterface")) + (require-all + (require-any (iokit-property "auto-focus") +(iokit-property "flash") +(iokit-property "front-auto-hdr") +(iokit-property "front-max-video-") +(iokit-property "front-hdr") +(iokit-property "front-hdr-on") +(iokit-property "front-flash-capability") +(iokit-property "front-burst") +(iokit-property "front-burst-image-duration") +(iokit-property "video-stills") +(iokit-property "video-cap") +(iokit-property "rear-slowmo") +(iokit-property "rear-max-video-") +(iokit-property "rear-max-slomo-video-fps-") +(iokit-property "rear-hdr") +(iokit-property "rear-hdr-on") +(iokit-property "rear-burst") +(iokit-property "rear-burst-image-duration") +(iokit-property "rear-auto-hdr") +(iokit-property "post-effects") +(iokit-property "pipelined-stillimage-capability") +(iokit-property "panorama") +(iokit-property "live-photo-capture") +(iokit-property "live-effects")) + (iokit-user-client-class "IOService")) + (require-all + (require-any (iokit-property "root-ticket-hash") +(iokit-property "IOCPUID") +(iokit-property "device-imei") +(iokit-property "backlight-marketing-table")) + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "AppleJPEG") + (iokit-user-client-class "AppleJPEGDriver")) + (require-all + (iokit-property "SupportAlwaysOnCompass") + (iokit-user-client-class "AppleSPUHIDDriver")) + (require-all + (iokit-property "DisplayPipeStrideRequirements") + (iokit-user-client-class "IOMobileFramebuffer")) + (require-all + (require-any (iokit-property "BSD Name") +(iokit-property "InterfaceRole") +(iokit-property "IO80211Band") +(iokit-property "IO80211Channel") +(iokit-property "IO80211ChannelBandwidth") +(iokit-property "IO80211ChannelFrequency") +(iokit-property "IO80211RSNDone") +(iokit-property "IORequiredPacketFilters") +(iokit-property "IOPrimaryInterface") +(iokit-property "IONetworkRootType") +(iokit-property "IONetworkData") +(iokit-property "IOMediaHeaderLength") +(iokit-property "IOMediaAddressLength") +(iokit-property "IOMaxTransferUnit") +(iokit-property "IOLocation") +(iokit-property "IOInterfaceUnit") +(iokit-property "IOInterfaceType") +(iokit-property "IOInterfaceState") +(iokit-property "IOInterfaceNamePrefix") +(iokit-property "IOInterfaceFlags") +(iokit-property "IOInterfaceExtraFlags") +(iokit-property "IOControllerEnabled") +(iokit-property "IOBuiltin") +(iokit-property "IOActivePacketFilters") +(iokit-property "NetworkConfigurationOverrides")) + (iokit-user-client-class "IONetworkInterface")) + (require-all + (iokit-property "iommu-present") + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (iokit-property "name") + (require-entitlement "fairplay-client") + (iokit-user-client-class "IOService")) + (require-all + (require-any (iokit-property "AGXParameterBufferMaxSize") +(iokit-property "BaseAddressAlignmentRequirement") +(iokit-property "PerformanceStatisticsAccum") +(iokit-property "IOGLES") +(iokit-property "InternalStatisticsAccm") +(iokit-property "InternalStatistics") +(iokit-property "MetalPluginName") +(iokit-property "MetalPluginClassName")) + (iokit-user-client-class "IOAcceleratorES")) + (require-all + (iokit-property "PerformanceStatistics") + (iokit-user-client-class "IOMobileFramebuffer")) + (require-all + (require-any (iokit-property "3d-imagery") +(iokit-property "3d-maps") +(iokit-property "navigation") +(iokit-property "adaptive-ui")) + (iokit-user-client-class "IOService")) + (require-all + (require-any (iokit-property "CFBundleIdentifier") +(iokit-property "IOLinkSpeed") +(iokit-property "IOLinkStatus") +(iokit-property "IOPropertyMatch") +(iokit-property "IOMinPacketSize") +(iokit-property "IOMaxPacketSize")) + (iokit-user-client-class "IONetworkController")) + (require-all + (require-any (iokit-property "bitrate-") +(iokit-property "encoding") +(iokit-property "decoding") +(iokit-property "tnr-mode")) + (iokit-user-client-class "IOService")) + (require-all + (iokit-property "boot-manifest-hash") + (require-entitlement "fairplay-client") + (iokit-user-client-class "IOService")) + (require-all + (iokit-connection "AppleSynopsysOTGDevice") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "IOProviderClass") +(iokit-property "IOFeatures")) + (iokit-user-client-class "IONetworkController")) + (require-all + (iokit-property "name") + (iokit-user-client-class "IOService")) + (require-all + (iokit-property "Size") + (process-attribute 4) + (iokit-user-client-class "IOMedia")) + (require-all + (require-any (iokit-property "chip-id") +(iokit-property "display-rotation") +(iokit-property "display-scale") +(iokit-property "software-behavior") +(iokit-property "no-sdio-devices")) + (iokit-user-client-class "IOService")) + (require-all + (iokit-property "IOMACAddress") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.wifi.manager-access"))) + (require-all + (iokit-property "udid-version") + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers"))) + (require-all + (iokit-property "IOSurfaceAcceleratorCapabilitiesDict") + (iokit-user-client-class "IOService")) + (require-all + (iokit-property-regex #"die-id$" #"chip-id$" #"board-id$" #".+((die|chip)|board)-id$") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "IOProviderClass") +(iokit-property "IOFeatures")) + (iokit-user-client-class "IONetworkInterface")) + (require-all + (require-any (iokit-property "AdapterInfo") +(iokit-property "AtCriticalLevel") +(iokit-property "Voltage") +(iokit-property "MaxCapacity") +(iokit-property "IsCharging") +(iokit-property "FullyCharged") +(iokit-property "ExternalConnected") +(iokit-property "ExternalChargeCapable") +(iokit-property "CurrentCapacity") +(iokit-property "CapacityEstimated")) + (iokit-connection "IOPMPowerSource")) + (require-all + (require-any (iokit-property "DisplayPipePlaneBaseAlignment") +(iokit-property "hdcp-hoover-protocol")) + (iokit-user-client-class "IOMobileFramebuffer")) + (require-all + (iokit-property "boot-manifest-hash") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property-regex #"serial-number" #"SerialNum" #"-snum" #".+serial-number" #".+SerialNum" #".+-snum") + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers"))) + (require-all + (iokit-property "Protocol Characteristics") + (iokit-user-client-class "IOService")) + (require-all + (require-any (iokit-property "idProduct") +(iokit-property "idVendor") +(iokit-property "Product Name") +(iokit-property "kUSBProductString")) + (iokit-connection "AppleSynopsysOTGDevice")) + (require-all + (iokit-property "IOClass") + (iokit-user-client-class "IONetworkController")) + (require-all + (iokit-property "PerformanceStatistics") + (iokit-user-client-class "IOAcceleratorES")) + (require-all + (require-any (iokit-property "artwork-display-gamut") +(iokit-property "artwork-device-idiom") +(iokit-property "artwork-device-subtype") +(iokit-property "artwork-scale-factor") +(iokit-property "product-id") +(iokit-property "product-description") +(iokit-property "offline-dictation") +(iokit-property "dictation") +(iokit-property "device-perf-memory-class") +(iokit-property "graphics-featureset-fallbacks") +(iokit-property "graphics-featureset-class") +(iokit-property "compatible-device-fallback")) + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "#address-cells") +(iokit-property "AAPL,phandle") +(iokit-property "unique-chip-id") +(iokit-property "uid-aes-key") +(iokit-property "system-trusted") +(iokit-property "software-bundle-version") +(iokit-property "security-domain") +(iokit-property "secure-boot") +(iokit-property "root-matching") +(iokit-property "random-seed") +(iokit-property "production-cert") +(iokit-property "board-id") +(iokit-property "bootp-response") +(iokit-property "boot-nonce") +(iokit-property "mix-n-match-prevention-status") +(iokit-property "mac-address-wifi0") +(iokit-property "mac-address-ethernet0") +(iokit-property "mac-address-bluetooth0") +(iokit-property "image4-supported") +(iokit-property "gid-aes-key") +(iokit-property "firmware-version") +(iokit-property "effective-security-mode-sep") +(iokit-property "effective-security-mode-ap") +(iokit-property "effective-production-status-sep") +(iokit-property "effective-production-status-ap") +(iokit-property "dram-vendor") +(iokit-property "dram-vendor-id") +(iokit-property "die-id") +(iokit-property "development-cert") +(iokit-property "debug-enabled") +(iokit-property "crypto-hash-method") +(iokit-property "consistent-debug-root") +(iokit-property "chip-epoch") +(iokit-property "certificate-security-mode") +(iokit-property "certificate-production-status")) + (require-entitlement "fairplay-client") + (iokit-user-client-class "IOService")) + (require-all + (iokit-property-regex #"UUID" #"-uuid" #".+UUID" #".+-uuid") + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers"))) + (require-all + (require-any (iokit-property "model") +(iokit-property "platform-name") +(iokit-property "regulatory-model-number") +(iokit-property "region-info")) + (iokit-user-client-class "IOPlatformExpertDevice")) + (require-all + (iokit-property "ForceSupported") + (require-any (iokit-user-client-class "AppleMultitouchSPI") +(iokit-user-client-class "AppleMultitouchDevice"))) + (require-all + (iokit-property-regex #"[Cc]alibration" #".+[Cc]alibration") + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers"))) + (require-all + (require-any (iokit-property "battery-data") +(iokit-property "BatteryData") +(iokit-property "Serial")) + (require-entitlement "fairplay-client") + (iokit-connection "IOPMPowerSource")) + (require-all + (require-any (iokit-property "camera-front") +(iokit-property "camera-rear")) + (iokit-user-client-class "AppleARMIODevice")) + (require-all + (require-any (iokit-property "device_type") +(iokit-property "device-type")) + (iokit-user-client-class "IOService")) + (require-all + (iokit-property-regex #"-mac-address" #"mac-address-" #".+-mac-address" #".+mac-address-") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.wifi.manager-access"))) + (require-all + (iokit-property "soc-generation") + (process-attribute 4) + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "IOAccessoryBatteryPack") +(iokit-property "IOAccessoryDigitalID") +(iokit-property "IOAccessoryInterfaceDeviceInfo") +(iokit-property "IOAccessoryID") +(iokit-property "IOAccessoryManagerType") +(iokit-property "IODeviceMemory") +(iokit-property "controllers") +(iokit-property "config-number") +(iokit-property "CrashReporter-ID") +(iokit-property "Device Characteristics") +(iokit-property "AppleDiagnostic")) + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers")))) +(allow ipc-posix-sem* + (semaphore-owner self) + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-create + (ipc-posix-name-regex #"^/mono[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-unlink + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.syncdefaultsd") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.FileCoordination") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.VoiceOverTouch") + (global-name "com.apple.dataaccess.dataaccessd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ait.client") + (global-name "PurpleSystemAppPort") + (require-any (global-name "com.apple.iapd.xpc") +(global-name "com.apple.iap2d.xpc")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.librariand") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.accessibility.AXBackBoardServer") + (require-any (global-name "com.apple.AdSheetPad.server") +(global-name "com.apple.AdSheetPhone.server") +(global-name "com.apple.MediaControl.daemon") +(global-name "com.apple.MobileAccessoryUpdater") +(global-name "com.apple.MobileFileIntegrity") +(global-name "com.apple.Music.MPMusicPlayerMigServer") +(global-name "com.apple.ReportCrash") +(global-name "com.apple.ReportCrash.DirectoryService") +(global-name "com.apple.ReportCrash.Jetsam") +(global-name "com.apple.ReportCrash.SafetyNet") +(global-name "com.apple.ReportCrash.StackShot") +(global-name "com.apple.VoiceOverTouch.xpc") +(global-name "com.apple.airplay.sender.xpc") +(global-name "com.apple.appleprofilepolicyd") +(global-name "com.apple.assetsd.keepDaemonAlive") +(global-name "com.apple.assetsd.messagingServer") +(global-name "com.apple.assetsd.notificationServer") +(global-name "com.apple.audio.AudioConverterServer") +(global-name "com.apple.audio.AudioFileServer") +(global-name "com.apple.audio.AudioUnitServer") +(global-name "com.apple.backboard.checkin") +(global-name "com.apple.backboard.watchdog") +(global-name "com.apple.backboard.workspaceserverconnection") +(global-name "com.apple.bypassBasebandAutoBooter.msgport") +(global-name "com.apple.callkit.callsourcehost") +(global-name "com.apple.clouddbd") +(global-name "com.apple.commcenter.dm-helper") +(global-name "com.apple.commcenter.mobile-helper") +(global-name "com.apple.coremedia.audioprocessingtap") +(global-name "com.apple.coremedia.cpe") +(global-name "com.apple.coremedia.cpe.xpc") +(global-name "com.apple.coremedia.cpeprotector") +(global-name "com.apple.coremedia.cpeprotector.xpc") +(global-name "com.apple.coremedia.decompressionsession") +(global-name "com.apple.coremedia.formatreader") +(global-name "com.apple.coremedia.videoqueue") +(global-name "com.apple.coremedia.wirelessdisplay") +(global-name "com.apple.coremedia.wirelessdisplayserver") +(global-name "com.apple.cvmsCompAgent_armv7") +(global-name "com.apple.datamigrator.dz") +(global-name "com.apple.distributed_notifications@0v3") +(global-name "com.apple.gamed.note") +(global-name "com.apple.iTunesStore.daemon.notifications.public") +(global-name "com.apple.iTunesStore.daemon.public") +(global-name "com.apple.iapauthd") +(global-name "com.apple.iapauthd.xpc") +(global-name "com.apple.imavagent.embedded.auth") +(global-name "com.apple.instruments.server.mig") +(global-name "com.apple.mDNSResponder") +(global-name "com.apple.managedconfiguration.mdmdpush-dev") +(global-name "com.apple.managedconfiguration.mdmdpush-prod") +(global-name "com.apple.managedconfiguration.mdmdservice") +(global-name "com.apple.mediastream.sharing-nowake") +(global-name "com.apple.midiserver") +(global-name "com.apple.mobile.softwareupdated") +(global-name "com.apple.mobileipod.MPMusicPlayerControllerInternal") +(global-name "com.apple.mobileipod.MPMusicPlayerMigServer") +(global-name "com.apple.mobileipod.MPMusicPlayerMigServerExists") +(global-name "com.apple.prdaily") +(global-name "com.apple.sandboxd") +(global-name "com.apple.scrod") +(global-name "com.apple.spotlight.SearchAgent") +(global-name "com.apple.springboard.UIKit.migserver") +(global-name "com.apple.springboard.alerts") +(global-name "com.apple.springboard.remotenotifications") +(global-name "com.apple.springboard.watchdogserver") +(global-name "com.apple.telephonyutilities.callservicesdaemon.voip") +(global-name "com.apple.telephonyutilities.remotelogdaemon") +(global-name "com.apple.testmanagerd") +(global-name "com.apple.videoconference.avconference") +(global-name "com.apple.vsassetd") +(global-name "com.apple.wapi.client") +(global-name "com.apple.watchconnectivity.complication") +(global-name "com.apple.weibod.server")) + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.certui.relay") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.fig.movie") + (global-name "com.apple.pegasus") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd") +(global-name "com.apple.WebBookmarks.webbookmarksd")) + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.gamecenter") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.midiserver.io") + (global-name "com.apple.cloudd") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.mobilemail.services.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.gizmoappd") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.networkd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.marco") + (global-name "com.apple.mDNSResponderHelper") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.FSEvents") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.iapd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.itdbprep.server") + (global-name "com.apple.gamed") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.assistant.analytics") + (require-any (global-name "com.apple.Music.MPMusicPlayerControllerInternal") +(global-name "com.apple.Music.MPMusicPlayerMigServerExists")) + (global-name "com.apple.system.libinfo.muser") + (global-name "PurplePPTServer") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.revisiond") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.parsecd") + (require-any (global-name "com.apple.passd.assertions") +(global-name "com.apple.passd.library") +(global-name "com.apple.NPKCompanionAgent.library")) + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.atc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.nehelper") + (global-name "com.apple.vibrationmanagerd") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.wcd") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.fairplayd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.bird") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.iap2d") +(global-name "com.apple.iaptransportd")) + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.server.bluetooth") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.coremedia.audiodeviceclock") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.sharingd") + (global-name "com.apple.videoconference.camera") + (require-any (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (require-any (global-name "com.apple.dataaccess.dataaccessd.active") +(global-name "com.apple.passd.in-app-payment")) + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.webinspector") + (require-any (global-name "com.apple.homed.xpc") +(global-name "com.apple.iap2d.distributednotification.server") +(global-name "com.apple.iapd.distributednotification.server") +(global-name "com.apple.iaptransportd.xpc")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.calaccessd.xpc") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.bulletinboard.systemstateconnection") + (require-entitlement "com.apple.bulletinboard.systemstate")) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.icloud.findmydeviced") + (require-any + (require-entitlement "com.apple.aosnotification.aosnotifyd-access") + (require-entitlement "com.apple.icloud.findmydeviced.access"))) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (local-name "com.apple.iphone.axserver") + (require-entitlement "com.apple.accessibility.api")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.lskdd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.mediaserverd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.audio.AudioSession") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.bulletinboard.settings")) + (require-all + (global-name "com.apple.locationd.spi") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.twitterd.server") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.bulletinboard.utilitiesconnection") + (require-entitlement "com.apple.bulletinboard.utilities")) + (require-all + (global-name "com.apple.mobilemail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.Maps.SpringBoard") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.coremedia.admin") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (global-name "com.apple.nanomaps.xpc.Navigation") +(global-name "com.apple.nanomaps.xpc.Maps")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.replayd") + (require-not (process-attribute is-plugin))) + (require-all + (global-name "com.apple.icfcallserver") + (require-entitlement "com.apple.private.icfcallserver")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.safarifetcherd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.coreduetd") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.ABDatabaseDoctor") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.siri.vocabularyupdates") + (require-any + (require-entitlement "com.apple.developer.siri") + (require-entitlement "com.apple.siri.synapse"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.VideoSubscriberAccount.videosubscriptionsd") + (require-any + (require-entitlement "com.apple.developer.video-subscription-registration") + (require-entitlement "com.apple.private.subscriptionservice.all-sources.read-only") + (require-entitlement "com.apple.private.subscriptionservice.web-sources.read-write") + (require-entitlement "com.apple.smoot.subscriptionservice") + (require-entitlement "com.apple.private.subscriptionservice.internal"))) + (require-all + (global-name "com.apple.suggestd.mail") + (require-entitlement "com.apple.private.suggestions.mail")) + (require-all + (global-name "com.apple.nanomaps.xpc.GeoServices.Navigation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.absinthed") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.medialibraryd.xpc") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.suggestd.contacts") + (require-entitlement "com.apple.private.suggestions.contacts")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.accountsd.oauthsigner") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.unfreed") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.personad.xpc") + (require-any + (require-entitlement "com.apple.private.contactsui") + (require-entitlement "com.apple.private.persona.read") + (require-entitlement "com.apple.private.persona.write"))) + (require-all + (global-name "com.apple.Maps.mapspushd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.healthd.server") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (require-any + (require-entitlement "com.apple.private.imcore.imremoteurlconnection") + (require-entitlement "com.apple.private.ids.remoteurlconnection"))) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.identityservicesd.embedded.auth") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.aps.alertprovider.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.spotlight.IndexAgent") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.backupd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.familycircle.agent") + (require-entitlement "com.apple.private.familycircle")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.cache_delete") + (require-any + (require-entitlement "com.apple.mobile.deleted.AllowFreeSpace") + (require-entitlement "com.apple.private.CacheDelete"))) + (require-all + (global-name "com.apple.fig.movie") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.advisory_socket"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.accountsd.accountmanager") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.assistant.analytics") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (global-name "com.apple.parsec.subscriptionservice") + (require-entitlement "com.apple.smoot.subscriptionservice")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.managedconfiguration.profiled") + (require-entitlement "com.apple.managedconfiguration.profiled-access")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.parsec.subscriptionservice.internal") + (require-entitlement "com.apple.private.subscriptionservice.internal")) + (require-all + (require-any (global-name "com.apple.accountsd.accessmanager") +(global-name "com.apple.accountsd.authmanager") +(global-name "com.apple.healthd.restriction")) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.bulletindistributord.server") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.SystemConfiguration.PPPController-priv") + (require-entitlement "com.apple.networking.vpn.configuration")) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.bulletinboard.observerconnection") + (require-entitlement "com.apple.bulletinboard.observer")) + (require-all + (global-name "com.apple.suggestd.suggestionmanager") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.AOSNotification") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobilestoredemod") + (require-entitlement "com.apple.private.mobilestoredemo.enabledemo")) + (require-all + (global-name "com.apple.suggestd.spotlight") + (require-entitlement "com.apple.private.suggestions.spotlight")) + (require-all + (global-name "com.apple.locationd.registration") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.twitterd") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.pegasus") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.mobilesafari-settings") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebSheet"))) + (require-all + (global-name "com.apple.harvestd.manager") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.routined.registration") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.calaccessd") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.suggestd.events") + (require-entitlement "com.apple.private.suggestions.events")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client" + (entitlement-value-regex #".+"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.routined.registration") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.locationd.synchronous") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (require-not (global-name-regex #"-idswake$" #".+-idswake$")) + (require-any + (local-name "com.apple.assistant.contextprovider.") + (local-name "com.apple.iphone.axserver") + (local-name "com.apple.accessibility.gax.client") + (require-all + (require-any (global-name "com.apple.Music.MPMusicPlayerControllerInternal") +(global-name "com.apple.Music.MPMusicPlayerMigServerExists")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (literal "/private/var/run/lockdown.sock") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (remote tcp "localhost:22")) + (require-not (remote tcp "localhost:23")) + (require-not (remote tcp "localhost:873")) + (require-not (remote tcp "localhost:62078")) + (require-any + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/syslog") + (literal "/private/var/run/printd") + (remote ip "*:*") + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents")))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.atc") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.apsd") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.ConfigServer") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.dataaccess.dataaccessd") + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.softwareupdateservicesd") +(preference-domain "com.apple.voicemail") +(preference-domain "com.apple.MobileAddressBook") +(preference-domain "com.apple.VoiceMemos") +(preference-domain "com.apple.XCTest") +(preference-domain "com.apple.certui") +(preference-domain "com.apple.gamekit") +(preference-domain "com.apple.imagent") +(preference-domain "com.apple.madrid") +(preference-domain "com.apple.managedconfiguration.janitor") +(preference-domain "com.apple.messagesbadgecontroller") +(preference-domain "com.apple.mobile.SyncMigrator") +(preference-domain "com.apple.mobileme.fmf.assistant") +(preference-domain "com.apple.mobilestoresettings") +(preference-domain "com.apple.mobiletimer") +(preference-domain "com.apple.mobilevpn") +(preference-domain "com.apple.network.eapclient.tls.TrustExceptions") +(preference-domain "com.apple.nike") +(preference-domain "com.apple.preferences.datetime") +(preference-domain "com.apple.preferences.network") +(preference-domain "itdbprepserver") +(preference-domain "mediaremote")) + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.itdbprep.server") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.OTASyncState") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.GMM") + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (preference-domain "com.apple.TTY") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (preference-domain "com.apple.MailAccount-ExtProperties") +(preference-domain "com.apple.OTASyncAgent")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.homesharing") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.AppSupport") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.AppSupport") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.corevideo") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (preference-domain "com.apple.carrier") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.GEO") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.locationd") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.WebFoundation") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (preference-domain "com.apple.medialibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.avfoundation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.CoreDuet") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.coremedia") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mobilecal.alarmengine") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.DataMigration") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (preference-domain "com.apple.coreaudio") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.PeoplePicker") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (preference-domain "com.apple.NanoMailKit") +(preference-domain "com.apple.internal.Voltaire") +(preference-domain "com.skyhookwireless.wps")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.mobilecal") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (require-any (preference-domain "com.apple.NanoMailKit") +(preference-domain "com.apple.internal.Voltaire") +(preference-domain "com.skyhookwireless.wps")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (preference-domain "com.apple.MailAccount-ExtProperties") +(preference-domain "com.apple.OTASyncAgent")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))))) +(allow process-info-codesignature + (target self) + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension"))) +(allow process-info-dirtycontrol + (target self)) +(allow process-info-rusage + (target self) + (require-entitlement "com.apple.security.exception.process-info")) +(allow process-info-pidinfo + (target self) + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (target others) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd"))) + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension"))) +(allow pseudo-tty) +(allow signal + (target self) + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension")) + (require-all + (target others) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd")))) +(allow sysctl-read + (sysctl-name "net.routetable.") + (sysctl-name "net.statistics") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "kern.bootsessionuuid") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.DiagnosticExtensions.extension")) + (require-all + (sysctl-name "kern.proc.all") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd"))) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (sysctl-name "kern.hostname") + (sysctl-name "hw.machine"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-info + (require-all + (info-type "net.link.addr") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2)) + (require-all + (socket-domain 39) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps")) + (require-entitlement "com.apple.network.multipath-tcp")))) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb.xml new file mode 100644 index 0000000..c2510dc --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb.xml @@ -0,0 +1,27 @@ + + + + + + + + + +]> + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb new file mode 100644 index 0000000..0c26d88 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb @@ -0,0 +1,479 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.containermanagerd") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (subpath "/private/var/containers") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers" #"^/private/var/[-0-9A-F]+/Library/Backup/SystemContainers" #"^/private/var/Users/[^/]+/Library/Backup/SystemContainers") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers" #"^/private/var/[-0-9A-F]+/Containers" #"^/private/var/Users/[^/]+/Containers") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/root/Library/MobileContainerManager") +(literal "/private/var/root/Library/MobileContainerManager.") +(subpath "/private/var/root/Library/Logs/MobileContainerManager") +(literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") +(subpath "/private/var/installd/Library/Caches") +(subpath "/private/var/networkd/Containers") +(literal "/private/var/") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/MobileContainerManager") +(subpath-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager") +(literal-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager.")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal "/private/var/installd/Library") +(literal "/private/var/installd/Library/Logs")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (require-any (subpath "/private/var/root/Library/MobileContainerManager") +(literal "/private/var/root/Library/MobileContainerManager.") +(subpath "/private/var/root/Library/Logs/MobileContainerManager") +(literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") +(subpath "/private/var/installd/Library/Caches") +(subpath "/private/var/networkd/Containers") +(literal "/private/var/") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/MobileContainerManager") +(subpath-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager") +(literal-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager.")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.containermanagerd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/containers") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers" #"^/private/var/[-0-9A-F]+/Library/Backup/SystemContainers" #"^/private/var/Users/[^/]+/Library/Backup/SystemContainers") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers" #"^/private/var/[-0-9A-F]+/Containers" #"^/private/var/Users/[^/]+/Containers") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal "/private/var/installd/Library") +(literal "/private/var/installd/Library/Logs")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb new file mode 100644 index 0000000..ffff534 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb @@ -0,0 +1,194 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/private/var/db/timezone") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/ptmx") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (vnode-type CHARACTER-DEVICE) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/root/Library/Caches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath "/System/Library/Caches/com.apple.coresymbolicationd") +(subpath "/private/var/root/Library/Caches/com.apple.coresymbolicationd")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb new file mode 100644 index 0000000..aca782b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb @@ -0,0 +1,184 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/logs/WirelessLibraryLogs") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Library/Logs") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/logs/WirelessLibraryLogs") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb new file mode 100644 index 0000000..108cc72 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb @@ -0,0 +1,96 @@ +(version 1) +(deny default) +(allow file-link) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ctkd.slot-client") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb new file mode 100644 index 0000000..0762571 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb @@ -0,0 +1,665 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Mail") + (subpath-prefix "${HOME}/Library/Notes") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/AddressBook/AddressBookImages.sqlitedb") +(literal-prefix "${HOME}/Library/AddressBook/AddressBookImages.sqlitedb-journal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBookImages.sqlitedb-shm") +(literal-prefix "${HOME}/Library/AddressBook/AddressBookImages.sqlitedb-wal")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/AppleInternal/Library/Frameworks") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock") +(literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.activesync") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/")) + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-journal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-shm") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-wal") +(literal-prefix "${HOME}/Library/AddressBook")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/DataAccess") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Fonts") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (subpath-prefix "${HOME}/Library/DataAccess") + (subpath-prefix "${HOME}/Library/Mail") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-journal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-shm") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-wal") +(literal-prefix "${HOME}/Library/AddressBook")) + (require-any (literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock") +(literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.activesync") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/")) + (subpath-prefix "${HOME}/Library/Calendar") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Safari")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/AddressBook")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.calaccessd.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilenotes") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.dataaccess.dataaccessd") + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "com.apple.message") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (require-any (preference-domain "com.apple.dataaccess.activesync") +(preference-domain "com.apple.dataaccess.babysitter")) + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.DataMigration") + (require-any (preference-domain "com.apple.dataaccess.activesync") +(preference-domain "com.apple.dataaccess.babysitter")) + (preference-domain "com.apple.persistentconnection-mcc") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.dataaccess.dataaccessd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb.xml new file mode 100644 index 0000000..16c4ab7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb new file mode 100644 index 0000000..0ea88df --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb @@ -0,0 +1,213 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (subpath "/private/var/db/datadetectors") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath "/private/var/db/datadetectors") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb new file mode 100644 index 0000000..972a0b8 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb @@ -0,0 +1,200 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (literal "/private/etc/hosts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-priv-task-port) +(allow network-inbound + (local tcp "localhost:*") + (remote tcp "localhost:*")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown/checkin") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow system-debug) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb.xml new file mode 100644 index 0000000..923f559 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb new file mode 100644 index 0000000..911ffe7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb @@ -0,0 +1,391 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (subpath "/System/Library/CacheDelete") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${HOME}/Library/Logs/CacheDelete") +(subpath-prefix "${HOME}/Library/Caches/com.apple.cache_delete") +(subpath "/AppleInternal/Library/CacheDelete")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Logs/CacheDelete") +(subpath-prefix "${HOME}/Library/Caches/com.apple.cache_delete") +(subpath "/AppleInternal/Library/CacheDelete")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "cache_delete.fb_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name-regex #"^com[.]apple[.].+cache-delete$") + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.mobile.cache_delete_") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (global-name-regex #"^com[.]apple[.].+[Cc]ache[Dd]elete$") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:443") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.cache_delete") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.cache_delete")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 27)) + (fsctl-command (_IO "h" 29)) + (fsctl-command (_IO "h" 28))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb new file mode 100644 index 0000000..4910f28 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb @@ -0,0 +1,451 @@ +(version 1) +(deny default) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (subpath-prefix "${HOME}/Library/DuetExpertCenter") +(subpath-prefix "${HOME}/Library/Logs/CallHistory") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/proactive_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/.proactive_") +(literal-prefix "${HOME}/Library/Logs/coreduetd.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.duetexpertd")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (subpath-prefix "${HOME}/Library/Logs/CrashReporter")) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/DuetExpertCenter") +(subpath-prefix "${HOME}/Library/Logs/CallHistory") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/proactive_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/.proactive_") +(literal-prefix "${HOME}/Library/Logs/coreduetd.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.duetexpertd")) + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-deny"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (require-any (global-name "com.apple.coreduetd.context") +(global-name "com.apple.coreduetd.knowledgebase")) + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.routined.registration") + (require-any (global-name "com.apple.atc.xpc.sessions") +(global-name "com.apple.duet.expertcenter")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.calaccessd") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.springboard.services") + (global-name "com.apple.marco") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.callkit.callcontrollerhost") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.message") + (require-any (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") +(preference-domain "com.apple.duetexpertd")) + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.suggestions") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CrashReporter") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") +(preference-domain "com.apple.duetexpertd")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaremote")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb new file mode 100644 index 0000000..a1f32f9 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb @@ -0,0 +1,743 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}") +(literal-prefix "${HOME}/Library/Preferences/com.apple.icloud.findmydeviced")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/usr/libexec") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/MDM.plist") +(literal "/usr/libexec/findmydeviced") +(literal "/") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/MDM.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/MDM.plist")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/empty") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-data + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}") +(literal-prefix "${HOME}/Library/Preferences/com.apple.icloud.findmydeviced")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/euser[0-9]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/[-0-9A-F]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/Users/[^/]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "ProvInfoIOKitUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "findmydeviced.boot_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.fig.movie") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.absinthed") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.adid") + (require-any (global-name "com.apple.iapd.xpc") +(global-name "com.apple.iap2d.xpc")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.networkd") + (global-name "com.apple.ak.anisette.xpc") + (require-any (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.mobile.obliteration") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.marco") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.absd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.AOSNotification.notbackedup") +(preference-domain "com.apple.managedconfiguration.notbackedup") +(preference-domain "com.apple.Security")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.purplebuddy") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.DataMigration")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb new file mode 100644 index 0000000..99af32a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb @@ -0,0 +1,627 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/usr/libexec/fmfd") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/usr/libexec") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/empty") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.fmfd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.fmfd")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/PPTDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.fmfd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.fmfd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.aps.alertprovider.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.apsalerts") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.da") + (preference-domain "com.apple.icloud.fmfd") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.DataMigration") + (require-any (preference-domain "com.apple.icloud.fmfd.notbackedup") +(preference-domain "com.apple.mobileme.fmf1")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.icloud.fmfd") + (require-any (preference-domain "com.apple.icloud.fmfd.notbackedup") +(preference-domain "com.apple.mobileme.fmf1"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb new file mode 100644 index 0000000..0a17bfb --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb @@ -0,0 +1,198 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.pfd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (local ip "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb.xml new file mode 100644 index 0000000..b310806 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb new file mode 100644 index 0000000..e97a8c6 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb @@ -0,0 +1,678 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/GameKit") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.gamed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.gamed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") +(subpath-prefix "${HOME}/Library/Logs/GameKit") +(subpath-prefix "${HOME}/Library/Caches/GameKit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") +(subpath-prefix "${HOME}/Library/GameKit")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/private/var/containers/Bundle") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/aes_0") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/usr/libexec/gamed") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/Applications") + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/usr/local/bin/gamecenterctl") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.gamed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.gamed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") +(subpath-prefix "${HOME}/Library/Logs/GameKit") +(subpath-prefix "${HOME}/Library/Caches/GameKit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") +(subpath-prefix "${HOME}/Library/GameKit")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.gamecenter") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.fig.movie") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "PurpleSystemAppPort") + (require-any (global-name "com.apple.authkit.xpc") +(global-name "com.apple.gamecenter.gsEvents")) + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.fairplayd") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.imagent.embedded.auth") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "PurpleSystemEventPort") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote ip "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.conference") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.gamecenter")) +(allow process-exec* + (literal "/usr/libexec/gamed")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb new file mode 100644 index 0000000..b3f00f7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb @@ -0,0 +1,20 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb.xml new file mode 100644 index 0000000..941d510 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb new file mode 100644 index 0000000..1b28385 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb @@ -0,0 +1,572 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/MapTiles") +(subpath-prefix "${HOME}/Library/Caches/PlaceData") +(subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Maps") +(subpath-prefix "${HOME}/Library/GeoServices")) + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/MapTiles") +(subpath-prefix "${HOME}/Library/Caches/PlaceData") +(subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Maps") +(subpath-prefix "${HOME}/Library/GeoServices")) + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/MapTiles")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.marco") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.WebFoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.GMM")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb new file mode 100644 index 0000000..329c280 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb @@ -0,0 +1,522 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.lsd.modifydb") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cache_delete") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.misagent") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.healthd.server") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.marco") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.appconduitd.application-manager") +(global-name "com.apple.carousel.backlightxpc") +(global-name "com.apple.carousel.glanceservice") +(global-name "com.apple.carousel.tilenavigation")) + (global-name "com.apple.nanoprefsync") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.sockpuppet.activeComplications") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.nanoprefsyncd") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.sockpuppet.activeComplications")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb new file mode 100644 index 0000000..2ceb32d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb @@ -0,0 +1,482 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd"))) +(allow file-link) +(allow file-read* + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (subpath "/usr/share") + (literal "/dev/ptmx") + (subpath "/System/Library") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.logd.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (vnode-type CHARACTER-DEVICE) + (extension "com.apple.sandbox.executable") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/GPUTools") +(subpath "/private/var/root/Library/Caches/com.apple.opengl")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "IOSurfaceRootUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.lockdown.host_watcher") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.appwatchdog") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-priv-task-port) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/gputoolsdhelper.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (local tcp "localhost:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown/checkin") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-exec* + (literal "/Developer/usr/libexec/gputoolsd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "sysctl.proc_native") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb.xml new file mode 100644 index 0000000..ccb1c4c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb.xml @@ -0,0 +1,48 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb new file mode 100644 index 0000000..f1ef282 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb @@ -0,0 +1,290 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (literal-prefix "${PROCESS_TEMP_DIR}/HealthWrap-") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal-prefix "${PROCESS_TEMP_DIR}/HealthWrap-") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.private.healthd.server-internal") + (global-name "com.apple.healthd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.cloudd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb new file mode 100644 index 0000000..3d23f70 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb @@ -0,0 +1,578 @@ +(version 1) +(deny default) +(allow file-read* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath "/private/var/preferences/Logging") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.healthd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.healthd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") +(literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches") +(subpath-prefix "${HOME}/Library/Health") +(literal-prefix "${HOME}/Library/")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (subpath "/Applications/Fitness.app") +(subpath "/Applications/Health.app")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/awd") + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.healthd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.healthd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") +(literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches") +(subpath-prefix "${HOME}/Library/Health") +(literal-prefix "${HOME}/Library/")) + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/CompanionSyncCaches")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.routined.registration") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.springboard.services") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.marco") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.apsd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.mobilephone") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.ET") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.conference") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (require-any (preference-domain "com.apple.dt.Xcode") +(preference-domain "com.apple.healthlite")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DataMigration") + (require-any (preference-domain "com.apple.Fitness") +(preference-domain "com.apple.nanolifestyle") +(preference-domain "com.apple.nanolifestyle.privacy") +(preference-domain "com.apple.SOS")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.ET") + (require-any (preference-domain "com.apple.Fitness") +(preference-domain "com.apple.nanolifestyle") +(preference-domain "com.apple.nanolifestyle.privacy") +(preference-domain "com.apple.SOS"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb new file mode 100644 index 0000000..eb7bc70 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb @@ -0,0 +1,658 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/sbin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "AppleAuthCPUserClient") +(iokit-user-client-class "AppleUSBHostDeviceUserClient") +(iokit-user-client-class "IOAccessoryPortUserClient")) + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (require-any (iokit-user-client-class "AppleUSBHostInterfaceUserClient") +(iokit-user-client-class "IOAccessoryManagerUserClient")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (require-all (require-not (iokit-property "PowerState")) +(require-not (iokit-property "VirtualMode"))) + (require-all + (require-any (iokit-property "Authenticated") +(iokit-property "InterfaceProperties")) + (iokit-user-client-class "IOUSBHostDevice"))) +(allow iokit-get-properties + (require-any (iokit-user-client-class "IOUSBHostInterface") +(iokit-user-client-class "IOUSBHostDevice") +(iokit-user-client-class "IOMikeyBusDevice") +(iokit-user-client-class "IODTNVRAM") +(iokit-user-client-class "IOAccessoryManager") +(iokit-user-client-class "IOAccessoryEAInterface") +(iokit-user-client-class "AppleAuthCP")) + (require-any (iokit-property "IOClassNameOverride") +(iokit-property "IORegistryEntryPropertyKeys")) + (iokit-property "IOClass") + (require-any (iokit-property "AppleUSBCableType") +(iokit-property "IOName") +(iokit-property "IONameMatch") +(iokit-property "IONameMatched")) + (require-all + (iokit-property "iommu-present") + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "PowerState") +(iokit-property "VirtualMode")) + (iokit-user-client-class "IODPController")) + (require-all + (iokit-property "AppleJPEG") + (iokit-user-client-class "AppleJPEGDriver")) + (require-all + (iokit-property "kUSBBusCurrentAllocation") + (iokit-user-client-class "AppleUSBHostPort")) + (require-all + (require-any (iokit-property "assistant") +(iokit-property "car-integration") +(iokit-property "low-power-wallet-mode") +(iokit-property "iap2-protocol-supported")) + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "IOAccessoryDevicePort") +(iokit-property "IOAccessoryPortManagerPrimaryPort") +(iokit-property "IOAccessoryTransportType")) + (iokit-user-client-class "IOAccessoryTransport")) + (require-all + (iokit-property "development-cert") + (iokit-user-client-class "IOService")) + (require-all + (require-any (iokit-property "kUSBDesiredChargingCurrent") +(iokit-property "kUSBFailedRequestedPower")) + (require-any (iokit-connection "AppleUSB20CameraKitHub") +(iokit-connection "AppleUSB30CameraKitHub"))) + (require-all + (require-any (iokit-property "DisplayPipePlaneBaseAlignment") +(iokit-property "hdcp-hoover-protocol")) + (iokit-user-client-class "IOMobileFramebuffer"))) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (require-any (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+"))) +(allow network-bind + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote udp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.suggestions") + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.da") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.carplay") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd")) + (preference-domain "com.apple.assistant.logging") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.videos") + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd")) + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.mediaremote") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-any (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iap2d") +(literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iapd"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-kext-load + (require-any (kext-bundle-id "com.apple.driver.usb.cdc.ecm") +(kext-bundle-id "com.apple.driver.usb.cdc.ncm") +(kext-bundle-id "com.apple.driver.usb.cdc") +(kext-bundle-id "com.apple.driver.usb.IOUSBHostHIDDevice") +(kext-bundle-id "com.apple.driver.usb.networking") +(kext-bundle-id "com.apple.driver.AppleUSBDeviceAudioController") +(kext-bundle-id "com.apple.driver.AppleUSBAudio"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb.xml new file mode 100644 index 0000000..9c877fa --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb new file mode 100644 index 0000000..7be0e0c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb @@ -0,0 +1,625 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/AppleInternal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.setmme") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") +(literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") +(subpath-prefix "${HOME}/Library/IdentityServices") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}")) + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (extension "com.apple.identityservices.send") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/usr/local/bin") + (debug-mode)) + (require-all + (require-any (literal "/bin/sh") +(literal "/usr/bin/lskq")) + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal "/usr/local/bin/figplaySS") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal "/dev/tty") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/awd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") +(literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") +(subpath-prefix "${HOME}/Library/IdentityServices") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.identityservices.send") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/dev/tty") + (debug-mode)) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.coreduetd") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.awdd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.datamigrator") + (global-name "com.apple.absinthed") + (require-any (global-name "com.apple.idscredentialsagent.embedded.auth") +(global-name "com.apple.imtransferservices.IMTransferAgent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name-regex #"-idswake$" #".+-idswake$") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.server.bluetooth") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.apsd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.absd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.audio.SystemSoundServer-iOS") + (debug-mode)) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (local ip "*:*")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.marco") + (preference-domain "com.apple.persistentconnection") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.registration") + (require-any (preference-domain "com.apple.identityservicesd") +(preference-domain "com.apple.identityservices.idstatuscache") +(preference-domain "com.apple.ids.deviceproperties") +(preference-domain "com.apple.ids.subservices")) + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.migration") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.da") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.purplebuddy") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (debug-mode))) +(allow user-preference-write + (require-any (preference-domain "com.apple.identityservicesd") +(preference-domain "com.apple.identityservices.idstatuscache") +(preference-domain "com.apple.ids.deviceproperties") +(preference-domain "com.apple.ids.subservices")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.conference")) +(allow process-exec* + (require-all + (literal "/usr/local/bin/figplaySS") + (debug-mode))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb new file mode 100644 index 0000000..b5ceb3f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb @@ -0,0 +1,320 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal "/usr/libexec") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/containers/Bundle") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/MobileIdentityData") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (subpath "/private/var/installd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/usr/libexec/installd") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (literal "/com.apple.xpc.launchd.bootstrap.plist")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath "/private/var/installd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (subpath "/private/var/containers/Bundle") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "installd.firstboot_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.online-auth-agent.xpc") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.misagent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.modifydb") + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb new file mode 100644 index 0000000..728f980 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb @@ -0,0 +1,625 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media/Downloads")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath-prefix "${HOME}/Media") + (literal "/dev/ptmx") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.itunesstored") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/Snapshots") +(subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/MusicLibrary") +(subpath-prefix "${HOME}/Library/com.apple.itunesstored") +(literal-prefix "${HOME}/Library/")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/System/Library") + (subpath "/private/var/containers/Bundle") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.itunesstored") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/Snapshots") +(subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/MusicLibrary") +(subpath-prefix "${HOME}/Library/com.apple.itunesstored") +(literal-prefix "${HOME}/Library/")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cache_delete") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mediaartworkd.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.absinthed") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.adid") + (global-name "com.apple.securityd") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.ondemandd.itunesstored") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.modifydb") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.biometrickitd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.absd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (preference-domain "com.apple.persistentconnection") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.itunesstored")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb new file mode 100644 index 0000000..5712529 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb @@ -0,0 +1,563 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}"))))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (require-not (ipc-posix-name "apple.shm.notification_center")) + (ipc-posix-name "apple.cfprefs."))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.assertiond.expiration") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.fig.movie") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.CARenderServer") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.system.notification_center")) + (require-any + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow process-info-codesignature + (target self) + (require-entitlement "com.apple.security.exception.process-info")) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (sysctl-name "kern.hostname") + (sysctl-name "hw.machine"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb.xml new file mode 100644 index 0000000..d78d38c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb new file mode 100644 index 0000000..12f1b6f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb @@ -0,0 +1,424 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.librarian.ubiquity-container"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (require-any (subpath-prefix "${HOME}/Library/Application Support/Librarian") +(subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log")) + (subpath "/Developer") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (vnode-type CHARACTER-DEVICE) + (subpath-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Application Support") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.logd.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Application Support/Librarian") +(subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log")) + (literal-prefix "${HOME}/Library/Application Support") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.ubd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.appleaccount") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.librariand") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.librariand")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb new file mode 100644 index 0000000..1248534 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb @@ -0,0 +1,324 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.iad") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.iad")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/usr/libexec/limitadtrackingd") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.iad") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.iad")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.AdSheetPhone.management") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.cloudd") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.persistentconnection") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AdLib") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb new file mode 100644 index 0000000..c357f3e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb @@ -0,0 +1,422 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath-prefix "${FRONT_USER_HOME}/Media") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (subpath "/private/var/root/Library/Lockdown") +(literal "/private/var/root/Library/Preferences/com.apple.mobile.lockdownd.plist") +(subpath "/private/var/preferences/SystemConfiguration")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/logs") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/run/lockdown.sock") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath "/Applications/Preferences.app") +(subpath "/AppleInternal/Lockdown") +(literal "/usr/libexec/lockdownd") +(literal "/private/var/db/launchd.db/com.apple.launchd/overrides.plist")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (subpath "/private/var/run/lockdown") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/containers") + (vnode-type DIRECTORY)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Containers") + (vnode-type DIRECTORY)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (vnode-type DIRECTORY)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Media") + (vnode-type DIRECTORY)) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/Applications") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.WebAppCache") +(subpath-prefix "${FRONT_USER_HOME}/Library/Calendar") +(subpath-prefix "${FRONT_USER_HOME}/Library/Notes") +(subpath-prefix "${FRONT_USER_HOME}/Library/Voicemail")) + (vnode-type DIRECTORY)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Media") + (require-any (subpath "/private/var/root/Library/Lockdown") +(literal "/private/var/root/Library/Preferences/com.apple.mobile.lockdownd.plist") +(subpath "/private/var/preferences/SystemConfiguration")) + (subpath "/private/var/run/lockdown") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/lockdown.sock") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/logs") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (literal "/private/var/db/timezone") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (require-any (iokit-user-client-class "AppleEffaceableStorageUserClient") +(iokit-user-client-class "AppleNANDFTLUserClient")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (iokit-property "auto-boot")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.atc") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.webinspector") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.trustd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.AOSNotification") +(global-name "com.apple.mobile.assertion_agent") +(global-name "com.apple.mobile.installation_proxy") +(global-name "com.apple.mobile.insecure_notification_proxy") +(global-name "com.apple.mobile.notification_proxy") +(global-name "com.apple.afcd") +(global-name "com.apple.atc2") +(global-name "com.apple.crashreportcopymobile") +(global-name "com.apple.crash_mover") +(global-name "com.apple.streaming_zip_conduit") +(global-name "com.apple.syslog_relay") +(global-name "lockdown.")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.ait.client") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (local tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (subpath "/private/var/run/lockdown")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockbot") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.purplebuddy") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb new file mode 100644 index 0000000..56ef6e0 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb @@ -0,0 +1,443 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/oslog") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.logd.read-only") + (require-any + (subpath "/private/var/db/diagnostics") + (subpath "/private/var/db/uuidtext"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read* + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/dev/oslog") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (subpath "/private/var/log") +(subpath "/private/var/root/Library/Logs")) + (literal "/dev/ptmx") + (subpath "/private/var/db/uuidtext") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (subpath "/private/var/logs/system_logs.logarchive") + (subpath "/private/var/db/diagnostics") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/containers/Bundle") + (subpath "/private/var/logs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (file-mode #o0100) + (file-mode #o0010) + (file-mode #o0001))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath "/private/var/db/diagnostics") + (subpath "/private/var/db/uuidtext") + (subpath "/private/var/logs/system_logs.logarchive") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/oslog") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-any (subpath "/private/var/log") +(subpath "/private/var/root/Library/Logs")) + (subpath "/private/var/logs") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-priv-host-port) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-kext-query) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb.xml new file mode 100644 index 0000000..b552447 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb new file mode 100644 index 0000000..33bfe8c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb @@ -0,0 +1,345 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${HOME}/Library/Logs/useractivityd") +(subpath-prefix "${HOME}/Library/Logs/Handoff") +(subpath-prefix "${HOME}/Library/Logs/Transport")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Logs/useractivityd") +(subpath-prefix "${HOME}/Library/Logs/Handoff") +(subpath-prefix "${HOME}/Library/Logs/Transport")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coreservices.uauseractivitypasteboardclient.xpc") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.bird") + (global-name "com.apple.securityd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.SharedWebCredentials") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.ids") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.mobileipod") + (require-any (preference-domain "com.apple.coreservices.useractivityd") +(preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites")) + (preference-domain "com.apple.Sharing") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaremote") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.mediaremote") + (require-any (preference-domain "com.apple.coreservices.useractivityd") +(preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb.xml new file mode 100644 index 0000000..f0d97f4 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb new file mode 100644 index 0000000..01c500f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb @@ -0,0 +1,137 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (literal "/dev/dtracehelper") + (literal "/private/var/run/mDNSResponder") + (require-any (regex #"/private/var/folders/[^/]+/[^/]+/C/mds/?") +(regex #"/private/var/folders/[^/]+/[^/]+/-Caches-/mds/?")) + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/private/var/db/dyld") + (subpath "/usr/share")))) +(allow file-read-data + (require-any (literal "/private/var/db/crls/crlcache.db") +(subpath "/private/var/db/mds") +(subpath "/private/var/tmp/mds") +(literal "/Library/Keychains/System.keychain")) + (require-all + (require-not (literal "/Library/Keychains/")) + (require-any + (literal "/dev/console") + (require-any (literal "/usr/sbin/mDNSResponder") +(literal "/Library/Preferences/com.apple.mDNSResponder.plist") +(literal "/Library/Preferences/com.apple.security.") +(literal "/Library/Preferences/com.apple.crypto.plist") +(literal "/Library/Preferences/SystemConfiguration/preferences.plist") +(literal "/Library/Preferences/SystemConfiguration/com.apple.nat.plist") +(literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") +(subpath "/Library/Preferences/Logging") +(literal "/Library/Preferences/ByHost/.GlobalPreferences.") +(literal "/Library/Preferences/.GlobalPreferences.") +(literal "/Library/Security/Trust Settings/Admin.plist") +(literal "/private/etc") +(subpath "/AppleInternal/Library/Preferences/Logging") +(subpath "/System/Library/Preferences/Logging")) + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal "/usr/sbin") + (literal "/private/etc/hosts")))) +(allow file-read-metadata) +(allow file-write* + (require-any (regex #"/private/var/folders/[^/]+/[^/]+/C/mds/?") +(regex #"/private/var/folders/[^/]+/[^/]+/-Caches-/mds/?")) + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (literal "/private/var/run/mDNSResponder") + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (require-all + (literal "/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/console") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))) +(allow iokit-open + (require-any (iokit-user-client-class "NVEthernetUserClientMDNS") +(iokit-user-client-class "mDNSOffloadUserClient") +(iokit-user-client-class "wlDNSOffloadUserClient")) + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (require-any (global-name "com.apple.bsd.dirhelper") +(global-name "com.apple.blued") +(global-name "com.apple.distributed_notifications.2") +(global-name "com.apple.mDNSResponder_Helper") +(global-name "com.apple.webcontentfilter.dns") +(global-name "com.apple.awacs")) + (global-name "com.apple.snhelper") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.nehelper") + (global-name "com.apple.wifi.manager") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ocspd") + (global-name "com.apple.networkserviceproxy") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.SystemConfiguration.configd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.networkd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.SecurityServer") +(global-name "com.apple.coreservices.quarantine-resolver")) + (global-name "com.apple.mDNSResponderHelper")) +(allow mach-register + (global-name "com.apple.d2d.ipc")) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb.xml new file mode 100644 index 0000000..438d67b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb.xml @@ -0,0 +1,52 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb new file mode 100644 index 0000000..3cec6fd --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb @@ -0,0 +1,693 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath "/Library/Audio/Tunings/Generic/AU") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/local/lib") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.xpc.activity.unmanaged") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.assetsd.changehub") + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mediaanalysisd") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.VideoProcessing") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaanalysisd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb new file mode 100644 index 0000000..b2ebcf7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb @@ -0,0 +1,970 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.rtcreporting.upload") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (literal "/usr/local/lib/libAudioDiagnostics.dylib") + (subpath "/Library/Audio/Plug-Ins") + (extension "com.apple.sandbox.executable")) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Media/Recordings") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/wireless/Library/Logs/awd") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.mediaserverd.read") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.mediaserverd.read-write") + (require-any (subpath "/Library") +(subpath "/usr/local/share/firmware/isp") +(literal "/private/var/Managed Preferences/mobile/com.apple.springboard.plist") +(literal "/AppleInternal/Library/Conference/Environments.plist")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-mediaserverd.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") +(literal-prefix "${HOME}/Library/Logs/AirPlay.log") +(literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") +(subpath-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.logMedia/iTunes_Control/Music") +(subpath-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.logMedia/PhotoData/OutboundSharingTmp") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/tmp/mediaserverd") +(subpath "/private/var/logs/mediaserverd")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/sbin") + (subpath "/usr/local/lib") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/Downloads") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mediaserverd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mediaserverd")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/awd") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${HOME}/Library/Logs") +(literal-prefix "${HOME}/Library/Caches/CoreMotion")) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CoreMotion")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/Podcasts") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${HOME}/Media/Downloads") + (subpath "/private/var/wireless/Library/Logs/awd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-mediaserverd.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") +(literal-prefix "${HOME}/Library/Logs/AirPlay.log") +(literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") +(subpath-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.logMedia/iTunes_Control/Music") +(subpath-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.logMedia/PhotoData/OutboundSharingTmp") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/tmp/mediaserverd") +(subpath "/private/var/logs/mediaserverd")) + (extension "com.apple.mediaserverd.read") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mediaserverd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mediaserverd")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CoreMotion"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (require-any (iokit-user-client-class "AppleUSBHostInterfaceUserClient") +(iokit-user-client-class "IOAccessoryManagerUserClient")) + (require-any (iokit-user-client-class "com_apple_audio_IOBorealisOwlUserClient") +(iokit-user-client-class "AppleAVEUserClient") +(iokit-user-client-class "AppleAVE2UserClient") +(iokit-user-client-class "AppleD5500UserClient") +(iokit-user-client-class "AppleExternalAmpControllerUserClient") +(iokit-user-client-class "AppleH2CamInUserClient") +(iokit-user-client-class "AppleH3CamInUserClient") +(iokit-user-client-class "AppleH4CamInUserClient") +(iokit-user-client-class "AppleH6CamInUserClient") +(iokit-user-client-class "AppleH9CamInUserClient") +(iokit-user-client-class "AppleSPUHIDDriverUserClient") +(iokit-user-client-class "AppleSRSDriverUserClient") +(iokit-user-client-class "AppleVXD375UserClient") +(iokit-user-client-class "AppleVXD390UserClient") +(iokit-user-client-class "AppleVXD393UserClient") +(iokit-user-client-class "AppleVXE380UserClient") +(iokit-user-client-class "IOUSBDeviceInterfaceUserClient") +(iokit-user-client-class "IOTimeSyncDomainUserClient") +(iokit-user-client-class "IOTimeSyncgPTPManagerUserClient") +(iokit-user-client-class "IOTimeSyncClockManagerUserClient") +(iokit-user-client-class "IOTimeSyncUserClient") +(iokit-user-client-class "IOStreamAudioUserClient") +(iokit-user-client-class "IOReportUserClient") +(iokit-user-client-class "IOAudioCodecsUserClient") +(iokit-user-client-class "IOAudio2TransformerUserClient") +(iokit-user-client-class "IOAudio2DeviceUserClient") +(iokit-user-client-class "H3H264VideoEncoderDriverUserClient")) + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "shm_pcm_audio_sco_write") +(ipc-posix-name "shm_pcm_audio_sco_read")) + (require-any (ipc-posix-name "shm_pcm_audio_acl") +(ipc-posix-name "com.apple.audio.abl.")) + (ipc-posix-name-regex #"^shm_notif[.][^.]+[.][RW]$") + (ipc-posix-name-regex #"^[0-9A-F][0-9A-F]:+[0-9A-F][0-9A-F]-tacl$") + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (ipc-posix-name-regex #"^AppleAURemoteIO[.]." #"^AppleAURemoteIO[.].+") + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name-regex #"^AppleAudioQueue[.]." #"^AppleAudioQueue[.].+")) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.homed.xpc") +(global-name "com.apple.iap2d.distributednotification.server") +(global-name "com.apple.iapd.distributednotification.server") +(global-name "com.apple.iaptransportd.xpc")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.WirelessCoexManager") + (require-any (global-name "com.apple.NetworkLinkConditioner") +(global-name "com.apple.airplay.receiver.controller") +(global-name "com.apple.applecamerad") +(global-name "com.apple.audio.AUPBRegistrar") +(global-name "com.apple.b184_mcu_commd") +(global-name "com.apple.b184_monitord") +(global-name "com.apple.carkit.monitoring.service") +(global-name "com.apple.coremedia.virtualdisplayserver") +(global-name "com.apple.filesystems.userfsd") +(global-name "com.apple.internal.mediaserverdtracerd") +(global-name "com.apple.lskdmsed") +(global-name "com.apple.securekeyvaultd")) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.carkit.service") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.assertiond.applicationstateconnection") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.timed.xpc") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "PurpleSystemAppPort") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.networkd") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.iapd.xpc") +(global-name "com.apple.iap2d.xpc")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.server.bluetooth") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SharingServices") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lskdd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.accessibility.AXSpringBoardServer") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.coresymbolicationd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (global-name "com.apple.coremedia.") + (global-name "com.apple.midiserver.io") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local tcp "*:*")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote udp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.settings.bluetooth.audio-route") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.da") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.rtcreporting") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.voicetrigger") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.carplay") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.assistant") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.VideoProcessing") + (require-any (preference-domain "com.apple.voicetrigger.notbackedup") +(preference-domain "com.apple.audio.puffin") +(preference-domain "com.apple.audio.virtualaudio") +(preference-domain "com.apple.coremedia.bag") +(preference-domain "com.apple.facetime")) + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.mediaserverd") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.mediaserverd") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.conference") + (require-any (preference-domain "com.apple.voicetrigger.notbackedup") +(preference-domain "com.apple.audio.puffin") +(preference-domain "com.apple.audio.virtualaudio") +(preference-domain "com.apple.coremedia.bag") +(preference-domain "com.apple.facetime")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (literal "/usr/sbin/mediaserverd") + (require-all + (require-any (literal "/usr/bin/trace") +(literal "/usr/bin/syslog")) + (debug-mode))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl* + (sysctl-name "kern.min_audio_buffer_usec")) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "sysctl.proc_native") + (sysctl-name "kern.min_audio_buffer_usec") + (sysctl-name "vm.vm_page_free_target") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.statistics") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb.xml new file mode 100644 index 0000000..bfcf301 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb new file mode 100644 index 0000000..072de30 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb @@ -0,0 +1,516 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}"))))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/usr/libexec/mobile_house_arrest") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/GeoJSON$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lockdown.host_watcher") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown/checkin") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb new file mode 100644 index 0000000..6e50ac9 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb @@ -0,0 +1,542 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/mad") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Cookies") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/mad") + (subpath-prefix "${HOME}/Library/Logs/mobileactivationd") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "ProvInfoIOKitUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.icloud.findmydeviced") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.fairplayd.versioned") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.absd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:443") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:80") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mobileactivationd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.stockholm") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.mobileactivationd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb new file mode 100644 index 0000000..94c92f9 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb @@ -0,0 +1,587 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.assets.read") + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath "/private/var/MobileAsset"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath "/private/var/MobileAsset"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal "/private/var/Managed Preferences/mobile/com.apple.MobileAsset.plist") +(literal "/private/var/root/Library/Preferences/com.apple.WebFoundation.plist") +(subpath "/AppleInternal/Library/PreinstalledAssets") +(literal "/usr/libexec/mobileassetd")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/root/Library/Cookies") +(literal "/private/var/root/Library/Cookies/Cookies.binarycookies") +(literal "/private/var/root/Library/Preferences/com.apple.MobileAsset.plist")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/MobileAsset") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+") + (subpath-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/private/var/root/Library/Cookies") +(literal "/private/var/root/Library/Cookies/Cookies.binarycookies") +(literal "/private/var/root/Library/Preferences/com.apple.MobileAsset.plist")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/MobileAsset") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+") + (subpath-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.cache_delete") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.AssetCacheLocator") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.MobileAsset")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb.xml new file mode 100644 index 0000000..b0d0676 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb new file mode 100644 index 0000000..faae357 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb @@ -0,0 +1,662 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath "/System/Library") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.Maps.SpringBoard") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.routined.registration") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nanoprefsync") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.Maps.IPC") +(global-name "com.apple.Maps.gsEvents")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.ids") + (preference-domain "com.apple.companionsync") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MapsSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.MapsSupport")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb new file mode 100644 index 0000000..c143f97 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb @@ -0,0 +1,465 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.MapsSupport") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.MapsSupport")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.MapsSupport") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.MapsSupport")) + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.locationd.registration") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.routined.registration") + (global-name "com.apple.nanomaps.xpc.GeoServices.Navigation") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.apsd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.assistant") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.persistentconnection") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb new file mode 100644 index 0000000..6200aac --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb @@ -0,0 +1,348 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (global-name "PurpleSystemEventPort") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.system.notification_center") + (require-any + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb.xml new file mode 100644 index 0000000..518eb4e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb.xml @@ -0,0 +1,30 @@ + + + + + + + + + +]> + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb new file mode 100644 index 0000000..e4a1933 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb @@ -0,0 +1,387 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/tty.stockholm") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (literal "/usr/libexec/nfcd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/logs/WirelessLibraryLogs") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (require-any (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (debug-mode)) + (require-all + (subpath "/private/var/logs/WirelessLibraryLogs") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write-data + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleCredentialManagerUserClient") + (iokit-user-client-class "AppleSSEUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleStockholmControlUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.SBUserNotification") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (control-name "com.apple.uart.stockholm") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "nfcd") +(preference-domain "com.apple.nfcd.nfttr")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.Duet") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.awd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (require-any (preference-domain "nfcd") +(preference-domain "com.apple.nfcd.nfttr")) + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-socket + (socket-domain AF_SYSTEM)) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb new file mode 100644 index 0000000..0cbdf9f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb @@ -0,0 +1,96 @@ +(version 1) +(deny default) +(allow file-link) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.pfd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb.xml new file mode 100644 index 0000000..7836567 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb new file mode 100644 index 0000000..f57919a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb @@ -0,0 +1,7 @@ +(version 1) +(allow default) +(deny network* + (local ip "*:*")) +(deny network-outbound + (literal "/private/var/tmp/launchd/sock") + (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb.xml new file mode 100644 index 0000000..fa56c88 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb.xml @@ -0,0 +1,20 @@ + + + + + + + + + +]> + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb new file mode 100644 index 0000000..aef77de --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb @@ -0,0 +1,642 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-all (require-not (subpath "/private/var/logs/MobileLibraryLogs")) +(require-not (subpath "/private/var/logs/MobileMediaFactoryLogs"))) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/usr/libexec") + (literal "/usr/libexec/nsurlsessiond") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}/Media/Downloads") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.coremedia")) + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-all (require-not (subpath "/private/var/logs/MobileLibraryLogs")) +(require-not (subpath "/private/var/logs/MobileMediaFactoryLogs"))) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (subpath-prefix "${HOME}/Media/Downloads") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}"))))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.marco") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.ocspd") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.coremedia.assetdownloader") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (global-name "com.apple.networkd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.symptomsd") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.CARenderServer")) + (require-any + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.Duet") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nsurlsessiond") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.nsurlsessiond")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb new file mode 100644 index 0000000..0797db6 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb @@ -0,0 +1,429 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${HOME}/Applications") +(literal-prefix "${HOME}/Containers")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (subpath "/private/var/containers") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (extension "com.apple.nsurlstorage.extension-cache") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/libexec") + (literal-prefix "${HOME}") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.trustd") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.nsurlstoraged") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.nsurlstoraged")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb new file mode 100644 index 0000000..1d211e2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb @@ -0,0 +1,397 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal "/usr/libexec/online-auth-agent") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/MobileDevice") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/private/var/db/MobileIdentityData") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/MobileDevice") + (subpath "/private/var/db/MobileIdentityData") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAESAcceleratorUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.misagent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.online-auth-agent.xpc") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote ip "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb new file mode 100644 index 0000000..104ba7e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb @@ -0,0 +1,580 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-journal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-shm") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-wal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/CoreDuet") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.locationd.registration") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.DataDetectorsSourceAccess") +(global-name "com.apple.dprivacyd")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.networkserviceproxy") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.nehelper") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.parsecd") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.parsecd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb new file mode 100644 index 0000000..d0bb29f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb @@ -0,0 +1,974 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.passd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.passd") +(subpath-prefix "${HOME}/Library/Passes") +(subpath-prefix "${HOME}/Library/Caches/PassKit")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Mobile Documents") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.passd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.passd") +(subpath-prefix "${HOME}/Library/Passes") +(subpath-prefix "${HOME}/Library/Caches/PassKit")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.stockholm.plist")) + (require-any + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-set-properties + (iokit-property "reportStatusMessages")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.CoreAuthentication.daemon") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.biometrickitd") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.seld.tsmmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.nfcd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.seld") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-all + (require-not (global-name "com.apple.pluginkit.pkd")) + (require-any + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (require-any (global-name "com.apple.NPKCompanionAgent.Server") +(global-name "com.apple.passes.usage") +(global-name "com.apple.springboard.carditemscontroller") +(global-name "com.apple.AdSheetPhone.analytics")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.revisiond") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.fig.movie") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.icloud.findmydeviced") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cloudd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.bird") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.librariand") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.SharingServices") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.marco") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.FSEvents") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.networkd") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote ip "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.biometrickitd") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.LocalAuthentication") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "com.apple.Passbook") +(preference-domain "com.apple.PassKit") +(preference-domain "com.apple.passd")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.stockholm") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.Passbook") +(preference-domain "com.apple.PassKit") +(preference-domain "com.apple.passd"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb.xml new file mode 100644 index 0000000..eb34181 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb new file mode 100644 index 0000000..ffc385c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb @@ -0,0 +1,506 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/usr/local/bin") +(literal "/usr/local/bin/prtool")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Personas") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Personas") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.marco") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb new file mode 100644 index 0000000..f18dc42 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb @@ -0,0 +1,176 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/pfm") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/usr/libexec/pfd") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/pfm") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/pfm") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name "apple.shm.notification_center")) +(allow mach-cross-domain-lookup) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb.xml new file mode 100644 index 0000000..4d39a5c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb.xml @@ -0,0 +1,25 @@ + + + + + + + + + +]> + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb new file mode 100644 index 0000000..8af1fb0 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb @@ -0,0 +1,674 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "AGXCommandQueue") +(iokit-user-client-class "AGXDevice") +(iokit-user-client-class "AGXGLContext") +(iokit-user-client-class "AGXSharedUserClient")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.networkd") + (global-name "com.apple.routined.registration") + (global-name "com.apple.calaccessd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.photoanalysisd") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.photoanalysisd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb new file mode 100644 index 0000000..9f5945b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb @@ -0,0 +1,590 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}"))) +(allow file-read* + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (require-all + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (require-entitlement "com.apple.private.amfi.can-load-cdhash"))) +(allow iokit-get-properties + (iokit-property "IORegistryEntryPropertyKeys")) +(allow ipc-posix-sem* + (extension "com.apple.sandbox.application-group")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-"))) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (extension "com.apple.sandbox.application-group") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (extension "com.apple.sandbox.application-group") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb.xml new file mode 100644 index 0000000..a98dfe7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb.xml @@ -0,0 +1,24 @@ + + + + + + + + + +]> + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb new file mode 100644 index 0000000..02caa40 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb @@ -0,0 +1,215 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/powerlog") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/BatteryLife")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/powerlog") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/BatteryLife")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb new file mode 100644 index 0000000..d80b9f3 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb @@ -0,0 +1,516 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${HOME}/Library/com.apple.printd") +(subpath "/private/var/run/printd")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/com.apple.printd") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var/run/printd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/com.apple.printd") +(subpath "/private/var/run/printd")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nehelper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (local tcp "*:*")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.printd") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.printd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb new file mode 100644 index 0000000..36dde98 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb @@ -0,0 +1,253 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/etc/hosts") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.mobileslideshow")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb.xml new file mode 100644 index 0000000..bd4ad12 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb new file mode 100644 index 0000000..3d4ad1e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb @@ -0,0 +1,1150 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.quicklook.readonly") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets"))) +(allow file-read* + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/System/Library") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.quicklook.readonly") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/AppleInternal/Library/Frameworks/TypologyRecording.framework") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.revisiond") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mobilemail.services.xpc") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.bird") + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.UIKit.statusbarserver") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.analytics") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.securityd") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mediaserverd") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.calaccessd") + (global-name "com.apple.sharingd") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.librariand") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.audio.AudioQueueServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.ProgressReporting") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/printd") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.da") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.quicklook.quicklookd") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.mt") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.CoreMotion") + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.quicklook.quicklookd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb new file mode 100644 index 0000000..3ce5c6f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb @@ -0,0 +1,123 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/private/etc/master.passwd") + (literal "/dev/sha1_0") + (subpath "/private/var/run/racoon") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") +(subpath "/private/etc/racoon")) + (literal "/dev/aes_0")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/log/racoon.log") + (require-any (literal "/Library/Managed Preferences") +(subpath "/private/var/root")) + (literal "/private/etc/master.passwd") + (require-any (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") +(subpath "/private/etc/racoon")) + (subpath "/private/var/run/racoon") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal "/Library/Managed Preferences/mobile") +(subpath "/private/var/preferences")) + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/dev/dtracehelper") + (literal "/private/var/db/icu") + (literal "/private/var/run/racoon.pid") + (literal "/private/var/run/racoon.sock") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/Library/Preferences") + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/private/var/db/dyld") + (subpath "/usr/share"))) + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/sbin") + (subpath "/usr/share")))) +(allow file-read-metadata + (require-any (literal "/etc") +(literal "/tmp") +(literal "/private/etc/localtime") +(literal "/var"))) +(allow file-write* + (literal "/private/var/run/racoon.sock") + (literal "/private/var/run/racoon.pid") + (literal "/private/var/log/racoon.log") + (require-all + (literal "/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs."))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nehelper") + (global-name "com.apple.ocspd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent")) +(allow network* + (remote udp "*:*") + (literal "/private/var/run/racoon.sock") + (local udp "*:4500") + (local udp "*:500")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/syslog") + (literal "/private/var/run/asl_input") + (control-name "com.apple.net.ipsec_control")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb.xml new file mode 100644 index 0000000..4668b57 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb new file mode 100644 index 0000000..9beda8e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb @@ -0,0 +1,550 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/usr/libexec") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/ReplayKit") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/ReplayKit") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.fig.movie") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.aggregated") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.virtualdisplaysession") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.audio.AudioQueueServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.avfoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb new file mode 100644 index 0000000..861676b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb @@ -0,0 +1,259 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.webinspector") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb new file mode 100644 index 0000000..ba631af --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb @@ -0,0 +1,391 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/fsevents") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (require-any (extension-class "com.apple.revisiond.revision") +(extension-class "com.apple.revisiond.staging")) + (require-any + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/private/var/db/timezone") + (subpath "/Developer") + (subpath "/usr/share") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/ptmx") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/fsevents") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (vnode-type CHARACTER-DEVICE) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/log/com.apple.revisiond") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.FSEvents") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.revisiond") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb.xml new file mode 100644 index 0000000..b0d0676 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb new file mode 100644 index 0000000..9f62f1b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb @@ -0,0 +1,696 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/System") + (subpath "/Library/Audio/Plug-Ins") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/containers/Bundle") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-journal") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-shm") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-wal") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_coreduetd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_duetexpertd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_routined") +(literal-prefix "${HOME}/Library/") +(literal "/usr/libexec/routined")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.routined") +(literal-prefix "${HOME}/Library/Logs/coreduetd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") +(literal-prefix "${HOME}/Library/Logs/duetexpertd_") +(literal-prefix "${HOME}/Library/Logs/routined_") +(literal-prefix "${HOME}/Library/Logs/") +(literal "/private/var/Managed Preferences/mobile/com.apple.routined.plist")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/AppleInternal/Library") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.routined") +(literal-prefix "${HOME}/Library/Logs/coreduetd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") +(literal-prefix "${HOME}/Library/Logs/duetexpertd_") +(literal-prefix "${HOME}/Library/Logs/routined_") +(literal-prefix "${HOME}/Library/Logs/") +(literal "/private/var/Managed Preferences/mobile/com.apple.routined.plist")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.carkit.service") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.server.bluetooth") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.awdd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.Maps.mapspushd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.calaccessd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.managedconfiguration.profiled") + (require-any (global-name "com.apple.coreduetd.context") +(global-name "com.apple.coreduetd.knowledgebase")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (require-any (global-name "com.apple.locationd.routine") +(global-name "com.apple.navigationListener") +(global-name "com.apple.passd.usage")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.routined") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaremote") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.stockholm") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.routined")) +(allow process-exec* + (literal "/usr/bin/ditto")) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb.xml new file mode 100644 index 0000000..6a34699 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb new file mode 100644 index 0000000..50b197a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb @@ -0,0 +1,348 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/Keychains") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath "/private/var/Keychains") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleCredentialManagerUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SharedWebCredentials") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.security.cloudkeychainproxy3") +(global-name "com.apple.security.keychainsyncingoveridsproxy") +(global-name "com.apple.security.swcagent")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb new file mode 100644 index 0000000..5a38ad4 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb @@ -0,0 +1,587 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.seld") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.seld") +(literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist") +(literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (require-any (literal "/usr/libexec/seld") +(subpath "/System/Library/StockholmPlugins")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.seld") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.seld") +(literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist") +(literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleCredentialManagerUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleSSEUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.awdd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.nfcd") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (global-name "com.apple.seld.aps") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.seld") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.stockholm.awd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.stockholm") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.passbook") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.seld") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb new file mode 100644 index 0000000..c514f9a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb @@ -0,0 +1,1046 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sharing.airdrop.readonly")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Library/Sharing") +(subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd")) + (subpath "/usr/lib") + (literal "/private/var") + (extension "com.apple.sharing.airdrop.readonly") + (literal "/usr/libexec") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/AppleInternal/Applications/Sharing.app") + (subpath "/private/var/db/timezone") + (literal "/private") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.sharingd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.sharingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-sharingd.log")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Downloads") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Downloads")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${HOME}/Media/PhotoData") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Library/Sharing") +(subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd")) + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.sharingd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.sharingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-sharingd.log")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Downloads")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-flags + (literal-prefix "${HOME}/Downloads")) +(allow file-write-mode + (literal-prefix "${HOME}/Downloads") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (literal-prefix "${HOME}/Downloads") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.revisiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.fig.movie") + (global-name "com.apple.nehelper") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.studentd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.passd.assertions") +(global-name "com.apple.passd.library") +(global-name "com.apple.NPKCompanionAgent.library")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.bird") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.apsd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.bulletinboard.settingsconnection") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.calaccessd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (require-any (global-name "com.apple.coreduetd.context") +(global-name "com.apple.coreduetd.knowledgebase")) + (global-name "com.apple.librariand") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.voicememod.xpc") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.absd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (local tcp "*:*") + (local udp "*:*") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (require-any (preference-domain "com.apple.eventkit") +(preference-domain "com.apple.coreduet.logging") +(preference-domain "com.apple.wirelessproxd.debug")) + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.MultitouchSupport") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mediaremote") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.sharingd") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.sharingd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb new file mode 100644 index 0000000..1ef6f97 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb @@ -0,0 +1,959 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc"))) +(allow file-read* + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath-prefix "${HOME}/Library/Social") +(subpath-prefix "${HOME}/Library/Twitter") +(subpath-prefix "${HOME}/Library/Weibo")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Cookies") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (require-any (subpath-prefix "${HOME}/Library/Social") +(subpath-prefix "${HOME}/Library/Twitter") +(subpath-prefix "${HOME}/Library/Weibo")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Cookies") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.networkd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.nehelper") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.twitterd") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (require-any (preference-domain "com.apple.weibo.xpc") +(preference-domain "com.apple.vimeo.xpc") +(preference-domain "com.apple.twitter.xpc") +(preference-domain "com.apple.tencentweibo.xpc") +(preference-domain "com.apple.flickr.xpc") +(preference-domain "com.apple.facebook.xpc")) + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.coreaudio") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.weibo.xpc") +(preference-domain "com.apple.vimeo.xpc") +(preference-domain "com.apple.twitter.xpc") +(preference-domain "com.apple.tencentweibo.xpc") +(preference-domain "com.apple.flickr.xpc") +(preference-domain "com.apple.facebook.xpc")) + (preference-domain "com.apple.twitterd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb new file mode 100644 index 0000000..6e16e7d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb @@ -0,0 +1,382 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") +(subpath "/private/var/MobileSoftwareUpdate") +(subpath "/private/var/db/UpdateMetrics")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/MobileSoftwareUpdate") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/MobileSoftwareUpdate")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/CrashReporter/OTAUpdate-") + (require-any (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") +(subpath "/private/var/MobileSoftwareUpdate") +(subpath "/private/var/db/UpdateMetrics")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/MobileSoftwareUpdate"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-set-properties + (iokit-property "IONVRAM-DELETE-PROPERTY")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileSoftwareUpdate") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb new file mode 100644 index 0000000..0d4813f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb @@ -0,0 +1,416 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/containers/Bundle") + (literal "/dev/aes_0") + (literal "/usr/libexec/streaming_zip_conduit") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY)))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-unlink + (require-all + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media"))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.blockableservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lockdown.host_watcher") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mobile.installd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.modifydb") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb new file mode 100644 index 0000000..63025e2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb @@ -0,0 +1,450 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/Classroom.app") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (require-any (subpath-prefix "${HOME}/Library/studentd") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.studentd")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-journal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-shm") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-wal") +(literal-prefix "${HOME}/Library/AddressBook")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (subpath-prefix "${HOME}/Library/WebClips") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/studentd") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.studentd")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.logind.client.machService") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.accessibility.AXSpringBoardServer") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.studentd") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.studentd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb new file mode 100644 index 0000000..2d6deb1 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb @@ -0,0 +1,563 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Mail") + (extension "com.apple.logd.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (require-any (subpath-prefix "${HOME}/Library/ResponseKit") +(subpath-prefix "${HOME}/Library/Suggestions")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.CoreSuggestions.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Calendar") + (require-any (subpath-prefix "${HOME}/Library/ResponseKit") +(subpath-prefix "${HOME}/Library/Suggestions")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.locationd.spi") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.calaccessd") + (global-name "com.apple.reversetemplated") + (global-name "com.apple.syncdefaultsd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.aggregated") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.locationd.synchronous") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.message") + (preference-domain "com.apple.suggestions") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.CoreSuggestions") +(preference-domain "com.apple.suggestd")) + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.CoreSuggestions") +(preference-domain "com.apple.suggestd")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.suggestions")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb new file mode 100644 index 0000000..a484733 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb @@ -0,0 +1,427 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/etc/hosts") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/Managed Preferences/mobile") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.syncdefaultsd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.syncdefaultsd") +(subpath-prefix "${HOME}/Library/SyncedPreferences")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-not (literal-prefix "${HOME}/Library/")) + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.syncdefaultsd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.syncdefaultsd") +(subpath-prefix "${HOME}/Library/SyncedPreferences")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (subpath-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/Managed Preferences/mobile") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.WebFoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb.xml new file mode 100644 index 0000000..b54d51f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb new file mode 100644 index 0000000..772baeb --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb @@ -0,0 +1,245 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/uuidtext") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (file-mode #o0001)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lockdown.host_watcher") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-priv-task-port) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb.xml new file mode 100644 index 0000000..aa5dfc5 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb new file mode 100644 index 0000000..1dce18b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb @@ -0,0 +1,20 @@ +(version 1) +(deny default) +(allow file-link) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb new file mode 100644 index 0000000..a0fff23 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb @@ -0,0 +1,332 @@ +(version 1) +(deny default) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Media/Vibrations") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/Vibrations") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Media/Vibrations")) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.DataMigration") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb new file mode 100644 index 0000000..cae381e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb @@ -0,0 +1,114 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath "/private/var/spool/mdt") +(subpath-prefix "${HOME}/Library/Application Support/Containers") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.mdt") +(subpath-prefix "${HOME}/Library/Inboxes")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Application Support") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Downloads")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb new file mode 100644 index 0000000..397987e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb @@ -0,0 +1,350 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (subpath "/private/var/personalized_automation/AppleInternal/Library") + (extension "com.apple.sandbox.executable")) +(allow file-read* + (subpath "/private/var/personalized_automation/AppleInternal/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (require-any (subpath "/usr/local/etc/scripter") +(literal "/private/var/personalized_automation/usr/libexec") +(literal "/private/var/personalized_prod_automation/usr/libexec")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (subpath-prefix "${HOME}/Library/Logs/CrashReporter/UIALogs") +(subpath-prefix "${HOME}/Media/uiautomation") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.uiautomation")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Logs/CrashReporter/UIALogs") +(subpath-prefix "${HOME}/Media/uiautomation") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.uiautomation")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "PurpleSystemEventPort") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.iphone.axserver") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.purplebuddy") + (require-any (preference-domain "com.apple.Carousel") +(preference-domain "com.apple.UIAutomation")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.Carousel") +(preference-domain "com.apple.UIAutomation")) + (preference-domain "com.apple.Sharing")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb new file mode 100644 index 0000000..afa4e07 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb @@ -0,0 +1,365 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]")) + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]")) + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb new file mode 100644 index 0000000..0366e79 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb @@ -0,0 +1,435 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.filesystems.userfs_helper") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (require-any (literal "/System/Library/Filesystems/exfat.fs/Contents/Resources/fsck_exfat") +(literal "/System/Library/Filesystems/msdos.fs/Contents/Resources/fsck_msdos"))) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb.xml new file mode 100644 index 0000000..93639f5 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb new file mode 100644 index 0000000..bb5bfd8 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb @@ -0,0 +1,217 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Application Support/com.apple.spotlight/subscriptions.plist") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Application Support/videosubscriptionsd") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Application Support/videosubscriptionsd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb new file mode 100644 index 0000000..aad5bb3 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb @@ -0,0 +1,471 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}"))))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (subpath "/private/var/containers/Bundle/VPNPlugin") + (extension "com.apple.vpn-plugin")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-read* + (subpath "/usr/share") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.security.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/private/var/containers/Bundle/VPNPlugin") + (extension "com.apple.vpn-plugin")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-not (subpath "/private/var/containers")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow ipc-posix-sem*) +(allow ipc-posix-sem-create) +(allow ipc-posix-sem-open) +(allow ipc-posix-sem-post) +(allow ipc-posix-sem-unlink) +(allow ipc-posix-sem-wait) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name "com.f5.f5_sslvpn_plugin") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb.xml new file mode 100644 index 0000000..15d1920 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb.xml @@ -0,0 +1,56 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb new file mode 100644 index 0000000..43b9146 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb @@ -0,0 +1,828 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-all + (extension "com.apple.wcd.readonly") + (require-any + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/Applications") + (subpath "/private/var/containers/Bundle") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly") + (debug-mode)) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Library/WatchConnectivity/Clients") + (subpath "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.wcd.readonly") + (require-any + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/Applications") + (subpath "/private/var/containers/Bundle") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (literal "/private/var/preferences/com.apple.networkd.plist") + (debug-mode)) + (require-all + (literal "/private/var/preferences/com.apple.security.plist") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/WatchConnectivity") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/WatchConnectivity") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/WatchConnectivity/Clients") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/WatchConnectivity") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (debug-mode) + (global-name "com.apple.fig.movie") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.cookied") + (debug-mode)) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.accountsd.accountmanager") + (debug-mode)) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.SystemConfiguration.configd") + (debug-mode)) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.usymptomsd") + (debug-mode)) + (require-all + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (debug-mode)) + (require-all + (global-name "com.apple.securityd") + (debug-mode)) + (require-all + (global-name "com.apple.commcenter.xpc") + (debug-mode)) + (require-all + (global-name "com.apple.ak.auth.xpc") + (process-attribute 4) + (debug-mode)) + (require-all + (global-name "com.apple.networkd") + (debug-mode)) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (process-attribute 4) + (debug-mode)) + (require-all + (global-name "com.apple.commcenter.cupolicy.xpc") + (debug-mode)) + (require-all + (global-name "com.apple.nesessionmanager") + (debug-mode)) + (require-all + (global-name "com.apple.nehelper") + (debug-mode)) + (require-all + (global-name "com.apple.GSSCred") + (debug-mode)) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (debug-mode)) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.nsurlstorage-cache") + (debug-mode)) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (debug-mode)) + (require-all + (global-name "com.apple.symptomsd") + (debug-mode)) + (require-all + (global-name "com.apple.trustd") + (debug-mode)) + (require-all + (global-name "com.apple.nsurlsessiond") + (debug-mode)) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (debug-mode) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.wcd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coreduet.complications.pushLimits") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.wcd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (sysctl-name "net.statistics") + (debug-mode)) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (debug-mode)) + (require-all + (sysctl-name "net.routetable.") + (debug-mode))) +(allow system-privilege) +(allow system-socket + (require-all + (socket-domain AF_ROUTE) + (debug-mode))) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb new file mode 100644 index 0000000..1c4315a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb @@ -0,0 +1,264 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal "/usr/libexec") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/System") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Bundle") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "PurpleSystemEventPort") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.webinspectord") +(preference-domain "com.apple.WebInspector")) + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb new file mode 100644 index 0000000..897ed7a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb @@ -0,0 +1,263 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (require-any (literal "/usr/libexec/wifiFirmwareLoaderLegacy") +(literal "/usr/libexec/wifiFirmwareLoader") +(subpath "/usr/share/firmware/wifi") +(subpath "/usr/share/zoneinfo.default") +(literal "/private/var/Managed Preferences/mobile/com.apple.wifiFirmwareLoader.plist")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/AppleInternal") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal "/private/var/logs/wifiFirmwareLoader.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleBCMWLANUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.corecaptured") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_bundle b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_bundle new file mode 100644 index 0000000000000000000000000000000000000000..c6e5e208c026bfd6e7edaefa0c492dfba2312016 GIT binary patch literal 448034 zcmdqK2YeJ&)c?H{10puIZ*~_Eq<4^BLlJ`X5=oFEod5x(h8h*=0-=-1E-eU(fD}Qb z*hNqTLla!PQdI1si1Pk^XJ&RLkj2F4^F05T`OJLx+S&W%<{T7EOD1eWRbEn7ybEL^s5+2hOfGfq(IEUOaMP&M^DGieq7GP6~@ z%c5^6m!QxpE=hl3VCa2LB{XR;jn7%#zYe^cnQs;;$C3 zTfBC$dd3SDFIYT%@kAUaU{|+9Ezht?g7OH`va?Fh#XV%}xwz-z1a25t=FKSc!6H3f z9V;9qrxqDwW#^*pVGUJN&oh%VXze2NScz;Ebp{Q5Hquy0MeDj%#xEMZsO_ThS`T6u z#V%^Ss0ogZu&Z0u>w3pNRzjL_hGxH#(;1YRn$;?l%vQ;{w|y-&H&z*&Bda`@`fTdV z)aSH5a>mR^{red-9s2)QtdiBQ{M}fY5YZ}wQv0OpW2Js--PAi%>uXktO6B(F!l=|g zu&dj*3-zmNFz=ChomT7Gg@(5^N9K784R1SV;hcqQ7n)~|{+Tmq^1_^r6}9)TMYM|9 z+YVYdU}58hgS0+2Sjepg_GZqiw}hFwU$30VkyYMb zaCE`O1@CKp%viup!M;*HWh_Wt@I<)(`gtTMd7nY;!?k8_m8J`fv7)wXwub&W_f~1K zDSK~Qe?i#=@rqaL)t33s&7VGh%Y3cn`SJ7P=C{MK&HPv#+g_cm zpR+Mm%vL!!`}45I&BsdatWsf1_S<0-Vv(%Os z&sscd-mE8Zd z9)?vm%*YyxsRGe4^Cuy56z&yvLxwdy?>9 z#h^l4Bl(ppPa5l$5l{Aeve1)Pr>mAcKK=Ogz0$2I9uSc`Tnmy)!%#NcKJGWww71Z+dYfGxVG*XNee_qzM zhE)=jjVZwtqkf~!toF(M+V;h5k!FzDugp%FnbId^w$_7(Q@C}(-bp@DYJOesj2;@j z)~%AY&t`wD>KZA=r|iA0*{?K9X@)*rUpHl1rFKegyzP;QRxz(_i>LTfewkKWJM$l> z{W$H1Y3FhL3cI?Uo@SiA{weQ~IlE_Z=E!Weif+*x?Lw;@oR%}IsP{pkh*sG$%~-E2 zpSE<`@M+7nGf$kBIBm$ZJ~;Nmu5KN(u}WK{8CUzCtl~mbbqgC~#XN)Fn3|J&=6EHy zEB-$tTE#qrwoTnSb=K5vS|4-zjDI@x^JbM!*;vKAUTK~qt8lF3Zf$GXo)f=PWoo6V zQB$jEeat_V+wW8IPrZy?-7ZYgud2cSe!X&b$_LlAd*l33{Yvhvaz~D=^2U_crYKY1 z(0Z_93bzH=pOR0Mrd`)N+UCEvO3wXC?yO?VkyVCH88W5Wl%d+0=X3`BziSmwM5}x^ z*|-myJbC0~+vHm(tFz<6qzjWWCmq7^Aa-@zGs&1a`lq}D_dwjV{bN^qhPgC3hWZDPlXk7+%Koftc@)x^d)HpH%ORl>c~&*R^iL06LX z+Kd?VYqEak3Cj88oWvk{+q20zi_B_!o*j|A?IElB56OudO z*a5q`#f1B>pGShy1ZjDTL4QopYcpBJ^rpu72|2Y&?)=Kph*mi|!LZ7j39BYdn6O6c zW734A2}39J#jy`|b?Y4NzkVM2Xf|YhZJYD=R}7n~R_QdM(**N+CB|fxrW2Z?5BfMV zlVhd&gq)2Pbrtu}&PZd$yk2ona8CGsyjwf-oO;{5kChk4>o&cD5u$!JuUDQOzcH+# z=9;Zxe13ZTqVZ2>(Tx0jh3$-uXq7SJjj_^ke7o`1@g22#ZykT@_&>+}Jnq)YD|tf;kAej)p@!d%)~)%xeh ze^SHWmC?sQcD>T`3?|_2FgwkxX<6H>8o?@YO7n5XSSd5^zHwK^meH=uPh)=?`~BE+ zIDUy;-A;|o+6tw--yKd0*Q$<{iDQ$;J~~!EV>~Y(n^SLl{WJbZ-yN!cWk5u$nEgtJ zvF*l|8QVeYW2v#+qOrT>6Q$e2{Wq+WcdPtwJ)s=&LVk;J9>%Av?@(SI^UIi-sh7v7 z`Tuk8B>ekU(Pv6zZ_9HW9nmVEjWK4>p)m(xl|v@0ygBCY-_&>w`g$+eR_?v+K&{0D z#qhSh(Jyt&&6}nA4AT1($tvm$niSD0ezfk;dUa~_;n9;uPaLg|mBi7BqvJ<+#IZeg zb!(#KsT%4r?<@X|kLvXqD}Los!zzOx9T?V7HT66*8H3^;Rb!B974Nc}TO~cBU#a(~ z@!jFoQCCLo8g+G)+Va{_Yey{}H3!F8*wt;KmZzTunfLDw{~D>+XN(o|D(>{iV_^+d z(`*g>Gp(YJ6}`SlR(V(IE4}Ob$gEm3PFX$Dm_d_9ju=^WQQQ0$@-H`7MXfzf zF+aC$IimT9nW-(cn*LvWTQGMk{=Xtx#W%v3K^K$GC+$hPn50^4P12eqC20|k3$d%) zG%ZinP>(m8L6eiJ;(hh%X%mxf_Qv{e!}a=%v0{FjeRBA*u!gE>9wYka8^=n5a`W{{ z+>6)GAhq_ak@@-ITZYdV{=C+MoZbiJ{i#!z@Hrb+G2aKp4A1E*E_e6LeIi=rw&Ax9 z|0zwi(f(oEhIJdZW0)#67}j9eeZ#ysda!eI3@fbVsT%4rAJX#XSCWS6_0cMcL;GXv zK2#qA@Ki&qg*8-7J&t9+AqF>znwH;HP?&nG^gxH&Nc$Fv-?$Q|Lj*tbYANQ*UlBF&)B zh8R}aKVUUl5*n{3kGxsI;>y_f+S`Dk1y={>}##m9$IXjEcuVnSMw+@PA z6}6VCFGZR`KMXXia%|v{fhz|d8>p5^9hf?B*1%~vPQlJ?^1vi5Pt{P5dG{;D!nLYa znK*XhSo2u14E%F|xy9_q%8lOk?;`WKm-1zM&wLfF(e7%S`V~;6Uk7meS&r&w9<%mN zm-HHRnfz(MkFxzVK;6uF{A`ptm!;OP25|d)K-S)5Ev@GnRG&H-b*lQGWvSWRCiAyM z94klAx*mgG7_ei&lLKDRYMMG=>VSy@M&URDyShDcT`R0R@9UMS;aanwLH7*shc(o* zHLPKLx^V_YjzMZI??<$X`KeQp0fh&A+P{d_ga5fzobi0+!~XhnMzde}uf9?JD56!~ z>2HjcZT+|QAJBhWf7Oyb`uFJHx_=WK8}zS-Be#lLo~of9^X^x^?x)w6{a88OFDKrX zZ))W3t)AX{BY9i%Sh?{{jZ^*1e@k|%Uv__unfDoFjFs%I@?VXW!4a*px1TXqmi1fI zuW!F)+Li0tuWP^9eob*~j9uNTg|Di9b^ndE?Yn*T+6=3_*;n@%3CgySrGH{%7U&zF*B% z`f|&vX-GzyCE4htnyg}!(Lb53p?=Oj2I=}bjW(HbB!X4ql=+WLe7&GX9A_iTEXce=!{kVIm`}Xc1Ykl0> zeQWp4-7|1pi(TE8g!`|b$G@>&`QP%k1rA0UD`u-q?LN8t%+#scnUC+zEeZQD`9!JL z|F5iaXO66LV`R?B?=lR)oqZLXUv~}U7OExc}Rm?N! zmAC_O%i~_rdaxvp+g$9ko=;E<0{8x|BC=z@temAYt8QYiZNCK5v^i=7H5yM z#(mSxu36=LxAWc3b^8d%53#G;k#73A8#G7ece}mY?H%mgavqt7hHEuu(131+RUYcr zEv%uotLK?{)P(JFtX8Ggmz&D-tct{-((TRzqGRM&UAzK-Lo*wt-^ zmS@=H-}tSb0pVH=tC-g-F&c*cJ86|pm68HoqzB2eW${mFJV`=Pde%S zH<ht6>#$4C>seLs;YAw2Jdkq_JZ5EBxE{%ANk_|Mva;j=GIit8fIo(@`G> zS-oxUta5X|;)`gN%^i)gGOpv8j%_=R)B4!7W7Cd}I^K_C4eaW6U%3DJdHfrGWo-w& zHq|P8nyqv&tTML4$gswU4kPec&oeW-^~%k^XMQ+>RoENWtoQ1l@}Jc3cV+Z5&aO{- zp22_e4rT8MR*6%3;F{?7%#AxV?2xZRW9_>9-2UhGU$*}c$1~W~?Va{F_A&48uM7>> zYWNlNScz-jIjo_!Z&<_ll-*dl`3zbT(JGDG8&>hPk8b~AJD=8rOJJ{|3j{C5y z+m?1WS|#sm+acjv4Xc7IAIx~L(}PcIeXR9htp|M%+Hkzr|W(oISKaYPS25oJl z*Ot9i=Cqj+)=)LgBSim9zmmHd)bO21RvFyJh|Cq*lxy=%Yz3_cXJgOCz7zWzj;~-> zx9zcd{|!D9yFPZlDP5mIIbYivb7^)gpW99xJ2Q4#tbVo$O2^pN;rd&}w!&vU&&=%B zw)D0Sgv+Wk-MA0B@7+jNsfpJ07?eNO5__z5eyx^6tq-++qxBvfcVkz#XIdN9&_Ct< zO^s^dTGg>qwRP3j<`{Hm>%w7;f~^a-&i zQtR2(irZ%Fo8%LvbS=-^lG(2)t&~=2*tz9=tUMB~HTxO#U-^|~5v|gql`&S_t(>hc zJmA*)c=my_51f49T^tW%SGRo+nC+o{ei3QL9QY^i+s1@zHLPO3532e=<*htlH9no!jj#ueG?*Dv^Jy z=V}XXfBy^7yTi3^Z$ZD(sAZ#;&$ZCcHbGHZ7?D|R|4RId7V7sw{5DAaK8RMC+afoS z`HqNI8IRU=ztX2guNJji^wIiQtwpsKm0Fa-@m}oeW()VPyld!AX z@auZV+Rc82a_+5CJ6vn_Rw>i``mtiRhWnJbpIH1j4nZOI<8yeuwhe8rlI8WChe_z?L zQR7A(!IV8yluKT#REXc5bs8PSo=B zvmo;xnI8z(s*V+|;+izn&p0=~sd4>!<>rxjP(-VgLF;-9D$=lU!w(x2(fXL#AhW^I z25;f`26lDZ)xc~I_45v-8Q1-vtXH~*Yc*z2y9S0;8Z~GT)==Bj^UUN7%3Wk$6wxX! zw60s_yZYbOf35y^_0^WQ)!$bCx%%sHT!UTR7HfHC+vI(1TRU8sW5}fZxnn8EeH>`51-idlo);m>CZFyw9k@XVlb;7Y-y$5mR)=10y zcdc@wu3lgER@qy3Pgq0MG>;Meb9Q4TJF6H^5)S3aD)Z~ktJ|jTe60sf>Ncrct!`Ny zOJi3z*LA&PAM?J7+gj)5R#{%>zp=`P5v}rQ9b>F?sMDrSr8*t7K31s1tvGg{e4=z` zxc~ZjWPMwZsd@~mo|e;l<^thbjj>|BJG^miOHamVwW5W(@m<^8ui`$AV3ljN&3A{N z*Z#Ej^R+*(t)B75+8b-Ht-S)rW!TkimX>GOBtdx`X?gRut-`e$R%u>apBV{C_1cxg z8fwdWo|(C^N+qe!l^Myen62`^^!WuW9LD#QWZXSa!N3=@de#0tL?w@r3%+x7b560imEeZQD z`9!JLb-iOB^S)jw8Lri^iXZ(_w*=*m`-_G({!ObCIUdQcnBQNyQ1e{Pmup_AskZ!5 z&6jHKsrfvPTd=F!YAsLIP><B74Xc>fw!c;XwYs@QUWFUC+^^yu zxWOvw)s0j3RX4snoK$^8^%B)bX+0=Zy-@Yb)h<;lRQ((5>K3Y&wRe<;F8#1t-o{Gt zaILCU`2QUiL!IiDpnOsFld4(U)$`1xRkE)5|Lzw7p1#2dN&vboBsDyqfQw~(K%@^}B=;mw{TtgoW}(#SvgA484Nk@K}}PS-1H-S0%ON}TdU z6=Md)Rq0yAStU-hO5rMntNc;<$I6APe2-n-KC5i>RsVDbX?dGLy~4E`W5pbq8&s|r z)=*nD&m8?TXORB8PI}*NK32YuXcc?qc*UZ%d8*R;mDW@`RY|RLB{;j%lu9crO~TIY z(MtWbJiS%257K&T>AfoTs?-xZw;q+^Wy2qaRqBq-T!xT{*PgcBEQSE*CnBv^)>SmT?Tm`kD?VIthIZy%D|W5esbXs!AHc3|b+fTbZr?&~2TzuDtemQ# zTUnh!Co7z+VE!A`H!Hjz*3ir9^TuHABXjwPRxyv2O%PjIS`J!cZKC zU{|*u*Y!?4JN8UJFY}XxoUZtd(uQ9#|F24|E3~|>UBec}CtBtDZ^R;KWr~z9QvQc>UzRIU{&Vcy&XjwnoN@O0r@a4)Uej=`>aXb4 zDOaalg>w4&CMe&P{kE*$no2#-Oj;%D+k%nTD{3t<5v+0!t+8fR>rmN4W#7iGO0SpY z_Ocw+&pfJm=HmgW!C!`7N0$ne}h} zEm`jfR*6&QqIG@6pHy~O*_LIKv_3W~+pKI%*}6E^#;$JVvh-hVzZBApGyEqrXj>Wm zOpF<1e#Rdt^WUuEhDWrD*{{qj^JJM`WoBx9%<12f2zat;ca4c6D1C?w#Jt1Z5G@4Ez5RzfwC~YxY*j`B=%_v$)?QTBQUmuY22k zrLL7cSTdj1$NeSum)u_R85}oYSGScV4QuG1mLM%}R;dxLwQ@@Syi zzJ!`*KIVM}6${s@j+G)Mij*+_>hDMQoV~}~Vs?>P{XQt`Sc$w|QLVBqqE!~%V_2oe zJ=N~HRJ?}PgCoU{6n~}oZX930u5KHOXYC!O+^+cb8jSJf3fCH82Km48>!noc_NXq9$e(|X10@ScixX+1a?eK2}&^mZJd$F6Q` zqi?iI-u+6CaIMA+GOywqM%N2#+}tX;8!M+GTBSs^F@tt`wtJrN?DVKDkM)f8jPwk` zaR7F8dq~SO+eW=!MoJCs`AN?I=ELwxhE>eZS03=>WCmUT>k;fxc57SX{gtTGk-V+> zKB$VPk|)YjMLYAH-UsD<#h>X`ZEF6zL-YSNmGf0x?#9ZkIkL+C);kIRTTdu&yNOi{ zzp~T4-96jAQ@e60?iBY__gEZ9V^_BUTAndq{*CoYm2j=b3^Mx_uRA9*h~74LW5s}^_%EyuiJOopT%(_c5bWesal?4ldLQLtXD6qWG=(c#@fyJG|#R-sW*SmY#u9WEm><; zC61M>Z)*JADz3-}kydei?8Xc#Z!c^A##UZC^Dk^)*iPEs#qlt9Zg1IMv|WF03Cd2S z8Rzv+?wKoxYc*z2X`6oL2})sGR9NHYR{7PMv%gXO!OD6bITOh$<{5O_deXYZdRj^( zC^=o*=H1&))LP7P&#ZmBLwgUi{x|EDp*gZjS8HeM%+#)0A3IpNJ%GK1e4f-pjgUgSV5#^Why{FzOQW?*!`v@3Iy{e#7A1q~wDrXSZ6x zWY8vhcB>P51A-1x^uVZ#0hiT_^yBGnt4B)*{k;RxOcy;c%8m2zftLe*>pjRX9Vkvp zJ{XmHCSEB4mV(~BU^%cP=nIyzmWFwv!5XBbgHdBqEwo zNdF}z#@ZCjpB^J}NNHwmF6BCqDSY>u`h^26nV(WfmGjNS=x$}Ttx?5Z5ya+z}jM9c#5zDrgyP9Vz`CMcLmZ@FMagA?E=SC)ato{m?RgD%J` zz*4ZsO7LnR&6(pzJfB3*Mjta>p;%m3~m0d zhkP;cwDnokb3A>6b)!}f2*2|T)1_Vz_S$6KjP!=V=SWEh_4(|(1>zHLjMdswEw#GHEI8K>meDR2d!_&_F&F)8<+^&KhqE@hNELZaMzB8QZtTDfCdxzx1xp_d%U#0rFZ$4Rlr z3C$jmF>g;XUHk&`<9Eg@AAp>PXTWkh;+3<|<9z%O^1$?utsyWG{0K|}KhgXHDE{PA z@ReucmCr!>gU>;)e zq2TY{1e;?UeoFaOCJwfY@e>A|0!t8XJh^ODdRd7 zAW=_2kweNYSf5hJ2%8DHgHGKZi}|DpKhB&`st*Me!58X%Pn$9@o4>w zCcXPn-iz|PgFahv=qCsKq}T`ac0oJ$fPSz9SOdHltOb??+v0pmY3F$#NPmm-%{M=o zpp=n*RI-(|S@NyiP|j9flffdv4Haw^H5tVGu7nl6CFNGcG4xCPa21>Cm#c#GTh&0W zJF0`HGHTdrN_qT+I^@iZ`)#!}85I9i8>D}#1JXa$1?jizf!j0c+gjp$cV{%PHI(yh zLHhS)G_p0;WYGUwMiX08O$Pl3Gh%GbG#T_C$!N}cV6PUWj6YEP{R5yc*vb|Qz2rb^ zQtS%C|F*HUMS8*DgQTQ`QD-yS+uDI2gB`T`K=FqiZR+}{6Xcj+S6gQ=8SDbq0pn2L zfM7RL>I0*eWjti-uGIrd9E%4T#}dHHfgZM=C|5f0Fe&B0sFaLew%%GfFsjX&KDI|R z8AN>SYwL$}#z(Tlnf|r`T0R)n<;+0aAWa4(UJVB4Wel+;YUyB9Ta3SBL3#Ve!1i5c&FYzi&`V}eU<%b^z=TthDM zu%3ke(;|nI4Yn;JZzTO08PC|B6?qHk->SiSue_OA!R;+QD0|lvpo-f z4{q1e!Kmu!?+)-uTrc>KyRWQ6{Ks|U`hS;=@^1PSJuYBfzsL46@-vl}NURU`l4x(A z$RTCF?SRNHlX5?Re3W|y&pWtIc$LID;dR?5_Y0^8=X=U_8uC}`+NFV5Z+u|;4D|&pXKZJYzHc?+Kjd`FhqjO=gDHyT zBiqNC45loxd}8}llgW!8ApXmFeJQmFxQ(iR=5j$RXv5?GKT!lCu6oKCbJZw)}Qp*K4-F9QVWKF3Q1kmIEyxEcPw67uiDx~wvIH&_Mf#c+OAK`&Sh`m?J z{VgM(qnhfTvxw@tO0Zj&-w|&sc-Wlm!Z?^`y?v0iFHueW0 zb3IIQecl%5y~5JY-X1cqE10s}(!t(Qlfjf_mQGS1^HDG6RTq0#Eg!_Z!hhMI$zVzm z%R~0=ke`A+2>%mrPk>DSLk>*uY3~6hf)9g9U@xuzV9M>5-gexVOL@?hs`Rx#Vz;<9 zg8el+^#f^7$VeYx9|W2990<~$ln*F_?L$x>pHqO46YayG??@j?ihrhjNEvQVLO*yt zLDVoo>sKOm!?arTLj*^lvB{sfTyN!Ij`?@Hb| z$$mT5s~m@uk$&3;Q|z9;KJ(F!s3^>fr_hh7!TI(Dc6HqWI%fnI;wikk z-U1Pi7TH%IJyTgsB91K~;Ww6w98#9qmy5iDlsJZblv{~!GwAQqNcg*Sy8`A_*CV~ZC4-c75a~~|zLaj34W!tI^%M>~ zBk6oTrq;X3z8QMGEzglso@5-{0x}M6MSda6^Y(309{2z7JJ+slx9>nc;~>d6xD#X? zd;w$}WV?)iyTwoKwZAC++GF2~`UY5DBBebLe(YuYKFQy2e_8r-fRua?`LEkwk^EPs z|NSkmY3G$7=fUy!2J$)n-UL^!!t<<#YFs;rdKkyv1{tpof%J=qLB_dvpwIH}YUPiB znaX?i<8ob(lDMwNL=GwM+cQNzPD=bjKI%VdKOyy=w0|gZ<&6E5jN8+c5m!DSQO_BX zL&{k#u6#&hJcR6@$$0qK{*jD_k3|kCpV&W@a-WeB|DXqZd~UxW?VPiJA?_BQ)OVSB7+1fEKF2G|(XU(q86W-t86U2KB{Bd01S^1l zfi=NvAmfI`p~jtjAmdJcka4E~$aquGpKwifvkmH~bNdHq9q~Ey}X=|vs4JJk3B=IgcR4#%CyKXDrO|KQQRcR7kVXs^3Tu?vWFtHX};UKSfE=^)Y_ z4j0lpTb!h%gGhHfqLJRo;vprS9GLERc)>)_2PT2V9jZSDF%Iu>+~=TwDM7;i_lg`+ zN;*o3d>@%|3+#@3=$Cd>5dAVF^vjAIQp!2Xi(G+}af^KDS9DYp{YoVCD~lXbsyM2O zT#Xd}g?xW2n3(`N-1L+^? zOMML-O{Km@j)qcSBauT&V@DIIuPG_x9(wtnq1$nv10E%FP)4}jwL+DX6KJGw}}IyyQ?zdDK> zQaU+0OTAr4@z2nMKkVx0hVt}>psxVVKMpJiK7{mQNbe3hzg96eCa zVoM*#!;sHB+sDxp9GBk5(F^H|klq{e)#v-*+j2|3;(@-7M<90t`=ei_1N}&xC*nWS z%LfKJ27t}MVGgc~6CHzOJPoD{|1gAvexk@BWhm=~JWT3ug#IDEe9jxtA5z9SCQ3WwNsRvqB<4{vDdV5y{GJ33 zOrPqQ3?_n8z$DOg--vb3V~!LD*B_5Lo3@O(LT|QXj-=!MAMzn(u45kB z=F9ylDC2Vt$hf>#($_gML=VsZWgM<|JdJ#gLy~cM1IT%|5#+pMJzQ@+3m(Sx+Jy47 z=W`(KsoxK7K|bTd602*8_4*%T`RXkE4LHOR9_K5rv zDgFofu*Y7w4$Z=H49dR6%a_>+^xpzsFJ0fyOc~2{MR4bR7b_{ySf%oz5 z4)rogvBz=E9*{9!PBLBMAoFSG(;&zB2O#6#8IW=BEXeNzJ_KLEbqImH9v^|c&-xf- zy!!-Xy!#a7IQLItwHHc=|2QC@md?|1ZRJ(F5iA=dIx7KoMtAe`Qm>-@jul; z`kxw-UekHM=;8j~$v9ZcSsVHEKP3H69gzN~E=d1_dN2>`v)+7hc#cFahy5F(9**Zm zAjflK=;gCCbv6?rnV=WHwXXeV+=Y47YH_UK58|A8Lb>Fn$Tjs?3r8DHa^U7VaZT`9wlbR%&+ z;zSN958;hS%H2s^w|HkS=$%#)NTl}=Iix)7>?v|DQv4(GVW-~C0n$!CXCG z3uOC{kv_*c4>J2P7i2#uA5flh&ezT#gx&(@LP?KTK&%&1or};O&mTnoV&@V~23^}% zEp;w~OnZUo#|r0i(OcopbQ7$>~1>QSnxi3kv+gEZv@d{*&=krXL`OJJ?_lqFy_%+CJ{0+!? z{4L0Ndd{|@AQ{vPCf{sH8C{t=`f_(`+-&mgbwFCgdBuOR2sWsvjwH|VcP|J`{- zo7W)b^;PE|avoQmeF`CdRd=S-biA1@|BIEwwrN%AweE>hc->c?Q*MZeRt^;d;7Xvk2bv|CBBZ6&6Ne5+p*cQAT zXy@vH{L+E;q~wG0K37L@48G^>1pbQeJv)Q^e!L6#HRP@!zd!B<^84>N&<#F>^Y0$) z?uvJ*>p@Vy|4sml<9qBLU@7on64$9G$n|G0kndIY24jMKTz%26*x)0i^b3^rW!@3H?zbhm=QMqeUJ=N_;{-%8kX}0MQSRBN3k_xWoL(o{C6=fJ??q}`HV{>Tu)264U|!CBZ+d)h#XR$)yi$s%B7|~2fgILX8d&*^|p{= zkFA=JR`+9bntjc>hnc(+eQ&ybI|A)AzV`gNfjaU=sL}^ebKg<@=qz zAmhwFka1=|$T)KVWSn^!WSn{hWSn{xWSn{pWSn{(n)eMegq}{97KA5 z@!$~1_;48My#Ibj`tvU14EiVU!OHWm_oVz$*D*QY6QtDlKFYB_nIQXf9OU_* z0C^rK!GY-?xK4qI;At=k#JrOGYju8|b$yEZGL;WW%&!m$yMH7y;=k(?kv}D6ejy+8 z>offQA;;C{B<9zbt}np+>0gQ*QoeGXlX5?kGQXgguO<4&a)kpIsVDP{>5Nm~fQ(b$ zO8O<&ccO>*FZ1ks*AK|&JR>>JegrwsegZkqSWh(S{{`h!Ex)=hL+1Bspp1jxK+eD4 zk^aIiWB&aCne*=|$ocmt$ocmd$oY3oD{pbD<@14=N`7}CH|}i;Dj3q|86)q5V7EcYtF-yPNaR>b}d(>vlI~ z%%fr?+O>)tQfzKDPTEP#KZpBtcb4w^~q4ctwTe>}aRyOEX;V*SvV>7oxJo;P(jLwdnr z3@Pa#)(6eqEs>7+Pf9u{@%#bsa-fwv7Wt(Etx3rTqlzGIw*l`29|Y$iZnp((klTS? zuswJ$*a7F;J=oFR$*sn3P~vlEFfrK0-3|4R2zDiC&Ol0LzmEPA;AcQbxZbWcJ){R&CHG8v>_nF7+Uu%2S@E7L$b zNSV)59|P}z{5a}koOuGIf0>SY^I4vB^EuI5>t>M76{}~G{^06a+C1o-#(B#3+UKAi ziT|L)e~|4x1xow}&ttwV0O^+&YVDzK1$xPWt@vdC>OD`29kxk- z5btq52b3L5m-PVid0k!r83%V!AKVQxUcU%3Uhe^U9bW=nh!cB3#{GRD&WITTz%sc-5$_bGE@g(Xy9604Z z4VnItq<{PXq<=gE(m$RBF9$w!e}r~R2SOz5jOYJIzl8jc!8*ZD+@B%8VenH@@(5Ji1ZP`3#6oj;vc^TuLizxUqXJt;J2jYgLtnN z@gHoA_hi2ZOTj<=0P?=%M=&P%i~A=q8T=Wn171cw1A@PjQV$3}_?!C*(vt(flada? zpZ?*#s`*n;{NbM<{o!AlKfDIHXwc%x?_vDNM@o4R?HBOeg7ny6K~mB|-T%q_F62?? zcVUq8`&N+ixCqGkeVa!eS4BaNtJ}d$kNIr# zxS@YZad_-t{&a`PA;sx&iN2eZ`3ya@AMNo-`_Y~f9?NF^?)UUFI|M`@>FELB5|+jry3E)j`hZ8X)I$O_1~bevs?wS|I0hZIJW14#@dj z7vy}dhjuuh>w~m=1CaB%A;|gM2;_Wj41K)+=V|Iu=Q9ZZ9^+}|u@vMy0kO_*>1hro zf-S%#&@?~2JGSEazsKTz?KwRE2f40_1v7D9-Ui%?{0GtAI;6J+x$bF)^c}(Wo~~l& z&Ylip=Z=(N=T0Q-*IDF{(nYg#R}$;0Zurd|+BuGdo_;^w-O~&8ZahKe5E|A$?#T^r^Zj(o;rlJPhRWIP@LG9I%YzRxuZ`uQ!7dPYOO3w8w| zk70ZAT$ZGN9|yjV_Z-KApPs_||8o5%dXhzdqGuA)FC(2i15O5;?L_=X|N2^{dZt0< zeFRw@=_%lrRfzxSH^JNC*q<)1m>Q5(8e?VkB|JUkYCG}@2t3B(XcUoCPLT|0exc~QLh`gQ@zl3~@ zm#00Opnpl(=-B|~Pv0nVNO{Kdtmtnd#Vz7oXB|p&vQZKi=_A!5WZ z0;h}Nx99jCmMz)}xf|#}eWe3-67}KvKhnzwT+vRjIp~jOocBh%qb-Q@9?F>S(IoV} zB8LxJx>`uQGKahz8n%RTsQJ^FKrBlzB-Wc0n!{C=Wj^nK_z{a-1N;|?;?OGlT5 z%<)$STGl3LNVA#?tN(5o9=NA&7O^ZOB|gWjWHebmRe+aTKFjeSHzV$Vv5>of z{JYGqApb728_2&mjRTj04}pA+(;eh5@R+^wNQ0q@;tWZ)9{5m<)~p@%Mkxk3w%ia1<$epxj4{1}_H2L{C8e@$|9L#8i;qt4ss=cZMlo9oYLZ@Jr-B z4j#rhdIDViChq@1-nTpn7K1zk_Uj&;89ggneQpEF-}%i3`FDSFzz*PCuxM~z^nCQE zSnw%Q`U6G{!8lt0@_Erhkk5-!K|U{91oC;&Vvx^^mVkU-v=l6bak>oT{nB!f-{Y(R zeZiH{3ff5yq><7NDEE=+AfF2bK;8!h(QiH%S_L^VxSDqBn~C3@QE}`6%}+elwJDU=s=dx;gqeFn{`HkweOs=&e%jASwQp z`h^4Am@n%}Q2gxQtT*;W zzX>^U-OJJYQIFknK;(U^Unb!{Uypu8=I^VNF@Ikpah|V>jKBZW=I@&%>U)d*l=w~V z*@yTKZozmtg#OWA9)`^I$vcqgN8g2f3h${O0XIPJJ@gCT`$r#@{vC^cAL%b69ppM7 zx^o(zGaV=KeBlI%=LaXXei+Z0PHXjj0CHV=2IRW*EXZ}~halIZA&`H6_Yuf-$H!W~ zKGFL7sr2Ks=&zBVxbDm7&&5t(h`ew0mn7_TA^Iz^(>cnp(|Hnhx*&2$xv2H;Yt2sI zME@w|zK{M^%3Y$2a^I0C_r1s=$5`-+l>aUI7b*WMWt6{6qWo_n zhm_y7@>isM;<`Vh|B(J)jV|EjI`B^t{m6er!?=4{d^eB--N+EAyDR(O=>kH^%o)q!k3BA+GZ6xX~Dso7<-Ft_~capNM zLO#aPUEaIVKVA<|*2Tq8J~?3Zxsc*}hL9i1EGdeZ}PJVt{Y zk6!5U@9lh$IUfBW|K6@R$ouGfK(2R7fL!n13o=fZ1i9WV1#-Q6AISA?Y49ZcXc;iD z5Ah$|g?7rJUmWMVkvtcNg`*;b47`^Q-}QepN$n6STi# zbt4k(uM zy{4Q_Fk@gI(R#wKH9A#NV`EsdS`D} z$h2P6C4KecP@s50Wb;V?_7)kxegi$a(y#OYxhx*>#@;D-w_<+ohb8nf_JQp zgK?BGf5(%UXA?xm_y1n?x=tjqew*Y)|1qB?lhBj%k@e41ueu(Z1~Pu8fTs|59|QS2 zR*$3o!+|Hf(;;(xL~?!fB*^vA43O)inc((}S>8qH&+d%b-Z|1A#DB>9GUj^cX)=i4 zn|R7QUz0)n-oyg$LQMwodlRXwNBRlM`f4$FF|fqD0{O?&mwK0J`5@Lm%b70vAmhJR zK|10;Dd`~ATS0F+m<$HMI^b&P4G69xMGutq)*3J|xYnD2{1L%*q~wG0e#&~VC9e0= z;9bY!l?@=@N7)D}xc<+89z55577St?wF&$cd=5;3-e&OSU3mWw>;ZWzxaUQ@{|6Su zx@sG^73-Ys;LAwg0rK~bc7ps}hZjJ;*Rl)bdo8=cGvJHhC*U5C>$jIc{yxNBFd5f# zAIRT_*bnk|Ar652U5J-K{w~BTAb%I)Rd7|t>)zME*&AN>9+h!-(EEmryEnauU>E%U z4+*;*6dCXTY2)q?iQhpu?0rYG8;IXQc-MPGlR^9r!h5V&>YgHK8W8H!TbLp*RfxKTxWg>^7kXY0{MFs=fF}(Kkrr7kryCONB%{S zzt`|Jcoyg zD=Ga1ao_Qq_X^Sr27f0d9pv+W?^X1Rzv}_w_crkTKbV4g;Rmojz2?2e$9RqJ>U@mX z`AC${FEZ}`eFa6ng_LzI@=-1d|3d)R1%*hg3vTrl2J@%iDso6E;=4`Cxky>pQonHE zcIL~v7L;}Eogmk>cS-u)zG9+>_y2rc*IIox zp7Fy2xy4Duf5?n0SU1Y|6+WbM{pSa{9xM)Wy?77E^x+A}awWC;N`aZmeZKNy zr_vyTJC)%7)&at(d;q+ETjvDfVcl*#k1-ZVRSM++{xP`vA!2eXT$~?`sY6IbSUF z79!5H0l7|j5b0c(wFSA}Y6o(?)gI(}s{_b*-4Wz^s}soeR%ejwtuA24gNXmAkL$Q@ zkk_Qg`5yAA>k|;`sqVgbq;ow5Vm+1M>!Hac$H&7U*NHtr>srKrkl&~D2Du*WgY)Eg zc?9yn^!~oSU?SKLOacdpUGe@O^!WF!1H~?g{~*^XgF%kJA<*aZ&_u{ww_yDfRSEH6 zm`{zj!$CfONJ9SMzzE++$c(QfwM4@7)T@l8ki@$|=hk89~5;_DMk z7d=qo7eQR(2c%laNReo zLi~sS!uS5ZXTkj7m?dgD$@jrFLyvxMi|9S?+bVj``?hK2LHNn-z8$a!pG$)9hdX_v zP@evf+^}jF>qR?=|56@*9|D>0UF<$t zM@aFH$cKM?&vzX9my~0^qhS8@VLJxL4;X5n+`oMQm`gMvj`gNK_ zdmo4#QqE}oI!nSnA>W5mKIHod=f~><%6;a?D4!ho1phk_%YRCWy*?8=AikrY2b3>- zU!otp-vCkWE74;;)Sn2yavr3Ay8zN}T?Fa3z6SX_8sC8QGv9*r3ztCp!S6u&!S6x( z!5={S!5=~T!JoA2^s{!IegWxceg)}QE`z+E{0;he|KE2-^M@e(*Pp&Wz(nvWm;}NP z$^9dU`yPw`nveHKu)SX$5BWfj2gpb-;J*bj+bamNJ<11^D1RZpY7Y>4h5ffmI==sh zd`Kzczs;|n2Z;Ql{@XPfba{8&;m7@zTnErQ3ii9puij7H4f1(zG1RvX^U(_O{>O&& z-9fwG>F4!wkhorW{~zf)f-e03Q;e5hzuPa*|0!c!M3d0-ij3#~es#R6@7r@dR@|@p z<9k5f|C9jfm+uAXA4;PA!+}!%`ykUlll0G}LHg%1ApLV$a8*Wme>rgWhVuSee)gxb zzk>9qqQ5Hojrada^ry1Oc>mw8_NOX|^>Q_Tb?v-Bte0!}Yicrx_456!SI!$0zh4`? z7^vfKfc)d>b^Z0Ud=P%SKGQ`X#Qj-A{{u+hozckOSW5?Sf7Zm`RFgs6pT+o_X)=iW zv*!L5nhfIptR?G_dO^g2R{mI|{nPQk$kA^^v?kEr_U5Qq|EZqmU1gdS@%=Fa9}R; zW!(=-{Cf&y{F^W73;YX35Aom6IG5^QgnY(1lI#A(AlLm%K(6~)57+(6pr7Beob~7H zhw~-}fh)nTU>eBheG2NQUrPtg_X9!XGfu7o87EhRjFW3X#>urH>s_an&(O-R2l4&C zf0Ni@qkn_gVWY_S{@?$s*kKbX@e6vWf3yENseiM7hxmtW{w?Akwo-ZJb!_&InA z?eX~|C~@>O$T<1|$T)fiWE?#UGLC)-GA@Te#^sNszj*!+neq4&koPg4g1nFU4EY=< zpMxAXUx18*UxM0t-rEf4a}M#RF?b&7{~uNF9xv7S{{K(sBvEugHM3`C&+I+t?Np>B zMM6nR$(au9RFYylBoT#5qSM;5cDub(B2f{QghYwhMPZzB=-`x7Mf7{Vu33KX&-btA z%Oo1TKBA}%0GV=AKZgp?^E|ey+{4Q)~O%c{$}@MU)!JTx_*|-{rE+s zU-y}ubAI*i$8Vy&*ZiIQdawBh)O*c8;Z=+NYP%oKfd^m~9)y+fZ`w1T{(<(s_Yhp^ z{?qob-N%1L>f`-Cdc6ns`Sa^u!&kowTup{A@q&K#7-b+KpLz_UwLyv}vhaLkJ4{Zt+4{ZiNCf~8}Gk6@Fj=nim zoU{eh`{0&P@lxhHi~Ah!&%ggX0qVTyiSY62LVs&Gd|{!#4IBmA!m-c~C&B>ij$HxV zyP(h?gr&$K*ae2+oiO5EAGGy13gs^pLA|#uhVmm~Q13J2Q1f^Kp1m;TPr_CUQvS48 z4m5uv1LaSYK=~6V!7lEp{*z%DJO#Fg?fhD2P803^L0cc%!;0!N{HMdo3(xSM>zDu0 z$=|^*f9OnqXYzH1rwLB&;>fAEhM`Jdx{)HqLz ztka7{+Vzadod5SPG5I;s{3_DPx0L@ZmOt^lh+nnL{{pOCzRcvDv)sSJ^1UaTUnTp7 z*_V`Veibyo>SZXu>J`(k@~<{K_WyqQRcrjOk}khWlwY+L%CCA2%CDjvt^fW_$fZ^5 z{cliCbKjdLubH=AWL|m4|CY@w8zeKYye)E_@0gr(Hv04P$|jNW-t}*$JiXr)<+rK5 zUlKojpZa+J@84qee&GKQeIwQ#aTn`X4J<(3YIYy_x0&5X{*Te0f*z88hkv{2clbX+ z|2yT1^7}sJ`n7(4W_F+Zb7uFs{|nMvkROu&EB}|K|H}V0`orXh=)dvrH2pXJZ_yWH z56v(54tZh4K<9g?_piI4&S&kme0%))a|?S#-nafB^8WKjuV4OmZsBM0$>011%HP}v z)i1w7-v9f5v-IEne^9U1bBKPw|4-BJ_y1$}<8S`~yB`N7b3gtPxgUR)Irw$`j2%@UoX%EeQ8z0K>dKmMFW%9%xfqzE*b}p z2xz@&B$;*`DbkL{CiDJ3kRKOKM8^Bkf#b0I$!Qum2G%ZbYI4qL7C6@O9VeRqjGf)b z=1_iF3s~c{474WScBhp{J;$5O_x}SYn%r76f0%Txt4$ze?JNkiwRZX?)6RfM{sNP8 zPS9&-NaT7Wfv{a~VIaZvubCGSx!zbHYULD3rkrAta$+XuoVZs`LZtrbbCcMWWmAEZ z%`Pq4{m4L#17!T@lcYC4TIm`Or@$fQ?E-rtyPI8)!1-p^BX9wFJzt{YTo*$5=NCcw=RKkP^IlN?`NdHFd2cBH{1T|=zYo;& zf2oz6)gLXDrRp#1r(vENsD zZQvT%tm@jpb?DVkd0rnFg#KXV4I=lu{~XB+d2cWnYTqyfYTqyvYTs}pTtfOya9`!H zKq+iiH7szmS1ugi*f%^d0=>>z!0}CdBLla1vbeBfRA4mriz{w5sy&kDSKJmDOZvge zF`~6cvf6VyJUoA(bBE<0=#)Xd=eQH&ejGtBi+w zUvnRN&1(~&&XwE`b*|(AsBsQWB=tur^^a6O9KLgJm-K)Kmx1FqM8NW8KlFb`Sd5mH`dV7@0q&Wlt9s*zXl zJV45MDzL!po(e4V^bos6fv1sIV+XN&Ca~D-o(Vkb=^=JY0?#48fgQx|`M^@Mdp_`j zr-#@r3oJ+8h#kc4#lQ-)dol2mr-#_B47`l|A$AbERe@K`ZdG8lr-#_B3A~ED13QS_ zYk{?9_gY|`r-yuR`t`t@^q>0q4XA!brk~aa-a%GBzvZQGfa>qJJv-9LzcH}c(%%hi zGX1+IYaFAeoc97X=$AMj2HrQj4+C4^i^w0C{fCw=d+c}~wgx^%zqn$XNdAvZR=V_S zo$Y}g=ylFoT;zNbAg*lBzv9dK-pgkJU+X1YcMkh1*Zeh$Gk<|z`}8lN_UT{2mG0Mp zZ)~34DKc)^|D)Hw`&+2}=XX%QC;uMm-0?1`^FX_y&I9d%`ku^QsQvX1u!{PBggO`W z6VyKVXQ+MfFHrm7eNg-0U!nHFzro@cdH)afJE}iuzxLmMB5QxVAD*~@_&-#9;2_lX z{sncte?#rR4?*pp|A9KE^e@!^+8l=ZzaC#f{(o?4!R2o4f`$c}U+NdsDbRXeS2F8c zJ(2#XZ!+iq3i8i&L(zW!bwt7c-@gstTc5y=m1+WYTVS89e{=sfowEWQa{SmW|78H}- z!z~gm9kMTu6(rEtb>pJxA^XQBYW(rC?8M1#oso-Q!hU_0tDLB=W zA^XSERF0JkZC~9Uvi~nQ9kTx~IM?o9r-BZ4|IRGvOg{GiBKbO*%>LiIf1O3`{|mZ! zpsD1qtuEUMpIDSbqiM_j*{tb94jTM7}}r zWUgZ{Je&3nfjXZx6lyecZi0HxT?%#1ei&4I;%2D$#Biwi#0aSP#7L<4#4S+q ziBVATiCYVNwjUpjtpDY?4JsZn25KKV7VgR3UT_!f-&%f0L7CTnNc`YV>Fs)8{lCd~ zH`F<_d!Y8mq<;$n|L{g2P1u#G#VU>fC@Wv7Z(KD7P*V^Hyf>F^--kHZAz%z$C^ zPeARvpM+!4&xD7un*|krm<<)zm;)6*nhU>#4pf||94ao6g^EkKP;rS0s5rqqs5n6- zRGeTwRGgp+Do#)h6(?8#6(@KKDo(HvDo(Hn>V3`AQ1QRTFpT^RRGi>hsQAYcsQAZo zP;srLP;nN`f8~s~7YY;?SXS^d{axcM7un~m5b3WMP0l$l6|6M*WzpgZq?7NJf^W#T z+gT;DzgknU8rCjfV>18$Q?S&)}XGO&y zJ~#ar1z#dR#(Dv<`>Nn;Wc@x9BJb37+df#_z`FD;`dYqS1>afvu7dAjJ>)&4x31bP zwv17ar!6Usl^kA70cfr7u0wXPnde`ZwtC7J$V{U=>gcG&8+@ogU2DO98v9V4izV90d;>{!d|4ef|tPKq2A-2 z0JWb!(aLEZY=f+Jh`KLrq3(-6nD55`l%HDwYn)&(8r1U^66wdV$vLMm7%@32T3ms2 zp0lE068oQ=Sg;t@E{~ba{y&&7`=mHt_X9inH5EK1sBwK#FddYCm66Q2E)l8kB$IQ_ z$zH#nBJzB+3!X|j&3&f@JJS9&^V*4&(;?X2$~j#!<(wf>P6w0u|6i}1j#kd3icZ0^ zX}8A9S=i60=qwp~e*Z_gqqFA(yTCE0E(%^??Y+?CHS;bKX>adfPb;sNWXii(q`clH^ZkFXygpuemj?S%p6)kf9QF_P zvwrL!ybRVuzMS;dRRctO{vdW&1_zqmmBA~_?#kfR*rlqj5?gj)yg=G}P4HUunjawY zb;0YAH69`I^tm_C&a&*F;Am^-VA00e5U6p6%zop>;7wew_M4FUZw{7P{+oltU_Im! z*tf14E?PSwcB6tL&2Cii7PA{=<)^A{6|J4BPy77apyE4YpvL)FsCdKeQ1O^MpyDxQ za8kvc!F$NB`+S$(=es4_eTKDqSB?vgxBBlDTMnpX{YS6o@;<2NWCGN4azE7b`vBDQ zI}whld@%SB`R*Yfto1qiNl@{g$x!j0hoRyL%nyNLwaN1+@Ry7i$luYU^y&> zSvUe#*f?bUM;<^u^Ps**R0&^azcruh)Bd&!>YPTTkC zI=GnpYL}?E%rj8)@Uu{Hqa{#rqvxRFMoXdQ=jY+BiWh<_C~x+>Wg_$Ia_@OqVb25a z{ev&sczG$f5_`?hqUP_H;k0?L1lL&pRU-LUd->OhHjloFo%(q#?VaX(Ew~O@?G?vY zyb*jI?u2hrj^4A2Z$Gm>_!fHoua;O@z9C3_CMEwNAE((Ed?%>=_r~D6*sDJ_LG>3h z`pv=jk=0-CLG`QTwa%8{2ed=a4J0m66a3KZYl2&;NAo^p-@h&R5wgY+q`Z%V+dUZ) zci0j9l=4*XCs6ewlkcB9qEj-uYzBjJ?p=fzccs^>AKI5=jq$v zZsaKyyMo`@^Yp!Bo~KUU``;v+J*51D!9U%Mj=0Dn*HLY3o(DklI{P61RrC6_eCvJru z&<}9W40ZI%hZgVX1P^7;3Y|?m>$;sqYbUh$Mi;n0drqhu>5*(#(b6Gtk#j@c(RXyu z6HO1sUb9-#|7J!Btxq4Z`4End+RwsCufdXrw3y;!t#X#1l}-~;T7`atcE zE~Wi?FWnb;CUQU6*u5+?fc(we{-WiF#BnYUU4g!bJ5V$|w0-K8Q2XAip!R!LL+$sj zf!gm~3$@?74r;%5J=A{h2B`hsAgKM`V5t4x5Li)tV`wOxyzs`*Z8lzR4&7wqr8G2x zc681T6KTiICg+^t-gp@y5_cIHy2WcJBa8njIwGbZ6)R^ee0H3f=ALA@QbrLgPFc5^uUUG~SaT@uvGi6FeCbZ@ORQSh>*l zu@j;Gm-az;|5nz2_!jY)Nl^9 zBK2iW=KDXP3X|uFudfbOLB9WQGT;9TJ!Sb`6>a}4d%pj# zbbB8UZGXHNYJdEU>7NZPF+0}(koL#Vg_e@8{jsS1@$*po;}@Xz$0|qr)#cdp{r}L5 z$Q$`C21I@-v=Vs*aTkdEa_ALg`K=InRcJM`_D>LbjoN4XAW{CtT3CyD=r!7<^>Q7u z{HxdDFZAmh;v&{`Tak#>e~plkJ|+0r@jm2 zCvS$@zr6=_9q&W!%eFvW#|Ku=hoKr|U5BXhw|eq6uilTm_I?a^JKIA!yHB5lcG!LT z#AN>eFZ7w+r<`c}FYIW~7opGL82GI{uRB9u+VlFAWS-ZrMaIcalXK2D-t+pc$awlL zv=_VW&i5jAyG+hGyF+_S-YeSvkaYU}htQAIr|W~rKZSlq*7ZZ=Uqbtk)o&2_*U$lL z*Po%^tX;oLrd@xC)c2>!IcLAut^*?Z4u<}s9Q7weo<8?)@|9%|g=&SB?;p|b$G_O= zeju|B`@+!tFQsc-)P@=tb)fbeb)oJve}uw?UV7L| zM@AnB7a^-3qEO{a=KDY4nAeXGyLdQZdd~kL^ZlQ2iu!fkko0so>~h#1A_ye5&O;EsS4edT8rf`*7YrI33DAI0MQ*=m6y(oJskcvK_;nkmVnU z@(<2}@-I3=y$3lPF01YmzA&tHDC0aUU9qS$LgTAACiD-Jrde<*}DJ+A1&8}a# zKX!xN%S5w-=2r}WrS9e7D@Y&d4iqgN+WLJZ{P8{3f02H@I-K__u0h_Dy*50Ed|S(} z3t#W$gZM8uNN?pp^G^mt`6ol5{F9-uqWY%rjd1e9o5Ewl@*9VTOYJ!r79L4CowGNK zlr!AqoHHWKbBjDu#1FV7Jj$yF;s@Ls9_`5xKj1c%YwdvM2aSdJ1K~2#d$@OqmJW6P zFMKz8&i{#~hxmi{gvW8+ir+)?hwg>)hsHzsL-#@XLldCWgG2i&h`R&wC_11$|leQPK3!*7d1Saq($T>;7X<>;823-+HfgenvRI z?mt2M|F^!+43{I5uJv8i`u;4` z`o08eeOEbJ-^K1L*#AS#V=qvS_OZ*L=B5AE*A=8|{d^H>eSHaPeO(DPpTF$od&SGQ z3f4HQ!|SYn)`;}at0wdRf8p0mUMG&P%X3OP{qlNvgZ0as;Ww;b-ZYu-|AgN%`wgP4 zr`S>dJK?vj{&&Lf+qmBx-e}`~lVryIyCU^&HaX|K=Z*XKMdtA>;g2le*6;_G??cJt zs}ae!)#RMB&CBlMlm{uCK6mq583wNPn~b7v|3))PXvmP#5ZZ zZ1te_)%BtF&kdmJZwPg+;0UO54UM3F$9E*u`H03)=M#>CI!Do@FuxBz8d>Klj)6K) z(G)Isn-#Vy)co0^@Yq6K?{ShD56wl|*TQ7J|67=!KU;}*&f<9T>-PvJK>a@8M5x~f zw1)a#TpOtK4)l|)NB+Y6x*334Hw&QF%^=iw%R;o1-~SaBB5U0gwQfeB*3Bri-~Yk= z+2X=D?Tln&qV*%ppZ|xA-DF{!^k!~Kv~&-bT*Xo6~-|GguxZMlSg=O$O*dF%4ez1GKX!g+dffqo%*S`?zJ@`dX@5g(> z82iLtQ19_ChWhSYZ>ab6mq7hKybt_@@pUQGd;7jn-%sfWXTHVzf7ssbUwAq7cXS7c zRzI}wstkl$$F6{SpMNFPd;6;j^XvZA$V<^*1Nr}-!s{uA|NjxK9BALmy8-Gw`5>tG zw}YXr|IpTd#>oKp#=@H@SL-UY^|=%t$_^_WPPuj6n?)-Z;%AL0yaWBp>XC)FczTGR zHLCDdPloteqYH2IWQdu=if@dETG#J`TGuB)?Z5Abd$JD{PNKf8#|5&5Rot%{#})A#Dn!~p&t%sB!ucjwiRL$uj^9vS zxSo8wodqI(!@|O+VD0jSCg+?*g-=_)^`iL=vTvAuM(O4^K=T`xK=}>NnSN>E^Jd5T zUnsxfg~DZ|%Wn|nH!O$p8&*L14V1&W`BLF)$fZ@U6t1M4=DwFrUNi3%k@@r0!c{gO ztd`7tutwxMUp1Nazc4?4z9v%My295fPy23Be#skF&zow$?N7xQcpl$^S|>NqZmn-` zW5@ab!p-P6RBaS_f3ZpA{lmLnJ)1>a2j9a^=S$y*k5Jwg%l~2F2Ug#Qh4?$Q-beqR z-?J4vy(iuV<@bC9<@bCH<@aod@{4vr?V~?|D)&`@dd){47$=uZ6!@Ir|C^Q0|&}zlxOeXW?&F&hL^b=MRx`{xq5WzgNxy zD`#}}ufl`m9|L_6<^Q+vZ_9s3GWq`z$^Wm(Ip?sK-xtw+sc~vW>SMRvsV!nx$K;$- zH&V~!`l9)Xq|*-#B1c(0M@AY(v`!x(nR*(DYY6=A~LR{-gOm; z_CBo`JDrP;L7l&jL!G})K>3eJDE~19OMKL_dm(<5h~*Z*sYdQLmQT@`0W&a!rQ6lr%Suia;f=6`l3 zUH<6VQ2uEbsOS0|sOO|B?P=ue7CD#lbbeeMQht8qJXi|5!x6BD*G|a!@(UstdiLU{ z+=q*x{?Du@oCtftbK2Yb)FNJ!Z`%><)zJ8I*koCS2GVctC z^tW*{AaXf+%^PB6`M?N%^8a~1c~#`fh~h3+MXvF#?`rS*kkMZoxgJ^9e;rhRNM7sQ z5E(?hdOrz~2S+7g_O{@vw_~U*vxB_i!hOmLKBBJP>&heO-5=XnKgB z`cPyt`jPG=(e%*#)Q4eX_mRjH(wn)Dik1#-y`Ktoes3BK;fFm2H*mglIt+8YkJE1h z+!>K4Xs7%tNc(0*o`hv^CTtJqQ2t36W#I=m5To!$hsPQME^Z*TU>dCx27eOTjciEOie`aqix=OzW?vdk2^)yqi-U6EZ?rkx0dfa$>jT9B;PKRiT``~_IUZG z&)th%S@ws>KC}B#wEpknk+lV7B_`9NovfLM~70u6+ka@jsv^Fe-b>Il- zpOcR}K<1|g(fU!%YYn1DMDz7DgsKM_eWPe&WYu>hRDF`yI!8sDMDy1Pu{%0?jOp3` zBX4w?Mw?Net`m}eZ1gx!hOO?});!8QXydL0iP>MbKfH(_dRMd z@BgEW6Xar1@BgFuc_A*M&&L}y|0JXN`8x$Qf2XN$Q#KPVLDoDaYMwp`YMwqBYMwp? z?$4eYZAbl)>}jHv3vJ$R58Jz^M>~+-(LF=7bjbQ}X0$VU{{Ju9$7mWzUE!f@x9EAK*LBYoEgjnatUGMaKJ9#{dAkSHdUXNp;`WSQ2+QC_ zusyt(at6D-L@Ng}pZ1RSL0^`=L^M5Q{=YQZH=3XSq0Qg@pyuz((Cb`4f8@sQfapN- zH*+r+EkC6GE23AS@8Mo4njYG`&;4nm_mfPyKs)q24T2iy zgJF#`Bsz?8w>v{c%DvI#oO4sO)Z}5J&0C~1Z`~Xnh5b*?i0E)wyL^PnIcH?_7PB8E z+PsAw^^cC;YW0tfmf1MGJ$jps!!eQ>hhs(Rz1`%TbB8w$%S7g_JEP+*-?->qmhW!K z; zAD$hZ1$V+Z*vTJ;%wy%zxv&&Ea0L86@l*SqmCJLk-)B`o%?tCOexFqd6~~+p75}V) z`h8Y4)bFwuP><$|r=aGGh3J>Ni=xk2e?J?2+WLF3WcvFVk^X+xWY&MLzn>GCFP3`q z#qqOf5y2&}`4X>SVio^@oN8hq^)_?35Rd0yC?a7dM z;X5jq{H*`fqvwAUZ0x=peUJ2J?q<=_ADGv*hc*vw zgUhNvihfD@%Ic4!+r4y1+-yhm6HkW3%|4BO=E;z_SuXmyCqv?9U#J`_A6i`RE2y~M z*HCf2ov@4hUGy7R2ET>v;V$wIcE1-bKeTw?ZcE=2{ekq3?q1Q-q0Li2l3qi(KS9Ok zeuj$A{Q?!A+Xoe|{1qxr_Zw84?sup--5*eKx<8@fbo-&=bO#s*1Kfkrzr1-8((b>b z|Im&e?jh0I0a-`>jrxkTjvN+E4=r9-3o1Ta8|rsjb)e$6b>S`4R}a=3~sNX*|h5G$dGpOG` z9SaX-k1J|Hd+WN*MQbm#-$S*8`aM)DsP*-DsCD54C_n#1sNW&AhWcGm8>l#LTX-k* z!#&wRk=E<2qA1MoTSNo|F*o1T>t+wAb@Ku*--TYji(rk@v#5{tOD~arx!B~K z)4S*rllzFaZjw%aTv{~1`lDY_U+a&4Cg+^Xiu#-V0MXV>?5KZW(dAbEz@lr5@6{&foNJ1h-;l2rSvRjM8fy6l7hP}pZjemAK_Yg8P0l$(ynI8w zeADONh+SFsrlJvMS1MY64D2za}-kMsY?-{arj0kxi%L9M@cLao1dL9M@cL#@B}K&`*ypw{hsq2gfU zq2gfoLB+u)K;8fQt)2&pCL$}oBr1OMAmsP|MU#s1`v+*_WHQt^c^GOPXWeDrFs10x zBKh@Gil%vXQ$0Im^p6!i?%7X=x^Bs9of$<>c>M*DpDdb*z2Yz8MrT&hY}%pggOoF; zXs#ziWT&Xy^0EIn`--A0-04&lx$wGe6-D!~*L6bll|@z9YrM~gx(;OOsV-u_Vb`<3 zOMeQgoeMoX?MJ4%1D&U7?-9g{7E`XCk7r<(_ovSm`5IlweO^-JJL1k4iT|TN6?tiq zui+W+dDsCm-_);O#rn_ur1g6_)V#I=YW{x_-cJ6Ppw@?#@Ob9Cm!aNIy#nPQtb&>s zR~O~ipEbx@UnsxcEXvcorgM|f=8JW-rz`XM>rnH-8&LDXn_fHD!+U7oTd)sy8(`V0 zw>3}J^>MvCKegUk&H9gC^Uo%z^4^6iZ!=VR?-lv#*7dz#RD-Pe-xjEG`2p0p{7`zz zQM%-<_|iBhZ`w(C)EEAegk*B!25q#Nx9!a{ePbNP4X^eUFUA7>)Zo%{d=M6{Q;^S z*thNoe`35;abG0AyO8z2DF1$bAJlvKU*Wlnek=MNJALN>+I#drpx&eZ3H2U*KdiIp zK+!?Z4%&Y9FR1tFf5WR59WFWq=fHnp7XAw>p|3b!J~aQg7F7FcLw#SM4wOG!7s?;5 z2jvgfhw_ITz$|PCZ>zl~mmi!~3AL@Gv0eCwsfOo?nybp%pgD?!wfrW4~jBtIre^KNq$VE`!S15*x zE5zU+sPUosAW_WtsA^Z7gp(>##UTgX4g(^xn=b! z#itef#`pD|DiZf@XS^xfu9)&|p3!qRsp9nFGp$_W|5k1X$<}|;&#CBG+{w!2{GXM3 zmgVp3>nvJ49h%?Ur8xh-{~W0OM_1U!?N)rA-IsGkD;HY)p*z&?sLzMmpY(wGz4irA z@zo2Ve#d1C2 z{vHYU@c!!-*u@=HJeqoXxVMT{53Iio``e)A?=ev8z*s2%`gSP)`VJ`nx(v#%z7xu? zz6;8)z8lJ~z6Z8<#}$vKo{sLlqSXV1rv)O^!gjt zFXMV1f`ce`64d+n$xwdw!%%+qBk=L+CyO72!xuhTJOz$|Q{h-R4NioQ!S2{ihkF-1 zS^PLGMVz$f6HaHdy3v~vNo;JMU4yVy6eCG*7`5=-rG=q#ye2^{*6%QHa5Yr^egiU`L>ZnM?(3}jnThPy+^^xl|AP+L9gE_9*sPy;+WX6$oidfQ||AKie{2+d_vyu zwul{P^|gpKhxL$Kk*{@COVNHuExG0V*0JMZgR0iC6U_d^SR3T8kYUTfeD?py`W
#tCy)PhIyCM2uER6m-Ur01PL|+(-qVMO6h^B|=i()bKeSO6ude(nycRZ$Z zEE}p4BIgE@BJbZ*vHbnXe=mXG`^PfY-jiY_c6}$sPNAIERVRyfeUN@=7dzGL+Qm*Y zyLPd1>{33X&xRT&U7*g} zoI|;~k6oeu@1`5neLENGzMg08=^pDD)404ac79BLSP#jJ%L_#A8 zk6nw*^Db)tAG^ZZb){t5b(KiIt4(JA@3re%YgdhPU2F(;+nwu0>~1hQ=M0JsHhG9> z@d?uD*BfI);TSl=>bp61lhs!$nfiu_lykGm{Ql3YZ-mHmG%|LFwg1-GE!O@~Ca;-y zt4RCD#ztFtw@IeFF(T!SH96|xs9*EdX`EX2SRjiuw^qm99I9w20gsgG+6!&9B#X`y457vLu6?b_WD(Q7~dY8kK*_W+=iWj{IC!>D}_O4tR zd&T>t_9iTa>){Bv!Nw!&KXU)IZ^z!Var$oT9n)`=%sAa7(l76toO3pNCaz|`CY*w`+_6d4j2jsob zXR%M=PMAZl_d;T>^7Ggi=oRmQxJW+`M!?r^khhR-^9K{K3Ms!$n)5L zj%0n0<9n#@JM5Coy0RPUy9#^Aw`KL-*pHNVweJVf%7^HGiv5DVkMC#E^bq~N*l*}B z@%<{AUYs`X_t<{YXV3dXWc~Ql>&N}pkGm=k#QwJQgCgmFdFg+PlzS-lFXi_2{Uchr zVrBW^*#CPzs&>3qT=BBn@w)N+{ip+VKakPai#I^leW?$1UnH+}8pe-^=bvNP>T3GA z5!~n;8E+iVkAF!1qvB0G84_nZI^LB0y6?w8)q_mFX7Luts^?fQ{Wz%lntOIi-~39; zcq_9f{%_@<5I^4J6XLC@XK2NVqK$va<15<6+rXVLfc}9Bzes)T|ItsXD2NxLpHdNy z2jhCKLy{T4VbScw*5#3S%zYdUo6??0Z6DKxK*<{akn%djJ0mY~&WfLD zc4x&q!WWS{!3wB!*+bfScDxI+o=3=dJ}2I~ljeu6BIR{6S@y`S7Z49SFP@JRbtm6{ z@hru2dZ1U_=K`qrsuy~87eU2&dP2pGdO?+Qv6sI$RNUwi^vm5o@d0r?ZAp7Lv)t3=lKt3}eUF*)a4 z8^6xv>qXmtkk0<&hWPE|+wBYz*?$a)4~DhNhnSpmhQ@ESe7B3X|B!vdY^l=iy$rPd z!Oc+ngW;wh5g%!G?Em9F_6N7bN0F}mfvEk#tx)@e(NOyX%E4b4qjK%{!(*X-S1eiI z`M3k>+*TRv{yghHOt5a;MLl}X?uL5K{(FBjj&$X}7s_885B0m``=I>B2~d9G{ZRhn z170~3y>cEj{iOIqW54$vJ0se2&@A70qwNj{b7uS=y)TDu=pW zWb|&l+S)rmUSaK>CzA-qX&t z&SL4!zfrpG!?RH9_Y!F9Kh%9&3U%L}hq`YsNYDDR49Xu_4&_&@fbuI|gz_t1g7Pa? zLirUhd-vxR@BXZUnnzbd&7W(ap6^$&uPk31e=VMWZv$E9--xe+rSNq)0@h5`bH_S7 z)z>;g``45Izvo=f?*^Vz>EDKW&fkH0?l*dNo1mWOckOxJ9Ivtd{viII_4oUd>F+Hf z{r!Q-{QsZV-!&r7^H%S9-u8c=XZyY^&$Y!1x5x8w${kSg#!sN)ke@=uF+QUmo3gq1 z=g5jTii$UWfqsDdW&EpnKHdi{?)Wu4l-(KsmiEm+>9!;_i-r56j># z*dFf1ez3boG?=(m>t82`!BL*kAi!Ym zPx?srPtnq$#UBqq#UBqs#UKBI2i6n+hx)zKA*guQKTyB3`4{T_{$Z%|2fjr9{6Q_K z_+o9S^9OaH;*)iu&L7l+iaXYaI)Bgr>ij`NSW(?5aRi*auu-B#Li2W$#E}V&pT>z} z61vYviL|?k$vNlf1T`ZcBXYi^X`-2>^ZpnqwiC;Nuk?n<|H4%#}`18SYS z!1Na;E;2jf{|T*gJrli1*E%O^ox2!no$C#?&Z!)oKj?#fZQrFT-+tF4HfFx*2Q^<_ zMmp<$qQBVs`f|KW*J8~?*3GyZQDxevol=J)^J_#Y{9 zzivs4vHLYj#O_v;bI$0*Z6=QqZ5mW7or#GDDOdY;X!qkG zsD7CQb$(zn)cJvjq3+Woa7g*o#G|kjPJtufG^>~Mf5=)FAA?%&rbDfFk3+3@GoaSH zC!p55C!yB6nNaKKEU10gY^ZY#bG-XA*SkLs)H+xWwGL*X)liUkQf9?5H+XA;kP{ROdG zl6cPa?EjHBI!hDJ(+*u9B>jcNGEau&U!GWjUgsUeWfd)v^@%rae62S* z=e(8JVEJl9n+IgyF#C?uZ61I&4{U;(2i`UP=EQqu$NPW!_weEO6I)2vJRoWw_yB4i z_z-FyP&t2XW&ck;_479Pf1l%zN!N3^9qKvW0rebz0`(k!>e+wh<yIx) z`r}KJbIw2KZ(@)v&lK<7w`GnC-PkWnmAzj{!IL4`F@v7zCT3r{b@44|MT)4 z@bXQcdl0*_>|cq)X7{&f{c*_a4`jyEztY?Dt913RFPVS-YC(;|+EC9~9jNE5F4S{Y z4-P4Bn5+*=VFNe<9+AxZiO`m zZvM8DNKZ~LK z&KTU2jVIGd`F)9GGO7E<`G4eVvMK3JhC2VBEWuuWsVKknBxvXVp`HJSoc~X@BR}W= zMavKK=l@|B_w-~3(tEgPh?WlV8_!I3LO;^&D4HJPznqmk8+|jkvuJu~{$>~0#yuz5 zjr6i?SJBd;`6cH<`6cH;`P|Q8ZerSG5Pp*4_+bemo z*RRn0nBJD}lH{f2>*)3oEg!@m@0+{~eOvf;oUcc@J(dvWDkAsuL$jAAAk$H8f zNcxQ?bN)YBYVt7A=2gYTllhe2{d_+oI;}hoI)|Nl^1PNj|Lhta&6k zg>r82Jt|r~ko4)vsn*_U$?2pI_B|$AIwbwcK9-xz@Bfl7TE3S=TW_#q9Ii~R!EU?rvPe0vn4EJ~C0CogMzr;e zbo%Yp4WAbP8SNnbv ztv?|4za)P}f3a_$XnKhKZ^=K<_x1fQnjT{RXYv60UcUXJ=^^$9lYgV{KkMv3`lD7#*I7GNC#8NrMzrg$o67fVJ*a-IpYpZk|9?_PrZip} zinQwpk#;o_tsaP7fYn?W!wsu{-|2I2-Dqwoz|HvDif>eKohFo7^DoXy|zKBS>2Re{Ad@NN2Ta?FA#jrI@ntfcPKN6x{C#3!9R0{I_ zztl-)ml3fm5zP+Lo|99jS^6m=k&P~VNZ5b8YXMNsYP33aZt7u31Zi{VwUH`KY(OQ7P5eW1>j zUJ5(GzFd#uiT#lEeW%Ny;*I^G&Rq_G#Q#%Q&`#q2BJI4~fp%{8N~m+QSN*SF%wM}E zmG|GSh4N>vgZlo{^-$-uZoqz1c2H_Cvivkre%cTyKW!+KpLQdxs4h+21Sc;nO^vnw z8<84j{daTf7VE#^BJCPsGQa=x`tKHzIM}GvtzNq!aj?;;+dLT(2OFbu?Yf}(f49Ru z**j8qlfJdQEOn=s4)HhdlHTkg@v?hT520UKJuY>xr-#JL#;5M{WJtVhLh61`hQ!Mr zNKN!)NWAPpm1E^X{KZMBhtZd1CySh@le1uZcXnzn`8&FEM9UBJ-~WN@-(dd_74OVK z#X()D?+sNzooky1b)K>k>OAFqsPmLnP`_8IhB{Zd0P0-jQ&8tB7ebw@Tm&1tPp6)t z9nIXuqO}9sxyomu&Q&gfUEJqW&%rXd6t;)U$T!%1L9~3(&e1K0`kvAXsP7=X2o>*p z3F@5XN~m*|FQ@W;@GHoQ&#r=s&#s2@*VjOuOMF%7*|n*4)K}MiO|<%;os)bWhOvJG z>Kx*mQ0F?=L&bmJf;uO;0qUIO+dLlw+;>tNsbAk|fEG911Qj=Z7b5rM6J- zNcVlw>V+0J{Qzn|^&!;n9crL{FSivcF1iiscXA&=#i>7ric@cgic{}^ic_;r*zdGH zP5GLB&3yA2?bCN7bI7$x{~YRfTVFu^{^3h_9P(H2FXX(RzcaO)d^OHDBL3C4BJKUo zWcL55T_*1q&Ce$tKYvfEVOoCNUJ*b4$J7txuU-D5$$bAO^|R$`n1<%(%f4ZDpVBRU z0?iNqjrm@F`0v;?@cohcllJI5A;b^gpE^Lg{BTiz_(3Q?{4Xd!oO1BD4yEc*UTM|g z)IXHd-1o1^YvvsmncwTAeQC|_wbIDU@3lp)vyRDp|0kWF-|LAMm#uH*Hb|?TiYJPS z^Bn>8KLCxO{vY5-u1o84W2p7{DD?WiOB47$_vL8HA^x8}4tYaWQ;~BH%|y;I9P8D4 zoQPeEbaSh>MVdHnt&hn6Up%*!SKjeZ{`m<|?K%<4pKJ}~ueX8n=i7Si@_X$HSh)r1 z80n=|;dGGu(A*a?dCk1ANIw;&3$33blIf?YNIw;soO6o3_QtHewSDn)iRDYD6P7P2 znS3dcd})(&PR7euBGSH-(CjV(7`P-SCbJ~0PPq+M~RcEHp zu=aOIccGj$^Uf4$f9G^ZE2ooW$~jAS5bJE?h`^o8+?h0#{cQZNX zoSQz+@^u$&AA%jv$@%G?*ll-uh?IMQ$vNl3^hGB36m1_uI^(ie`eNFr`vh%Y(3|}H z{y%-0+4m9ceqCz)!Fo?UYn^`5+rB{QiZl0z@*f94`TLhc`TGN*#^n`I?^&;eiVt4} z6{o%$YX5Kz)PCSvsC~qBP=4U`Q2y=>-gp`0jhDet{^bxT|8gkQ{@_OJhm;RX-vmox zDI5WBwtnaQKeEREa5$8G#|Wsn^+>4a;TAX?{V4jQmTz?WR_mA1>D$n2yhFZ!G$uV3 zS^HG6vi$b+9ciC^=LmAn<<4{&+zIcZT{`y!IY)GN`d;MO^X?IOzQ%d?`(7J2yDG+~ ziMx@0pGf)yFMaV`#shxq#PkDc`JEHf4^fVu>j$BpYh?73(hno6UnWEKi{!P=Bk4!I z`voayYI=&L?_7mxul&5;1gsK;re6!LHvg)1f zrO$z?f39aoI{#DRrpsZwEp9ps_f@*-3d_&>kKI~lUb+%ladvT8#r$-Y>Zg5>_Ee|! z`#;@hSg)Ml=Vh3O)|0*vJH<^FLCx1sbG;3Gi__0guI6jVeEn>C)D!vn8rnJC=djnj zv=nOIdLC+idI4(QT1I|d?{e=tR=^tP#q=tB&R!CE&Q_Y7b6!rrV)81{o-@*Uj#sDG zVgHl!YI+TS5(zW36bEZ@75$+uY~-+LzKocFzaTfBVJ=YD`)S@y&9$7WX}T7PWy z`U9E%|44d!{+0eV{l6XR`QIUX_zBcJ@F~vO2*{tKw*{!6Im{wt{Q z_cisX-*-Zdvu~ir*SApP>N}`$@ICgG<-5|mz2^_|{Qr>N154pvI0EuK+5Qz;{Xe1C zc=;J>y!-;EK>UvU@Bh;I{n>9&zmxl&`l|4Y{(##5{E2?0yFY!<`s;v5zw-Vc{c`uO zH03bg|C|2X`u~t*`u`shyMImQ`+r{lTYTL7t6G`-KBzX-KBx{O z17z)kMD2qbLhXZ&fZ7K&g6-WSGe>3Qk2e;rebDwRO<+a!F`1*`ZfLz7Ub)kJys;&aVF=S<{8Epato1tQp-#$uUyDJ>G;eEo($P1ov3oHUdaBWO~#MD zEZbHzJ!C%=$i&dEtS-m|Jw0SU6v~7>8L}TL%tSmHvLA|OiaZ&zA1YQkRxY%CPaN*a zCNde)x0WX}DK8zeFH1{r_R#+Sqy*|ar6)n1J2)B2e?A4ue?B#n_wP?bo{8KJ?$5T* zoI!b!?CGMF2iaeA%yfWd@J!eqo`v0Dx07gg(ERJp+}8o_*_kesFaI6dKIt4Nf4eJ` zzugVW-#!=0-#!n@-|h~zFE}4+-_ZkV-*EwK>|U7ZNxjY7i$tpz(!O4q-spR{7mKEc z><=!Pzh3qYv%{2bem%73emK-~Kf?4QGq;!>>wiY;#Hh@zq|2`t<=2mfnjdb1^6OQO z&PR;JzP9gnm2ZBOxPtku3@(CqQm*E)yP)Q=yRqlHKbdUqekXOdUXWb~u6k7OQ(W8idqzNcj#wdZ?^WS;M- zBK&V8Ak$=ZFHo0((xWvu0}D`_?+oN^k3y(&e{42i1Q|;ZpcK98$hK^8ze|%isvO!rH_B zA6fqEi%|aSOHk|HN~rbhWvKP+6{z)W71VmR8fsl!1GO%`3bih-g&HrfdG~LfcmH08 zTJPR~TJPS3TJP3lUs?WEWwK80@%jm3w>7iP^z8qUH##3>KBgVIE=c!4!Rc>%?|*EG?}#ODwJkZW z#8+$1!nP&NOMH!7*aG>cY}=BSa8gC9k`rm~l!~?`$Cv2b{t1%lr?#e_Q_;GljoGyo zkC;t<%Kz_NfSs2Nl;r)M0(ckKAB2kcg`mz=hT*d6!jd%QudI%gM6G;&|Bt+;x~Qbs zlOcXWtR(Kq5I-SNlJsPVpO8{Hb|0a|KQpkR`lON)ICfGy9P`_)w8tQwq*FeRCuZ2hQ+*}9sJN@h7N2K2X z_5TEe;I#F`|Dk?oJp}513Wh?L{5Qfb?y!=ZU>Pih?cs3xf3SPAX#EfIi$;{(g1(tM zQZzlZ-=~j)ibLND6^9-T6^FhJYFv(iibIcuibLNH6^Fh9Dh^!+OWiw5?xy^a?p>ml z4=w(C4^$j_9Bl92TXG+E9o_Mw*+ItR{UsCNJ4kVq6!(LtewV@W7vOCsu? zxhowiSqq_+O8er3#1Iu)Bx{!F_k6wQ?(6gW>-l(J`+eQleZ61Tbzk?)BB=GnVkjNG z1U6+{FNM44k7ZEnj`yMFg%6^3{+?CG@E^40c3TL&n8o$L>aw{-x_ zumAB&w*DtwZQoCwex^OzFM_NCe(Cfp@mdFnS_k|FwGQ|lY8^m1=+8eoRinJ}nSXcs zlX9B){xW;f^uI;?$l*?h?796%HqY(9BG-A??40BC=lw`E(bg3OR&I5F4a(L335r^8 z)U@zgezjk^8Je!E1EuSZB3%2Mb)kOWydLa9zt@KkPix>mmUQ}V_GsEMY1%QeZ5%;# zWJ7-w(tS9yk;pz|W08HxT9Z%L-3DqM)D~(T)DCJL)E;X6b1Kwz zo(A4BhZ?qf)#|H5YHoMNw^A|m5D>Q9o6^Zz30;%0OH-(O;OQnd9G@r>tEe;3m4 zchde8EXbtI&N*fN&X&H5XzM4^G49Uw_oRL0GrRfEBfN>PtJ#aDcM}!d^7}GLd@v z`Y*S7`pBl9D@5}3H9O~A>D6e}|>3@ZV+ax>K}v z$<})FZm9L*Jy7eX(NOEcd!g2aW1!ZB_d%^Q?}u7vJ^;1891FF+90#?&e30_Bu6qdT z`F|K{JvSa|J@*LIy75ucbN=7|807rF|8dCqfByvQfA;^eHE%o#^&C%xnm3+;YR4p~ zc03Jr9nU~Lcax#spF9ioKIJ*6_a{@J=7p(H|HI)xJ%<_kSO2S##n%6FxKQ)SG{W_N zAk$%E-wglrgzNnZq<<^@Gp&Cs{Vx!%`9z#B{YC#AuJ5_&vqa{p+1_}WBeG6@$v@Yh zUnfI;N8n}uE2P)&2tek;SN(5bYrMZ^fojv$4Scj%SPCPkYzT`kQvWC(^EkUb~LG$64ZE?AN+^iGLa8>i#W-x_{V&zwcj; zZR>w%>wmb!S>azveHx#Tb@VF#hn9Yoe>L^$en8geYy4}mHNGI_t@E$)T^*?Xfuo@IBkDr6uO8GsKz*qF zi3U*n07n<*+kFhw`wVoM>A{AD`E__BD81MiN>?5SwSU`$^lP)n7oLEv^{FU5*_7}; z?umuX3iInyXu7gFOt~!zPomx3+?JxX8=Bs11?#&f7q%w8k$Z}0@sRaT+rl<*{H(Tx z=UBg;R@kmk{S*KcQttjEtR?BJCLS^u0>*wM2g>z}h#uGI%w zuXQRcBz&0b7cCr`-VMN%8!9Y<6)*_Hu$c6N+^}frq3tI`=m+WWD0Y(GI%TYdk1Kr8(&7ILwN81c z@L}S$P7$?E84tBic?4>mLOJN2#|odpE}uD}@Nvp%;(NmEMbjsU%uACBpS0&|qHLb8 zr$nxElG!=uY47=ZMx?ySh0jvn(I4Ueq1GpAul)WLcoO4&D(#eCaiIK4hIUl*xrJG4 zk6Sp6bmx#xl>V4bx+-TzVITbFR_A$<`e&M*b1Dm8u=ezs3dhvM4-#+h@n?}=?U)U< zUYG;5UU&&=y)YMQz3?(ryIz6P{jYlMd(CU#>(;I}3g08XeCC^l^Q@odo4siIn+P|)_igFfBUoX=B&4nAR zoQ<+6XOl=do6Y9?f3KV>k@35w@H5iwcRnfn7#3tcF+1mcTDaBneJ0wvgmm1$ZG~Tv zZmaXTNV#8_opW-9Uz+`uXzL#08Asa-zovbFNVey80(5UHvnZ ze)@Y}e}xR14&v1Bjk12vo;bI#JJ44XAZPO{no(3rd&QhSKGApmh0B|FQ~jGFu)6k=%H%^*LgNX4-E_q@@$A68XUOZvmtuu29;ywLep*Ka8LHe zz%b&sWNr%F?8QTL#88D>dRXg&`S^dh7TyY_n{I>BO~avd(}+M`*Nw!Uj6Dh-%-$ZT zpuG0kJ47oFq8IND+zBh-T`&wslWvfEk7((j>85+RuYKGxf%_<5=Rct7r~9Gw(*scY zX)Kg}8V98(AB56T4?*duhoN-Tcqkq92;~3&0*_NK|Nkdiy^!`j5qOgDZteup!XY|% zVqg;C!`!Dt3x}qoo`(8e*=Jx|+Bq3YS3L_4WuFU7C0`A9ifH+u=`aU+=RfRxcQ&B! zJ6Zq36Sm<0xqh7w&+Dxjfmzs9&hsLEWTr@Ym1gt)Kk%a2vqaNd#G|)n2i_y!ZfA~& zznU9(2^M7Lnw@iA4!mOd-V;r4DSe&nYl=6$1x;_g0j0O*S@`_Go0g9E{{iW(w*qey zFTEv7Z!Lh*Tkk;WEtMlZBx;^p2pe&oi(psA*J8?(E?NRLKOfomTt>Wf%KK0{<^w1l zvm8pttnl)!^zwZOtDIGV_0~_TMfz!t**RxzV4d0PMf11B(?1&mRn|Y70voM=Hkr-u z{{}v?^i`tybJ9`&$AK+Y|HpyPZJzin@QKY6pUP%_+$vJHb|03{> z<=Y;}S-vl2lkY2$eA~_D`+qOrH(tJpQ+JTABD*uN+tTe4tv|l?`U9JJ{(FU+e^I>r zgo99i>klZM@F$c`_zOxW{0-%&4?+3qf1v#Izfj}iFx0s473If8HK_k#Er4UD z)hMbCcfguO`E$h3{`aF+k^EEbqB_|6KM-i+=_si2R2RzM*MsuI`0*CCsHXw;OrBSs zGxLMT6y@Lh9}DFl8$zXP+KUJPXP{b}Y)z<7Z>*z1KM~<#sA6 zB!4&8FIs-cycQ@55?;eC5-l7uPlk$$2_NQ$MGJ@KcOtO98!d_x-^h)L77uM+Pe9G< zB~bHv5^7#Ag__q>Q1f~kYF;mcn%6tSlzU!L7gzz$g<;r@dIq^&MXLwmPtGs8fa{b$ zf%xAGi+Yf*BHLZGbPzq!v*;q?r6)wKmoJ8z=P!Y6$=?fVp1%|x%=Rw2oO0S{FB7dC zNIUuz^(8#+ULjgIw0ZwZDE)F3)O*E#Q2K`Z%)EVd(IDDU;=~1Zp=`pDJ>2av}=?SQIPk@Kmhkp|4e~>0Z`JJb{_D}Mz>uK-0 zo`ITQCPU3H&qB?o&yjCNW=hf2qWnAyna46k4%`8?FRt$)Ai8~8ky|8vKdop6`PFaJ zq52J*@aKyvu~pAZsCr~Cab75T(d$P@x>-fDEu8f~_8MnS(M!~)>xRV7Eqd9rA@(ap ztOu;$v@ZCC{(p`9N9IL+fBS|vFV6Gk#rbdm`=)QgCZvB0>ipH)Q0K1}K%KvO2dcbx zq0U*o2X)SBA=EjmMP5CNq2|>kgwJ=E7Ok{-b$QV;yWj82W?ub3e#1E_M&}u{X2`kw(I|<=v&H7W_O5`yVLBPv&*~wZ$;K0-xYoD)eBjF>@M2l z*^u?eUX^R@g0+6&zWhMHug&f+`Vm|6ov8n%H~{^ezxxU5T+h!?=Zk)UI$!iF9E1HE zT*`T*-=Y5h=^)(2_5J}hkN*kvdw+k4yhr;RY8`P1Y8~+p)H>o{+R?{7T;vPp=Vxf^ ziE2>ueF4;bUmfZkM-8a;VNIxg)ml*gqc)V^r~~CUj)L+Vb>WB?yHBkLHGkKKn!g*s zmhREPV}tSo$B5QH5I@&2*qHDdZX?mcq0QgNLCxPypyu!6q5S9xQ2w|nlpj42>U>Bu zSnf6twxqmaZVS=MgZQtLgD1fX*b0VWYtjvJPZ2F0H2=`X;@bw>6CZcmi53s#|AS`| zj{gsy?uA47e}!8*h`;I(>_~X~>{+6PL(>IkL+OHZxDVQ|?}VLl{lNg~ySas;rHAz>lMa?yzW$>5FVeAZ)Wz~GU_75o_!GYKWZS-t%Bz#@Cfod*!u6fY1yKI&LJRL6 z>|yCR|3`U;5BCgSM7;c)DF1dblz+Pf%D+(#^2{sJ)u^uZEiUuOVH{Ro$l!fcMYsKJ{8SeLd&@;G*dR zgM+Nzz7DK5WdY~^;0v_pdcq&^-4GmN>G=O2>_>g&!5ckWl%KoFu48EMW^2dL;4s3s zkspqE+;>axRxdpq^O*0pAb#7f@5uUW1o5hOB-HwB6qKL59cq1c2h{ql0;(VGgu2eV zpw64z4b>m_c-KAJyY748Zf8tzoQ;F~gZJ4uxZiAk|1UV!#=$tz)@7ul-iLw@!jbUt zpmh18!H0ud7mSz9{P~E;IDFLXoby;Pugf17xj#4I0F z^w6tNdgwLE(>Qz`Y8<`+r90+9>5lnO`sPj256&zIz6HzS+i)m+$NCTdkFD|hF4Xva z4@#dcgjz=~g3}pqi=p(~5-2^l6iUx6Q#|ASeW-Ev0o3?j&UHTGTM=A|t^HZZ`2H}s z%Ckj{@6~WB{%H;IkNMUH*Lm@f@x4B{!LuRH^TyyuT$i5bO~gOp+brA4hs19QR@wd7 z68xBOJtyL~Ro$olF;4nzYw**c^wieiHp)@|eFoKk*o1!`%wek^zkupT*-M-+gI`gf zbTA~{_Tbl)tA2v$w{Lxr-q{vGbgjxrLAp8HJh+SW?X!Sw+{v+y@7lYFKal+@ji4f&8U#CJPAB@C#oOOd5XXjJz+Uy0P z3$dklMUAuWP~)rz)Hv%2_hc^$UCMQA$y^+|#Jdj2IOwHtyDn(st~WfGy)4v+`1aY$ zMT>{rmn%Y75?;gYD_S_@zFZaRPk1A@pJ?IG#?{rZrF%{2TH-6R14N65_PxM$Q0s|- zP&#)Il-?c;rGKx7(%Uyctv7~1twYMW{yy%Fp_{yM1Wm8s3^h)NLXFd5FzntEx{dnd z?yaKL4|$G;hei_K%^e|HIJ9v(3hMd39ZDD9;f>D<%XfF^PRRa$=q||qe`qx2u>UVw zIgsbz-q3x74|B(e77mY$*M@)aUi5(wzmo#T!UD$KIH=!Ac~If-A+Gbk{qymm3D{N6 zBO-qJQIT>VGn?Q44?SV_1kv;;@#xVfL$k@Z+nFe$M<<1zf(4mLX7m0(^o-@3Et(!x z`a0QX6>oYIR{NTEPJz;$Q=xRHWAT|#*3xtSFC^XRhNclO-6=|UPKVN+GoW-Q<)H^= zhAOe8Hz4*4p%<~GqagMy)nDyN-uH?JsDBRJ4PS!ti*sSkRj-6zhWF2XCG@I2cldwW zBY*W8l>a)S^WGqxblf~Boi`tkII}zS9W006!=Z4GcVD56!@W?tYai4&_yI~6?uXKaKSJrk z15kS7Cn#O`Gn6j;1xi=`3Z*N5^X}{KP~+wxl)m``O5gkmr4#=m{fx}tp+lkkJ{V;D z{TuoR-aq%>5c^-u`?e2e?evB7&r3C^=cNGZIbeRb`K3lUKd;w>dXH8sta-h5xDK}F zb+M57?kK2vvM$vBT-Jk{=juaS|C6tedvy5Y&UwEIdG3!5A5VCd(@N z-*9W}t9_@4=(xU)sQIIf*B@;yeYZkZKSa$Rr$hDI8Bp_w%GYz< z0qTCypLSlTBk_8^&xU%w&w+ZbJ3);@zn8Dj%NMZtV7SQQgW*_M&v7Ii3hO?GW%Ilg zi}YK>?3@z~=lyp~p;+S9%-Lj_yiFfA_HT>Tl)K|E*mFHO?=F zdOj|JdOmtVJs+1sJs-WHo{!6*o{!6+o~u4yzg^+=TVJT><4UOK<0`1*xF*={7C8Haw7aUgWz@v~d9m9~8cx@SeWGqV*%>x^4)U6W-r9M6_^7 z_>JM43BSa5lW5_P@S)*b2*21jOtf%uM&{P=<6ZL4Ekys12oDcS?~e$NBA>?7NT~6I zP5ABM3T$2H9Z=UPdx>*r_%6yggChO#kZA3Plruj3n8iOL691@Z@sRV-6T**MITON9z;=r# zgrD@<1<5}#T>IJEP{&xL(h8|Tl9cK&%L`4_mA;TLVZzaWwx|4+ES3!ep7 zQO|7nEZ>38f!dFM39iIn%!ShPFGHQveue9pN&8-f(&d_GrI%l4o|Jxm1M2Bcs=hhkqs?-~Wr`J76~7 z|9j)^XOZ^{zl4AF%7wgN_$~aqXG7jE98|ehFJwLRXZUZz+h_k0EgahZ{UNCR`+uPJ z@Bf9`zdsDMj`0=e*D=+g);9%E`}ozN-UrlxdLK{|>U~ZvSnk#?KB`#jhB~6v2U$ne zEv`>^MYf)3;ZXYl#m5ld%{^MQaA@y^j)giG-4J$$jiAm&H-PE>cemvvW?%;*-p7C7O;Po_r@4C&{4 z3o>oY&N*$1+gZM(XgWga>ts(=yy*yNdf{{^{d9(fpIO|&(&7J$r5DaB?nu1!f+)Rk zHk4jC2TCtc4t~{N9K|l5SyWs|IZb>4vlmS-67l=R#ld3v{g74^xdJTeei_UQ=<0UzNaXCS_;=OU!~w!_EXYO-(!_=9r8Dwq5Mx5!gY@G zTzDes&!fC*zHY@`t=w+K+PA)r@FVM)3rMH)&KE-Io$gS2rw5eY=?SHWE`r*Jy%?(8 zOQ71_%gVj9xVL9RYsY0?yDo>joj%3=?EdvFzQXQbU$goCulOqKpMIjPQ%Fa@^e?`i z^2%opD8AbI`5LnqO&=iA&x4AuwSK-%HvK$Mq+bV_opT0z{d~PhIpxJSSUE$AZ=u{p z)5}H58Cra!m2;D9%DGvjoS|m(`@dc}w^%vDv$qxBO8$}X4$D8Pc(~;sA)EXoMe>g_ zoAdu({yRj*e?{?V(rtC_6iIiN**WL#;(N>3Yq;&E2b1I1&kp8I4|&;26# zA22)TjP>dnCz9{M;)iIb?ia+KIQ3!j@%z8UPguT3M7z(A+V$|hpZm1Ld0gS9OBAnj z&=a6^-;+?|a3a+H^ixp#)03d~r=Ny8U;PY}-kS`i6Q70BiO)glnJG{@aVnHfbf9!% z25LNKsbA-?U8wWQ(+JnNpAH9SW){zYQx^bMb;V{$BLP-z+HoH5*EQ z&4JRHFHwF2-`wJt$*1$wkaO6t6u;`(qMoDIpw2_T4s{;-4XE)ykMxaw^NZia)_yVM zIeWYKE$i>Mix&{C=S-ZDd8e3l-I4RsraRuF9nu-hk9H1VQL(SZl?&Pbhtfw&p!CsF zINx1X{GpA56~*t{^?o3maj;xu9IP;#|NrsE!H1&hqgCWz;I1xSYxjSRNP6D?6Fw2W zvkpoJt%uS<8=$@i+X$tHHbH$Cwi)W&!bec&6{@`UZ-M`-lRjbImrnW=N+)fF(n+6@ zu8+H|`19htPJ;NUFN(jUUBld*XzhZglfHt|N!y`x(%0}%_M76Jq_5%b5G_44owEz3 z-0zFOg%$8S7>0XDKgiuJT6%~--dp?w;q9~gL<@)Ln*GH;5-(jNO4l5)a(*iQh4lRY zpJ?f!>6%};9_gCju$R)0ze5MTauDvx{!x60d|NVq7XRhtgXpQh6>jA~TbKU>b*|uF zD4lZ{UX1OFUSe*LHXs{a9ZV2kveevtfL}LBAV|S zMCwN5pXx=9iD>-P7imWWvvbbT5o*LfMnvZv8)<0q_wxyV zEyqLYvJ;?mSyL!ob|S3rHjA_%Un94Hwv`&Vtfk9ijBs*--lH z9H@QdPEh*G52e2fq4ZY(N`DnW>8~J^9ty#f8;(S%x0_omTD{P8Q55RjO$@eW{KTPj zQ(iBXL^?<0FOnkuqEsY*%53)kBV}fH7ELb^k6!8$xrKbYopVL>QrF0Nuprab?3~jr za=zueMKrxcI_9qn6+h-e=7l_aM0#2{{-5yLzKg6}{r-j0YyagEC_UB7;xCQ#re4KE z^wedM%ZZns5~Zj5KbNwj$! z5?6AFLE?424?*d=hoN-ccqm=>2$ZgS6zV!3gKF2~Q2qA=lrEeAbw1%qsQM>D_1{z8 z^-uDy|7pU9XD3IVfg@qY?%&kNvv&WUlg<5`B69zxn$7S3dG{|PGTyV1=SjEKaYfQi zGdt%@kIXRpdC~L{@r?7Ck=dl*@4OJHgaw%w%+5J4MrK+1*`n!6(s5tsMCQ@H@|iD3 zULw4SZ?4&kroSvQ-d>NqV(ooZHtl^)q#duDopavs+B;9AoVOzLt(-R_3n_Qe^tVLH zc{lR5m9s!L<-8+O&bwyw|36+i3q{(sD6*9N>fgms_iYJOKNC*;vdD*4?uy9!R_+I~ zDR;R@xhu@Z|9jYkyO8@1cp06*V zp0BT(-A*Wdw+l+&eQWLD{Xf+6`91Av;M*P9Lq6#|$aA_k zvJYF&3*TgiG^>^a+oF9bJ zjekHr=YK*yUw=XA=f9!!^C2kx{15q$_Wc_O_z7Y*G5PE}W667p))7>ru%3(IARGwQ?Z)n#V?uiE6*^ z*l43@z8@Px&2!jbFlcKG#)lZOioDx0R(w!1*?S(_?X%ppK#s7W3_Y8Wp9pN+c{?oo+I5nF8 ze&IAIJ$*WCM7d``{T{-ZUiuDD`t>Zr=er%FfvBEefAs9A51n+5Y@V}DBF~xM?3_~= z<+;TUi0JF0D1MvgBPbG{-#3&F4pV*~w>TP!=5;SLT^xnlSBydJlf+54Hk*i+U`v0B zTVN7O2bV(W;1mqI>1b!#6?e--s}GtE?gCS8*XX&h0-k5-yGG9^{UEoSXz3xk=z?f> z!Yi^DiWUyh$33DK5#B!AQ?zhsdiY|vCwocsGUB&ndPOhw;vu@Wx56zww0*tHVP|ws zA1FO_1#I~a{R5>FuY}TxS3&8-e)N;{bboApM|U-xS9wjeobne`4v1dsl@HN{*F^_< zHbfT=iVpT{h%UT7dV^;}bm0({W9@_JcHf6aZzFv&J4__~ zEoSGOTfO^!n}|Lh9v$J82hqnPqoX_k4 zb2OCBycbGmj)Bsd_d)5*`(b_ef#^8uY2=O-tscnze=zzm;oaPaL<@(kx5h^wC489s zh-l%^bm(KSE&cvDln#9Y9?DLLP9%K|_es&xL({iULGQagbm!C2sf^z$=NS?IJy|6E zvu5X<=b}^0o+_GNC7ygv^bPXub}}M<+>K^oLB=&Z=S+)Ew|sAirdO4|PWE}l+x{Lj zJz5E+M_;h;7o)Q*9sB>xpN9|6j?N)odQ_AieF;jB&V|yWl*2sxO7vB1`8`p(?==g5 zUG>>_=;GSVtpDK*IG=jtXWqo#F^%{CQ2y&}sB>!z;C9lzL%YWL-i`k`Pj<) zB>E}kt3BfI>}S!fa3uW7>d8g7Sv{Z2rk*cE>dBd%bH4QI`ATFwZIA9E9l!r4lI|O` z`Tf7>PP2E3rU!{<9DN(zOZxrJ_tEcQLFRk2bI$JQ9!tMhG(AWYg~vLXSLvrOzl{m zSl+)w#@$h|dW0{UURShnCtKsUKDPG58bJB+qY2kIJ_c$W9}5$Vn}$&5B^p`%$Hf|3 z{l~?c5U%kGZCoA?^*o#ar4L@3DnH&Vc4AEazFDk=7vJ1Vk4<>XSSv66Nl@*Oy~H^= zb_(s+{eYCyCf3^0w~4i--e+h(L|3$nwZ~TfLCQNdcA95Hbj9hhGq4@fL(1t8JJZs2 zh@Ity!=^3fcZ{8bt$sNhsvoeMzO=bhtk4Vhd*Rr$FAystUgtx_iB2dMg#73yF`$8aQ6RqaVf-9;dt``bBn0EU#aZQ2M15>UX14Ub-}tZYd*tzS}u= zeoVThYphF5y5(HiJYVODJU3m% z;lrDI#V(@#Q)cywT^!T*n7v|`U=PXmQojE?XDC0`JC@)7y9{do?{X-e(+5iDTtU0n zX8Xpj#FowxrE{)=(mDO0bWVTB_y4gWTnFF(#|GGS@ctj0@Bd@hc{arF4~z}+Y>3|< z9J}7LA%6b`m1EZjO(&JZlzVgRMpyxFf?+s}^n=`?qNRuU&0Au(5kAblRkU!3ei|Md zNq9weglOT=bkZou_y4g9;`#nxw0LN`=T0cya~G8ExjUBEJ@;Ts_l$=1-FsvAk-w2U zMzs78{dIrrLBh9W9*B+g!Xf%=oWd;~G`;Z66*1BIzBob56z^mst^A<;JFYk9rGH+9DfhM58H@4jJRf(pHl)g@OrQ%H&LDNO6pmfn{3ttmkYw7U+%-@F( zuZyiGUb;w>F4_R4i#9^(B9$W@wAtqSk5s5k}_9QmY6zJ$^-UqR`Z?NB=AYpC+SfzmNMpz7J_mA}iY z?_0u$XTOhq2S>vFHvaa-cH8*dBb)KJSL8nIGdt(}5M$h7?-#jWKgNEw`*lDh{3o+> z&d;%5%>Gq0-9bF}>9^QlcApN$ez*H{(CnP^N9<2a|CeaGgLL@qzhj4JpRN~T{}Zbo z*Zf^A{;#$3ux#4ti$m(KChGV9;`w$~7s)qqY7N3GvNhv%EnO|q`mHupzhUF2j#9Y! zQN^nt>p}HjeW-ni22eWXXsG*o43xh=7D{(CgwidIpma-PDBW@#l;3RvrCW}N(k&;z zyI@l&9dsh?&^TxYH7=S%>4O$f{=OxY4mpYRGcv8>C&%;p1)_Ia$4`L;unqAVH{#$- z`*>Se4%@+@5WRu_JEA*IkDnHozdb#ECgrRCGob3nCcHzuBevRc7F0WAFLBO}pX2ox z#O@ULlU{ya^0j;;Fu zNmmk2Sh|vU11BFY>U@7G={nEp5>HX?riJNvXWDnEuS`VObukXfc8T|O{`1G0$IgrA z{c%?)KirM{YqRIaFTj@n73F^~gz~@Lq5N+Tm~tgW#d;;P?&XtKnWRT0Y4242j=JcsI9Pv~Y+&yeWQj zJns*o&Fe#<^vW=(_c^x^uYHMIvG-(ei;tq5Et%o*5neeE|2tCQRxYH!ZjVkXQo2=83)SG zP!7-c^mx|lb>q{mozp~X4|ZwQr_q@sRl0@fR%qMQh(c-z=})eXZSk z{^t;{=l>;3H#hzY*Zpezb;1YuUK1@G68=VfKH{>u0YD|cmlo%xY9@ekvg2Up3)kE|9cXN}qX{!cvbN7jjqqxJERY#eQjZ?JK+ z(d?YFDZbhAeI%OyA|3r)75~iY`82-8>iJkU^?V{y&!=YRoUL9xpIJSd7H*4wK{=QD zJ{PT@ApMt%e?|B;zAr@!htxB1>UPSl$bKE)ZRLI=T7T}a>*c#X@-K0A#lI!L)`^hv zzEip}V}0LSdfgA@lRw%6<-1w1MZA`Q!V4 z!e1l(d6fSFeyb~72)hx!#XUdKakBJgkHiHD%@Y^O=K1X|lD~)9Ij3hLKTmX=46VM4 zy>jUPW=Hl50<_~&t|z>?x9-c4@D}F~etClP)^D)>hb>u$T>)DY-WT?xeOD?TUPZYx zXHk)T4cqa_qyTzY*%3_)SpzEH^{7cPP|*rD5=HcnehfZ-r|AZBXqW4%Pk< zup1odUB@VF{cqOoP}gw>)OA!qUB{hJ{|9y#jKI60uInDC>mLo(fA>QDPuLhZ4BiJn z*vS4rT)}&k2cXWkkA=4rKMv}g`-AZCI^O?7o#T2K>i@sS!!&#Z>i1_Jg?bK|8TzhRN}dW#?R!$BpW|Z%VzvMBhufK&CWT`dgJFg zvBh@EokD({ADaqKg4{>bw;9IIq*;}TESv(}g!Y*#6VtGVWGfTX6Z(I!%ESzK=UbJD z=M%n`wR|%*-m0Cyv{F2>4^?M5{qkbMSEtWgR(`D$=*QU!U#%}$_s`+}jCNm2%uVF= z9z5Ye_hscbJuK>c`m3b(qc2~BdXM)y>DFf7NX)~QZWgt_H6Kb>zX|s)XZ;TkX5UV{ zLw~f-E)Z?}LDSjqLh0=Hpmg>^xF@?Pv5fRvGK&*Syz~$~xm4knADYg7AC|ixBvueV z%v~;8JVf8FO00wx@Ix4eYe+Z9T`gKVh(2DMSWkEjcb#bA&~*0(Sl`{4*i3vQcav!G z(Dsi$g4*Y+g3{kxp!SVEhT1p!1Zv;tQ>cBTtx)?$pF!;#ZG$b{&l5SyugHEOTKSND zqpuQQ!tt}dO6;}qwIi|J#@E-0U8GNDzY$5l!|a^1Gm)R4c8Tm8eVh2sD-W`7^nGHt zXG8Xl_NZK|51O9eM}0bn^#j!V$o)|Jaz8@t%N>9z_ou`!>; z1DivwPg}r#*e&7jwC^NXopM{j#_(j=8=eB&lD;)OgZ8w6`mVceiPmrJO4^s?pJ!NW z8}sz3Q2TwSL7j&@9qN4L8M0Tf{)hVBqyyCVCuhM9r0WQEp7LyXEc3uQa2N5Np#Hzk z4?B~t5b8W;0O}lO5gfjf^MCMf(ud&Lv@;C#e`CdPI`I*xbDB~3Ci7GbzC-#rT)g25 zCjs?+O9@;`d=l#S_DbOa<`?Ftv32n8olAT*pXEN3mHcP_PP@AhzKr{MF5wT5?mX;C zr0a@(BX&1(+*4>*K!dcqr)asHov*1qP&*!4(v3H+V? zt6s1G`%-u^><#zQj?3U={Lkf3-=X(`#}H3FtY7<(z3o z_3Di!@*_8u+>CwxQvAQA8(K2V^5Or9KYaL>l3R(_`c>5W^){&W>u{*`E9J6Y8CfzK zyL{#yC8H>(iSKr^7fruI#9!WBQc)tkb*F6Rv%5sD`);#y&OIgh`E0ak`>yv|xnoN1 zqgD6-`%#a< zQx@a@VGq_LPr#n^#{{VNfKS3Yls6HcvYP#W`bX=7NwARcrwN}*{m)=)y)YU3OUiu~ zhKPTT@Q!c__W5h@|8O($4%F}3WT4JXWnn4lT&V8>rqSMNz8NLct=%(9o+tbw;>Atq zpd&HBIO1GATl`SriGYh}p_YsboxbvDk{lzeF8Y?W-r*=mt; z)|k!u-y3J^Y@C(P+*q>S#_NWXk11!-^o=6pwW?&3m9tqk<$NSkPLv=LKT#E!l^y`vtLoDA73pJumrl z06&%-pdDJzLgt5`N`5B2<_A&Z=NG7bgkPbakKf<{#^dj>9Qz>obuRD^?9<-m{Xf*X zfxqCHuk-$&c%2tKgsuN4_y_9w`xg$*R7)O)<7?aTL@(MqQ|Vka|g-i>#k)fUR?pqV^$R#5Z8$;4~F;S_AmORb^ilQx8Fo@tA%d8!?@p11bcns-ixnomxHnomxL znlH|PItO_s)cn#RsrjX2@+?>Y&n8^+i#Q{5PO?)nzs~|WU+GU460ZFuQRh3gf6|x! zETaA;PB0lFT`gZs%&-4Rr~6P0bsr*dC+&#B-7p3va@%+Wl;TqO?a2&dD!Z&bD{cG_7bOSvYWN5uLCLPg5>#@{(|I%)T4fZ z>|bDhTK=x_+ zB(K0$J&-cM-*6Y_n zt&aynt-}YwzHl(qI{A92a&LetcL-FuBU$0ukoEJOy06S@qmy^pbA7jL z=Cyl7>K|=3`~S(j9?1V*nEn^|zNF9AqxVCtJ0E~rhmM8P+2f$}_=E7N$|sW#!JB72 znS2=D3dh4y@DVr;J_^qx-D7a?3r{8=hvnE$z!aPS?}QV*_Cs68J_WUoodmUxeHy0R zXOhp-kKNqKqV*%Rb?bBRP4%+X}E`?Xp-eqtRt*=(Ya(7K~9rX-z*NRpTwDrY$sP)wbsCC&!+POBnDY+S2`yJw* z>_;{(w`8i4TfF>`eTt90ahqR9==Y~SP3G4JTcOqmpHZIH58JS{e)t?}J@5t8`XC3j z{$Tv0^S?^&B7K#!T|@_cEz;g^%;x-Ga;Mq5L|Y#aPrh%HhsnqP|B9>+b|=4w{Qs}n z{QqxqujM-|j?uiT^!)#?;%$8ZZGG?~)cW9nh5wZN+0xmDYg;Q17K)C;W(Bu17l6TOUgAHh|K% zM?>k^W1#f!u~6-AXyr62ZHz75dxXbf>w20%)qA|xz7xFmHHEvK6H8Aj)%|E*+6)$C znwy<-T9mdd)qOolH2q6D+HrDeD>xFiFV#HRw)B)z`N7t*nJ3$bai>!S?*|aYtQg7I7{{Po&UqmEdv@}LJ>NkizacZ1=71=~-+VYi% zc0ZC(_X8V$nNqmvQpIaLltJl-&QQ9i3zU937tY{*oCl>xyF%%(Zcuvhd?>wm0hC_6 z5X$d&hterMp!8x-D7|`V zrB}d4Gy9faNx1qMGJdZr?T`J^w0=f~W21)#lwJ+X;Wcn5yw>^||8M!PD;-4mpECxE zjFZc!$e#5){vRHGzOQq=Y@UxBMEYY0)Hp4NW2W6ydL!HcZ>GGl)C+lThLsMr`!cNb z7UK2Xi2VLfDSEHtf9Fd^lnyVIo*7X(iu~$_kx>1BP5AAl71-*JJD~bQ_7dmL(!0F- z2+>XVl-_OW?-~_j|Uue%iRw2jG`*EZhtqw0!t~OaD;m zBbJW+e@n;u-_o)FPy7z&(b6Yq&$G_srH{dBP`3IXQvZa~r?FpgCY3&E=_Zvan>M9%D(Q56kn3?u|3?SbnnXDBf2~U1Gq|O` zT6belgKgLcn+{KhGfI8tm!HR$&Y20Ne=4DVcl`w@Klmd2Xa(zkD19;;O0Ud;+LwL_ zYCn1|)V}Y_a2xf$0=2*SD%AgEz6Nz}@^vVE^#;_w-8`s$*ZENUux~=`hrb22f5&w+ zyp{Y5O7s6`^bVAtBfMIe@b~Bk`HO{6{$dfVP55HQ#b_Vr|FNgw_m{$o_m-8uU+Syj z^S!V6W6Zt8tDJVEUru~rWA~{mpvqkdqwqucF7wnX*of;{4QFGofvRsUd=ajLs&_r* z*YIs9{Rn#*={7>m1Dl}cfz1kE$oKzH?W%%m{}$S-_I&KMn|8Grj;{W+H2;2WEBt!{ z{-1F%lm1h@-aCCxxZVSO0j1+}Q2D-udN21CRKD$Sf%|po4x1mp5nD;0LwjGf6Y9O% zE~xi^-+J|Y2c_G;Cw#uUyOesFAATs^WAn#e+04`XM9TZY?3}aTo2T=7Tl>WaxSx9e z^AnWb{+V*uW`8OD6=cGP7js9x@weNp4{DFQy25LY5Sg3K{5NbcZ5o`+^!=FiaTuOSjN$U7i zUe7{%4o-l2PMX4Dlyf4KE^P*-OPfRO_qTxBFK-D`?#Zc>U~2&=lB0bYd=Jf zw@I}lydv9Hv~Xzq_U)ne*H4Agv!_An+0&usi8ElzJu`I{`MbFtM9UBD`R)icubd4v z51hkw>D*T*?E0=hrE$~9Efg&uM0XaYqVz+R6BN-MA(8m7+4%od#O$bOdX;$c#ZniN zZ?_W{(MKhz1T4sun4NQysZz^#p=f$l>FZ?EiZ{IqO|N!_(yLu8{M^)emJa`)l3wka z>PEcuswlmBKGgGj0n~h;a&~Y(yOU3TtOt}I>q)qD#u43kF}C(oFM-mBy`c2trBM2@ zH6fch1Fc^Mq^_}k8DMtK zxi)p3r5`Ac(R@HU>K~jMWc3eD-IUVvUY@!>CEa*~Y@YWaBK4M=opWwX<#pptV#@;G z&8gv*@7B~%%Qs9m`EC)(cdOYs=Qc0ja4+A)sUt{NksX=3)6$I+tv_z}`U4xkU!ic* zZ;Drc-vy=L?uPnb(tAiJoiG}EaOS?$y|5gPfkWZ_)-K-vW6#JukQ$rH>k(-8X&jWk zdk{+BJp`ri9){8px6Hxbm0+fD1_t^13;Zsoa z;UwbMW}i+ygRS{c)O=#y#h5qy$Usdyao?tUr)^=Uk&#S(egpAXMXA}!n?U|iWUx;58qBL@a98k^U6C= z^UAwW^U8bPys{9R_y4J7l*9Y~)Do{8sQ3R0w{ju<^?qtO;c@o^(ZZq4Yx#L-WojMu zS2-Vw%tNb0(ycZ-=d4MsHG7?C^APdOL+exDkdOcW6PbrLr8dHX%qFw>{x9{B<@-jo zd5Cn?HZy*=z+2(Ra1MS#<=QFH>I; zuX#$;JhdHap86VUo>F-m;SM;EbUWc^l)npVoPSGs8o%E`jo%~l)^6f8U+saKul7RC zSNovms~^04`@MWW!Yb!L>No4hpG5lcXR~w8FR5S6{!O&`ig^0(_tf9ke}AM7TL1lF zcFy@T^_QjpTeSI#bkzS(>X6m{PpW!a^HsInoQ2l|;e08kC zZN5^x=BY+d|C`vDc+FGCLCp_M2p^njnm!(u!xP|8c%ron|BtQzFKh;N&apYvJkYHQzt{sQ>Q@9Q>~%KT^p!z*A{BrwSzM|4`#B ze||EQ4yLuP38jm@bYU+ZoA5|FhOPdJLiL~QB~Cn@@cJ2&t|XnbaNhr8uW?G#De70h zK;qNsGS7xh*KO#WW*ueM+l6pluWViCdDwdHxuD zsdpyxR1YZq+>`JH?nUWKY`k17GOl>82%qovN>h&3-RVoMpL)w?{9PuJ?sBtpP9Jal z{r7(beQC%08~UfOgi~hqPhXYRd9VKIe%M2@{gv@DdL#Ba&mn!e48hs@8z6>jMveqv<$cEW48qeKgb%-eUQ?<73#R)`i3%`e>r4`%O9 zk0!o-_8!sVp{+abg*tCF25NnIAJloP`=QQTJpgsyYAn>cb{y1ss|TUhw-3RV?!)Ov zD4*Z|6RmuRAAL0aIN`(G$3zQ<=1-o0Iu|toX6WxHq4u38LY=F53Z~pi>1W8_&3#(5 z{IJ#>;wM}Dl=QQ(!kvF#OR@|V+LjB;nd z@0aubAKLmKYF%ClrSo5a`X1y(sD1HSFwD4_4cijWxM?&cKYkiM3FoHs=UrZAd}x3A z6>Ob%Asv44we(wrS2?eX_|rE;+C9(goHIZDrrB?aW2*C95Kq3h)2qq1+gTvuPv1?y z0}C?mn$7S3q!(Jg)uQ=R(p7tu_AJJ(?OS5`^?OiK=&;y*|)r+mdj^!(4Jl`ZH%X-~Xq-GJCsd zewBFo@$2-r){i^V-&jBHFq`v#>0OroThaU~>8Stv^mkVO_v!uSANQqq+x)agHuKY7 zk$U%;&G&!a{IuWmk3Xh42f)1cOZtH2`$;zWeiq61i`hBnS1;e3iTGpY@!!)2X@|}Y zK--7>1FGNugk9iY#OqwZ-`Mhlhp=@H;2&)LPSU?n@AVHu`A1(_-al4@@{a{jexN#( zf2;xJA8SJS$68SD@oPi9$FBqR9{(t)`&$?4{?>yU2ldNz4xmBV(b#%#4|$J&OxdxX zEe_5!E^7$OVIw#c9#@usFAYr>G=UmN$Cu^D$q7*VzD=RV*@;kouNjozYfkzZnHFU& z%kusjGTu%qYgHz{jQ_{JYeU0~FCaY}bGom6 zncm0iI-s3vKCO)Rz?}0r9crKH47iVeIFokB&vk(Eb7v9G@Bfqq%5>lTWoO&GJ+b^G&!c@1KgH{8NPb)@Gw+F>LuKQT{0o zwO&d0x zZa2}wA@lJCW!(vnyBCTU4$Uw1fCsZZ%PuCqefA>J;$f{Q_xTd2{h?m)6V6*+3bkL> z8#ZMfdl}R^>T<5PkK3p0iZY+Q?}Ro__l4!|m1X@Xf0%ofXyrrvRsXVU2(QRqEm}CV zd42%Yynii}U$~BP3~x${FO|AX+()bme6?5#G(cQM7RQKkKNW zWg}>Jl`~9a-oHg8-K}P`{x2JD_6X7Ded3w-N0vQIzTM6!k$L})vfE)n<_@!SPDRiImfPI}x+{{+;0KEcZQe@vZuoK^Gx$8XcV z(j+PsX|Y9iSt6Nx=gytG&YihaQYtDM6cPpz3E3)<>fC#pOte^{BDB)J5S1cV$kIZk zkfro{zTR{Cef{-(yg&Q-oX`2ZU!Tv}#^z11>*9sHaduriFPrOPyhy*iV0PAd(Yr1t zh&KPfL^<*g6QTUVB(J{7Uj2@RXY$f;SSFKKY4uFabFH2!vZ<#+q@Jl}XPuY5dMZWE z)3m&qq}%GeB9iV^v$M|hycuTC6i3wHx+I?SGb?X4>GwLX=e-7V(yyDHb>7H()6< z&7Y8tetavBdEfdGGOx|an@hard1(DQ4{Ck%4jh<%FYjGg2Is@U@O^K-gx3Eb&<@Rm z3!vu3g@jK{FUni&&4v3rzXHmytb~_vzE@Gc z=Hb;)=XnkE)+;S%&&K~V@3kS_dcrjyGJje4C*FLy!HfUYi~kI2zT8Ooe0Njc=k#BB zX0u4Yu%9Jcuo!9w!E!&++W!I*fsN|H$QGOJL`PqoyV&EcFmVxa~*1bX*<+> z`3?20&3v2p9k%96QS;>vsQL1HsQK~-*uecUZzt`^b$=4AJ<#UMU2u11civv&H>LOF z{p`g<=F49cZs{TO<-WXM39sSq7cCqzpB%{hjqon+LD9mY&6mH!LzzGF{v^Ib=8$Od z(B32X3u?an8%CHX|AErUhv9bS&m&O#@BebV{Qo!4=lzEV+I(3Jmbp3p8h*`})kP~G zGGEs8*CxC?Q%kgPX!B(qsQI!k)O=Zway4Jp$L{7f@;89xup#UWkEfgg?s1}(14-A| z--Pgxn=4v4{Lg&Z)PJ&H*WrmG*WpPb>6)3Hb(;HIn0>Nn^Cj`jmo5G0lW&*PO5}Px z#orp{q)#zB>zwLuWBJY(ZN60cI+?bLxA_v+giE`|=R`Jk?|O`^DqAPA-7&aK0|2d|gKuVQYWEl!u7nsWl;0!OwX>&e+IhW5 z{k_c2I=#Ji9@Eo({Cz1`^DMOf?*}!{-U!w2H$nA#e>gCGvwr|Ag9G7Uc#GA?`X5{8 zZ4jKAF7w~&uhN~+=Gohz=Goh!=Gnne^Xw3)dG-#ddG=1IdG;>vJPq~E)7?<>_%Nt> z{T`@!_moMxzhCaZ&#!%(a{mK_Ykb@fHGZ%Of6)IBw(<{$$}fAd^RRz}cl?lakN6+8 zaMu6WYn+k($Gmnz;z#)(_iS<4)F=E;5`GcK4e6)Re)fe(hyN%1YQnMYJ=13>SMP^D z3-!L}bAG*7I>tYa^Zl_qR^&Xf{wI8s`@DbSbvmCD{Nt^EUy#lDd{HFb1haYn&pV$R zuVdUbQvOL+-emuObh16qnf6ybkC}ne=`PfBol~Hm=d6J9-KqXc@|R~`7Og$d{MIxm zzw`>}=DM${eA+k5Ki%3lLpJT3>D4>S?5y*e*S`PlOT9rky#Mcii+(Th%@%py_if{# z%-hO$Y+tJO3(VhhN&k>L&;O1$Uqjv}d{^nrUx}K3-($X%Uwa>Fzv2VZt<5a(FT|E# z6ZQVqBB=Mb7DK(iwFK(Dt))=!Ykdgk!H>w_!(HZI?$rxx%_e*Wl%H7%bSL(q1wVnh-@5_oxyesqw`tt}htI=}P1*P3pLV4%?T1NRsIKGNm7 zdqqnJ@vHm&2M90E{3=>F#Lpk}|4w*^%x|KFLyqeY|DS|+aSw?W4$%{T`TrrjhWoc@ z;m~vg{%j;CSo-zT-s3eNP7x-Z;>N z@czDB(ZV6&C#XE$+ixlo&i!)2>ts%{aD5*{_J#$`11FQNkFSMj`9{%8Ta@2E4a#q~h4R~!kAFEM(BA6l5IBQ!2KY`FtsY2x$H18u ze^#KQwc~8j;vw1plPe0@Igny)WVx`h`8E~cD>?;_F4fgI;0 zfzE{A=(|+3a7g%Nfh!2_=eu0Aa7g%-fvX5l`MQV}4hg?Hpn0am*Ht9kba|_q^k+BH zNiSRrr6=;Bbb}vCPXx%X_U1#iH)!P*1PZCAuP-E8dE(GaBoMZIkw7w_`7#lR2Bafm zvY9XABI7M#cGf8hROyJMNIQ!IDatMJm55d@q(4goy{x>Rf$mmb580G=ok)2-&CWX4 zd*$^K$v19tZ_<@#ZU_vtbbUlSzP{E@p6lay7CScvZlYf40!TahD;?u&fTh>CRlbo^ z+5d;q3%5Y|^+8a6y$s5)-wNf|Z-esdx5KvN8w|DoHUvr++(A9+*E^y5^)4uXJrv4c z-woyOhmn3@`o6$DungV{2g7pf2cG{U-G+tt2Ogxo3Eu;vop(t1@W8`_$9)fp)}N5$ z8xeSv@Dkr6qJ=}kM+Qa_euM8Z(ZV6&j|ZM4Jn4Hvv~WoH=)lv27x|tNEnJ+MekSmr z{~9viJQow^W(sAA6|Dmq?sZiJb%T`WhV1||RN?@9m z^NQJg|35I@%9$bB{6;!^&uS+8B>h@o7VMvSE$|lkHl<$=ykY5Qi};Z@70z+Y7Ek(; z`e3!M;oI<6IEQh5^yu8cJZ#NRqUN)AsIRu~-N1bEX@4Ht{Pvyqp3wV*FLpi%EFfJi z-!jq0%|g;?TrPqdmy2mf)>#r*X6;xia{fLP83!MUcK$?-@8xh{dR1TrEQ2fIV95Nz z^=$J8I&^Jd4gam20oPNW#`8L;@r+IQ$AJyl8rPpdjceJ9olgUwS$lgrkaQaZn=Bmv zkG;m(9Qd62)P6|(mcUlehK%bk0^7)+@O>%L?w$@L-&cX{7M~Rv_g{;4T#$0U3GA@= zZ$;w26D{7t7knSsO?b-pgGl&~BKdX)ezNj+2X?|6rtA*vf-Td#)gL^Ex+kz#<*%7aa`zVflX(IUm1^mLJm3e+CZ08So!V z_m@bzzeP(2Y0tlb!*GrBZ{P@Qzv$nom^K zHM@yu*D>+5?}YpomanNuz7s|Aon&^_X_nvI>=vTsQ~F)b$@!;}ey`Iiza`8`w=z5H zw9Y@p(w{2Y^-nt5*CzjT%XgYczIOR-EnhpcdHz4YgXKG2wCkO8wC{|3&Nua)DU$E( z{Ie|I*=A>*j``lt6f5P>CS!by4$Xw=?cRAEL*x>u?l_}#AgUGjCEUS;j-nz>q}oUUFw zugS0SyH)#S($&}ISFI=Vp!BjIYMl{)T3_T-&)Q5dzW`h73sL)KAt>Ej2&L1*u$vpp zkHB&mg`Hu7;~C(_MLQm7`)Eb*a3+~wLVOLkShRSEE>7ilC%i+ZRJ3r2j_#4))B5K+ z(ZZqW-|JyFw^#lR#E0D8qQyg75A}gs5A}sw5A}okf544U&#m4B^&D$|sQt46P~UqU z2J+L*r7fvJoKB)b^ayWwW?}xfS{Q#`RzS4tG_e+LD-T!_F z>bdlXp}t2lg7ewKeI)-;>eqW?(7r!15_WbU%YU49c5z3E)=tR!=ZXB$gb#6_6fGRu z_d}k7dT#w`sOQ_CfqKs1S*Yg>o`ZVMU<}lA24kU~GZ+W;oWb)@&l!w|HEH(?aChd# z{7KZeDLos~_^67bkx*96jC1pPsMrKP5kH<3E!>mGoURu1NYRX7m3a zZ~RXc`OeGB`ITOIkng-q%YVhQA>Vm_`d;uB(&zZL=6`{$?<_#XaEq1KI>!eaTl!ql_IF9g@r;|?gmmSZ6N1exzNu*acp_9kVxwc4DSU+1X^PkR zXaS{HPlkHlxh2&7s#Z|XEwqMuZs8QD=N3+d8Xs-!_)iPA#ny9p;?#7zVEbUzJ}$Iz z(*cf{az^lUxC5R^J09cwLp!f$L9Oe~hFaHkgjyG#1EpWjh0@=hpw@-wL9GkVryS|x z3$QirF66j|`z{JzjIHq|4or6rUINSDrEoC3%-W6rC%?w?<%DZIUV*J~dnJ_K>jI^> zuOeR8!PQXDS$2h^;5GDnHQ%+tZr1X}paTI#>$zJS4f>G~0LG)`p7_;>8V1n`|Q4d6i6$O*n>L*Bf#laHKhWtMv6)eTp zcN-u&yL+$)_B3orxjlo|S-zgZ>%DMD{k?*{3Dur~=Ly)&eJc1QEQh0EXZQ^D4{)Crt$v73dp0UZZ5(HU@@H;v z8ppHInIbZeRfy!DYBu-(gOz4a6U`42Prg@z?~-qq^Qy>vHX}G4=A>tsopojgXIZ{? zMe~D7Unldr;>{02^Mh|f`N7#1{#Nj9OUL@3>+k5%Il;Na%MXh3gY%&L;5$%$P~|+s zam|OC_uhlLPT!{-%>y4mUH`}Y(n8|pZx%uMrNvNwX$jPPy41_}p_lI?xY1b_Ty6cc zT%>ms*30*` zmv7wU?W8Nud=vb^(tRshe|+cl2R8G;_X;=vqWA)?haaK*$xrY}`hO?XJh}@`P45ow z@%#nEpZ*;Dg>dZ?LOU;eu?MDq4eo?FrSKh$}R&F zE-0w-I~PK&vo9*}jk=w7UW~1E_$5&DIBqxAd8^Z*GZ`LburX>x&-PwjVag? zyAIHvUHyJZk50WWf`p@0xi`B>gC} z`ToB*{+|$8FF#o@+A9yTUVf_JY0rkNm!DC&Rv$Ed@f_5?!x*Ujld+6n`TKF$6R@9$ zhce>}UL=2q%nPFBhv8!aFNi1K+XZXLx67F$qA%tZ%!N7Wd1hywcM9IMd}~D0 z7fN3z^Pb{OUqI6rA3*7g1+d@xg$0Ye>k^V~alsPHhyO2--dI}jA?c(yMCpx>p!CKv zD7~R_weDU)`W)ZNf>qf1{vE_#t@>>pE1t`BxE5+%wT^mh{~vo9^X$ji-HHDMN~dff zTz=}9PWcR5>*0-1`eYN7KG_WQKEUTt?+0&z(lcA3+VO?8tlDpPu8D1WpjP(5-Df5 z*;!|gcYXXUaz1}4IAG^(`@pJox*N{Cu?#G@YY( zt&^)mt&eL!owu4$=d~8pd94knrt5_2hN{-b(DX+=sP%7sDE-m^O20IO(l3pm^viKj z`sH{i{nD8F_1;1*)cXoe2p>rJ2{1;zO`+EFC&H5TCxx1Ys`LjOai*_%s0HDAE??Al zC{BjW(OoT}-gjsPHO^W?y$5j$9GE^WbSf-^ZQx+o)+-nCoEE z)IP!)^q=(7nNZ{TEU58*Hk6*~2&JRWfg1PclCRhLPNDO>dLY;5`JoFu8=|)^457PB zUsbKUF9}^7(mM5$P-n_fJ(oh&gH8Blp)0Ue-{ny4k-gZtGSr23Ykvfi?yAt$7S8$~ zdyUgIbPe_Cyg=f+g|78%*zAn;c_BY`CHfIkULd6ByR?pmZJKaA%y-r5Rba^y`1lO=|6z6FBjm4S-i%`FzD5k{I~;MvV^faZ&nUufjGctifyMANSOROq6qHUZ zh0<5uq4Zx5D1CLES5HsuM+mU;J#Kz+}?57hVU`$Bz(zaP|h?QewA zpEp6>pXm=n_=5rP1~?GvyY)9iz1MgP)bnJ6ppLr?>bP%(eE%;rIHc?Fc9H84|4+F3 zVF*+|+@bW?cS7~!U9dOyP^jrpZnlkw>(5YqF;xH?zi#u zfNbWC2Sw@~Zg$prD8zh${lDkZMuha;`^Q6%z=_iz4?W6xp9DvS^xov-p~tWXWgZWW zg5$9%Z$w=$|FacOhVCEc8}T5=1?@Z1Ptm@|-KRs(gsOBOk-;gnDX=?0Jw=FVI3BC)P)I%p(3N;$Krg;D=tv*7vI4 zfcjqDn^61nv!T9c{T9^sd)|inz8&SD2j+&}C;vugo`{ZkN94S{Yj)O|A9~O1_eIkY z#FOuX&^Gezau$f_h()1=Fekmp?5wjmw8Zjl6RY;?Nna=Pq2f(PK+_S+pmfA?3ttgh zY3X?WFC^WtDzut-=>}1{VGWdSSPN~xo^(0B^`XzP%PKd7KBk>Rr~)|?$*#3l=}ev3aRHywZCfrANmRZiuP)r%tFnZ zUlacMD)#?r$Ai9aLf>L*ei!8*zJvO%>kfD|`M;;!YQ7&sKUn!chJGS^1mTeIogs8f zwUw2-#FHjg>=s+Q6??q)CMU};>$$35$S3`>7fP4xgVHzqq4dqKPS-gJdQKC`-`4D`)6T1> zy-2O0OC6jqJb3!(h@MTARFT@0nCE`ichmqPjN&QN;lGAKQDIh3Bdf_6OUyRxtg zw#K)p@qHDPzPlPqzjTGtdDlRVw{B3^$F*=^I#8Gg%b*_)hWXZC-2bP2(ltS->#6`s ze}qV<>!%P(cZH$GZv@`XaYmu^R}AWVfpMts94Fw^bWvfluu4zD5%qkLXi4`}9T&I1!^V?S( z(ZtuU@J7<sYq7Y@NzKMjUDzp@uQcNE@9IT|;R`xrwD@3Qnm3-6{K>OY8H8&-G^w$3}Gyn74p z^K3{t<%RbXE`28Ma2_ZePPp3fAXGcBDd(ZWN3qq8hrRd_Q0;ldOGiBSNk$ev=G70W zZ&cxb?vu2U*3#HqhgVJqdpmf_< zINu#tIG%nk&pa=39pe89*MEs#fZE@C5uQao6X0C;rNWF|$4=oy8<&%0a~)3>$?urW z|9`#nmJwU_VtwzDe;nmbfogvRRQsnw9oNeohxApYcRbSwm;QVON^iXirBA0r>A)FK z|3R7wr3Yt0?JK?p^&Ps`;q?pf|4{p#Z$jx@`pNd`-YTrx_j?=ae$yQ4U7ML(I1gL< zX5uFJ4&i+Nr*M8@m5ze8zxN(IlzG2!0mt7V^MPpn2W>xZA?)lfDqKQ*7k9B}@sNGN zrG?80-<1Ba@FOoAvM;zy;g$}vpSGfK72!kNm7;}1+vi&i4`P#X!|hh zVK;X};m5EXegZqg&qzPO{ZzE{(Dnm2LOu7t3F^It%}~$jd=B-T&K9Wm+_pmP$9(~{ zpY|oxe&IH#{kE^5_6f64_r1P`+OOLVmw&|lf2jSwZ($Mf-$6ZZu>iJfs*K@B;p>*hp z7JpK>8TBe2qC=a9TM#cDDoTf*45dR`Lg`S-!C$uyx4~}8b$ANY`(vlVJZ!>=KP}wW z3y0Y4!tJs3UL3^k5blIsR(WRlblTC>cZS&uE6xxh+W@&E99-s9+O@t1`!$JTKj z;}w)!?z=MFg>d;ZIO0CvRpF~W8{#LshV!sjR$e3G7rTl0xof?4=83l7<0t?9zCbwN z%MWQ+FkFD$ejWZFN?(LXcdxH79QM*d^FI+N{}Uzt0beW}_u}D*dwhwobhO$DO)n>j z*FIJ;R6mqJ>E;yF`6z|b&)uPpy9d;HybelF_q6t1AMS;%azyFt-cUOH2B>|+K2YPJ zuh+hQUVCqZyPTWCx7fHI5bkf|dVtwkXJGhdJFmBhrmsmyd&zf;#Vn6F({J(2j_2vS{O}%1(zfo()Oo zhNoa_TtVz{lPhRnd1h+(RcqhNqK&UgsPTl2zIsLBrqdL!>u);t1HKvInb;b?qS`l$ z@cVtQg;I(`n+KI>f4NoUT(9#ip7_&wS&vEp5k z>vX=?fA5JlFT78>sp${G3&K@88rphbA=El#5tQy;47H9}0(VYX8eV4QekfAzM_#$h ztX%2M<+MXOcLj|2R)$xRPsaRF{&j^>!7e`Fl6y6ATz|FKvx*k?*wGRJJ`bNGj;jP%JU(~$w1=Kp}OQ`k5Hqzz# zz6xi(bfVTzUqh`+wo|Tj@i$Pq_gkp>={u-(%?>Di{5|C~^!*UleQ>o8nxFnDT&34` zLg}?#q+gra9o~a2y(UVp{S0*<_7|x8uzMl@`wQ=b<#0dj3=h)p1Ka~5*9Yr=!uOK? zH`vPkJ$%T<=O3cQL-g36;lBwV;{GLCI7A2j6Fx$Chs<+_{-rvs4QoK@lbY~wrdFg5`D(beMau^{p1P6xgooUEqJ=|rYJ*6_NR>{7 zrdt|8>6YW5bj$I?OSd$}-kr&foJcvF(oG^Kc;!HJXj6q-xsd)kDbk$qE^af?!r`&! ze$XW+N7_*TMyI97ywyr1U2C(m&MA>o&2A%_o*|xmr$sI#-!7-Eh@NR5X$N!C?aj_Q z9U`Y&z6(XuGfH14bEe{L-wc{wIU7o^bhPkuBIjB<*8dUdl}?fKh?iawrB}{}(kmB0 z=@pgZqyH}=pT_CMP~-EMf4r1<`LoVYe(^FWe|S06e07DF?@BLU7r4>6Dsrv$$JHYJ z(bep%b4{e1+1H9Tj}uQnpV>nU1)T<`SkCc-gfjU2fpyrJ-sCng9sQKhJ(oap_9vK{|nwKH-;+>HpungV-2SetU zWA}aRz4@W!*L(AKL%laYETZ@3?}^;U@qX;yE7C9Q{}aB+EsvaQ|6Lv)x!?Nl0onB5 zgCgmMo6Y{e*MIiks?h4x?GF&y`=YsN>$MtpT%S~Wg04%bQPZW8j+(c&TV(zM77!Z)Q~iM;BCL*}LF3b%BS`FLjJHNuCu zvqTGrHt)U;4`<$p%qG5u`=)5|(4G@{3+lUqZ$qtj=RmD@=R&P_=RvJ&-+_BLU++Tw zhjc#2-@|<`^1e6E!deYh@cbXtd-e-pH+OMlAuNZBU}w0Lb_{Trh}I5h^ZbWU>(Gy2 zD|cCB1?kE&%SB5EZJu2TwGLecHJ`7Bn$OpG^Z8or2JX7Z$K=m-*Nc`P(w%$bCLOci%5A}&CWVsM7}h8n`rYn@yzF6MfQH!>`q4U3%~y40GcVK=$yeWO*8kC}`MsgY`D+wy zLOS066G?Zx*}VT3%{9A;X#R(I`s;*f3#+GDw5io|qHO9pNhE(Wv-$pyS5FI(d?!a+ z(oP*W#2z=f75U0Dt)p!%-zlQ?+o^UuJntXXJbjwN%|9q!`{eDQ`msHfU+4hk7fy%r z3ui$2ku#zE$XQVS;cO`X&=Jb7oJ09KkLN<2$4*dw;yfrnaXyrvxPbIi(-%fBiu&w7 zFp%+aN%Uenj!UAK60h+g4oqJj?F`G{WpFU$dobods=f=;C3#J`nCA0WI#=6=z_A>}<3 zeGrzz;jl9tLAn9%!=j~w=BFNkyEBhQA18iOdSvu5FCOCWMk(CVL)+JV!peIx`V{e9 z+|i=NLwkSnX{hHrpMh`DZ_h&cvFD&4zcvOoaK}cUCx5OxPPF{c{LFaR%6%a^f%x*w zi=xFt(*rNTk@&lb^luM$Qgm{(YP|vNy#@#By@oW@`;i%_|J}Jz`@mD6p3|&=dM9EY55uHW*hPX3DYag_A&1=NVPreT2C*Oeb zlZ+Gm)9mOww43k$ip+~|i{zhUHsAk^&NKTR(fk_mbA#D@|KGb#KlA4A zjcTXO-(rSwvl(ig|2dq1y@hsaKHCa4pM7ET?DLLyzjwU9Mh{uO-=haC-$B{r`%NU@?`CJ6KfHX0MB4vX^iSF` z3?8-oN1}gQ{(oeX|FB5@BW7ovf4%%iEq_^MPRtk6`KlJH6VrZ5j!64!#j3~TM{3BX zoSGu#)G|Bk)Q(XOuDZ&Bp)78d|y9)cM55kF`{|`E$j~ zKevW@U*if2i?z zCY0Yl3(D`G4dwScLix#apmf8zP`aTLlx{c=YJ8s$HNG$4_^SCXid|^Oc~R_Q!ZnUX zy{~Zz?QZ0|G}akg?S^(8Tn2R=Tn^>Wudw6i`F|+C-i7p2(^thrQ4Eb7@1 zeGrSqvDI%7eNYrjSh}K^^nt>q59IfYV^#N8OW@o5XE#MX$8>`3yLKmhBlC0*sPxxC z>4cteu6uo~pN;1}v0irGddp@!-ykyX`k0+{`g-HJpJ+PaM)J>hZ;B1Dan@fXJ^r6? z-OnBfTf>{-JpKO{s(pjJ_Lae7dO-gDwpf)OxE<;}j=@m6UBy|HrISHrzewDv*M3HQU!?gO#m#CLHY6fGX22S&sm zg5~gGOE)6+DCq{ckBF8I@*cv-*t3MspY~X6lot+p58?6H6P^uu58=t!XwQbchwxPF zY0rkdhwzNbv2vm5jOSoCcT8*?@gaAtXz|c=#q%7mz5j=;_cLCAdSBp0sQalC;GxV* zu}S3bkeMi2erWFxOok0yCzc^T*G-ES5AoM-tb*_%?iA6&p}jva73%$gm!aP0sDyf- zV;YoBcm?Wxj#r`XFHeVhpJN8p{pXob?{mz8dY|JpxI6QD>@Dislzt=jrdJkyW086P6OsBhn2rCBeP;GX(R2>+=$uWl-^jPi*(~B; zw!}V%Iq5BCXPvFFFD&10qUju^uanuPc+)x1bWRpZ=X`D9+hgBYI{ZKL?9rp&#=aw7 zI!Bbw*#V_-F}4r8ta4ZEC(3E++iCW~id`ap^Ox9eJ70TbbH08SInH0q z=Kp`*`PwJibBz0~++Sk{C|CErAoUzn`|ZA$sQ0;lhy9or|FHN&u|Kh&!iJ>(EA}_` z7;MOMO#j3VW6M84o7azE%fI}Kt@-^Z_G6^?#nD4Ne|1bJmm3E@qBCz!pkqNzy#Hjkeem!CdKHvQX7q@3nvXPp*tjtKi?k#btcTUt4- z;_WDRVMS|^a!!k%V&$AFn{wKSI!xKu7Mg~ z-Qd8qKYlGNgL!Z;3|Ko@|C7IoFFzh6T;ofenl6Zk;#Il=+CD}h;nG84C_NN`(nC=w zT@ZuPLvbiQlz`GhMNs=LNvP)&i=m!REP)!oDax0gDaF?K?T#&d(gSMTT}Qaab5CsP z8T1bNqIbMkTsow8ypI=tgO?tg@V@aIu~kk#sPbhmc5aII_xcNxZa{pXh2#IR*El!F zZ=pUN4r0S^pER=l-69dj4&U(z|2h6KuS{5Fcmb?0MOY_wge6UND>Q|9j(of@u2d zCGzY2kcm*bY?9YclcA@->^?)9^D=(=)OZF?f^J;zHB609!5);E8n1}^>b|jJYMk@% z|Mwf@-zwu(x@{ViZhHkvx4jDWJlAyUS(}*=pNTEqCQ7%>g3^7jLGA0j4yR0eGyVn~ zJ^ju22X?%3;=I(Dc$8D7~~6N-wR0(o5^1^wP&rdg&7=y|e*JFMSH7mp+5t+|BWgupDlJo#7Vh z8{mE}T7A&;;a1`gWxj}SBfdlCOVQ$?>6ove^kWuEKYk6RAGgEZnQ!9XlW$Y{+xT~0 zK8P;cp>Qh)nx6atmbpL1cM?Cu{YkWVh)&)WKS=oeX}jZlyl{w4{yF}OXG3)I-uOPx zhUnz|@n1a~qLUA(94i-^9{mkUkNys|5A_F>4m-rS>*4+x|BHUm_qw3nFZvtme$hX$ z6Fdy{edi-k`)>cjBCg+~P|rj9624lOa-CO$dXG8>zPk+n4<}*QfaR256Ka2~7Sujk zZ8!(kf$zb((7&Ab|6v!}TOVFS`UX(nb8ZOr{j)|;-#c|z-+W}@{MtW`!iE#Up|WGMaF5{{z2R&e*5tpA~&(>w+0 zIn7gHJJPj*`rg`UP|s(!g?fIo9hBa!(y<*99TW2Br;GUWGeqh?)9kEsR^n{4JBp@b ziATqtlemU_yPR`H^w4>UPB15Zp4nOF{KN&8?;6o`tkT!XT%>r@vCwqvB~Uu{QVZ{# zxXjXV|34uedwJpt;-zCn>DViwbZi$W9jkKm9`Dtp&+&Ct`Su)?csk>v8`N`0*FyQH zJknM3`4a`$D=Pyc&mZNBJSP-PFoHP#0@3_)h9^|=r3vZ4?y~U{Jw%NIv$IZ5uU*$$yQEip zdF|@$wd)4T9h&Kz=mUqrfmUw+L_aI{M%k2mlSsM!&CWUlymAMMjDwpKw~=nEbBjp2 zL1t&2vc#=s-zJ)_BcAhrd*UwA?{$VG2E&~65VNz+9f>7;w1_OZVlIj)BY*K<-2Lp={Q z0;-=MfqFjdQK)e+67HPxSmFuVKe1wz$a#O<>xU=A5eUk)AI37wLz5t~UUxdEbmVJL*Td_i|KE4CW+&cENH5M#yzRxm1$Dh(6Fw&~ z4_oETg(^q(V&|R2yWaVS=*jmI^DX^*iT5dA=MSPwKS(UVRzE_@TbNkn*^qJ;CzcQ{ zT`KNymL@(TT8vN+r0Jg~K2At?eVX_Ldr;=n#D;{vfAVSKzq(7`pW4X0tLHp6LFul|P`c}L zsCj)0^{>rrO?-hZ-6cwQeF>$zwn6Exui&9fHnE-Y*CF$@sCmMHrjNdX4cu=NJBZJ9 zzY{GUqMN=?{786t<_FQjAv)lv#4f^zxI0A)ho+Bq!zt5#PV9lBr~jPz)8>`^iC=6S z?M)mYU)Rh&k$n5j&N{z(*Tn%5op&(tn^!JG=l!1e!?Phe?~uy1dZFpAzo2y2-%z^i zA1K{*7)o~?fzn<7Lg}ufP`b-kRHeJB!Om_@QH>($y6U2p4^3y)B)*$ltEdj~A-A?@ z@emzSx2PWJq(h+Tt@==Us{xeWYH0b7FKPtK-Q$angPmb6qz10LB&YVzm zBJnlcrlQ3|^wvp5Z3v$~tyxiXFC3z`S`?k^*$}}IaV$- zy>%Lt-f9b5vA^FAwqQPM52X`2Ks(fJ zx!G5U=5L6{-&|RA4e9qfR~2=EIq9p+&N^2Yb+z=@h~{rdNB!3pb+h`fEh;FIpUp4I zE0Uk}%VyjLMC#2qJL?3C7(v(tBK|5=H1cWXixw4HzOZcaMMTm?&CWV8FW<`w*+dPn}XWkFNIp~b%$E#_JDKU>x%kVyL%V)wEC}? zP5r$@>hEoK*15r}zmM2*G3ECqzux!n2emG}k#=bPcoVkT*B`2V1HASP#J2r^sQVDN zK)wGp2x?ti2DKi)6>2?x8`L`db~xW1TyzKRD$fiNX&3wdglk=VC)9eDabok`P{xhs z!Mma6!C~Gwx`%f3aPKX;&%5p*^Hq7#16J<+qLmA6UVIR0UK|cJFFpjjxsMb*49npN z*cpx_{{Z(<(egu^Cm(~mGoy+|6Td0_c+nGHJY>8-sc=gVnQxyedWP^0nWseyhs@W{ z7ClG2=4-Jz$1?`bnKrg)GU?|}8&~wammYFGk1u+`vmw{>i$xPW8*)9rR5a1EA=mRH zm1Fh6s_*}J^H&;M>%a`uyyQa7OH*KHx1#7}@^^8kik2VRJX8t0xzmbXB|hZ7B3eAe zZ%i+mNqDY1L$q*c^T;fydE_;y`v|W?&ChQ@&ChQ_&Cj!;=I6Jd=I6Je=I1$3^YdJ& zb@4penRkljQ(q1DUD4`;_?!2O-h-p3zhAV%#{Z(C4{ZD|C|W}Lu9<}*=@*&J`~Tkf zUn1gfmKJ^Jl?U-R9~CY0Y>2;Eu5ztDi2qwzw3_fC?kds3p{=*qKt1oV7It0E`X6fD zxgKi0`7s)ee{>)cH+4mU%s7e9wuw{3x1pKXQOhxr0( z-S#EadT|@nI`1o}^;;Hd{{9+j{@xD%cYosBqMsO_8=db&=GPq}$MwD0S?7nMAI<(r zv~?Zvtm}3b)k$ie-6b;5?kU<${+#q4v$M|6MZZ|SI!S2jI;F3Z*{670*Fjs?{mQ(n zb=?8d)%G1M`i=JJ{Wi$D?)RcUh}XJK)Vl5v)Vl6ZsC6CXF#rBtRGsq5DvuQXLpe=- zhs|DCaYSTZu9p1Q#>G+Dj0;~9a-7vf{s)nhWISM37j2zb!^*9htVOw6hd}D7om9JZ zKVFpnuFG-BU)6*1SM>?kd*BV=53BM2Q0s|Cx#xA>w{dc{w5;n znkG-M`kE$BB)yOMSKLo|$JUe0u;n+KL;1}XP=57fsC8sZsCKuqa#|-(!B)FPwd+(U z|J%k3KMiW#+15LrcHZ%{hZ~&^$+KzaR_An)emcYKtaE1aEVIuR&HoZlKXpuAOnGIM zos#De-qd%l*$XQ=iJXrMljkMnU(c7#`M5x&+zZXlIv08Uaj~6`vdYfMORStrlUGsh z!ivr!t*r_LY59yd8fzVb|I@_NhHU9|Jx!;a@V2b*(pDJ)~UC7yOYB_Tjc*g z$$KFG|4H5p`TtL{-1?REKk2p3zaMIy{{Zp24j+WN{)R(cKMz5z^B;z~4*2%}>2-a=5lwtgC7;ID{UMS6 z|0JJHR;{Zc`vT7;xi3SxV?@dw>yev1VB%PB?TR7`~>@`j%=~BPWA0&QCvcj_=`KKmdCS2=can6*= zdKah64nta9by_(dz*5)9|>xSBalN$C+Mz-Lu~yUV8OS zINzO}eA~wJTO!v1{-1E^$T?6taxT>Um3dG)_#G%6{4P|z^P#?D^&ZrBQQwEH*zfrO z>iN|LQ0-a>)viVGbL_=X-@94@bsuOclwSQ1X0ShkbKPahHFn*uN-nqYwL&)6?MjjM zt}>hN|9j_ejcDIBUCZ%GKd+-4-9K6n1C;wQ)cvPVpzb?ufV$uGDU?3`3`$pTgwoaY zpY0!PPU^coXea;wO@4lxe(o#Q(WD% zA-b(SbQAuHQYv`#lu>c zpwo_r`tM|8I0e0%3w58M3DkXp6QJ%7G=&COEyg(tuy__f#RzD9cVf|AMRhq{eRfNEhsLe{9HFATKUj) zeHiW`U4;C4o-2y2^-K)vzDyiyU6z1amleToZb@+xmcwG$8J1H105>IC`Owy9-Jx`R z52*FQb#No)^n_Y}T@SVX>IJp_>J7F2x&dna)dy<*)fa00)ema@btBaJi}}O8Bj3N+ zS91a50lV>hIIy_tdu=yEeXs2n`ssh~E0q=BfxXeWRYWh|CerTP&CWW5i-(wfhiK~w z;#p7JS^OgTb~$&6=&QSnhr*on-DYQ;W@K;|G$`d2z#t( z>y2?%?(@atDOb7=QqK!I9@Fh&bNYV*l%9Esc1ssb#D19YNu=kyKgE+RpHrMBJfCn; zx-Ua|=?NEG`{h$;_uamVV%8I;SB|YKUM61aiAt#T#56DcD^Trv)ykhAYCZA>)cWF0uidk~_Phl*I&T-hYvW~(NWaWAJL}9Ve#h*0MO$AG zPruABUS$2ep!hxO=l5mP&mV~7Uto6DS?KliBJ1a}%B97N?R+gMUP*fvRxA}cU(1U> zv~oU@O*zX%%2{r9)>+||v(m~Lnps`Eiu}XiCzgMG@fyp&RyO(9iR52zcGmgW%m0bU zINwmbnRI)d&x${VIqA>L&N>^5H(9>TqOBuH$MJq%yq)^WD!(Y+V(s5*_QHxUMB1M% z{?h8-CY$=d5~)9HcGmgYtAD#ldEXR&OL;n<5PRI@@5oo4*-^aP@_jGb`TW6-6aUV6 zTI~E(yp#H+Ga=X0E=#BDN$I8c_dt!$pGhYj{tLF&6?>t^-9D)G$bP7C^DESP;{eop z;~>;}<2NY1`a9Hm;}59y#v!Qn#-Fea`Tv3);NP^Tn(uJ&KXyEai;obl@edj2{}vy` zmM$0dJzZakZ$tw=shd+$6%JW%R4=K4t@Vefby7{Jby6+j8~JLN)bY}bw*H5@{^}9m z&{w~t0k-ms1JlQqG=yca5gZJUFVVb!|HpoV|J^i(LDJ{K7;I8frRz_?o|DqYd zunBKl(%wto4r+ZNd$H4@t+B|J;{rS%>y^rMyb~=QSl&-=W37+5Ypj*xFyugIaI+q4wPa zq?fMG$JRO~2g?YW;9M)OxBHyd3t1 zTIbvVwJ+ZXYTeNnz6kq4JzsYt)OzVAsQUr^y?&y9Oy>_QsaikW47E1($ZZE0QPteu}gJC!K&XOUp9Nqyt!=W7S0QWA@`VpGmzZ$g=r{|BX$o`8R0KM4!ab)%vF)9@6Ou6i2wBm5ayZ8gvT!P%@^ zpMzRwje(sR4`bos%(#;A)K|lOUbOn4J%{uH{DX2{gnur_|3iJh?IkGPJrQa@c@p%) z$x!>r4wTMML+RWM)PAz7aCb_{RO;*ER)|&~wC}&Y47JZ(3AN8W4Qd_n3e9Ykm4Ql%AafrDqv$ z=)!p=A25zKI`4?+$#+Ha&o?{kyjSwR*&m3eCy6KDf|4!d+vO}2@w1Cd7QvkKVzc@G zZ^=^2w?#BPsq}R+A1U7Ur=jV`BY5BdT||; zUZfoS>&Ge=|NUvnCzR9Fx54a%6`zV+_nS*Tv+I7NY_9uFBFDMeZ2te_UH4l=^E+E9 zZ#(1f3)-Xk^h@lW%zxY9=Y)R+x4|s&nrGAFefB;3)~Txdu-_0bJ@ze>PWui@zwLn1 zf8RstzaOB!ga0Fxj{C{0Z>Lx8F2c(ye=gZ=$F-;A0QSO)pGA&qf5|U)Tzh46T>C_h zYromt|M!mTfF0M+%x@(J$v+JKZTbH!`Q7sWA)EY%MDqV>cGmgJ%m25?IQgfhQYs-Kd7Zy=lYHWX<`BeQw_KUFnl7 zz7s_9H8nfyoap5{$;&rxax>DEXPT!tpQLLc+W9*f>il8jFIy?x{I=qy6HbBBU#CLp zpf6&&>x~)BwKI;Ib&rXNZXJ})7~))8tvo&z-= z&xIO~ouJ0;d2nF*!qoY&3|;^S!;7pRxc^Uk>iI5CT|&6@6hvQLn(FM?qMq-+%#M@y z|Dg236@)k8d%{;@>$>OyHU6)H(ic|~uYKXJQ2V{tz?)$=sD0sU;m#>}seIB;tniEM z(+0f$&lg8D@dZ-_q?4W$r=~-x!c>(`gM7y;k_y8eFiJW4ju&MAHW5y>L5}UKk8DzYl@(gLgp9`**^_nY&VV)4m$+ zP|@mzqlQxdFyf^v?t$8GyccS}@jl4=|EUMa$NT@H<%6al9)zvj;i-p-FV8$AT0F$h zKbqnv=jf0}Q;)#T@G;U2a7T)k4x(d5r5;aJ=@@7_;t9gnW}Zxq#+L38wV(48)PBy> zP=50n*uZ@@HHLC?-RDFr7ur6~SlG=Sml{ue$bDY4c!(c;AvKZkP3ad?6TEPUAAL#T zmJZs!&m^dQpUF`BJ`VkM7yXvT*1k^$YTw6&(kD}(_I)a#^vqPKeV>=1_Ngj4UhP{= z!|v?9lA2DvUEEhis~56wIWsi_j-Ea<^^T3RH&U}~oV}KsP5Q2x*G1C5VK)E&@y6L~ zk$u>=Qg3_ZLH1$iq~>}yWFK~(%C-8S?E}6G^&hSIQ2)_-59+%H@58lRA0NPWw0i-R z9$5(IOk0#%MS1h5Elw@*%7g4jFHL>u*^vF{k5bD#8?qn0Jhj5JA^XuQRgSd>qCZ!s z))GF%T_ajJJodbk?Vqhr`D)IiU0fIFl21~b88;i94I+N(Q;~e1na%n?waM(wqUjmp z$@h6`C;4_cTSWZT7pbinQtuo+thcK z4*!pTJ9>0S>U-j)XGH0lAE5Nik5GC><>)zTQGQ|!066`sWX``TuX~PqY6L&5sjLzxB=+5mo~L@jYaE^Tx$>e z{iX8TCn((fw&K;lCqnt{lc4rlnnCq{b2u>Fva|&(gD1nmu$8ro^*{F1bnDVnN~`=6 ztTvnSPKEO8ZJ_-6X;6N>EtFqx2j$n>L;3X%P=5V%sQrgCp!Ofmq`f-tXF;9!v!VQK zM<{=M4%EH`{;t}jRXv?fxby-zY5K*b7naJOTwHn)_Mptg zrT_6Kd?$_l|5EOULBj2M!pkfj{vT?5T>&+|u7nz2U8rB}y9%m(SHq1?*HS;{VXJeE z$ocAKcGkJJG|z0mXyc1`##f-Uko0?xuT&&oceArj4=>+!|3AKZ zlCC^+eQ94y*Gshi=?ojO0Z|d*cXPiOn z??Ut%r}smRuLq#U*C43zH5h7q4S^b8L!rjkgHYq^A*k^+3~GE0hZ^rAtelZKqmcET z3Q_yeAEsROZxK}gj)oe4yPnm&`Do5K zHvaLW{AD>yt^8#IZBOSeWc z>0TE}x7K8?|DAN}{@?h26ThO=`kamCS1ww6R5ea7di(&jU*kup`;I?B-B&yWbwBZE>aXjQUy#p1{uQoH|CaNo_4m=7!`9zN zB-7u&i{;*2~rPLtW913)=NYeW>e=OsMOP2Jm>QVeZNJ*Gr!ynm@GbjYhC@x^eC) z*t@2ih-Qbx`OR{h!XkL8`8CTu4Zm1AOEf>ob;aqq&9UpcLezfYGa&o_bI-<~{r|Zw z9e=3(|GBLk8EXH3Zfi$|+W(*1){&w1|0^FW588dcbD;JSoC~#2pgkO2&H4|u&!7X; zeu49$;_nNf-h=E2gV-;Gx*vHF)V_g>q4oh>0<{mI6VyI{OQEilE`z#Gx*X~{=?eNo z*Be(Nzl3}hJeayV_d4pkyZD;iYn}Q+u75g9Z}o@7;azfXKtCjXy=Z!9*F{~Su8VGj zx-Pm2>bmr1sOzFzpstI$L0uQ!3Uys{8`O2t?NHZ6cR*bi-3d$P-Id!NPF{FdZvR}x zk3DmHiN<{ zsP_t=f@d->PJ(*gIhpbwbUmH>46^P2v-DGPry@U!pV$sQ3!8DjX&QE(|L4AdytQn) z$o;10MeYmDaK_6EVn$!my=eKplsgmuvB;40vvOZH{jA*C=p*Q%twTwub*LD9-3?s- z!*%6c|HBiNT>rxq@*KDmxfJSp;=k**GGyH!o(C02%!i6A7C^PbLa5_k1QmZQhHAGZ zP;tmosOQVetbWULS2!}XdaZQo`3mIuf9~rxepZQ$pVcPw{6BY%$*+qRk6@=BZ{)6p zBVeVSf91LB?EHIEGUwlVk$lQcu1Qun?O7=@?l$CB;ddyxDR(2RQ@qLKn&jr(EtalI zw0H(T#zA%NJ66uN+^ts5Taqc~ZIN=enOu|H?v(S6NV<1(-=m&t7l=H4_WPtOO6|z~ z(9(S%TD$JF<6*x)?NOQBExpAjvTNLY1Qnm`fr^j!LdC})L&e9RK#j{!N!P^nS#Axo z?wgA7;xBVQhlTJ9I2e9q$HDrKtbY6&Y8-z<`UhR#=I%q*I2QMpe3yHGdc8d7dy(0ZO%WrF1PCauSmU5IQ4e9 zRqu|j40j!OZ9dTAv$|06T0N+Eu0B*8mkD(~HNbx;`8R|eh&xV#I-gF4I-eRz&vX68 zQ0G$VB)XtE6&UT;U$PoElcY906`j5P- z>3}CdR^c?-~29ccXad+{YCBzO@EPF`-9cb(AJ4d+_iC7C#d_smy-YX)Mf6= zkrm&FyWtg3an_Ykan@DvkJQ!fYw5QRscS^eGp_&9AHv=lc1~aCz8-tmbQjU=khtLn z_s!^c7k72v=;$GF!%fngA0%$L#eFOKA?a?S>7m72x54A7+ue6!ua~|fw`lo5*4e)9d(juA`iZ88#HaVU`@3u7 zQ)qGP0I2)sIp`H9v~^ql4O4?; zw{;uZx;+GH-5zTC2i*^uAJ_kGt=q%g!?A1K7PW4VfLgalLap1%r#}7gFzIw&79o#g z{u&M2b06ao^g4f8&o~brbC01M?O%cB_c+viIu>f4c>-#l83&c`lQ3R9(LEj(!U=FN ze9B#WT?Vb3Nl^3IWT^S93h0{q?fRHOX1-*(N7N>o4r2D|W9W-GO9Eq`yksY3r{N zlWUT5+@+RorD**n|AwhD*{#2z_1Ao;{#s!Ah3-Y>$NF#mwb;D`yZTF1e=UXTuVqmE zMLw*5E0k}>k6TU7_zk{7KI*?$q0?V>UvD*jiX&cwiaXXo#UZal#T#p(@_EBazs^bj zCglIW?u~Z574C97-U^d>|IfX_j(4MI>pOnrzuCRX^55)!+pTzht9y&}bCqP)`D&5& z-fD79@-3|&$Zw1E%QpA>`0Y(@7tz0Ca!vAG_j@M4FIxP9op#va{>aMN?f$^Z*(sTF zc8R3lZ8HD=b;|ijB;6kOUgx->#SnH>+;`?N=8@^k5J{L8L! z{w37-{|ai{ehoElzkwRJ-$ISseNgAecTnT}d#9cEL-pGMsBwG{Y8?LnHI9G8zqI%# z_aSH9gPc#lx_^d+@E153{?B*YZT>vWJf-&&jzFy!zmwng)KT{z$XYK%trventrvem ztry2&xAZ^mzhMzP4m-mWv`;MkuSmOc{f}Pjhs&e+H^WocqxP#KnjNw()bnJbACj&w znjW$qHSnB-zC)^^XnJVt#mTU7x{;>|_N;Vc(d^K!pHG3hZf*+o-0D=Qb)y+Pp33r^ zPP%&O(?m-LIiBX87U+AV&k#)ySs%{ywDi=j575@xv!L#8w1QeEvaxHOXpMX@)y8uU z`Rp!k>uKlY16dExmfrG(wAZo{W8Z}xjva#iF4On$+=KoL^moI3P_p8`p7;&LuNU(1 zSJ?kYJ$2snf&V+-^~0|D?p~<*?mnpbu0Pa#Hvp=BIZ)RVxlTTACm#s-iZ<`zM>%0n2#$aWkLJCYC*R}ZK1M_`^HEf!Ut=co|36Rdyq6H^ z{{qh-{PrdXiue_pT$8-t^MJ{NM4R`p)82zU!>yc$JVUIUp^_=*L6P(inauUSQ_gUa zbR#??o#Tc!?~Ni|QR-pOW0tN+w00Y9$HVnL?NOP0RC=5DWLLkAftvRoclu>4R6jle z)!*Z=$BQR;o`i*PJRA%sT79|xr+nW3^E_qsnBc6{vrL)JK(<&1;b zP~$5JH7^%K&C9jd6(yduM{$0Mr_}MExv%6+&+b{SHv2ZNH}2oK zdluuT!%FTmS9n|4ZR7;b>`;YPSEy~(qM{N77%78!@!|L6Gh|EVgd|4&up*Kg}q z&)Zh+TVlIulneR))Hcr!8`tl7w%a&)M>6C3U6K6WGr1=DzB8_Oh?M(*XBU3=Y~3kZ zxv<0Dbg$XF;b)ZlA?#kl^*_8D?t#7FUf36Y4Et~GHT(Nnu2WR+Pd%bgGjd~W&H zh?Xxz|An<c{`CBA?RnJd&Hg_T`=2JW|IcYp zFC))&N~WvVZ0z=YA4@kD?KmL% zQ@p2}e^c+N_^Td}a+-OwkPDGvn<3?=$^&HasIUml2E2_EvhhGz~oCp6V zUg===3%%#VS&J_8UI0_DBP@j%d0j2$G9F>}QT#84br)UY?d0eofc#@R)1*Efx5sRDF97s90dT(>efs}K*{Hz?99VVYU;Xv3O>i_I_!C|lm)ceSH z!zbW9a3bsp{fqi~d%;<-H%!4kuoT{F<@OV8yus|rq`MDJU)0~5WA*`}*n`^`V#4OxCcvEAYd?*F5|6?+(-pndY8-dBjg zSuhIqyf6k!VI1mxhy;A~)k1Fp?6$SgI}pCLu+aN}<$u3u=LNL)B?iIO>A~LNUY*wu zd53si#2G^+YyB6g??WcD{yX&_ZuQr5%n_v5^Td%*&kaYxAF0Q~Q2!w)g8C1^X!!gZ zuK(dnuRiJ>WA%AVwDSaVUOn!efPQSnSnm@~|3dnIocBrmbUs4*f4uyx{~_}O>py&p z``S;zpQ=j02sOKFc{sOPgOm(uKtt5=&vYrShoeP}{=KJ@c*4y{t z47dZn46$do-MZ7e+x&NlcHThdwGX{}EdP(3{P$S?dd|KVyPmUu49{8giT5+}`_%FK z%>3?HRO9`|^8MWV1^H^-fgHz|-mj1~&LQLVYx!9}!R(G(zx5t8zkS~CoOF`SQE56tg+zW*aEgFm6KyXcVj7fb)MXzd3%KaY5Sg-cc*@%{$8Y(3&V z3=dQv@g6n*-$nC>tml7t|1$lbq8$%po;>C~Zu-B)b`{KPF#DRV|9DTJXaB#`E+?#A z)}~!~b@E(XKV*njf5?7^x_MeZ+5ewcJAYbSVf&sl^J@1sH^_5kOe$%Z*C@}`Vk+z1 zN#rx5C9qUiYJC*ePT}?%Mt|HD@*etI_p60{md0Bay4^NZK z`Ea^Oe$7p0|G!h87UD^ZtG&rH^IRt_fi2-ucotj+TaoW9#%*?<_R(?ukF4v*HrSUl zU$j+y%G>3&r#`)1XN%P59FgNb*D0sHm~k7|ndf1jRMH`@qjS9H+woo?*^XEGStS?d zU1WZ&|9LLn3%ywFXzy7=zH`a*f3shjcZHMBWtPw7k}V(UXO&!;ca@V5q}{I0yVlz6 z8qwMfQvc4%pZZ^C<&@9q;`H0~PW`RlT8v3|&ATzL_C5)0F)@8p-pzTn_mSX)LBxx< zV1IT#_XFSy@K!jLcDoI~iY>S2-AO&8<#&kf#&fyR2MTDdUuz0D8h4M)Fo^Dxo$Fmuo55qYD~*K8gsnjU7(oBwd$7%Q(RZ?sbnNPj(& z_b9UFH^@BonEWgqWWUMdc~2<6B8jV*bRuNtXXp zqO}WTU&Z9SXDq*`o&27${JN#5|9a_{MDvH4Bk_9~o?v{$8VhW!60FNHt<{}Ig}+I`hDJeVrU zE5p9KcuroaV~5-ioGZQgL+&%q%bV|`~ObAZWYz*L-uX$Q9hP0w0%tOT8- zQ1{Khhx$J3eprFu0oZiG!Mq+Lb70Sf?S1FMez1ep<2=!>6Jh50^!xd+i1Zi0_N40w^_`mwp}vcAk@VE> zVz`y@bqV~4@zn`xf8eEX2N&afN24vvP``)cn$z{~{Y+yHM`c%!c?JahhyzMC97%si=z{eQ6Qyl%c*U{Si8 z?^eeSGyf+2ZSaPLJ$$#rN!2}kcfhL6J$!edwg06&}`^#$RzFa+;{VK}-v>dS|Z!w7s5 z#>t=W|2yL_ls5^$oEi(`Ub&UmJam|mVfn7 z-w-$wj`S)19qxP3r}+0F$;`jQMA8p8neYEN<&U)T^}mf#q`wP33^%+!+E)a}E*$L} zYx#}wJ!1JiDw+Hq6UlFk$u-Hxo&3gHe)o{i6Qu70$H7q5lfLn!D?o;fj|skKkfY@j zeNWN9x{iX#lYEnrH6K9cgQw+Z#|<+FlYWZwrM;%Y;Z@K2p2u%=)imF8jvs6@rfRzM zmJVi)tD50^5&ctDFNmgxnN!H`C8+;_%!EA`&hots`@tms(el}1JKeX0?C&i0rP0?U zQ#wxaNsIPfffDS~s^<9SVSk~j)Hl~D2ez4ARVKZa3p3|b&G#)dzXhV{Vdi}5vj{G! zTI^em{k<(qd`lfWY_qCrnQyrx!#3-xR`^yrGHkQ4>J{IsjttwpUA0R2SpG0`C;7hy z?_j=M1EcVDxTk8ZZ=L1;hG_nfc#!oUKFa-*^>FAs)_>S@VWqDE_JbQq7cJi)+I1q# z{G4(&LH*xlv#<7gU<>j<%BzCc)85ta>#D83w@Lqf)mx&K3;Cb(Hs8DGf2!Kk`|ua;Q|y3$V*dc{V4mE`{IjEcm+wQ;)g*U2{q>>sm#cb@?<4#= zFW%$(7<;sQuW0=Y+0Xll?=wsHsgv$AOQ-Kq)L_^C?9bso%KrlPL;e!J_6F-eTnE2~ znboZSuyfA=fQ!v8m@eddSZElYp*9f5zOe)s)Bx-+Veiq_sRvkiWK z!uq8D3${c)CV$%XZ+IH=ad^wZe|`VJGw1*7bNSV7Cqz3An0XfEWN^-S^EXF-SM}+l>0#y>YtHbWiN05L3(@p2^WN%~ z{#NKc)n|#Ohg`>I``e%oRJRsQ4>R+t+xpK&AFpmFnjYGJkj{bn57N1?>EibO4*1<) zeV*8E5bXr{zTo-(j_3zhUm%(uqQA(0Av_6sldd*Ht1lMK4#ziSJ?i3jjlbV@ssD1) zzrOi0(aMKrzXG1&_&rd|`ZI}Nu6Fd-So&-I*ID|`qNRubMM-*|`rPQRpsTPJxeF`9=QGR{m(G{70m>@?q9Bn;!FzxALFxkFoL} zmrVI%Mf{#Hxh6Tz|D?&|#b#r;e!`yBdD8^{M5jGqR-a8z`6prb&^|EBzv&tOWLUKM z8UNF81e}6Bh8<=N+%(nyEb;@$Fzdlh)BMjN4?~7oBR4(opKj@%_s>8-6+O&)Zqp0? z7m+nSV4D{=z2u+i92d+g-t@A67WO&#!>oCmiv6?U;LXMUBpeD;*gwM#v%cIk$Df8z zZJgsTG5Z{UDfUCyVb*V(=K9O5y?Os1`R`5h{qx}9&GY>WoO-~lx|=lzcZ}FW9)z zUxhtdzRACt`Al&fB#zr6z2y(dzuNzn<+Ihv=Pk>p&b)2@x3M>Z@0fkNV}D1q?_$1- z{ok_pY@Ughzc1SQ11a|dlbQ_p*O0zW@#iLU{qO(M()9~K+g~OB9qYgLe~TP*eIs(8 z)tiLq_xZm^A9Z~vnjWIx?>~rsfa`#0_hrSiD}M0*OnK4rAN@Z$?FnhmL(*G&!i-_% zzxaPApLTP974iSgf7tPd_#ctp{9#6e%0K)^VYAXd>^P$3e~Q+Qs(-`OG0C<+toC@0 z`~RhWLDxT`)mzl}KuG8pE@H@Cs2Ez8j`+lpq}N&`j7p@iTZ&|?Ak{rY9Cnx zsC{G&q4tqc9{Z7+1WvYgY!qlhJ~3Bg(aMF`n*~lWd(%KO>_OM5qS+z#=7B7;pB8A2 zJ?c7LG&{t8MxZTnVOh&S3+&BZXPR6-r=`fe+B$GnK=W!V$;@lnBJJ1O?(svTEUn<&tbcp@(KxgdvWmkyUuMAv;UDsC-`Rc$m$T}|} z7R(}9+Cd*DKh`` z3UFSx&2aS=$*)hKFZS-tL*kFTf5tfCIm^9)0pz3SO81d&MoE9kq~rcSjE+jv3$NId0pL*oGe4>pbh&~Vqp%1%)qUj;}a3F$yfGb}#J+%Fa zQK9?^xa+D1^P?AnX$>9}unnFyqgP!GWRZW9cEH z>0w62q6Y)RO#hH*dYI9wa(G~*=|_mBhZ%<|Mg@vY|FCF!n6Y!+=)f5C(eg(Ej|OVT z4P@LrCcXK=j473m2gY+;?dFaZ@qZ#P&hdx%KPkQW!;Deo69P|}-$c>IFC6Q2O$t1N zy?oAOk$j#O?fORgLlsj3&zpW~;92w<*ATyHf#;Alt|8@3mtR};Gt4+`?u@`o=J$eV z>0X4-;E&AvH8TUnW`9{U`z)yE%d?@LFDId%FJsR*QIQJFGyk+`{w0q89LK-Z@t+HI z|DX)&{J}rt)XD{c`N{__wtN`O(nL*8$CHLx7+tb8@F0`7q; zX+MwamB4D`@;R@Hw96{d(n+5xe=YF3>DP#+hhu%NwShM+-5Vn5)`@0^WBso6fl9NN zi`Xkf8>iB@n7cW!0X8Vx9N1{*)26^SC|r!d28S;Wc3@Q-`- zca(n^_!xa(*GD4yJtFD%I`hfLB7UC)KF6=O>r)ZG&qVxcoN_)FGu~&O`2xGXfA%Gu zT-s~)SCli0`Q~fnNhRL|zC+gh^DXITl6-dcG=IO`9b^+2Yxlb!-3z-?{J_&$d%El?1ds-sn=g7*CdYx{xSJ)k@?A+JP!M8@FtP%eUg8X_p^`Y1l0a&SFm>e z&4AixT?guY*Sb*qu@9-NQ_%=jaV!Z{&vXz70J8hy9RG4!T-QE9Lz^sQI!n z)c)=!Q0;pPJdkV}JUytmtXc3>Sf{v|$u-HW;Aue}&*`G=&&H4Qym{~}{G#P&h&B#e zK%M7jLY?O=q0V#ctSha8X9v|@ZG+iC#RIJ+(_U>v@^5Q$O|o5(7C=5*B;7f|izu(K z?7ZN)l;7Od-sJK*=ZWOkG1$TKJ6|&ST_BRaqsjdL*U9f9k@meLcrp2nfR|eRJBfCF zLdv@=cqR5zmt8J$d{>BOm%gyAeYa%Mx-8Hg4bF-I!mS=*NN1li^(;~ z>z#VsVD(6qcMaZT`QIp7{*dx-4&F+>xf^Z~DZiU&>$&v9Qnv?hgCpSG*vD4f5xmpN z;rieFy9e*WU-JND9_S%I>cRd$OW!kikEQP!>}~$NMC(6D{(Xae%-%OR!0i1*v)>EV zzxP4)Z-1!%#ZJ21V2-8B4SFn{TeRmh5PM$GYxcaL-|Rlo?sG!oxIi$3K9&xOR$oZE z{9xG9I8$EZkq#exH|=aj`o+AASidlo>g6Selj;2^W#FPi-U$Bs;Y4-O7B z`w-FWkn`@r;4mxqA*bA7BJ~;(9B%a*5gcXdMv69%L)PVogQHDfB-*+RnGYWcKF;{* z?Rr#X{5&RdTw|R4AGiE-H;fIAv-D4h*8h-l#|NLZa>oZJntg(3`v)QOh5lHS&TlcxorL$>uFne|_OmcBOKjNmNudm;Fu zlMa&4OTn2=I!L;gWIR z>A9li2eHo&&NKV`;8HvP76%vD`L|Fq=ied`|HUTPB$qhtyVTluSZaB2nWbMId=>v_ z`HJ95r~Z)ozaqVr2PtoLaFzM54z9r-+3=cZc8Gm#@O87V4X(%Dr{ay^I>!#l|4r#_ zTtVW>@?a(USh_;Ad?5X^A-Ea)$%{9Nq}wFg_<`8B1h<;KN+f-?Xz6S9Zw0qmy0=A3 z2dUpX!R>Ga+-dfAgYRKizeCD-Kez)~{SG<)59DY0Le|3%gS)K!4}-g5edImlmtFRe zXzM1#?~~wO^ZO+DvH5)x{0zTNWuJ<+Zi+kB*95Nz6)BbLV-}Kr0see)GK#=vB`X3bW=l;L>+qz9Xe-8d+ z{yzr~Sv`La{)#=j>=&^%UO=DWIuiWN{Eh?g$il&F?FAjA=&o4Pe(~Eaj@cloi_oOa^FTl&8-jlil z>iwZBq280a3hF(ntD)YLx(4dI7uQ04_o6e@cQ3AkUhG|<-s`#^>iY{fz%j3N4c$n6 z{N?Qbhk7sdCaCwJZib4_Zh?x|xH3Mbu1PAE9CkpFBGu+eIovT(aMKoPjLl9`DPD^*u$d5 z5s>TrXefd`cTO}EH+xL9`a#ksLWP#TKqUP@(c%p0w^Te3x*wjj;epU#vkww&eT5mj zD~5)Kz`7fTh8{BegQC?Ba@{;ERAl<$p%Lgce?rO`85)JGt7MP^?hnth>DJ~H=d7KfHv`AbAAA7(5pSr%Gh>6VL@4szdQWoQ-l@;R@F z)azBz?wd&8y>fMEjp<(#EgfWBydHYP%2_K~IWQx)a$RVHT_;wA-VEuwXT433FEg*L%Ga5MGuxVD70BA3sp5~*LcX!U?&ySUy8Z8!Vd zBKB>foj=l#Dt{;Rp6TBeEk1yJYU2ISPD{5#B;5z1oj20An7cc)3pOa*9r~2{sNLKT zMf^Sr?ZHpy0Yu&#`WRW~0pvXRM1IyDkpI@jr5ieWWM_@v=8=%`>{`~{9ZIWhpLccox5dYt#H-E_exg(*!%>Q>0|D&Nl9Dj)apVFH@v(-*Hf&)2nT~%0^FP&f za=0P>OhBKbCQ{2GgV_ozv@sp(H~^i54aZO*CT=3(6*Y9?}jC@XwgSjW>` zB%jkA|K{euzvPT?EAww5;(unirTMoK@juJ)ZzXd5lO1kH{rb9Ei;UwoB7SYdwQ)l` z5x=v;=i%4eb&iPNxgvh;o&3&o^6L=35WhaI^F{nF5b^8i_+2Pwobt*=;ftwfJJw%l z_n9t%HLTN}pw{n8VWQ-+@a6bDN?Zc@UjCKgE8sWqD)jnZKFnxX%K8tr-d_W?-d_v# zz5dQn|4+IOE-dL1zJYX0O0G95PDRdWiCGp7UWW`T+aJ(~0?v!lf4iYEb74CsuaT3h%!MmZpcXbcc{{?!&$*>oG zHKo17eUQIGhWtmMZ@3?_>LEUf{$BiaAL%}*`$qlI|5}<89ssk-a>BXjb$oDaj>{eP zIO*ZoESEQ&=g5%x-xu~fG9+Cf976u9G$?XEC3lwOg|uTBo|x-R=1VT|CL>|ZqtS2y za#dwaJpUcmn>g+8eq}VNsazN4n9X#et8Q{?YJQ zOaGWiTslT1PJUdpb{FHtPllg>g>W1k3^_kIetRCv_s=GTpR)WWI_J+*BJDIu<4;g^sVht6>9FF?hs zFFJnM8J9D|N#v;|v%@b_uNft?By;?;Me^bPKg=#J4$m?FlxX8PZT=;at(_t7}-F0yn>!;9f`cxiYU={0`E9qX5eSJUnT zTq{J{eWgfwtHZCrZSYkXC|Mm|W$9O|-N@(l@M~s&J-h~tJ?qdH79u23!x%t0)g|u<|QJ`n^)Leuva|Q+Oj>1gp$%vxwgo(flCaFQ^W`ZT79= z*!x^>iDrkS-xl6s_U++!vES=@M>IR+_}`PA>!J5W(?iPN8UDc1?+ow8Pvc=1)ObK9 z-w(rkkTo7Yf*J>sE0cS}ACsT1cOlm~pM*cde_QfX(XMxD<(ly4*mb@^^7|tEr6WV~ z`6~Q1dVL>GTvhT-_&e+si@p_!YxjxP?~wZL4}Wj@><|B7eg{PS4vOX{{mykig@1%+ zSNs(I6??S&Q26I?ZM*_mzkiY5{2}qdZ{a_vPrJE?Mf{J1e|P*L{zs)Ze@H$54F65K zQRRP$_#YE3&VtnQpYU<3=RaXrzWn|b@jD@!AEZ4p^6O*&prnq7y{>3+Rz0Ze17z}R zke_M(4f31dzoMj}i2q5V`JW6GUp0b??;AtK_t+Vir{p&yU8=mPNV-!+izgxDH!J^) zeD(k7`KQ4Wh>Txz(flC&+akX;_T|Y|`DdDctNfO54f0u*u9fVh%N8viq}(?7XIuKV zBKCHo*`=SJJU9Ow$oK#9JD7ia5x?_9^MlNX=jUI9Uv}{YV#fUPjv{^+igtY{{mSx- z^DnjXE)lVJ674!#`t0J%@~^~iUHRoA_AA786|@(`epUXp*uN^hTEu>h*lrVcNIP`S zzn@$V(#-`nx; zWB!Yhee(yHe?Jlbdqw>36Y=lw_z!UWbMtfT_;d3;_$5l*qQy~=apcYSA!{DVgPKQ> zsh2-LjI4Pi;Mjvu^GV3@!%iF)$`RB~g*|JpV^OsU)6Xh<<9x!2AUDn^96A znf4nfnxB|me1HBB^M63Jb!3qF50-4_F{GUz%pVFD!4c;FkZAtH%zwCK^M~X=I)5bm z29C0Hqw^nz(~*l{cJb)^M@X-A2jcf={^Q6qlVkE9gC$V1;wMOcWAi5!1zhuZo-oAxHRa(puu zzLWn}KK~(sZzIow+w%3k^*j07kq4&U`TzBw-k*Dqe$jXB-iP`g{SK)29Y28Tzn#>3 zdumtyZe+b*De8U357E2RALZ|%zk~Qe>;Jv5F#U1*S?_uN1^-AL%Rf%NI;8#iz0aBn^&V>jsP|VJ!ulNFN$_Cm$M-O=qG%IqNBSYQ;Jw4LgkshT|04cvP3HN3q;}mpTjYJ#b0X(D`9a=iZ67($ zksXMA1+^*-Un@ObKy$fcyOm+mB5dT8G#ybS)| zcjT{#bdKox<&`4OFRv2uzuM%Qoypm#*>#IAjy zqV|Dyhnn~9f|~cpr*$3I-I05cpQBwweOJDx>3ck(zUbuI*%l6Ae(Ca&cQK;v7F{t{*t=vSUz_E*}-$1B+G=)(6 zWbTJ*hX)G7Btcp&*uWR&&e@W?Rh$KfXP{$FII_2VdUtoB*p zN4<(755p1gaU1uKMMm4We?&6l{!x)}^q9#!|98gy<09j2Y-9p{dy`Ly_>D8UCi!G! zyvY+pdtQ#6ewi4VV&yy?dCJO}B$;w1i==U z^7P2!>9y?(iCbqxUZ7lE-$CpzMqa{S<406K&x98vzYH}lX3>6%?`AvgnM5BiPDhGi zAxy!+u*B-^NkZ$lIZ)5zN}-;|&4qd%R|a+6I1g&wpAWU}FMxU;w~%`A+&{9&>bE$u z1ii+gsQY|Nq3+u)gSv0G9BLe_fEs@*p~l}UP~-1a8@H<>tC2Ns#nR%}B5NY9PC9R) z#jCGFyZ*-h3d+2q2ElyAF zh`eupJ0c(8r}hv>la}cz+ym zW#=J(0u?WP3iW-i&*18GP2?LJuU|zzw|@UZGUN42k@5PK$u-HZo$>mOXy5Dlmh@}W z`y$`tUzGYz#GmK?==C4*{ZQXoJHT<4QSL#gxQn>S-lO}G`CakOPf&5rA?({zKSzE+ zR(vBWzWEg@KKczRu00Hor;bF9Qf|HU@1m6pEw1?k9!&iiIgWjI@n4Z+jvcbz{w=-v zL)QC$A}7#yP5&#J9uhCOqIIH*7cxZCLyL3j!fxq$(M;?;()C5NL;Jo)1GAqTZ3v6f zCr3|$ond4AW9des`9q6~n#fLjodWf~cT=eN=v1ih0XKvC9&i@a|94J<|MLCv)1!*} znn%xwx-9O4nFHwO7O-{t%;;H^SCncgT6xgkpKJy7U65>;N4~A0zAw`T>izq+Q0sI% zsCD{msCe`o*f@P|^gQy-O1Bp+Uuf%e2dFspe5mV@3#gaAuh9{?FnwWE@$!)LMWUsH ztk0K3ujDv(B|C}CvzLn4FEhC&d3p2-ldlwQUB^zktD{DdJU{oe67hf z$pFhS8`sM|wkPAXmR+Manx6ar=o`3hvV0p-fBEZukXxYE{cdKzHF_K6 z$_`ogZ;#%AUF*K6b^lJNb-z2*x=%jL&po2|A{UnRjNVN?&0Y7H%>IAzl6tPb(Oyx- zW4$GF{`C=QhrTBB|Gy~b9rC>*`P~=oPkvf2Ao75y8@c&<)_{OjnOu{6E;`-PJug~ZgCFP1jOfew?M=QQlJAQq*Cbzx&NTUD(c%*9^#81A ziPb9=oo)3>N~T`LBI#2m*Cf+Uy-J+poD(hOIMpAJeC9^yBdfp4p!#nfRDYt!z971Y za(lWKiZ(84<;Bq@jtudeK6@$U7p0a(U$yd=i#A?XK#db**0Wcnw>U?3jnh?7>-uUK zFMd7x8Z3ls;9$7cj*shqtH&GBb?6l@h^qIS=oZ?|O+Gr0zkxcxzlA!#_d)g7 zccjz2@IBP=?uWaQ2cm~;oE{VzXFr%+ll(FIlgWof8>iSg4}Ojw!T(V5*XS>>PVuiM z*Cc<79yb3YqMZl$QU1~B?^gcN=y4n0$D)5&|NkkO@%@)bxyMYdN&fAO@8iz+{wG>D zrt>u;_OGQoA(?cp7$jYW$bGsxvD*2!u4v=89{QqG{n*Lomnm9%G=ORkWcukO>23VV zu5r=`YWy~a8dpuA`r{O+an%%RT%8I(q<@-0#ot*_?w?~(2z zTE5WY#2aAebl2ET*t@206wMAv*DZE4^A&j>03qfgT$G)$L>PEyZDaS zosJ$7XLgs~{Gi2+J>VayyJJ1EcSzkMnjPBrBznR29B*%^xT_E3|39&N@h?jC6U`qI zPu&+AfPP52zi4`Baaa!R<4)(s+_BoY5L!IuK~_BGMLwR&i}^`kFYOa8JtV#h#6sw^ z(m~Pm@W1~%5O?Lr3dny~G9t46L`D2!CiDIOSi5uPF6OY>oN7Dq1_Pvg7A^pZZlMUz6VESJ~BXud968 zbuHAq`Ucdzx(;eyeG_UPUJo@7mqX336;ShQCDgpU!Re2UPJe8InrAmd&9hse=GiLz zON*;xTb+3pGCtmpy=BM$c5EAVjSn$i{BCSJEQIgC!SH|PUtRyl-j8XW-VxhL{u*~5 zK#e;k5Jzo`w42kJ_I$7{|xnf>KCZ{zrX%BZzWy!yy|ewRlm5l96PUn zSGn}pQKpuKZ2Cd(^HkmR{@JL*(}_>(>MD z1nJ8(PokHc5wCr|R0nGPs|&069#TCx1bcm`^qKM6bPb@^!-nWrr%#GEjVr!r5+{>N+A!_%Rz%bP>3i)TQs zmn|rNd+N-1OJuE&qT2N=sCI7!)!x~#Te@w$H7tT{U}tzX^^2w3iB>MO_3|8eFm-PH zeC)f6+sDsy?2z@YgY@PPdEU@5egT}kuw(pcJN`@J7uxY(6u;Dt|6&pUOH8gwc5;sY zQjzBkm&Gr4@`F5YxFUX~BSW4yT%~-iJjl9wO}sPu4ykKJ(?eT#uY<=^UE()jua~}F zG&{8CI9;KhbXugsOMC-LOtKP4eI&M?XY$Fj(B(SFG}4h zTK>@1+qZ;4eW0Fa^@ZKi{o?nLzDN3A z(b7YEzSSS{|KE5ncK-h>njP{y$sNx}zjmG{?sfE#=Sg{SpCdz_C;8(6M}|C43dTc@ z40)auRz8+5wC7#wLHq1V4i$+r9u)C^$Yj3%A0KY=2+`sU?8F%(<9q~&^M8~`oKX~i7}hB+ zGPx!>I{t{In=V?MA%8#h78|C<$j{;pXz|8asCeTE(~pZkX?}eFKdyLVe0&0S#T%mH zjfqh4##2!9lJe1Wp2_&vaXlS>205SdAo7&>RAgKKO@1~$4O!RQ5c_kgPwn~-uOi*^ zQ1jdj*ai6o>ZA4HMX2@SCDLWMUXIVS^e@L1pY+D>zxZUflV1|5++wKsBn4G&8mgQU zsCZ=#RJ>9ORqwe_aZQ<1-aM!L`S3t;L42vT`=a_>u1T(qzhUw^ z(c&5GwC9`gjaE)&e7%)ZE}3#FMABE9T$9}3l(SJJ-KO|v=lCJ=mUtDi+7BXE$G0M@ z{UGvN@wbr`w?X9Tv$s)BQEGeq11skp(c1l8sCGtX9e+Q*gZk>Z4z%``pPmEkgzA@F zQ2o9e#*6pFKZJ$wBRClDwd3OYA6et%W6IBPeH#D7>hWp(GxQn{Vrg+r{PTG2^&zx) z=nJTL=u4=0=qspr=xeC>;Tx!U>RYIIY9CZQ^&Ql6o$sNZ>+FYmu5$n$;`@aMp__7l zaK_D#&bavrDxNt670>((6<7TNbzas!r#T$|Ev~rbaQt`l8s|r##yv9nqwznHmCqkg z`ADuz{uMvwv?oOVJANF0J#P`WCI5;4OTBblkbF+WU5Q#5B4;G(Bx>sek?SVvVOM`Z z;->nEOl0*7ByMV$XkdN~6N;OphfUiiYU2t0C#6xM_J1^uq2h@qQ2(Jh1>OOhLj7Om zRH*;$G=uujN*2`rRZgQmWu!YDD$Zz*es%hcM0P@P##xCL3B?&_N@iTQ6dBiNnOu`> zMNK4Ui^LhN6SZ+h8xehNoS`_OU7|M5I2$UyIEV7Kr_N2ZM^;=RDy}#Wy*u3@aekt9 z9fKBMTmb(_bxd4DJvyW=6fJ*f@x;ZjbNZ6RrP#ZsJBen8#2J?*u0p@N`0~URjvf+c zTq(WzLDrM26W5|2lDmIJ-wO4;{o7!-^qq;@VG+Coc7}IRUM$^RwDO>Rf4>LR_xJCH zjnnredf}Iq?kSodw0N#JwCjJU^|LS3_uKoyLh5rb91ZV-t<(JzIpkB68X#Iekb31N zJm`C*-JArwp>Bu(#_56nMVBc8_C2GHy7N(ykqR&Ux_tdbn z-bNFJ=yxS!BJ*%uq`ZX5HOYd+K$8naTc@#;?*7E1q&tv&KxCaBoEQY_6c0AJCOITA z)Y3gF+Bz-&hN*{SxAhs?`aB$JeI8-@k%>{}$Mt_g>+{2jBJ5h9MXk@Hq1NX|pw?&Q z^U*r~2S_^2Cu5K`Z$6H!d1fs6)NwtL7>B+i=QCtJosf9a^b-=}VSQw+v)N@6MSFkv zzx8$!>9oF1hFV9ThMMo6foGH76sYxds#E^6PPx<24@*r?JZJvX6Ep4nelhX9o!>Jg zbAG=d(%vtc%>DmF?fE@Zq+ec6q^w_NiTKSnxh9!R6q}q9ZGFT}f20#-)*o{cCDtEv zOs+|mCgz%dnP}@bezeQH#1gC5qQrcw*8<7ZYoSPai%e$ycj~o7r2UpBmRkDdiDlM) z%M&X(&g`-kqO~8yZ&l(I^IMg8)%;c^Uc;|b*=o_=zlOHHuA$tb)a!|AD|fAE?f!|L&R6Yrtd^9eY%yX*bL4o4OzvCez| zb)RA<)O$m_pw{QzQ0w!DQ0wzYQ0v$psP%a-)cX7})cX7h)VTf>mKJ}Os7chW`_RVu z=kQ(X{RPx{@FmoG`W4iA`Zd(LT)Q6cOMGkV+`h#3=yjfa2bB()b#i~=AhOaQfJ!g9 zGWkQ|N2mQEem^A+nV$6@d0X=5#4prO#{sebn)uC;A^U3&Cw|A@)_-X0zok2xIEHNN zzhnOss@%UEKiS`1_qWz%%CU7hdo#!T4|=Vq%xC;JitB&YQ~gKGRZzP=XF&PYfo;&& zg;&CQ1-0qwL#@M^=vSv36f`N&I^3wBVS(1+lO%IKoGfxaG%~p+*|?zgJZ&Pf4xds$ z`HbJDB7Xn34mT^PU5B%vuJ=!aT8~eMn!lS<{`S-v1uc-ZE{j^1&qVJ|w=6iTpmtq` zwl24Vjnml$ZKzjPy0vKKL0gyG!q(|_1?ONdN}Vm59kQ;RTW}uw9_jX?=^^?H3Oc|d zcs}e5FT^jF?kJicv~~F+vtL}$347P{C8F7(eP{VnsC}WA!7t(EP}i4NK<)Ru66*T+ zDyZw@t2sWcU)LaOzvs2^k5uP^F67@Kb)9JWL+(r5P;fn*yzqvC?$%E?7j(6Ly0M@e z{x_#?67j#;WcL3%{nSn5zQnBsw>kMi?n~TWaEBv9?n~UMe62ia*U5K5T_^W|+BbSP z)cuBgpzb&Hgu36*3+jGDZ>akXeW30)^o6?L&=2ZcZGcq0gJhaq@33`1Sl=fn22cLXX< ziNaO$Vg*CUZ|%HzLBh!oa-X4~V4x#I?lTk?-0#Sc`wR~h402@1eTKox$La$u4jBsn z@4mo81rIZ>cO{33#2dp!{70BvlN?zv%H)Sdi#Mi|H|L48^!g^GtZKr=C^53^V@%M1RqtlIN^Dycwz=r9Pt8FT=62* z_sL#@x(=P`q<`7TZx%d|oLx|2$6s8KwBs)}nfw0*X*>QB(bjkTD5tbw4jcg&+W9iS zV6L4nWs*5x=83fbe3NUE3!L+1p-4Y1Dp-!+-sEBtza=KuB$pQae^kAByp;3*|397f zlvGl3LW`6XLLKc&t7Ko2%F;S>W;?T-nK{Q2ijpKz>N<0s>O^JNB1^JF6iEwN1}RG+ z5)#qx{&>#i`+5KVy5F9!<@s8!*L6Lg&)4;uYo0RsY0>--@|llkCatn|R!n-<+Idbg z?L041e}&2X|DV^+Dv^4tC%xc}8=60`hI*Ooi<4fpdM}AKZ!g<;*zadP);VjHZvKGs zHUH~iA$ImPsCf2usCf1bsCf2GsPDS0hqB9WLD}QCq3rPnD0}=4lpT8)${ufovd5dC z?D2cB3GKb_U7yWR*ZTt~JGKSNetigKcehf0QN^}N+b8AiHsrf9J0^WZy1pv|`Mvqa zlXiNtIHBURNuR&~{1k@a=Qgjz|CB!tJClR@o(y)q-P82v%SrkFKmH2pf01`V{V(#@ zBKf=FMt9GoZ<*iC?l&UW1^Z7w^*_kpLH#fC_mtc2?w$0rUC*B;?Xz}&kj(Y`QKa5a zCg+^}-u3)hwEs8$h5Gt`;{$MTCFlR3{@?f@91eej`hVl!q5A!Y*Dm(6+7mC$cu@9S z@%3Ts@?+%xMSd0X-%$4Yh}r9ZCRO*_`+xtx*1w~Y>7UOJ>0dQb@BjVu3%R<8y{_TU z+v}R5jUU?ndToE+Ue|%L*L9)nbv>x(*fD-zo%$g?Desvk8m6MkMrm4H8gwO z2p-8c_8(6_YPd~AYY&>eZVC@&Pw+PRvX@foCamD+d+qUJ{{_uVtc6nOXvXg zzYS+FF4^gh$g<;SLfOSmFvWYj&QSL7EU0scXTyH(IsS8Lcc|M%w05DLTRacS4>%vn z59kW(yWRX3P`HtGWxp?mE0zrNUxWTNOD^#b_w+;T<)!}1 zJQ-pyFZW;J$q;*arT;2VhSbe3dr&N*CulP7|NUW;Bcj=D@~Ic~Podskr$oeV$Ne!_P!Tsd=Op|| zt2ae7yRGtdvMJ@8-G*kjGf;NB%+kyKw^}*kf4}VZZT{QIm)#a+x9@7zYQCBN`%T|W{{xhp zK{+^ipbz^G2f_bm|H;=r!9&pOKQ#Lf&Hh96V=mOb^E|J;N4@suL+ro5(&n+k@7O$6 zn2i1RyEc!NV&49v2m9||2(kbErM8|P^DnmbR3(}9v_#}OK4voZ-&;>hMcIG<)0D&h zi!|F`JZI{pT#ePq(V^Y2AgKfZ_Rhvaq6KK~EiJVWFk{XbD&`|#pM zXTSev+S7bN^!(yK;K>mASN}n)hy6z$`OTD`-5 z?ZYb_w!0ku?a%u+N8on%AAj|L+5f=5w%(3Pmi-Sv)>}1E_CLTnL#{63|I`T7B7L)4 zQzV`EKalr-YD4)ybpm-mrY@8pQxD3IIR?s)sSoAHG=TDBjuq)&L$5y1&B9Imo~ltG zfBv8`lt0r1YJcK*%2gpZh4N=kAbq9VEYQ-%b5fvrK+pXXB{QBDBKa?pcAe19|@kat`$z^~d}qQST+rrM!MO zavqd_b-wB&cZISy-Ke)ITNJneS^kwM|EfFbBitT=o}PYa{#7q{B-=aCmwBq;_7QFT z(EO_l;h}85z(wS@%k~#7AL1tr2n-^Jr$}9Ui!h{7m*z(ek0q&*e~l&J|F8&Xx3Ee$-XS+V8j;^8Pw zlJueO^`fOi^J8v+^1ntw`7@)T{FyOOe%Osre$7o#e$CBLe$6dVe$7}Yzh)eiUo#$7 zE}0mZ0H-gV7>L_CEDlVvb?6U-=ttjdK%^hVCg+@>w+=%h{zo_v@%jnzKcayWPlos( zG3m8&K*m=ZNWctC!XlWa+;}%7S~amf2HXb&57BPKoh@3s(EP4B@c;Hj9tk+C?`_Up5qmpNr2L~M=bZV0 z1tvS9`B&uQUsVL2quyR8E8<^OazsP^Ri()}XJKHG)q74f|4QZSWUG{K{uMO;>MTye78dzrK`2BxC{?+op6XeUk66Ie#3FTis1?68!kNm4=C|}@vR{G745w|d}&%@v0 z3i7M@Rs~jCxmAJHq<7?bBFbLB0QG)$4U~O-5z1b^M89NLU#4HOSFb?XumAk3S1BjI zX&scG^%|6)^*WTF^#;`b%9~L7*F*VTZ$b6%ZBO3@Pyail$Fmy)@4_V9V)w)5z$UvN z-jmGz@V>}(+H7*p`M|p$wuoHM4+9_B_1r2_Zkx&c|6gE-$sdX4KatOM{5bHrUB^!X zJMB7tVsg&;H1L^~|6DZxj&jU%F7O5Y)3_n>mw|7rpSuHJSwDA4rk`Jnw7=WroU_O4 z=QpDHTi;SHll?C6qm}z!wE5d>E>@KU-S4A)PBo;xPy888GiQ!`~Q^F zzQh4!?YI02<(D0V^0$72^0$76^0)qg@*fUC`CETN`CEsf{H?#B{Hed8{HY^Q>*F7& z_30G|DpWDI>q_*Ru@@* zWxeA3dOHSc{ndx^lNvzzNykF@YYi#CsN%TdM#Xu54Nk7-Yh2ufbnWv%_IZvkZtBU9 z`=MF!39ta-ui5>Oe^1k*_{3uQPc4cI(XaJ>5>)%hq_-?S1zG(#8LA(W*Ey#ax1t@r zCxghXi`!6M{+hVaXNJ z!i%8JV+??LA2bl^{m~#O|7QbF?_n>7kHBHDHoOEjfWu)Ucq#ptKX(~& zYvjw}O81K5>x$*4UQ>Lft-q@zb6;L9GM;Np&NvvQHI6K&p@FZ1KB=X&bA?#SZ2 z|8@iOF28LQ)N^cfao&F$L;Le9Z!ErvbiIGf^XB3J>H5y$EwnqQa;#*VM@YHx#gn}J z36?)mvgIp%ex+aKO&_c?0za}Cu4mqZ^hbVW$m^HVH?` zu%DYKE~UMpZc?=Np!s_#D1R{xb>1}tS1c(joKcm)=`E$FA3m;%RohrWenoUf=9}BK2mN z%=dr1>orrv|9PNzmZulu|2$Yc+mj*w&qLB{?Lz#Whl}Tu-phSNv~-AHF|XJmeS5{D z#q+&%i2u1j=~fP!|5*V8Znn6R{D|v{mJjXs%nM;Zx2kv%%)rI42tG#n@$M4Q%0oNn z{W#RQ@1;=x-?|Jg;W{seN3u^8KSjM7?vtX`gXS+i4fVZ{XQ2G1XQAFVJqPtawa-KS zPxuP>Ec#X!=l$SS$T~;98tVT^Ux4zr*1+S?_abb;{r3{o|Jl9_^?$anK>Z)=TB!eb zeHFe&`Z{=+_FscKAM`rZ`JgwT&Ii2-bv|f4)cK&dpw0)q4Rti6JVpx(QE2nWEeQ0ITPL7o5E4(q!+ia$nw zWA`J`^ut;WDZdkHU+xpA_j#W}{m=Ag+>e{GpBLwl6(5N@_wxnR@6W%4_25@f@zgF@ zi2OCwxuM+p`aaJ$u%-KL@%Qut`!8BQp#9E#FVy*^eNg+vKR~_L{SoTD?oUwr z!TX`&oS&iMoL}hY2=_qouUu!HkA@cS9E7dW_Zw_W`tNWX<^O<+XAVKdGk-$GGl!w# znZKaonZKdpnIll~%s)`^%)e0a%u%R##uxO}I-YiT9@%-Pf?)oCA*;iG@t0~q{r_Z5 zsQ;6!70jQHs*QXMGWGDU>joQ=zRjs8;+G#IGC%cA&N&T&$C}(wG{2mD>KzyCNxi*J zBN4y6Nw6_2sAys`-~SCZwR$~8^UEnGKOopVnD=X7vv;06QRS<>|0MPfxlZ;Z$>z5! zUB7Q{3FWt+Z0V;2PqlKK|3lx=qpgCi$(P?Q%5QH2<+rzm^4rma-_b637IL7fL-2I; zH1)MNdF{duB6h1&@Qk4RrjC+%4xTA851mZr{C_ZSx6TsLcXsd`^y&A-5V=e6Tx6ZM z6%{9(XX8CT*cDlR9Hd;gU=gz3e?sI7g58nzT^fko!{$T&uErnXe(%M2%i9`R?;&BHwYo+?$sxY+kDQt_ogh{kST4HRb1{N4yXI z7sp(Stnpn3HSQ5m|37s-R6H{hDxSFkDxMhy^}GAgQ1dp%^xqh~30ZnX_4j5dKj9Xr z>oOK9P8tVwUB*LwUu6RQ*L+Tdn$Jn32davLep?rTUTU4%vE zD`IlaiF)HNvGEu9V!?9Lmkh>DU&7?I3zH)HGQm>Qmy(RWw1~cp$(;Z9^p%U;m$wG* zq})#DHj#3-o1Am*2u?QnPSN5k^0~fu1*dw~_ipOVshlF&uCLPfI`;%;kiOrU7Q7c0 zR7^8D=S&aYXXR#y7JpHW>oGHUKTN_o*8kbT2dw|IB-8%~MfA@$Ip;j&^?!~x9}fo? zSiMJsk669AlBqXOq~4<@6aRbl7I^iXUcA1XnVDic28vzYtty^q*!1;Vqb4^mcFq zdi0%dNWAt=@LkdsuZem-ZG@LE+7x`>`tzP>-w}rvmu`lNOFw|x=idSq_kIW!A8&<< zd$&Qwz1yMU-W^bJ*hf%t@5kuX{kIe9{`&+fzWWp^zWWR+&itJ66Dqz8=3oGR0mJYs zTSwS`#?ipHEBH0(8VAIl><;chmOT-tRelrvo^(C$zUBJOsr*i|-4D>7cYC4EE$)MQ zj{E@i-22g+$Dg3)bwBBPj{OWn%;PUm<32!s6W_1FgUC83DNZE+H>mmf9WJW)BX}s7 zkC$P!$(4tLf5P4HFZwry{z0zG-@zlKYdnzg{S*Axlf_vJj|K}udj9%Ckmql;P~I*T zh}FKYtRAXm`87oHYkK*$MAliIQ0gKOxi%{hD7$eBL~CBC^&6 zL|=>0NuCTjM_Cv;8GUNEB~-h})H@~A23hT%>gBhBYQMEtj(o0r+faMtnU$x9PGcVC zRJN1Mbw6E15BvYHu%bh#la)V1v~|+a%AYCO)(K=BXN5Y$W$;`pf3|4l&$04dBwKli z{-V%%a5p^P>J^2$!r92(U|~g3=mP5NJFnt8r+cUe>Ds>#Gpl-rdee^X%U)2|2bukd zKB2zInny@~E)22%VE2pmA^gPS{X_Zq{vxP-hXGLg2m|3jo^ONTDC!TU-74~jK*jSz zNnhz+9J)LtJ9TMjSV;cRC6akw4;LBVr6%W`%e-}Uxyb&-6(Rgdo{v|GHV@F^hO0yQ zIQbf=`1o4d+myX7Gy+-vy{Pve*F(j_BcbBq8{nbrsL&YNZDy!D&7jc2?KCF48yl= z{KWs1Z{XVydWUrN2ikRg7wWohgnF)Sf_k352W5xfr~IOd&7luMKKqU#_?b> zU_S~k=6SM}=f^kfb8Lh9F7kGGDd{`VQ^k5^-Pv>KW74&+xD)F6^a)h`Poe66237xa zsQNkh6>oHIZ=v>Ozk^qz_j{=C zFYkqG+Krc`{_bv9a`+e#mqC`0xp&x63vaEgkY)ZWca?^z9YR!zX&_kmqs> zrCT{@&)-6LB-=843i&nMlSRviwOVrhPKDaPYX$XQvo+NIO&h59n{8nS(oci>ZgV@R z?>3(fwSUtdYX7bSybyoyjBx(B+7Y=6_0ELdU?-@3yUtMGi8u>t|L|<6bAjhTeW$Ps z>_Pc+VN3VCa98@B$(}D-zoG3bb%WYhDuUX-y8vqct~=EJU5~Jy|2@OK=#Tc5pzY)J zhT6yL1GSIW7iu5xLRjSX3tvQgz1;qywFhk&8oW68$_^Pn%{IKwl zu($|F zNsqYKh?Wj(4Pu_IgWCTa0oyXp>s4O+Qc(McH^6@GsPGu-4|PY2Rv+5_*Nss7fHy(y zx7`f2uXqcTog53bZ#WKW-*!CIe%SM7lP~m54&NEhKhGiia(9KNv3|BWcZ=BP zDI(*WYI4rGCw#BT(?r|PBcFQH!?UQj*SSx`PTwD%0ShYbH<|zc2|r-)hdwV#%yUV+aIS0XDehsX=nuI&SfirW^$z#4x4PkXX!ODMH&i_?5wCFaZ9V%7PgwbeFb}vUnE_A{(t*pFC$COD^UK}S}1?)RVaUK9hATJ z8q_?z4yFGM>+hT4ckRC35MFQh^;?p;uiq9~2OCVzIq!Jmepj^qZ1m=9lj(Uc{62cs z4>6woAiNnS;SSTkExg6_e<&IKTSfG5Gnx1Qp8g%Cf1C4B_%q7wbUqd-x6|aD^GWzq zlRp#9UnHM(_<492<@Y;ZgmbW<;tP{=&X?h@to$y~{6)&K4!#cWrhl3bh&+429_nSX z--P#B`ENy=$M0+$#QU_f&e^MU^W&7S>;D6kfA%BPI{Jxxt@HiJnvb91tcAaX4^scp zg$G2|(XZZk4~lj@exsbO_wP{G_YbJ|`-h!0&ZvUd4{=UD%N07C?AnWU& z@V}lcE~+>h_C@l37-U@+M5@68SUr+or=s>VYC!pwHKF{!9vf*C(Rdq*jQ6+*Rn>M`X&b9(FW-5QuIO1&$@xDx8@-ZuJKZ7|&@atL z5mf(?X}^1`%l^ojJPy!Hvi6_po8`q8e&0qJ-D$p7pIP<}vU zApOz!p?&9K5Y+k}40XMSK&{K6Q0wwysC79E9>(9f1Zo`(hgwIMLan3ApyumxsC9G& z)H=G->;F|=zpsWG*ELY%xfW`jTu1pu6(b_od+QmpE=EO0!T`Jhh9U8Vtqa)tApO}s zKmWfhH%9XR%W@Oc_bYCOr$WUU`ahMik^KLyjDz}Lmho^uoIv~k#UuJ(mPw@R|5*G` z@kjuwelgVlwFIH!k`Po}5{A+jfzlU+iYrQ>;)$52KMv*RCrDrECL`q$+y9T0+B#23 z=DC>`xsNg?v;XhiSLGsc$*mE_!*lF5k#hOCLGi&Ik$l`R8S4DOowPT?y(@BeB=0vu z^Gl|Xz9~C3au2fN2T}3Ey-@ot)1cyq>9EMXFLFQq>gCQ5tvzV*!c4eg$peu`$zQW% zR^&l19}+Ljjy&Yaka%HE6%m*8 zp>9^RbZGHGCES-?7+FI8_KHQ3#a=!no~Tl~m51iHKL+KuKMn`rcP@qY{vYal=F6e} z|K$m&_~A*o3Hd3g_x(>p#SPCezuJF!7P+6hBJv!}z~^BRTt)li-Ib!X4{M!(U0DtF zp8o}C@BiU)`tc&v`}~)n;+L19-bcRzb)H}?RDANP@{!j;`Ms~f_UL;ZmeQ{`;FsjT z3FWu0hw@wBf`_tiN8X`d?Xnw0>lZXX_FY)t-57a~{KoDk(efej!sf{PaQf2Ckxy;? zZjF3k>vv0JJLUUkKNKmy)#RMB&0D|QMdF1Wk&irmka*$a$WBj�#HDueArwfBp>0 zfBqcGf6hVq&tE|K&tF3M&tF0L&%2=f=dYps=iN~6$@jpT%;z_fv)@L(r@b2PccQfi ziBI-Mejq*K?h`E?TKw=MRDALiRQ#|XeuMloY|Hik1$*0~wk;16_p?^jEAz$<;^$RL| zQOP-{TC^Z4J%ytAMglIEl`A?$!`R0~> zVzh;q4k>q%`fYxkD8HyB{gj4zE;swt$eF!Ytr?<9iq;IwSfbW+giDH z(bKG4yXfhpUrahQ``g~~J4QQLe#ht;u%@qLv=ikDtIibd{hVa|k40ywbAe|;{olub z{`xt{@;keD`R78-&v{Vw&WG~byF!h>8&v;_tlbNu-H}yalwaQi%J1(9HLty(=CwCe z9MA`9Ui*6Ua-lb#esG)9KRTFovD3LoWL*p}Ip++F4l;SLXnr>Ntg9i>;kK?Wjt+$d z6&IVFbB0APvGT)3^Rp>O`w9f(r<~5 zMb`X4h6Jbr{0QrSge$lQsq+BRkY~@1Hpp^?n_5U`VtHPqa zkInzjO*C4<{K&t8)JsHTRxc5aTfIcI)buAs(+??^iKeVvCYrW#nP@rXI#-p6reCuB zv0I`1wcDWlwA-Qlvpb;H<7BAybSKpPa+m3!6205>Pl-+?UF%+)P%$lf4-CM2VHi%g z>wx`7*8O##)xSSF!|LB3ok_axFHwHr15ke8EGR$lK`1|PHk2Ru5R@M{2g<*E7@ooV z&`02+in-Bw(R};@%@2H(bltb}k>wvQfbtg|sQbPG%3sb>PWPP)bzfD&1rWaw|9WwB zQB?l#;^-2ue3e%pne@k^OOd7baj14AuXC0~mwVR_qUXuz6ITAo=u_y|{6hTmr=!mx zYn%{$&qkl~WZ1mJ3(rSa+Ptk0d5_NiKj|wfS4CGNtG^KaYoae${WZ}Sy>v0T=%wh( zr0f54AoKA`^i?Z|{fGKrPsy{Lb!TIK7}H%RY;3>nXx(e=oR55#58ThX^E zr*S~~vmyEpvepYk-^S>>R&HZ-la~&u_g?gW;)r8T_i_F&>N`g78$N)i`nE)|YYq6{ z4)eE6Km2Gk@Avyk^6v?% zLHYj$P<}~uD8HmeiTwVWCAE;{_lxrTYeV_{b)fwIy0E@mucUs7{J&#Fn^$P@Lj$-k zdu&N#^0!wsEIH20hxplzly2oA{^Ic^P2lvU$CsR1BKy$1q-lxl!wDrVDBm~ROr(5s zlXK3AC3*YMLd0J@sie@;2k{qMmYnR#5P$I$>9zJC{&uU9Hl+7*TZ@(sEk0-qTe_!} zoKAiw+fKB6Xy=C8!+vhZk`6Ef&wxd+6XnOdXNp!H+IyPLP`~>>3$}%4Lm$`u9H{pS zU7+4GoC_5voCmv6?tBvAKnYjM^A64 zxSfG#wQ0H*_LA@X7568ial+XK(0Z{S4K&W_NP>HYh1Lzx!tbObuaK)0L zC0Eg(HA^lo8Rqo|64zZ)GTf6PaowdQmw7TIuDiVC3QvZ_byrG{jR#tsbT#_5FMbV_ zUwUw<8xUq1rMufHD3uOA8J*WUo;*N=ko>qkTR^<$v?`WxY)>`f)N&~Cfz&7!pn ziG#xTd$VWFdNWUJugF zBK6<=JaG;0<*MMva0%4@>tj&g-+!EO$e&mW$X+ox@|L={eN#BcGz_bRP8MJ$n<<%@&$U=F5D@i=ktL=m1R)0^)F022wWa{r0slUhMob!!W|67s!>AR92DYw)4UZmV!lXK3# zk{?X|QMCAoeCFY&l7rUHfs*~!&d-u*=NFOs2TbPwf4p`Miq!k9jRNzFZhFc zne3sGBUbNE(XRJl8xQuL>%{kem2UBb^0jXNf%5Mbv%^6-4xpXKh(Z&Gs^3JYYuf@=0vFRw19eVaT3(| z$wH{}F)g9|*OQ^{%Tu7vU!KZ%<&U;PUR2RK)+UyZE8ye~zP7Q`NY^qP$^UD#3NK0Y(X40C-uiM;>l96QJI&l1T$+si*kbXjP>^BtrygM zB9q=Hb|JFnwJ%g0BYB`E^kQtqnQ)yQfWqUV~} z|HKpR9>br#E|&k!#R$03y*_pW^Sap`DKhWZJJ7!GH45tcUZd%szTY(l>iZQplD^%& zDYk3Ao+IO8H`}_tMKbs2SP?zrOwKvuz3a7WKG&=8e)=^LJyqzz-WJ}2et#?5s-jravqh{SguUQIm5{iKjm%7A~QFociO?n}GT~WfJy>rBHEB3aTGz zIF$4ZdfF;EQ1QoPsJP=!sJP=UsPj&D!;|3@s5oOP z)bBsNkg}vc4sPk0Qq2iGHm>0dbn1QS~<$kE|f6s(EfAxSjZ?lkRB0mUkhO^;p z_z=`N)HyH$ABJ)G2vl4)7b+f`2k(TB!Zq&v7}r7j|Ds)gXuk`si0SvBOJiABwt8vI zWnIlju8isTpi5&5k^R}Fu|;rN<>J_5^lxV6(pVMOX-?%5$>>{Z>GLZemww7E747$? zTrc~**z#CDE_ed!Jl2!w*_3@M_B68MCsFTRo`Le`pM{FMo`c%Ie;#Jw3K(!###YmQ z#9bxYc%a2!FF?g#YoOw<7va9_OR-lezrEt+*ehOnNPM+c=~f?F{I?Dkxv$0EAitOU zx@h?jKljbpTcp=;*Nc`8wf`S`hjjM;MN5YkC%p^%xf^5ekw4VkBw9YSxZ!=MxM4F? zT=M~}T=HRT3!J|6!&uJlj~%hCc7JS(eT<&I+3g~Fc9@)VKJxC5k456Vov}~6b|7)y zr?JmG84~AxF1^+dXmQFHv3%U}CDi+uuSi#1u?s4$_!=s%*bNm|?173azJZD>zJ-b_ zzJrP@zK4n{_Cm!K`=H{AA7DRsf9yw?fj_|__zV3S@BS=WzaVk*f!IOP8@s=XmJW%h zevAD}`kE!b$NuorA@S6q*q@#ZiKh<7{_41+yiynH99li7b7;pv#i{k7&L=j2 z50QT?RD9VGDn309>ik(FsQ9Ka989?;Q0L8#huVi|3iUqg1gPI*HiJ4Z*Bt71vnN8u zxh-HBJPGPNRUzz2eoLtLb0oL6h8-(9zfEBTak7L35Nq4opLf!Yt~ z0`)%eTsRQ@=fP)@&xfmESNI|926w_Dcp~L4fcucU!-KE~Jel;KQ1N~*SRM9;itGEp zCXnY>^?O&3bS{i5?&}vH%(&VA7q$N{a-9d5%>I9TkjaBZixVNH1&-#dF{f{B6j%Z_?Wo-*Bd4CoViJ4oHv`C zb8d-qXCRLiEnXaFddJ5npjZAlWZ!?JGttr~#r>oYCT>-xUsWB<{s{@n)kJIULj;=((ie$O}=Dqg%3DvrDhDh|9GYP?gR;>xK| zapFDnPvg25YFyLcEd1%|P~*GL%HJQK0h8JL;}6-qKNz2B^ZtNj=6#mPxE?e)=gjuz z{UMR-I43^e>dlKkZ1oa9~W6iPsEp6zm`d+U&}@6 zJz+B6|MU9wl=W+y^K^U#<#syHh?INQjJW_*2mwl^!4#K zVNK+>$uF#WOSE+bDfe!CgOz(X{*IM=UvCo z>^gof*{&nx{m2*bFUi;M7a?)&*YU4l0PccexZCCv`;R<|a(kfS$#0RNVR- z^QXA(cjU>HhvI+0-SAJwq2K#Ki+>NpiIsoF|0exb(qXl`(Q^b&hyS3bp6}oIQDnul z(BfWS!dLA?@~c6;Un@xD3QANGPF^PQq z3@0D!tDk5)lAS--*J>jeSiL$9wf)v)rPl3F6vn zyJ$xo$vib9eVx-h!MbLBohaJ;wV)pV|C=}o^8deyLdgIBCa`mM{tFUso|-r%p?LDt zL~HbDoUNe7iA;K%#A(PHZ(FGGN?zx*OPo&sw4R~8Piqf1Ivo;c(2mvtq<+W5nVt-p zpH7L+Ru21bdd^CmjjZ?>GLPpZx*+SEpE%n&H*ub&WB-wtIp-(3dNM@rmMB8jyhF|d zUXbX4tZ{UQ8V54{>Y3<^ta0@6@_R##r;k^TeDw88TxjL{B`%`h6D#|RwvHrEt{j*c z0C&T|q)(|FB%+`ApY&;!LlT#eKC^OIVrW9o&x<8<-whM3oLE>fJaL7Uzf`p6?PXT} za>;g|LdJhp;!3y-UT5X67Ong>R{mPaRvuDrMB;k#wJ!u|Z%kq&+zoHA{4t49a5nO2 zSXeP8p?w6cUuf~+O$o(^;}bW-ven}gx6tl<5T1Wpc-c!6VF_Dk+ zCPBq9mH@j;8%5-{K< z6Djf|ZmDSbka}f_G|a#ZEP}UEZoFGAS~*BOaa-bE($_4xJ#mMZ4v8lwC+_rQNIY>@ z;%-ld#1m5zQ#~0HPuwFtrWacLHx1Tzrzd8R-`KrRw0vm4Z@C{Tj+zM-|2+WpK4}(I zT=-xjACJvOo{RhtZ0XKPJc7PV_F>WVLE_W7iAPDV;m#8+9aU7DL5xRj_i&V~Hhj`qIY|&nIMemnR-i=y|d< z@g)7|n_VW-kL4!koG0`=LVi*tPJJrzwAW8aocc`SSx<(cMi?`-VNLjI)BykLEU%nCN_G{MQG2#O;C35Jt#Z) zK9v323}yd5fUWnZ^L+0`Aiujk!IP|vxKp`LR)p`LG_Kt0z! zg?bKr26cabPJRCWFY$$Emmv0GSK>>^_kR;#LB9Vh`(pMXzkj+XvD=;-dlKKGN9}zB z)gCg>o9_~Pk=5?^Q0+?Q`@e}Fym^3>`!Vs8rDOk*`TlR>XWEmUfaL#@IN-^U`oAU) zk}kUd>HlwfPMKZE?|c4{IOOSvHm`p|&EH|D`TGlM{{DuVzavoX{R1_R|3Y1tqv+ST ze98Q{szHsX0BStdq2{p$)I8QqY94DPYbW#e9Wsygl67DJ)`emCKl4ajSU=gA`rDia zB7X0&BI~W8$vNk^WFwOsixy9kPrW9|w$$6}953R>pO9<{3o1@9Ip;J>Hn)0hMT;j@ zzD~A<@-3c(7EcyJ#gi>9{p92+R*v{Tsd)0#WGnI&Pl}2sTf>=@Zvz!iO3x(xv(u=j z`DzEX4*q-p)}DODQ5~S-rZb@8q>fPW)R|trPF}svaGP^h@;sZ5vqk3P9FucSm*lx7 zpC?)zKtA(uezLpGL$_pCn}=>D=bWPC1y;VhXz>i?XuoH&hqd1`*)OT*Ro`Tv71X-D8fx8M19d&Fg<9{| zL9O=@=+*VP9_spxgj&xxK&|IdQ0sX#Foa}d7g3|qREiWXIL`x84)QL zHJSZ?%_FjXKg0Zzcv5~zI+=jiuTCeE^lv_LX;OYkI+;TDXVa?xpI>6%9V|=czduO2 z*}Yqnc|YYgC_m+PC_m*6C_iN~hxsymW}4lTEsw4DoX+lM6i=;^!<% zF7{-IpHn40rWay2A4@JJy_q-0}_q+k+_q+-Fxo;=e!wh^27QuJu$9Q*xX#Iec zdpEg>^r7xX(b6IQ;CsoUqns2XKXBFBKgc$^U{;8ox;)+t(_KzYaWLuY>ZuQ!THg9chJnZ)~AH@Gk&&U6y>-w~Zn#T@Me(f1her-qC zoAfi`GR~KGg0gR&q3qUKPS>p}TN6+KIPmFE35$a?8h+S|t4r?fBmS})>+ivFb+!T{_C!|;FXA93@* z(gCINR|l33M!(j_AgK0{Ngq;rF|ztG6sjMR*Ez#VFY)FJQf_$ZrIya`|ByF2mz7>l zdm1++|BBKpJsDE}s?w`Tmp?47sJy21TJkmDkbaFQz0T^5C{-MXNE^*!giq2Aw5fjTcR73w^}J#aL<7wVkAwEvq2^DFKv&HEcOpq}gZlfNlD zv-AOE`4^)6i&;?q#e-1(#cX&e`%vk_^tWAhj%f1&%@244_H*Z!K1%*jcb;hZ5IZ@) z)Uo+oAX+-4yjxlUGcXH_;6loccPm9J2hENzg8Q{f zUW0n?_&U^k$Tw7zZJO+^R^A@{pxo3?<(SdsQ1+$!P>0%kKqY$ zCrmKEpFsIFpF(}N<1;9~_H(G;OLBkO_iVo?&Ht|MOXlPMepk1v^gHBj&etOLXSYay z_n6H2ztV3_{!TPMf_(gl?@Q~ZWGDBE*vTJC_ffx~;s=vC|6lr()vKF==0{MD=kU*^ zzwjKB{eXOL@PNwO_Xee}PWGT=^D~sL@7MlLdHETCpr^L)Q0br4tHU@UaqQvJzsQ%L zAIfcs;Z@qqNl0Pmy*18VKotZT{BgXlD)1jnde0fk$I?T za?Yuh%G>MOBIBr&QvWoL|5y)s8Q1F=#v%JqAIe@dU_2N2j!iYR_SpYN?%_Kw)yR_} z^UydYKc5`eB_9FAs z!Q`BChBrSQZGH-TXQsMXy|YuDtX^ly)H_S0-q|MSoO8T-T}0O5xv3(`?R3r)DR;if zIj3u?o5@9@`9b6}KiyLoz$ENz?e$Leu=aXNroCPwdU~6jbNYDg^%WU!|I~#x-hQbe z=vlk4zsPt8r7ki(10qEE>vxIu4?E9wA^uNY zMtgdX0_}SOD)%(+C9i<;d#;4?d#-}=o35tbJ5OGdx)xdML!3}?ed;-a_grJ3{IDCL{IHv#{IHv${E=Ir{IIdKD}QDj)H)sywXP>X z`B@X8{GLgaUsT~w1yXr`3$nh8Q$f=8{tNOxER+g+GMwDq7fD4u88W_-R18_)9fjO4 z@f3cT)ra^yrKw~}eo|>FO?mYv1=Sy9(le=YuRmo_{g%AWxixhg`ZV8=??T?5x{G!+ zKX*XQ%VcZsPD@vR$;UstJ2i!T%?CvP)YLtm43Y0mO*8%2f8^cH^wbPw_3J*Uej%gh z{?voWnx~mw{sU0`o8^@wpMK0vX}{C^-|}`P^lMJa*KQ(w7;bkTNjbJI=cne{b)F}g zb@`~sx}0xv&RO8COGh+6u!45v2WHW;(REV`skhm!6sgDlKj}N&;R_Z){g2sVsQ)pm zg8Cn`C2%-=4C;T(9*64JQuNBtl>avtc{%cb{-FH7CsXH?#yGhSv zzZNYWnt!tg%8&R4%CGnqz4BAOL+1yWbg??yEnb?yEy^oAYPtAN1~Y4vXmh%jBH% zcj}1A|A=NM$j2W3o2s6cpW;g&r5?ZkPfOQ@)d9+FP`HPba<5+0M5J*bK!YYdJRR&9cOaRY2?*w?A4pS zpb6zN+2hkETDhj8&BqDWAMAZv&$Z@Cx96JjWhYv|{VO>C2lf5TLMzAqKh*Q)WYQ;8 zv`U`>1MpNBhOMoCy#GhmcR1TX*@w1J_Te-r`_K;Rd3ZXMeP|D5uR1{4t20bb$Ml)V z`mUv@?`n2}iz+&&&r0X*1GMXTHq`Yz2kQCAcZ%$s`nl=+x%TtmM)&-5H|Arr+f`)V zIR8hw{tbFskq50ioq5SS~mOef` z!OCI()AG9~rYDgvzgv{w?T7Na15kc9dbkgQ=@7DhcO`1SPx`mAE+Vik?+mjD%-K3zN3;+4c8S>Rm8Ps#69O^l8E7Wu3HmLJ^w?jQ| z?ttpYWKYkXp5D7ik7uW(?}kZupIzT+>8W;o?~%;)y;tOVOf#A9|9jW>K9TD-BmJOV zxBErP%``dZJdmDc@`Iv1pUCHW%}&p?>oq6+kX^4iCg+@o(~nsBxuQLvD960cOFv5g zG+u~2Kh60w)_pd;!20P(rk@oe?PpESIj+~w<+Ih#bs*zn_46_u3|}F? zfp2a4RWDzhT=`mh9o!9HXWn&=4Dx(>BmJiLe1f*0xgKiY@h!^f`S~`~dfNc?+iIUM-=m)TBTlIJApJfJz|AlW|Nr}oThkw=!{gAxQ*_r-?_H^AK`-7jRKSRH+6U2}FJe@<<^?>O4BK@T&L*%d0yG#$~|B+`q zyVGA=`tI}|PY>ncKvHzs&cQSuM?b98m zUwSV81@&C!Ia=#Y=HW;>?+^Y1cF-yU_f>+OWv2lc`63FSo8}`H*@IGRMFStZ(HSWExU#ynC!@)bPZsnl)hfU$3>U&%# z!vXk-r@#%&#;Wh6uXeX(uTEv@_Jc;8{@nf@j0Fw0jQJK4}*iaL>)0&p0CPd7_O2n!nf; z>it(YD8IA_$}hcu{>d-xj(jBBBh!oeHQb(})ra`^y)&}6jom(?r9;~nyO44I-+oyC z%n;;l&P5`2cYsLwfhOmiL7BlO4-w7ol8@aTni)sEz0SoVcK4FZFj!D=iOJai%%xUu zoM?7e(;jKO?()ZRR@iWp_o{-4RfB_j)M1iyrL3 z4bsd0#+b|~^fdL2HhJyBF(P*2mduSA`Lj1k=6<|cWSqB{oO8xzxDS!XiPbLUI*&)6 zp4$`XkDh}Q(c9HGDdQ(yaWk~%;(zwIm~`3SAe220LD}Ij)c#cj$__`pdL^FT7~Jc` zGijU0WF}$rm^3-(lx9-a&$MXvkaCPSler6hfvQ_GWj5Y&lh-c1Rb;%AGq>4zZ*XNE|* z`%UKiznKS2o+X;yC!hJ5op}%@;XG^ak<3HZ-WgvDm^_5MaDaO!6M3KvWqiItz4C8*KdjS4|~sb zS?4^ibhA6kSDdj7PN;Y?vm6HC6EF;)vi7n6$nq1OhTpM|{S4H8*R$x8{d^92QN{C_ z6`6c|04@Gl3FTL;f{H&@L)o(zpyH1;Q1Qo$Q2xeCa0vZ*8EU=0f_~ZQwbpOqe<=I8 zj(n}-*BD1P-|Lw-khOkA#Vc=;eyneO<}EKBvd-VmZ17~ree+J{U1Y^M(C&x)KGl1f zO&QtE_cEKk^!K6qflT@bnGcaQ?k!OLk-W~?n%U;fE2P}^%nnOu{~vjy^HJtw+SB+U z`8zY8crt8Wxbo8s_PAOr`VVd2=5y*RF3Lg0Nnd0XPkou$#dY57ekHOVu>YiQcfZc; zny+>9ZDzNPZ;xcw%{LtvIO_=9qQ1-Stl>I!hOm@0O*-7+M=UyQFJGrb7W?)NL1W!f( zc=r_1^h5liR%NZp*Z!C&``QM|zP5$3uctx1=W7Rx+|$cCpr@DHUNk)r|KyCaGf8ik z?I>D0#4qVoCcB%-b`~uiVlU4w>q`6EoO48;mt92i&ow#coL6?f$z4UWv*c5+TiH}>b43t&M-caw8YkFuUtZ>VT?R^{ttdn@1UEHpdY7s}3FXzBgR`dc}^|5GMA zdr{c{@?~d5+1Y_mc6Jbyokb7N%^}ijahSN9{g;c;Bl|cE>b}1Oent9l%2)GUR(7e? zyQ~a5S*?KU32h(j3Qy0KQ1@14y(W|u z+x40#l0M1goZ~MGm|QHHeIuXi6f7&T>l7{v*>wt=oO2>&Q7c~}njNPc^BF6P(?7+v z5IIp+X8lZ;C9R*OlIdqkr2VwXIVa=wvrII5R!+H0_SUjHt=w&*&FAeletz#q|JFH^ zm2UP-`HJ`Mg0fe4L)o7xQ1)jk)bsZqDEo6Sl>M0oWq+na?VH`_&HD^*-tUKc-p_=3 z-ah~pFV3R;go=mC9)tln8;0Q=8z=k!$a_}|U+^&0^?U?se{U{40O!F&@KLy^Vt(0z zvb_C-w%#1(kGQ|A!sans_QZnxdV|D!3(G3YWJea3EvCHI>msQ2icES{*<;A+_Y$an zOUC|}E%oLLT06_E{PMCVET8xvd86}W*;DjO^99lOblEeW42f5tEqe}G8}Lo2@8GS6AH%oc=kRSPd$$2DU$O6LB-$SLw%QHFVy*%eNg9PetVWw(EdM&^z}WXQSVj^$^1GUQxwr}EC83^`YPmh_l@Xy<>FVq7b$@VPoO?x%mUZS-JIltYvybqkdv~T&aa@oI& z$}cRJ{p(jgkn(-A{YA=OWOB|KP|iw09w>5tdrOZSHI(df@)M~S8%+BxYlP`?Me5o#ajCaCk#H$$C^z6I)B(^#l; z(c@rE+8tl+v+o{GK<58{%Khl)|9?c&4{aYNK)$~FT@1C)6NLKiLkQ}-4`HZtOA)B= zy+onD^H2g;!5Gwc9^!B(Ou(8j3H6}oD1$e`a;Wb-+zR!b zh})pP3voN_O8GmW_P-{>e(s&+cQc-$?p>md2b%vo1?oE*Q=z__aSxP#d@qzAJ`HN$ zYdX|E*L_gm<(L6)fcHcB)ia^?xgLP}&c-aLb8!zs?Z3^2Iv4j4)Ool$Q0L(uhB^=T z2-NpM=0cr!o5%BDg!^dueCAz#Km7lwdh>Xh%m4p>oQSLuAx8>nQQA~m2yN1$RYclR zN2o*{XJ*bUXO=T_=9E;H*O?i|A+kgyEmA4UQrRLk3N5IVQc}wI{&>!--{<}N>wbG& z*Ymor*Ich_zpmFcN8iEoO@+Eo$ALOuUj_Al?rEs=Z5gQZZCN-DPJ_Ddq#Ejek?Bz1 zC)SkY@9&s_*8LzeVNdK{ggVbZ3u;|)Hhgx*qLP>3$XSa@=D^3`TsRKSgAq6%_QCFD z_`}RaB@18?dLir$UxDM{Vz-@xb`I`UsB`{HpzaNN4eC3BrBL^Iybg6=2<&x~Jo7sQtJdmfp^iUFa_zuU&?;!e)r?&WuC z9Qgy(IPyo_bg{24&nYK&m+dOf0g`$zwWX4oBWuVJuGeY7}|QzzpyFipN_x`b{;S9 zf%^$+!Q)_oSMeU@t&QG7yyCyu*YW1R13Vgk&i#4onq58b{z=@Y&2x*IuhcjHM&1VI z-^kk#*6}p*HX)wEn#Q6%KO~-J-eb+KnYXFgHS>D0>r!)^X!kron-{jg-Anw(D<0Bo z3AK;e%EGtyo`6>RqTX*CsP)xCsQXRYLfw0EBGi1c9n^gCB&cvFL%oOgQ18D3)cms} z)O_+3cqMk7+OG$Z^`1|M`abmxd!EkTbG<5`XM4}|s$V@zn)2C2K=LVEm9kVrh;ycbwJ7fKV)MIzz4na(*EyYXCN@x-&2dVBCZ zDhHQgKQY@~+RB04_c)h(uf%Mbr->u%k zq*qka-+PD=qR2i8H~kAGp!eWI05h}}@{17_`;fT zqCF?XZoKy?vm5U%HoNg|Ju3O%dSvaBkMNq;`=RFbrBL(w0MtA+2sN({LCx#KQ1kjS zsCj*abXD%7P~|=bH9w9+&5z5W=Jg5ehgGG#Nmv9c;3!yW?~VSS-`SOR@M(BHd3r-`v_P-(b!&G~xqkY&x+o!L=UH7rffI1H_6Wabi)V(URuxsX- z?R^QYbYcD;PPEoh=0bfJG!N>$zbc&5 zdaie&`h)l2tn3Q!2gEZc`@T`-8C`3C^(ya5*sNxi_e1>Up65s2HMk$DUM*5T2TYMx zf3_BCpJ5%;Jvbjjwcnq>`RGrf`j_?mzVkdAyc^NVN67Ep9I2(*&XrL@~QrKe9-C-~JMZ&X=g?l{P*w+mARJN(FiBIMGSZT_4Q_<|i!m8tZEzQ2U zX!W6m*&i=$^#PK9t$nTFY}nT9PY}(%joBAUn>{4{_P!J0F4)e(wfCI_C!kM;g;ni+ z9SE;_DK2+9`cA=J=R6?wqm%Dcw0@7c%Q?;08M{f&8NSnD7E0^=L+sA>=goJl_TAIob0?!gn<-f9VO%MZOCm_y731VXyKej;p%ZcbT~} z|2I44|8N)2DfdO$?!F$_sop`tU+(KkI%=mO@%HxhGWXuTMvOyb2W{MSCE+ywxe97L zbT!oY=^CiqYYa2Gi{S`}&!_NwoeRf5sy>`}$+Q z&$-oi3oNL*)pX9e&3C)m_ZMwEf*t7(@ZDkQ5AY4~sl6HO8|c$G>rQFL1A|1;9c()1 z+~v!UvxbQDyLbB@v~c(P?y+$9N)zrrk#P5$X8+#}_n;eY!qlPI6{m;!Mws1j(emRV zH$TwiYmwZoe#&3{=Oa-4?ntQqb`(@S9SzmrJ_^;}J_fZv{5Vv9I|izseu8+F&tswT zc^p)Id=jc2J_YqYi?Oe+8t*Id<=4R>{jlHXg+|L@a$@j2h~_-no>YQFdaOkqC>YQCs=)Xz*IobqWZR6gB0 zHD8Xa@K-rbLzUwUR5{K zEb-;b@oOUGc&YDg3-^}qbqn`~G~wP93HO%ioU_ag_qH2u!qny16{p|vePDL)ik2Vm zx%q*nJiRY>E64IzIbI1>j#ojI;}4L*F%-#4N&EHBlgu*n|zzyattZQTYaCwBDe*Pg8x&F3y-1Q+D7;q)`3_Dv3-g! zeI9eqx$fJc_65GeeR1Y%-*=XO-}rV|{_T_||8|Mw-#4cD{?E<7??m<;zV{J7`L|od z?!R@Hy}n6{$xDe7_OCpz46> zob$Wy4+~e|hgOedUoZWq{H-2At4Dv4FRDj>V^`O6*!K_5qwfSE_2^&U5&Tt;MAah? z;Z%=mLDeJ0qxW_c@#{U+hI&tRU~TgEzxq@cJJqLpQ1$5;sQOeNsy;Pv!#8xpH-a0T z#{T2@eOsL-BKdNxY0m%qo0&dNwEBcU`O)0p+VbOge+$U{Kc>0=$KT5ATZ>koup|98 z{u3KEGi3;k;6+Dh|YPZUYFo#~u&l0RRcP8O+8?fs`&xK92K7OtZ-;Z6|= z*U5CwIn@n!nj3Dy)YGvmPM_gF+w3}vmLF%j`GKZfcagi*C;2O%&w;8>=R(zw^PuY0 z`B3$$D^$I@0IFVH2vrX+f~r^Dh*$6FVyO3Y2~>T$6skU5234QBL%qKqgsZN)+~3om z?;jxb>I#1^$oK#L-jMJA{r_99?EJq!zfX5H@u+@X167au;LiDfe?QB&8~lAO->#D; z->w(Qw;N2;|GW9tPoy5*cmn?>xb9@#qat^WMJ)NN4bS8gZ0HR=BTJJ8xk5;wsC zQ2R&&q4tsPga^}u{CAOlr}SXa;)S+2jy;dkbSCQ{)ccMof$5gJG6bGhvDILk^d3=YiCA?<_~SXeL%3VK+FIc!p-45G@|azQ#EJQ@9tWpA^jQ_<@HSL?upIm9s(1YFy6pg@9eCgW9xQ?@;3)XN?SRe^taRIfRZ#81hfw?8 zA3^PVuZG(9UIVr7y%uWUdmYri_s3B8OMC)#Zv9iJeg5@4R}JxPfNEDZ;=VYu$-m9= zeXD=7<@;yS=3CBz@NZaqr0U{{R=w_|g9d z{!3^4=*y$Kj3P}e(~>$$Kr?7|AYQRxEH7Y6wMt{ zfB*6y#=URmZ_(VLwM+j%&j0xfO6~lg-&30RhqQ0CN^v)PXzkQdQ2Sc7;kWF+)`8lG zJsN7Cx-Qhc74=|tM*Y%bVEL^2rN@`5-)&slpj7>C!_s4kzh}CUNc@dW=bR>``S*3K z$bNFu(q?Y@kp1N2N}IbHvY*^S@!IpjqYv^NEur=eTS4s`wuag_JOOIounp9{VIkDM zVOywu@e@n)?O;2!_7P8l+DAMYHq5jy?MQmfG95%q57M8UQhF-xozk5|bBES$p9Zxr zd^*%V@flG2i=CnN7te&fGiR5c1&d)9*bSabd_yzmh!!8T{rmHv_Mgv(+JEi}wU2xO zEXrJ1+Kq6dGZ%>#4%)ut#ZddJmq2}AaA~RfgUd?0^Lw=~3T=P82h_b9mqYDu_JrEU z>;<)-*c%>BUr~A$>D10#DOx(v_EE2f+V{N%s$b~?b^ha8sQt;l@C$ey)c*SQQ2Xoj z@AjR+jivc}Mf*YZA2;!w|M%U&Eu{m{8=YH4`h(j<(!bqw&goxzhv@;Lji2#n{5-I< zh;VzHJ4O11!KH&>LDgW>%>PS=ShylFpn0$C>!t6Jzm1=vji2v>8b9A}?hlkcXm;%X zmumbxv~(E$8b6B~KM#i*KR*ODepWo%PZYnVoQ@#8+T%x{+T;Jm&!h0S^Z!u&<)cvj zOHOw8Zk~Ns;_{$~5QyO2?Zn5v{+(pM3F_1}$Iwr9R6S zziICODGiu?P_+IMJJJuAhAjPXX}Q(sSZSHn=ZG}*IVzHF%rxi!-TGWE(qAS@pRsV2 zrAZ4{Ax*fHNVrPVIp=9N+%s;t2~#IvSDb#fbduRk6fHlVbMpgD|Mi00t-qAN*0Co; z^_Nqi`opPE{ip-=9;%?$z0*+Z-5IFsG=}%dATUffFRO@jIOBWH3(s>0c z9W?HXOP8RP-m6gQNiTO^D_!dTeu&-crEi!!{XcrO^JeK=q^I8j@n2T@wyPoQg3C+a z#a`*X1C<_{aPO6_L@T`&uK)W`>3-na$$z=Cs+9G?|Gs~-@0C9)&EJ=>8ooq-z6P$& ztS$YR_xW*VoydEq|Hob5Eq_8hI*{TuXys;;H05TqNchi8 z=bSBWxv}&2)c?;*zapNE&Nh*D;|me{FHQ6Rf2G?^e92?Z&Rs zov@&4m+74IP3gB5?pHCOc0=~{(%;M9+6`#!#vZ74W3RdYQ2L|UvHx%F#!sdD@K?Jb zs@?b*s@?bns@+gLYB$97l-J(~ulI8R{%^bS2mbHUz8{2YH~xfbHx5Cy8-GEy8-Kgu z54++2fg7EFOOFaDe~yUc4|##+`~N_J>7ztzH*hCkY6p(NpZos;bzni&(WbfoFHq0y zj}fiiz>f4A1nNWX{|ht?XdKWa&@iBJKqG11V`GtYo0#VQzd(K*&{U+|XclN?;f@a+ zXW^Pl6Rw3wxZ_PT|98W+a>GrS+8Vp!^a+7>X4giv{3x{NVZWc>v)nmR?$&O|U+u<8 zQ0>OaQ0+x~sQm8$KZhNm+Kp47+Ko<7?Z&B4?Z#OGzX z^&Y!G)vvRm>eV?=?Z>&;S67`EI6shYKOpVLg@LZH2wnh3!T)JLtlo4ZynX*4P<^{3 za2fgVapqEy{9^u(`=(6yK>j{}UV$E#ua`@cuRTTVdYNYbU-^m7-v{skzn^}adU93Z zI?~zbTrE<5t`V{8V>;(t8|Z8LI??JE{)D?ea2MhBI5&utqke%KVL??t)9n8TZnkiD ziB`X4UoU;D{H=aLt6#T6)vx~Men(({*)jhQs9zo!xD$WXFH!Yt5LEpd3{}4rkJej; zz&H6_cN1Rk;~uE@^IyMwAO5OW_e0gI2cYWJgHZKqsB1sW4L=-ibRG(fw0wD3Bwvb5 z=bRCNM@)|ttzO|zevAr?vHW;6Fxv9tQPbT28+hF8$B0(1up|AkfhR2ev4Ik+AH{)j z_8y;<<~=?ol5Vl-oHO2ik0m1Y${Pq-xIn;X;r!BsD-{VBFwOUWZn%&eZod_wh93{D0sX$oc=k1jzaS zz(jja*8kC}Z_h#1x96ei+Y3WR&BUqb8L z{T!(I@?3cJ?0JFt#G`#YXy?dZhB{xq0O}n6La2COfjWP`2n=&N-{xa`K^Q=l4G%yw(9$L#+d>fm#Px3$+fg&fGr^eB$N< zwDo{bq4Iw{RK9P3%J+?M$m}hFO>hd_4Aby4SPi$j@j!bopQE*Iunp>ceS!N_;`vhH zU=B_qpSHtl^jB~u{2I37JIozW-z)5db8z1UUxwen>GPTY!z#jm2fyJtzlX2jzZ)JP z{2sU#_r35E;`ssUeE*M7>m5Hqt#|B$TJQK7zDoFCpuU&b4|~90p}ybv4eEP{15n>X z{0{XU#2--KK^%no?%+?T?*|US``}+t(%f4GTbmv8 z|DgJT6M}8Om)w-+ij-oO4<*-(Q|C65koY&cxS)=ZEMsgJ+?8p&`0U@Er83l!LS3 zYRZ+g#(n3S|9Qdl(K?R^vF{qZ0IhRtqRy*c=-OXo{@sEXqt7RPi2WtOOVMYbA^Ngl zceKu%L3EGch3KBaUTCEU(Y=-5wPv8jI@9iSu7uxH?yn-B)xKVh*13ag&}w)4 zpa)=gE%|q@r*H5&w9ehYw*3E3@Fw)Cnj1v^7x_k!|2^*K=G#qTtv(C67m)DHJ+}mJ zb;FATaKFv+|MuV=_@C|RFIxQ4=WuRp0J;Nq1K|dq^G?`u`jFrtShr?KaIpQZyMlM4 zcc5X*lQ@3^dA@st_n7~^!Taz(o_Iu^*S#O=|D_**I=A~ET*dDm3h%*gn1z2RINZWN z6nq%>=WvI_J0e(Q?jwSa;2y_aTu1nka6KFaH^b3z8+;V%{M%zt=dd1!I%hNn>Rj#< z7T?(5IJD0DiaIy-Bve286jXi{^ZRsuWxPFyFIZyXd_ga){+;7~{O9sm=zGN_A=_P|H!WY(5 zh?X8Cf1U|en%y(Or_Jt}V3Ux}RZbA?TqU&gCld*;{C*Cq-aHTW9$tXT&q+}EITXoSR<;zg@e*siJFN9hTdIhQ+FM_I< zi=oaPzY5h3EP*=D{2J7G=B1>sdigrkIl?!f-v66W_46%De_3#awP)`J-?sX+T$=Xm z9g+9=uIZffp6Vldg-Cn3$*-->0T?&U!c94VLa6XJc?HcKe*o!A-EBYO`tn|2MeB!fh38 ze2g9MV_WcZI2L|w>1_{wVd;G-O?o+z^tPMMIbXTyeJ%3db_Dm@^M4cEY0tmQ^s;H+ zh&=!9;I|gvchbc7y-0k!P3N3FZhU)1>dOzoedNE+asG(?#OzPf*wg>p`}jHd3+bt! zfTX`a_$yld1VsN9{2i_GegLYRpmF~rco3~}0nvX351~~qAoc2S@Go;e9Q+&BLH~O&Ug&680P9+~dZGH% z+rpY-M2jC{*C^D$>>7m{nq8w%zJ50r|Eu42F85f%Yo5>)s-I~F)$bgKoyu=>wECA8 zJV$fS@u8Mz^)F)Mg{?xZu~T~vNw-bt1WUI~s1Sd(=c4LYTc~;biBR+Yc2M*AljM%w z$x!vKJ=A=o1Jrz@Bh-B36sY+|C#d<%sZjHo)1c-vr^A-hJBQAIb!$3@&UBv(*6K|B zXN5G5=n^`I-*L9*Y|(y)`1G`MLtU|-JncM@{_*@!z8-cJnIBygx&XT(cp)4GyIFkf z|D!dYxft%wUJ~kV@mwkr&t+~r-7OyVvpul830@A>U-ZOY^QB%;^QGQU^Q9}G+LbG@ zQ$KhW%#mML^ZYtTdktFWTKhod>$On%+7~KcuY>B(u7^55djr&Y*&CtGKlg(==Y12@ zIq#c^SNEgc0*~|D8oCX4y=Ta|-`hj|(K-h#-duf0XrR6C0ivCIhIZcjPN?(VgWz!D z9SldpyI?#!By=zKs+V_@KNGX}NL#&xod3QrbU*$+?4g|(e*gxuLqiY3U2quwWrT-z z{(CrD?e0TR?e4=oZzE4pXaxRxUdZ|IM?xdf`aLkv*fT0L+SQQr+K+}FL+iY@I6V7! zXbkQ;*ADIc_7hO&x5q-|_c*BheiACbpMn}U6vJ8B@gXna=VVKa>Yvb@m-dHzuvv{i zREodc^9+PSxF4zxinMnFrbw&b4MUAX%Am#}5uRV~DT>y4?ikcKB#yhvMLAmIkp$Fv z=_KxrJQbl7TKOUNft66@?`g}AXF?Ou${!f$;(0bS(bbT8{e0*-tJlwmUcg=BDM-1P z6q<}yyrRn46xa_=#lNA)300vLuc-6pX{hl-25S6}g&IFhgBm|nLyaG%Te>qsHJ0v- z&`jJlz7x0O{~}a*o&{A8W<#|zFF~E}o&&Sk&xIOK&Et8_^2`stjMnprN2U*Q7Qk8A zLC!*`_+Ekf9gARf)#A{rq5OIUU}Na zeQ$K$4y~ZvZ*`W7l>2u~=bU##@0ng92K2wy_^ba9ePs3@h}f?*P5&SI(DX-QzW+D- z)uB(!evOFzTGKgaUFc)epNN5@cpm(j7k(PrjQu`mLufrLsM=sU=WGmZGW*S9fdBJ$ zu(NsJXYfVJ*B1Rw+NZ5h^SaM1zHOneEWR&8Us!x!nr8h!wB6$SO0;nUcC{7|?rZo- z)y~ik_+WZx=zGF#s@fI$#_Ycn*&qK_?);wb#FpC#2WxGIyWxJghj{CH_J)4IU+3+h z%~yZ4=lUu1t3B7xp?&sTKby`uzl8Q%yuXV1{RPU~kt4r_4iH}RSlIR`e*f>VHv9wk zX1E`O$HPAfcc$m>&>{5Ug@1?sLU%^1-)NWqCv+J1{_qItc1r&%@;jLS<9Q`&jkE$Aq=dR6pD>obR_A zK=mJJ+#7|Ppw-VbhU#aempjLXn}+k_3uxalG=r<1yN@GZi}yBe~8)iT@) z{Q&h1qE867ws0qe+u**IejM^#ZNr6dHarn`)lbMd|90V%&}ye3;ZF{?cQr(J2%p09 zY5dU<>UW@du1?`I(E1&xy8fp@{hrfZJN#*fJBQCSd)EJPU+$b0?t<2L1mbMx?C?46 z^FYq$pBp|8t?>usxx0qXH@mLk3tV?dxQoIU!qxC%+=pkoiPld@2eOxjFM+#YcihXe zmxI z<>9{YgSgKozwU<<-~&+KQOJE!c4&AQcH4MQ5dVk5!{KcBu_y?lkr;P>I;%m?8$)<1j{UTOWqDrx$M4@K(tN2YVmYPWw_Bij1$TEY*R{b_g|oB}_F zY4{1OhU?wuhE`rSK&?M-gj(O;1hucQ8ERkQGpK!qEl~RkTVWc04y)ld$oao;j^`^* ze<@n~18tprJLzek;48G&*(ry1PtA_7$L_<~33Wbj7kqZcPvLLi$XP#yzlD#%@8CH2 zJ&eHJun%^7;14r@3h#wQ=pSHj_#+$-_qo3l+WEnsq0Sxt0{6lFQ1|Nm3U!|9H>i7b z4nWG~q^G%%fW8kXh93ynn1`86(U;-&*R=XY#bQ&&UI`889#_8gFNa?Q(*$Gv-| zg=p@O^O-HnTH&wrnPO}5r!{PtIiai&`(~LoqS-?`7uXi+oZpGiOTB9cgYYD%bBrfL zooj3lb^lHWcqZ%!bq~)eQ1|e3g1Z0XRH*xQPJ`WOPfmxu_}`W@pw1t5hEuRR6FyBk zXF=U-(*;gMpAEax?wkYLX3i};pXV-4pC{ULL(UC$ExQo+zL^U|bBFdnTNlAaGrE=a z#((LIi_0!?{UPT|FD<*w)sXY0-OGBo8gjn$^0J<;hMX_$rFblUcyxWr-4#&x4P6O! zF7PVY9DOw`gxA3Kun*Kd$JavLbKDo|{+H{Z?%}x}7G-WI>qk1HGdGHs4zzQEH$j~f zycz18;4M)1@Z1V@4)QjrbC9<~ov-W8w0*gJD)*#OA-&$5BA8yrkJLo9)!BLXDHOYJ;R{x?HLYr zZ_h(e_x3ytb#G4*)V)0;pw9O{0(EcCNT_>zMp2FjW=5AiTIR9ynb7Xzc?|0Qp2wl? z^%(`1&%LVZv06!GYMe=&TH{27n?Ww@6>-PhyAy%KjHTKDz% zq3-J`h5caw4u(OfbDbfmbDm+SdwR;C&f7+y&f7+z&ez7E&ez7F&exX1t4J>ab-p$U zbuP35>O64@>Yk!X_yX=vL*3K!4AlKR6QIt|J_~hzb|Tb0PtQT!&+|O2gMI<(o}NkY zZ`>zC-On=x>K>@6Q0H46sQZAbpzg;>L!E!kz%u-^Q1|IfgE~K34RxPRe&4gE>?PjQ zMrVe|ym_WbIeF1^&Y4v<+w@DK&1>;z-*ZmcCc^D;=8DX3=a?mIN_0`pJ7sSZPYcg-)61s4Bhrq)U-quG|^v}w0jWyPs%<;Yo7$7*OzTTYo7+9H!2@2 zeo^zb&9DLCKjZgnUbY2lUbYqcTAt6#a`>;R*(S1%`i02)=a=qt=j^#_dA=&!Zt;Ir z_BHmciBHsi-wvpKzMW9%?1D=78+ZfyTMPGH+4pGezd@dJciA4a_RS#A@k7~ObN`|2 zN8A;^sCnj3Q0t-lpw{VrhFVwq1!`SwzlA?g_N#?IQ1%$ zmhK+sg2*MX-u7w@t;nGMCez(@SFT)OaQ_PhF+UN-Gok>7Pgq_4$y zoiy=XFB0DkruqKQjjx{@-%XL5iBIJL68|lcThS^9kaE~Ra+|sLkK7LHpaj>eU$Lp2YU=^|Kf3|ayf60qkCMnbYDJu#jQN22^5m7_8%M-gc&N09aBSR{^} z(ie5#PB{$21pduD$w&oS>)nujk5r`6)zH?bpGIr_{28eBaRSu-+p|#nZxf;R-=2e7 z4}2bK|Lp~+{kKU_`)`w>)={RwPCWlq_#^Q-Q0wVcQ0wbyevjIN3{-oOg<8*>2DOe? z4YmF;9jYCvfoex)5Po-dW@I*c^0XI4`j=U5d7dq@kM~k!p83xa@t^DZ&olp(jE+$BCUO*bx`{+A4Bc`d;+yk^C{&(<#0V( z{n`d}BhSXjCbY^Gq?~V#eCBF#fA!YL7TBz2Yvgk`eQ5P$8&rS$1>w%{d>P51RsJCL z@vF#oE9YNDzQ*19f9x82c0_i%c94CeU6F5GEn5E%RgS)c+SmFXs{h^%Rj&3BPWxYb z(dy5CfGXENLe=A+p!S9K!Qqt8pW&?RFOgp@fA<@ekJ8h#zeRq>|4{V-(ehDR>HYz= zZ*tUj?wl}^_Lx_Y3DkMW+xU_b&8&0 z_NR*0E}mxgr%PMA2>G37MmxjV@Eo&0OEmi~W`DM{*+b&LAbKv`1<$i^7evp86VP2@ zVbulE3kk1wNL=n*6zzt)_7foW_2TFyXsri}yPQj-J+PbPbdO#Jvrt;)3u1S9^h)%6 z=Za`gv%4bN3ob$ThFK_o*+a_dRnb1^IoYd4!e3)r{?e@fNBiQhb`w(nu8ZpXAg!Zc zkH6N@Z-832#+~_5zv%7QZ**=F8Bg6Tk{`F2&N;V6Z!>+nX!9!k3D-Y5jBtCLJ4D7q z1ET|ALDfLhIp@ykAPYB4w0V{6>!t6Kf1s|1c{|UibEJ1e&8zM)_j{xFnH~Lq)Wf{$ z{^$evYhER4UiBchbN<6%ZK9VQlXc|Tgx7a$FF}2eGbgI=app$n^SeLJ%oE8U*8g$elzBP2 z!@hG{6kTBXxKNsWd_}}=k?EYX*v-fM|IGZ!I^z=JuOWWzpJ?A;X*9nt@H*7K#~V=V z*eo2?I*ko_Y?nnQ2Poipw79!4|Tr%1E~F$l~B*I z3Tj{FL#TE7kD&HBR>P&4HPLnUzSoNOyP@sxeC$5|Cs6C~pW;4b_NM51I0bHiX}A$q z!_C;Koq_zG&!Ssg4f&m0qo2DPvQM!sO1@C8w@1IQeEm|Ie9ehG$9B`4|8w(o5N|xc z4!^Xo`Kf>Kxe3R&NHFb!OwzP2krv9&p0P`HZ0DZ6Fb+zdu5)-x&J_C5V2F;CM1p662H)pzxmp&OvPL*3ib12#ur4*x>BJhI=w~u<10kcxzaTE|HrO2eT``SG5&<>6B|UhJ0)O6TC>FE#Sr!Z1`z$k^b0V>**~dg1S768UmB-@teC4qO z;nhw+-bXSv!JhZ&ScN@rN}A`b6nT!PP3N3v+~=Jj5^loOXR#|zPmE1AyXQp9*XJ!A z=KG|x+?gbI8!yOT|ED(vYP>KN>is)V@4pJ_{imVce+CY#s*Yu05u64`!Rhv#%>U7| zvNf@pq%$Ww!>Hedw(-S_P~(ePP~(f)P~(%ApvEV2pvEV2p~ffkh)3mXK2*7T8EX8o z0BZcP5NiDK3RHPqM7aIcuf`U`W;L(Imf)`R^L#D#I_`(6mx?w&l-B(44XF9yo6^}q z&RbCP)@4xh)VHC^-E#7+zUQ6TyJ*d`#XxpN>^-;(zE65uM}U<7m9Y=(eXfkH!e8Yd za^CR6*hg-7$h>`ZY>lhM>Z-M|b+P<73flbmW2pIlexABM_GwJ>g!QqFq^JDZ0F^&z z+&9HOLo1&)L*@nx5d67UHv}DJmt$+4z2eBiEn%CD_2A2 zBVWgM5}(rD0hKPAaJypPqm}MAuK%}C>3`?i;ZM2R6Wa~B|2MYR!ZH6xkE{A2_M@xC zUCvLjUo4)VWBV-p&!+W0aVNd~u|II1@BAM7)$D$c{RWqy519S$<}Z8fNbg|mFWl#3 z{}c&-$h7>W7iIsB9mY=i0Quej#F%$k`GSSd;eLehHS{yI|Mq=it$5zO0BRh06kNf1 znA%X^E!KfLpK~DD=JEWvtOe9~?0Bei6D^^}WvxhmO}cgb1hmEj;wIPz z_ko$hc-y$g_E({epH75_)9vCX^IWwvCyACGwDD7W*e%l`ehU8GGaW_qhm0Rii+6&> z@Km!qEq(@eLo=s~W(V1q?;O7X_oXw=jGyJYL-ysn#Lsp$WMBTA__?lz?8~1QKi}1m zefh46$Kr)HF1rx+&Ri6~82`SRZld`^+jqVM_TpT@rBM5ymqG1wc8A)>??HZOoN_r@ z`>#D=QKnb?3gR1`=`C7(ka5SA@vCv~l)g$dcWCERu7TRu?E`h+&$Uqd_ z@*H=V&N&0zax_rne94{hLGE)x&X)|1-{oq^`H~@u*M0|NoP1CGKHQsS?iI})GXA?i zJ`DFwRS(1;bloB2zoBwBJ80(whC}@i(?d}AE zXC?88gya4nk@1;7?t=wYe$({-@qmS!DBAc;_Vv;s`P=vm+W4#tYJ3(k_h>w3cI^Mh zH9m{S%kkIvOw{-+0X05LLXFQ9kM@I8*cW&z<4>dY-3mlM6Q6)Smi7jspH=!c{t<^@ z_Z-~7`I_h9L+BTFX9VtkhC4lTXeZh9}lJ(D`Ml14AM<_ES?+uyck939ulKng>OF6Ode0jn_y5K> z$MfR{X#Lk`xDTuPJiY}M!L4u<+-AR<^M7cK|Gt1)2l^6foR)(cr)`HC4}1kRPWu{a zoVEjMoVF8cUt|~5zQ{LF`y$`+`)YZbFA_%E*g&#pZh_xF|8_Mb{NeaNxNDtQT$KGceguEzGi2OUtK3traJ9-A7nr-o2RGt>RJo_{c38Xo z|HcXJXVd@Vu63TeP~(Jp@I>@6Q1=|vhZ-+5fEq6}ggS5ANbaz)NPF1?DxG7Y(rF5{ zp41HLob7Q?=WLrpowIEL7iW$yFD%#i;)L>+#}DV;E-=kG12S%Jbuq zQ=!HorxAWl`tDY;8h><#TDLh9YTf26*f7(j{2ZR6S>|lfo&(yr<6O8meO~#6 z_;0E@zr3sK59xO)=y$}hvcd*)Kn+@Xydy2FF%9_2mp z@07k=G=FI4vU)-F)4gFg-p3VC{n(YTJNhbEl)1XR58+2=t`RLfwDW@3!nT>d<=5k1 zoW4#pe|WUc2i^d6KJZ5JYhb2d`Ay~daT&C8hBrfvPi}!aXLu{rIm6qa&KcegJMy0T zL-n6`K#d0nz}}gG<%3AKZ{|+X(uLN44u%>h-UYRuGK6$B{<+)2-B*4OEY93lelP3> zdEboZ?icg%u&$!@ln2Z6_ZJR@S~nR6b${V-evj5!9ztuKg>dw{Mdgp;zR?*W(w;sd z65mMEIcHS)Xw#31)?edKxW~#vgxljhF4A8=Q9cG1R6Suj=Zq~MXW>Gk_1ChmmwrnA z)?Y*Gug636*CpoeE%%un`~T(Yul?nv_^ZDb)n5mo`s*N6f30}B@ZQ64H}i@zsCjdQ z@U=YA@&tNSO-y7zJT9`|UGCPqglOOGCb84Jy8=7Svr_PX`{k$c*Luh^Q2p-&sQ&p` zsQ!5(RR8>(8~%AW{0nfSGpW4F@^`XG{!THSbEcL%rmIBjuka^d)8*4GU$f;I%h#;w zoHMPw+U%!`)-Pj6`ZLOFEd3efbFAH&T|U#=ofoBPcV>yCJKHq(|GK|_j!1tvxBL|g zx1fBUg_|!;xR*u3Eij#P7P{eHal=iRx(K`C^y2c@&F)pv@?(jcA86Y5rE<4^RQ@_Q z@&?pA|4pd(_ZHMRW*O9bd>d*#U^!Gj`3_V+`7TsH`5sh1xdN(Rc^|5u`~a$-TnW`r zu7WBLACkWIy+1+^Al}tb?|Ti;r}w=U>V2<+>K8wT>K8wOTJQK2`|7IoKA{8itiUUzWq@B(66{J&iqz>$jZ&Z@&ooeewU`){2@|q z4w}w6f4a|oNTi?p%i6Ev^xyy6epx^C5AB=2Yxozc-8=%-e|Zx5_OVt%{a8WbD75-9 zQTHXk>{fS$9*5+8bH?n6OHljo@peSKcu~G znrH%x;jw1dG;thuLo>}pvxCeBTO^vp@>wksCnwbJw@w_NP`}?Y(FXgT=~g24txe~g z6B7I)bQ_WRU}2)I8y{pocw(ZRt0D8jlN7I|2d$rM4|``iBu>GFPY{?O*vo#3&& zw^O0!*{4CxvrmVbXP*Jpk98)$)X$uW);#+xSd{6KIEQ#gXU-NaUP!-uZsL60JEhMP z%^li2yDQW@`vRzW_JvUM?2Dl0+1;S#*%w3g-q zE$Jclm!hOAHYQ9Sm%knv65#Pzs0%Uma# zJ7ipQL*i!KH&xx3=;yja#x*y|-Rz*vr*DCpN8buH{=rcZwDtwEliD{J(khki-L&=Z((YBK`6`BKG&1&N=rb?l=8_X#Fz&^ve$> z#uILjGgPEs9-bHm3#x{j&N&Yy9=34fMeCPkUoSmE{?;!;>z7AD^~9s|`cKLOP*D;~|G$6;UKc{1@7TJtZ6E>?OrUlq4=Z%7H$e98;= zpncfY@{}h0W?z~J;9iUT71f>xc^Yw9K{Y*Jj zKc0Ykt|ZiRR9Jec#6+vd6B3nHkDr#N9zP@U9wwO1InTQFc%o>}@tpfy&s#h%BqkBB zo<|&$o|2dh$HJ_|pH57*_#J8DuM&wrZ93;<-1xH=|3+t8VkUN5ooW%g>85i|O=5=W znWBv&@TVNSn3#+GK4*4f7A&ZmZJPc+F~{uZiZ+hGj`uPzF`wsCen9kusV@_*IK3e8 zs@X3TEk9qe-@$o*(pl~-mb>-u^4I%Y0+pYyLA}?d#8=DnM&fmg_l?Axxa)n2)m3jL zmL>B2Dx{x$C-F8cg3IA3_^#y>{Xbgcf%l-s11q4$1MfqP2R?ur53Gb553GV34}1tU z9{32V{H%t%nXj#Znn$mNnn$mLnn!=^ma9+P_xUN*xL`fhxL^a+xFA1o-kjK!(EN0B zVhipnkDo!6Pc-gZ6Wh=V|2b56>E+HBi7(xJgV^N~+s&Q%KYF$ERpM)&N52Q+zaz2J z)sXPJ65rsid9%1E`)%So{FU#JdGqeX_ZDtyG?j`(x;{)~cKPK|ygrA_s z2m7Gxeuf$s`~o#D*zbn>6>1#t8}5rU2NHi-dHyr;yS=ABq$$q_Mat=)rgP3Aw>{8CWZ+dRvgh{{Nfrs^6)d%#R!D zK#d!Yh8j22g_>8@OKRM3OtL;&;|5XVh6Ygc--b~0-$w9Yx^eQ@r24rgqCFS1@j_F0 zINdDS9RJ#x<3#g^j3ZhkTjJh5bG&HokbbOHvOVrgXS7b9;JQQlu{Oy@0%GST6k#VgL|MmKCtgu?xP;4AG_b`1N;9_{oR95{oPQg{%#oguJ&j+ zRD1Lg+~_=<97Q@?og$HRMwreyk0eK$9wk~ofSPW6wKLO2^M|%RHUp|2&4emn zFG7{CS+I9zPI5LZhA+Wxa31jt&CC@o9!NQ!pIm@@ar$M^+#&UMVe%EX{z7Y47eTF8 zEq2?HSJ4eKOOi_o-z@W*XyGC0zn**(_r94oM01DMUelg4eqEMaVde8}k@C4*#O@u_ z-2an&&-4n>#=ZCx?)~HzE2kfbl+#tom9U^{mFb-GVe%sjw?(vZuk7ok*T~<-z0k(J z>!8NHADjCp$xqFW`F~R5-u1~1_-ouNYTUaKYTUaCYTQdal;6)3uib|yzDqy4m3UMS zKZmM^|BY9_z+d(DOQ?FAgQ~aNp~k0QLEWqOwHt1S8_!O-$Jv$KZNK;1pZo*6 ztdl|bIxHmoqybV{BQDz z`@5lyLp>ELkF_d}u28rF(empksQf}R9;zdE8;8nYb*6E8pkz*8pj<6H4bc!eRWlfisLKt<5{gRCvYrR5xl>5RLVPS=*a6W7cbsxux#9KqXZHLx<9J13rBqyVF4@rBd zaa#wtIMcD>j0*L8r&XL%q4+yVlh3D$GnQyzaSB=XKA6I^)Op>mQ0H|ofI6>xAv^(I1a+@RH>mrmFNV5@ zLwz;W z`HyR$&JFj0Ixl=J)cq`dq0R|k2k*oEdZ_zaZh*RfNsxGGkH=P&V9)>mh_n|^ilqCLY5xDGV!Y`R(b{qR3FobtNw__ZPoy0$ zt?BHTPIW-0YbDSEwB?uSnppc3f0D zo`h=0E1=qO;-THCteAu@s+mynH1V|XJY#y)RyJ)^M64@o~$kwxqKPKcgXQH|F3$`C!hq6V$? z1&E%Ze6ag_MSUOlB5X-~v!K5BnoT~a9eWAAa~|yw)OS#GaaTJx53TRT=0kmN{xa0} z<_nh`if7@Zhgh& zDSfZILA396p^e8k5nlcGW~lz?GpPL90@c57h1x&*9O`@WZBXz33#f7Ymr&o4=b*kL z-wss{zJmI0{cC%U9ThuWcTvB87u5Uz2I{?h3-w;UgL*IDL%o;X7Jg5~UbM=SsPV-Q z{9b)O`lFk_KS7m)eNg4(XYAtHUn+h>>%Hu^_wuW>y%)J}bPiM;!hNgryNLTArgP50 zia$*s5^Y?7Kl$``#b0nNtd&wdI#O}i>d`;a)T4hz;yGeE=Xg^2eyf&9IWI`nvv5bJ zj!LP&t1V5qIwIkYHqHP4xZ&!Fv@6G?8e_N5X^^T93#uBJ=Kh~lBMaA9wDA&l)cdBX zCg>KPV^b~B%ceCIdEOSOW|r=8(xls5B;6LKbI$Q@x-H%3ZIwFN;%k#?ZSkF8dfBu# zBJs6L6sd};?E`Oz_T3R>j}qC2HdMXOvu^l7Qn z(Yn_gQm)TTonh{0raHqq=q~sd)|@3;`G?q@n>yR<&P|6|MhT({JP7Oq?BA`90ob&17)v1su_?7F8eHM{Pq%gnBODqp{Pi2v0uJ1^Xm z@EXVUg8Ht!H~uQ0S3s5DD{foly035L7)K3{_9>BA#ZRA*s93ibvGFcK1MyOYemmm)-|8p1mJx zJo^CDc=kc4@$68j@$WFGebnJl`>hW_t#>{Qwcc3-wca@bs-JiSs$Uoh)h~>K!>S%j zjfO?=Q8)@dZsnE!AFcjk3{?N}1kYdJGd492t$k53kbNrkB-{my$p@X+7S+y-hZ;wh zK#i-t*u}HHQ~<5^#!r2im@Sp2KCu3e|JdqaDulnj7l+pFh2fbze;MhY?un$LXr(XO z{l8H662u9o@p?IS+7C|Pu6qZPQ1=d0K;1i#!e8gVE8%ILr&G`1uJ-{cx6h^~Sh;;R zH4%69H!#r1^IYnAw9*xI&%g^%``weE?i-j)`s&A~pmqLzDpWt^z!3dZ6_kA%K0Pgy zs>Xiuw5-Vf?=;na@}XL+wL3dKHPifSMEqyC{xi+Ly6VLg^9{bc{%@W7rPS<{){$RI z%_W@je-2bVLgPL!^)g!TVLsG*kzVdBNG;^|seVKI-ue}|+F6uZ%yX*zLBhY9THK(MwUFQ0~4VC_K*AD+$pUqp5dKd15@4-xV zMe2PE&-y={?W|0FV0vZhL;QzlSBX~7r32a3sgK|;xEA-a>>82uS^vj9o?Vw(k9#Wn zY3gGucb`a;-=B(RCl*$1NPTAZ8$~Opo6LT*w3SoH`uo<@7RdU4>Pxf#Tr~S_X8(n> z*+b&rk;=hcaJz-uk@^ZwKz|Jjt9GPz5?L;|$Lx`)gzoz!Vb?|4n9{vJ1!~Jj@JU}?5^BYwDNl$S8 zNc|2u|Cjn3JGFBMp~fYDLbZ2?pxV2?pxQgxZO^7L29>O%XX=ZV z@6i6|u_0W(lxJaTB-3yGimzi<3!?VZaU|*sLa<- z`(L`kd8FU6(o?t)wt|{Zw}#qJIRR=vr47_Pz7T4@+7>Ry{zRzr8ttI&7d;8;JJ*w; z?*D8LH81Y~mu5OvcH(yxr%w^>cR|(#POUtvQsaxxm8aQrpDxXFpCMw`*>ui1(|zu< zM7zhd3*pz0&e`OH)&&?aeJj?I%|2Myno`U-Y*!eRTR$f$@U+0G{qnU1% z7gy%jRbk{*-dBE}cxh!X{5Lw6iHsk+i#%5k(>dqz%ATfsi8fEfpLt^M$~y_S$GJje zJa<*)m9U`dD$_aV>dI^K`5@Xn5xZLJ=3Z;zKAcPci=M#q{>SUFtLwSJ{B%P*E~|xJo0v^d1Qa6d8FdeKKKCa3p@iAzwNJz*YF&J zUBd5`T8I{1rEhs z`>w-?SMBU@^f%~-pvE)*kGc1NkE-bY|1Y7(vVdJtQ4uRyyV&Uvx&*MGV#)$BWn&6W z9|e2QX47|XvH?NCu2`@j_J$o)EV1|Ad-=UTXYXb=5zF)ae}BK%pXY(MXXeb@xpSwS zIWza}X@swH3o1*j-U~(Qy~yNNx41HBa*4P|-&rRf{nIPwn0~2tfo6P#Z@(j~IQ?&1-Q|^6!?dR5CbzmPDz7p9YelO^^k|pYRm!eceZ}qh8!B%kUh_TdR7$(K3CjMy z8LGYB0@Z$3qPMGaYvpaox?f29y}j}dPZno2-Bq~?7Qj1U5Z-O~&;0Mz-#vtDeY_f~ zo!?9NW7n;zybt*)t^;j8xF1<|@B>hG@Pklx@Iz2`$iq-}@FP%m@S{+6@MBPR@8eK* z?-NjV?^>vS@+A4o-gpYi4tbhz^_ORm^<1AtR=;@;E@^tca$RNIu7W(D^_4H%^Lat! z`MhW{zyDjg!Q_`k>qo?+|4QW>rvIvl{%a=l{r}3>O@2eP=Se*JZ&to%`frKozio1> z`%dM%Cch`z_((j@|NY8O(Er^1u<`?#*7Tvt{Qghn$EN>@X#Ea78{a;K`n`hBpvJGy zp~kN-Xdi$4@nz*#$QtKF{T{*BcAal3f3)j-SNW}7=R1>I-R~=Zu4a3y-ztB#^uL+h>i%B&hoyHy(8h1{Y&`A+pK0nGN`rys&Y>QpU*FUv z)HS4f=`OOL)=l9iL;D>B$at}Rs3+uHekh&v`h9{;;MQ={kh7?tvsp;}dgo?eXmi4+ z!QSLIpt+Ywe)#_h-@AE>P#-uPZWq%0x=m=yknDo3B-5X_7SZ3ve!;=4J!iPrA>aXq!~U7*_cuCRdixf@i!>ptV?LPymKS*BV?ibqM z$}`=C=p7I`(8BTmBR}CD6grseseF+5LqdmoG9>+=&|!pY9RNE`zwYo5b{zJp*>l$3 zjwD>;$x%@A-O*6`$NLJ*RV1pA&ZB`Jqd> z{yO&pk@@mMk#rZC-0EH&y2Rv5MH?@PC*5VCWu*Jay!ncRweop|@>~U9hgXwc{d_r8KTqsC zUqih7zt=+9N7q5wN7qByM>lxsZuHXK1lPGYhiy`hJ!|2_~}WBvC&$@Jg*MXvjR z$*t~#UjKba#EyA5wARu+9(u&mJt~=WkBOvv++@E0@1N#wHYA-KCwU<|*?3h=f?3mY} z?3h-larAYs-run6;{S(wj&DJY&u>GG&+nkWr0Lzzd!e{J0%?cuhdv-&?GVxqKMZ~3 z$&hyVap)6I7H2hm9{Lm(z|UY1rtVWeOnEg9svmzv|I@jduc5}lZz#vw=5IsaA*;WO z>*4oM zg*Fau4>b<%K)BA|_eI_`wqw=Kr0)~kNwoBk>-VeLmGCjKT|^6qDd%STSMAMp*15Zj zjC%t_^!6~B-~X-J%jCU98~2E3+}o$>NYZ`e?kh6xWmFA>X-yd>x4QnS{Vd&)qK$jf z@6mjK;%(f5Hf|jRHEtbj;fGWmYI^MdS83cDRCO5f8n;A^TZco9TSq{RTgq4M`zWY! z>S!oGS7N*xjGo4;AyDJhP^j^07}R(*+)F>gOFt5>b4OK;v-%h!NqwtARYHNom(qRFl9q^e_0f3j%f6?$BMN>!F!e@fMfRk8z*ubNsVduy6x z#+~Ctu6w-6t?mg`aXautk@0GJRko#@QFW4~J6SU6P7z5r!{k=?R4-k&mo6O5L2p5G zZq;nl%M-0W0$zO}GhWS7xQ$neS3k~&8n;e^8gB}q#+yQ@ajXbx94m$z$AS?5e^m*@ z|6g@F#Q$GaX642IkF0U59BLe^;JSK_bD*B%T&VGC9@Ka>AIh({0P6XkLAoVPXI7>7 zsmgxwn(I2IR8)heb=5_b)Huah@bBKD!xm{bGW$b0t>%T zGWB_pNVeIeg$Md?ZYP!p>hC24g?8_^-zU;|LxDRvu{M(DlSu zFT11a23WlOj;b4BDZB~Jg*U?s;4N@8dMn{4SKU!{D=a|14Gx93!!zJ2?|z`o3wJ`z z3wJ@y3wOg`oA0T*m-2Lptro33(B_3T@Z;wDsvaVKebfC_4|wsA@&7@En?7Xxf4J&V z!b@V0h!zg{UfbhUkHKxPdc5ihuRPG^g|+agWlvQ-2^Ykks(RXshxXmFXP~~5_AJzQ z(w>7lhx|OegZ{J*-VN8okGY>0pyrPkq2`a5;LzABRU6;}_%a*>U!$BeW3P%@G5K53<`d#c_gz&t z_Ju!kzZaQLeysX|^l42$n#}qCs-G=gw=lH%MEX6Ne^tEAC(!1T-!-lw}QKW7v2OLI02 zZ-#sW;ShQAF!N5QmB@+trx)>>cX~t3JAI($oh_i|r7gYdZRK5WYt!2{yp8E?8{R3b zaj9>3yRiD}_L3Plb`Yu8z9zT2JBH))!%iagzjL@hdK=t+B6_=+-0JQc-p%CxqRn5# zQ}4Tn_qKZ9BRl}6HSJ+C^M80R)8AXP`3pVnbD!}3RxW>dUn|!@$&@QYjqqwDIdm z;x#WF1vT#+4K<$}12s<#hMK2_K+RJ_q2{S!Q1j1luii&M%{L>V=9^J=J@)^h+CwJ# zUo9CM9s~O<9UC4;xXKS{ALGLlk*{r;U{p9V^WWs~Bv=5Cg+Z9*l^c?NN_ZOKKP{Om z$_|J~)_2a1gWBgkUNY_P1gLg*B2+t^4wp2Y6h1i|x8Gr>I>JwZ&!9I0254WW!fOa; zo+O_fJqNBcGn{MX$P23<4{i>KJhz!9x4N^u=Vsr9!2fevI6o}^%xU35uRaQ(`Uf)M zMd2W_>aQ58{v@w)OTwpn&kLeg8ZNVN=6~cT-12aR%8NcEeolCA%T31r@1?uOOBdGf zA@Y2$3-ext^+#y_@f)D}94sCITYR6Dx|$}U`u{*tD9!)v_$0O@}Zgztj|@O~JCDeF_)w|yw=44A<4 ze;8iFzUU+HiP)pz$Ek;>V~>f{1O9))ZzBE)t|$9)Ez~~mlZ3C2Jr$1IkI#jlwt9R< zGWGbZNc!hYZgrpc>e1{+dw*#?@0Dm>`~s9;>qV&b@k>zi_6DxAw)y4oE6AFcMXi%x zg|dfUgR+NOVau{N!mq3Z-w8p=lZrtdEPO()qU41&wC>8Grb@F zz`I|_`%E8(Kk{VA`%E7zU#kyjcGjnG)7WR>FNp6G`&_hmh`sn__-n!!G=C*pIKkGq$s6dJsE#m+IXJ?-JWp zv~Xzem-UCTJ9me&I|smzoA;>R2mSR;dsgq|=|k-1y%lchq1luBLht=D8$UCuo!%ed z5B78a-Z+YVw}17a$m`q#M8?AdMe;ewO)LER5ZJgc+w539z(j1+`~l1#UrW@ zhiOemnB3|fS$&kH8zY)sDE%JI$0*+HLTGm35GcEFsD%%!9&UQf|JAY!M^uj_UUs1< zyKoegT{s%bE>u3+k5~R0=f^_Lf8)rnFXKbP-kX4)=81_=^TZ^mdE!{8d1A7cKFdo# z1+H_aR-b6~GEJmjjx(9>|5cx0@`<9&6U0*=)2mOl`Z&4zB&&~;O>T8hsh(l_r;0XD zpvU!dsc4qCdR>eDP;fn?GZ zis%)Y%>KWZF6gBTM@!J-`+wE*Os`b5`Y7}21DWx=qIwSH)xI(8REE7W7v4fUlKw2} ze?HW_vH)uSI0I@w_DraGQF<=9`P5=9^2P=9^2=U($40_2t!Z`wLReQ1unC09L{vtg`yz{GZoO zn18URYO1TNW$)Bf*O8yDR||DLWWwvK8U~aFDzn60d)VZfsQ130>3H80SyP(cJ-3?d8?y0`l+Sh8)$_wqiqBT(O72OB* z-p&0`=bj#bI!E;&9KrP;g8E+D!%*dU1l}5ZwE8J)?`x|cv-^2mGWYX@$aU75-0D8* z-Op2^`F)=D?&lfu(fd%(LcOo_9Mt<#&qJNxS_gG*YdxI7bzguwuk|9-dp@#1D`R~B zm*<`MKAY@6{yPEAi8DiJ$pnNP}X#Tey$$ty3zZ2B^`a46}IsKsQ zoL!*4JGU#8owFMp6zg9zfc%b%?Jin=(7s2v2h{I0?+Ins>;?6^1$#sNj_^KEzazXa z+>G`+5dPYnQL`WUb&2^!%MW4)?O$^M<&+%+yKRU5fpBQ-keY+w0(dYS1P76RX6#VW z(nGT|4udUUwsLO=PAgZdqZ@$gRcCqVt~@kA(l zY7$&a__0vmQIpnj+JM5x~{W_&om z2jlZ8HBQ$C`t!*(N%?#7nL&6B;itl1k+X^40e#Zhdw01t@%3&Vl)V;!pTL>$OE?Su z&bg}DQ19#I^BiT*orb&#GWlSi71opzzRoQYvFnOOo?Fo5R=1?)bdyU(v+IZ_U0F?t zbRW6pB6i)JnhKcKG{@vtcW%u*OBWK&u9JR`<^_s3yAIm9jx(Y5zyAYe-<@UgXV)w= zedhlf*>{U-&LLj*ohbY6TqyhQJSh8){IGK_sHsFQSbA~Ih2*o9bCJob7hf#mH@Up# zk{a1fmr7>*x=iGLFE_c>y`m;=H&u#eFRGj~sLv|Oqj^4z97V21)_h-M*R8FoBYZvK z;w!Ko%HPvq@r^YR25Rnot#*W{E&|>Z4r47V6n(K z|0Q1evb28h^bq-dfxdp{bQ$S&uJI};yY*@)yLCB~-MRwGuDu58yxp}>>92!N!0VyD zi*o~f8u>;m_f0joTfN;{bFn_3zmaeY3+n&!oH4h@MUc6f5`P^S~uU%)2WUh0c$aU^Fxz&BZyUv4lo$}^~YaSx~ z9JtofKVI{QrGHd1=^qnG|G3HQ|9k1zinRMDYo0@IgZq?--qR+xy3f=+Yw~lV+3m#B z-k+~|3H{IA^)>5YTGM)yTiq9GUNrreM6=t`qdjh@dCTti)tZ;>eqS+p_2O4W?)QzF z*Q~s)k}2=&BIS6)|0R^&{*|@cuWP;~-|d}mL~FO= ztfn7ozJmqudl-a2+I_MAPdeG#KSA}MpP}sHU!eNWuTb{!Z={pG|2veu{|A)4@6^Wa z;Z9KYej1d$-xS?6EH4_mgb-L6*sbsLfXx@|3Y zz;oJ8WWBL{?GCl^^#LEZ=2rMAE2yQ@gPyLtKc z7Z>S$rQOL-??=c_{2~5k!da*6Rl8@c))9Nv?n8Rj|K3pbj!gKzwHe5I9s{ACgXA@? zzjitiEo zlb|=U|el{oiZNkdjb=<-cqhN5o#ZJ65*?2 z$JS);A&BMeq59ih5-)3A2h>T0KYG=ZsQFju^)IUp*XsF&YA?6vcZFo0 zU!}-(Lnd?n-+O*xk#V@Xw$akn*Vb6NTFIoV6G>NZa;w|mrEB!kg`*Ml7Boj|TTIUt ztv;H(`aq`t#1wA*Pw^V(7DJ80OQ6QZE1~+|QmAop8PvFV71TNFtD(lzCM*F%ldH=w_y>Bicdym1OLzOSsk85Y1>U=XJG;e9*I#{XaI`1-=z z;f_%KSpJ4p^iTQa@3j7VSM5FA|I@L%Md}IvKjHFEtmgXa=l4SO`!&|D@ALZgL$&u? zJwM>}>j%Al{gBtMANJ}w-mkSjf7I*Gk3sn%9*6pV$rDiDGg%8yfloqx$K)v}f5X#I z-!XXx%5U*3<qmYU6%~kD>eypFsH|K80GZdngnI@MO6*MsJN*c`I{uj@@b>wnSWVK*P`st;_T zKDU56AF?IvL-$M0RYPhET+ z56!QzFWfOUu+Go@E@;jW?S7&88TNw(vHj}~B)%kefN1d$Kh;5X2NN$pm63Wm1X=!u zL!tIj20{5_4ukT?91i7=IReTbb0m~M<|rtC%+XN(m}6j9?qe|J)j7!_3U3}-H=J^G zi47C291wrjh`LO|*Efx<8|8&V{8^(FZhFxCD`TL3*KsUdK)&Oke%En4lz(Ibls{l1 zl%HS{l)vFvD1XCbxN=!m-O1#?YT1;!sb2mNKhU(g<2)JS2Rgp)1W$(efljQO?#U28 z&`HY2$_MRtB2R((oyZwb{)bbc{2STu0LqmE^?QoBP=1a)SO5d?3^)_&oX{-TpLDaK z{1W+4{*lw*F~|jQ8P{Q)F#kYNUEH5g%yX4p5=54tpakkWKj>j^l-A87ew|w;VyBdg zl)u7czW-l0*W`Jk*(t=6Zhl=Q={|B7h}bD-)|~;MzV4b*y~7OrC4u7lfL8L6v>-Iqq{ z8Z6(&x+wBn$Z(r}oDYGl^PB2ii*KrHCjJZ3!$sRMFUH`uFkwe6CSLh3fwH5ngtDWS zLfKKvpzN%xpuYccHIzSKIn;fw@b2dt?|!Z&yuA7Py6fN^xYEYgo9k|{@%2W@jITF| zJl~s5#{ch)uPa5K=dE>j+Vi}?UFY7qyX`vn zNai}LMXqzN$*t}h?>hI{b=JA}*FA#X2KNCGy$4NhbswsG*yKkUiI*-;p=G`|$ ze!T7pWYr6_dR=Sboc||Z&i~gvZ}~heTD?AF^}>8leR2L@;bxC1UiR2JD0^%@l%4eg zl%4e=lzsLRlzp}V%07D;%07F=dk(L9&*3#FJFFGT4tpKS4toRrSxs-(y$K88TQCUU zv3kS*kF56iE>wGb52`)B54HaN0IFSn2-R*rf?6kk47E=F1TJa%wC=OI_<9u5ZojDe z9Cly&MctQ_L+upOPQR}E%IfRux^IYAJB3z{-$J$5og-Rr{!sUQoz{at)cr(y*_%H? z^&e!yf3Eu#S@-)3)cs0c0AdkasGc&@uu{nlPNA?4bpo^`H0N4SaB<=fTkI|bXtlP?$G=~&Z~b2NvYYmnOn=))B%ggvZgmIN$L%Kje!+kZu?g}onw`8~ecXQD zAAZWba{&AT9>{fMpB{uPyZT_L@7)~&_5Hp>Ve0n_4?~tceK?dIeT0|(NMwDN?_Wh>9L*O*1eahqD z(eQYv?*X0wS$EV==e~7b4chk#PlB@dPlobGoC5W|!WrqWa-Y%;z zv37I1WZF%sNV_RBnfL#_c2gnR_YdcgzVnK?_4B;)L2DQDp}vE-0BV2q45)S3neY_& zAE^L&7$2WwDsUhsP*8jPyQl9(jA0XYB*!`lVgSJk4 z5DtnxRR0L^N5vi%Egsr>=TWG2?_*H=r;o$xW$WsnfW^z#)vtx6@JToqJ_Rp;Ps7pZ zJp(_vYF+)aumJfvI21k)&w%T_`iHhodI7d9d#V0Kc**jY>ff>c^J@JD>pw5ow^B~l z|03ml)nwNHUjJzoS+Blc|Au!TkoD@D^>2AHWWD;f^0oVftV7oKzkpiDeF?RW`wD6u_chcy?i;9e z+_zBcxbL9Waoiz$NdPkj{8Y+^Uw9aa=k9GUqrheWc~SD{U3xcX#QQaaL78` zX-I3(I=qu;;n3D`ouSriU7*&xU7_}~yTN^7cj$*b;DN9wJQSwGBjF}c>-SBe*6W+W zOt?854}I|C=3Wh3a{cv9y&L*?*N3btw@|p12X@Ore=9f}Zru=HuWo}}jJz!@huguk z;P&tWxC4}5pfCCwCw7DyCw3xS{(zlf4EBRsr|kme2iO(f2zP^8&-I5Zk#~pMza9YZ zgL^=&8~21-NA3l+F5DYxKYJhe0^ApBKYJk5es%_Y5Bj0jq5Hw_;r{R!cmV8Aeh0#? z_#F;{+Rr{1>Kw}~DiKV+uH2;G1 zdo*9Bc=Inn^DkTh9PKAkbfcEP))r23!?lBHBkPAS}6Yl`LN!sZ)ia- zSQ=?)AfK(AMw3@Bj)>S*%?;58+2gKc=7lDa`)oFu-~VZd+v6>w`6m`zzDpXeBwu~+ zQ`Gl^mqPh3mRbB&4Ob)Ud!LYUEN@tWoQn*RuW7gzxe6H~U)OLwaugXN-_UR)vc3}w zk#B0a8Cl;Og~+!wtVGs28Y17S`s*|uS^Nxp(5nC-^;uc>U)`YQ6F16 zcQ@RFtbJ5bzst88o&@iuzP0{Z1GOHzkL$4i-|#T;k1l;cWPkNRk$upIyn1?Aq&$x_ zJc{00$|LGK#*abm^F9vsJ>w^!zE8Ins(epEUH2(?am&*U&yl~rKlu##*R(t<*~WRu z`uK&0=VAAyFEp&P`(NMiBJx|v(ALY6_1(LdpuT&z0qVPVFGGFz?iJXZ{pDAozSH~~ z)OR#np}wQ}y5;*u!<)!2aUbIE=)Yz4@NUD~7XNO;JFu(sZo~V;_g(s)Xx~>A^?vOK zruSjPN5sEIKH@{<|1s3}JwLJhK5O{Y^ge6&obdgLht&6%4PRLJmknPL-bA>l_n5vW z|8?#+4JU9OWrO>zNd0_gGUxvqez5vFAqwrgN5oru`N{JAwc%&W_t%DBU{~kYhTqAz z@6z8yD?jA=of`izy-tlzqx3p8E^O5IXVXOcJ}k6zFI@W;+_m+D= z^_QMd-&szF`p)tuQ0;hAsQTCpsvU1mzG;rHv6mMws{izc1xvSV?9-_JyhY>o$g3A` zDbk;}ZQQC+{dsH2^yh6v>SbG#Tixv%~)aHtuEl?k$;o_Yui= zUz1t?d--NqzUm)-@=-h952_vS57mwjfNIAFTK)$$9*nH*3Cm1*+o#bZRC*M!EgRv+UeQy=3+@||FEt2@!Fk4Yl= z9osmW{4`EN5V5szN^=G zGU@s*JxR27579fd@f6cLwQ+{&o!Xd#UdGaF(b~P_^5(q8TsQ{?2-i9gQm&bevk2Gt z4Ve#THx^Nz&)w4+^I=-kX(qS21&xJPz9P~5v*?k&xG_k2^#h2^`G3-J{$Kr$`zf`4 zsQy-F*FVuE96wh@;~es_^Z%sdd;g7dE&cq)d9W+;8R++2xawd->J4_W7P&R72M0w}-ig;0Lki=h0n7eo1FFM;wO zUJB)xy$s4PdpVR}_X;RKX(g1OGz8^Ot>XT4&L)hk`K%ghKC7V|@(VNfw ztGzdnPX50}nC?Uxqr~gHkQiF*Hpb9vT-+owpEY~!E@u5u^HU3Yvzo4KTnr1~5*UO_ zt^Kn8C*LidWsO%6uK85_u;uE;Yb@X8BKfZH^1Vjn+|jj-*P*9!!1(?@RDZmIaLt!D z!dBvM^2&cRvc9u@3sn8AgsPugq3Y*0sCn&nsONJB)bm&cb>8ewsP8P_1^0$`ldtOY z9=L_Gy76AZRenf4t!cauS>+RtU2=cpgVtUi5bb-~(7v<$5Y+R380s9?BT(nJ9)%aT zJl41tef7)7sfU`DCnQ_HgnUo>$;PLM*Y~8MeW&?pxTxjX#%JI=@Hygj4h!0Mq@PFD z__YpdTw70hH*;QSe35vS7cT1Kywtb>S@#1MZSK6>_=+b(zB~SE<7>$J?zlL+rM2;O z!u4Hp*y;Tx)7>}Vr|?av`hE+lzTbwb?{}c=hj-!fmiHPzApNy1?;AB9AoITSM~xrC zK1)Ap{Fr!!$N5R)XN3Q>DP_lkdO8S zpnYHaTkcQo`#Y%T`Mo`-9~*zLe*I(PPw2_6fQx+2&yBwzt6m`W@@wO7o(!qS-y8ox zRy{(#$L>TrMdJE!(I!q>q_ZbO#*eO%E-(#tBV2ZhsQ0hCqo3~di1b8OexllCI#mDN z1gigT3iVz0&7k`2=1}vW4{HAF1vUTmhMNESK+S(!K=scpp}y0;6;ylQ8mgac17%li z3-vwv?V#+h?csND2dMYM`$E}OJ4Un*vr~k96!v9oKZSX(Uu1XAv2Ad75ox!(n%wH{ z7U^&D?xNXQ#G^kTvXANSA)>#h$^8CLWN(xA5pA9%9{qhI`2S<*v{0E!d>JEtvwfu*Pwthp8b=&aB2-4}hypZ)6>wn8< zRAijxlNlLp`DB{R`M=0m%V(Tu^B#J3UTQqldBh2n?~gwwMkXO^ohNENcr1LTDJwD= z2AZ=XtdH>vO^Hmk{Eidx3r$lv^?00U-=Ea?WxB+_FB3nPNqU~Q?w@`)BXUwicH_yG zAK(A+($6rN@Bc`T{1WFmb0azIv#oG*BLVJH<8>a?JcCU5%*bqH%}2AK_NgSVaq}am zale|Mp?$}_!1P)FLw(1)$n=UML1gWViSM{2k<%$}9_<*Ce_5o|^vfa@gwJj%7j4{v z=+BAFLsq%wLX``d{O3phgRF8b@Z!&aD&Lu&9`TI3XGhM0@4!WbpWm`jwDLj5^K&8> z5Pn6=`H^#}@0ynLBvU`4>`ZMraWsp(%N+W3F5>0crledd4k!tUjf%is!FW%^f$ zreA6LA<3o>$-gcVhVQ^?OIH`EfnnrY*te-JQcrr#3$RnHr6JNtxawDY$Bjgqh;MM+ zNEEg}$r_g-dd-n5k#BI9L}I45B+>$JM_vqDpyH(uX-7*VS0i8BvP>lXRVFK5a@buF zSq@jgYtYwtB+hNRHgbc7Gyj_&>wl>4x+{ET%Z-tn(7O|TNIthjZiXx1N-rFucWdM} zSzAE@XXYUVOA=P2_I)6ubvM2Uo)v;Jxq_ct7b>p8KHc zPjc9OF!BIg0Utw8|J%7n+n0Tt^skZsJ8(4j z_bwa@--G%N!u#-8_yOh6KCs52rE%JR>Bodi{sd~@@Y9I)`#y_&W99iO^0}4g3(1t{ zOOf(?WisFY@yhd!$iCdSHcl;Q{w}pXY+vpN>hHAX9~GY1KigdWPUSf}_Dkf~NPPbb zvj6p)^xF2nlA=6~c`QDB z-HPx&u`NXlhqf=ZHQX__O>{fr7c_4xT0Atr`Swu$_#NP&Sl{SQ=p7Z?Q8YcszSqvt zT?ii&>nB<`G=KlDP=5X0sE-q3{iC}_AUwKC3>bL@vikEC4d+(Sj|mO&!< z9%gc@dwBE+laCb5t{@)&?NQN*r2EJ{TExB>96bi6H4QeI`9C_;(oGa?{+E7_=HZGr z|1GrndnD9+J<7sIM>9KLK#DpIV{S%`zOnxbq)E9Cy-=&cAf6;k%ALSzVQDHLY|DtnE zo+sLU5Kp=0N6)hRI3v2i%5{dx{QhtBKc;_{XyrnW>o1I+ZP#BIy&x((>AdKosO+S3 zBr`6ZD{|fQOm210*LfA>3q;lf7e+6)beBdivUC?qCfy|>dY78q>R#rhyWC3`j$VP@ zg67I-t?7kCtB)$LK5A(n{o?I|`J+bhW>-m1?W7LM|4^@VumQ@y&7(^9B;Y#I7Xny!jo?fvc##BXp-bU7@5 zD_{^_YxQC83Gp1Si{8xrZg8&`sh1l}Zgp>r-emI4qP1V*(Z3~nhv}~r(ZAJX-v5i< zZt@+XJ$K^KUlm<#`ge-x-(_;Edw296lUIv24iHZ}xi|VC`k%Y^Mc2Tzru$6h_kW`g znEr#JwRiNapFad;_dg8Pj~{{R$B$Zmk42xd{GNzDZuvc7a;v*G`lRLelxXb^JzIx7 z4WDUxHu?+xZjlO2(YBjmleLeby<@=^+;~aX7TW>|*CcVZjXup5)4%F{oyi2&g zXa64D8om#AZvHU(0h|UuCV$@l7b!36f5P`}{xtdt91g#>e)47XGiw*0OQxTEA)^1K z$*t~JUO)L-?4%ZlG*0|qAzo)$2oS#H%k3W#V+V780{op64e(^J$)%08R z7gzv)g+WMu^l!@-JI`_d;5!@q{*Rl6y`b@@6V&*FOn7IvE3*1Q7pQ(9d5zo6?T)>n zbq++YhuhP_ng5ZWaMRsQJUb2&zp3oGgk48_-Q3-R@pFUg6S@ChCbzo1-99F7AzFVR z9{Y4_cT2c+)7I`*urKV(_13xDh~%@aNIu({-0E)c?qG6X(fSGT-0x2Aj&KF+Z|Qdy zN#9Q-{Vpcs|95vYxxZ-XiRZp{clWV$14Pp8A(C!SlUe_}dz-wEX#I_NuD7pyfTbHK zk}g9eo!?}>|L5*+@&Tfylm18Uf$kvmKX(sy4}xh;2b5XI)eM_zg4;=tmXC5J3oy7;E0{g?Gz{@9A2R-AWD_iKx<-Tk`F zulx2|=lT`bU2@$H*PnHL@cL7)k6nNK4Ts*a?@gU<`S9koH=lO%!8aG&GVYd=l}E4K zZRIs9FS&Kbt()9-;cc(ncH?c2-hTY5BUkObs{5)BS3SIH@v2K#ZF%Q5cb$7zkGtQ! z>x#S2ynFk5e!lynd%j%VS}^`n)K4tnf?$L@SA z>+#6rU$1>??YV0wt=)TVueEtkzVTGwXZk$T`s|C(KJ)Bj&rW>q^XF=w4?dsy{D9{d zuFGC`%(|V|tzNhA#dBZUcf;2k-q`tqJH`(A$diA*7qLTc=KxtN>bWVP5z;QMwe6&9=Fvnj~UNq0=_|oI`?*o|@o*gKg zv0q!n)`U;8@VxTU?A*ZYKw(Lsv@P1%o%k8K!J>@pl9IxJ{vBABU7VK_oR?7=$j%!$ zw=};zkW_b$L_eus7RaqYVSYwnUT&bIJU>{RF_Yq!Wn|}+1q&<60|QI4%V($L1PLv0s~6}h1uo#bN-wOdF;&J6Osk#SnjqGAMx+5w~_J&iwoyF&ftHS{;$d#&xAa7 zY@d%;#esQLV0m^3rW{|H5>y z1?@(BGMhvbC^P+mxxwP{?EK5)}Be3x8AeI+WKG%cOU@{&Aen z1D zU|I$F*^@lgNk7i<&*EWj@&5G%C&ilV!P8HJWI6f4YRg@N% z1hT7q7M^Hi=NEy0Io`L=AbUyiiP>$hbr#7K3ntb;5#3wuHnU4Pi?};DhI4616nf8C- zI(lMsQT^#$_t z;ek1U!k{Lq#1OR&`H%Mx(Ik~wTplPb&Ms_=(+$VtE6Pg!g~8nHLVsa?PP_P>(COuy z>_0v?m=_pYkzZIosWg~Zky~EYPR;3!-YCE2(=Laeg!f5N)%=`kdSx{6KwFH)o8$c6 zc;}y!UFy%v@t5Zp1r`L0lUniltCue;F%w@t%O`ZK*Aer| z1I6ls$-<97@9cKh9iLsCJu8scZ&GPsW}q}soEs?f7X@>ep8Xl43WGV>g()!^C58EA zo3Y?jw;P4$u29K zo7Yw%J-^{*$M{B8lrnt=i_T%{8WI1`HZ^Cvq~5UNio!xE4O4SFhH5#O!Xo1@!q z?1dS_g2glQXOXGw7g~i`F#bsuIfePTnZ+}M@s@jidhS#v)_Z2E*6$T~@pUa6K*Y3K$E?fUkDkDF)Fj$d? zd0CuSG#~pHYdE7Q-oz8nGBLzt>DIE#v-1Mwf!y+7X_@LbrOm0}7x1^sG3^TWKPgqb zL(K}5m1h^0=Vs^54kQZWA10}c2cNL5$6Mzc71!<9;q-j?(|IQwxAT~o<}ja>^FL-3 ze_v;Z{SHgt!r97^J)g`nVfU1jW2)L8&A(nh8CG6CzvSXgI%Ut??=ZFgVQ7{3lCtS* z+&s3e8r1)0(;&*)I@Dm|lh04_zTwtR)v*Sb)D5?8DuI?<9?T6ETG~;vL3u=N8EHJ} z?K>`6JHgVx@QOgWe^MaGnC_eC&)2Y?ovThbEF&*RS@QoKNSD0dTvFwcDlenNl5wPh z_%2y(H}L+wk-c7gz1g`|I)QA5tfa>ts@%-oDv?_1ro>wSm5orv)oCJF5gk z%VygsJ#;R!wVr23dptRw^nk&~TUP*F026?I`nULce8nl5xO z>5|DdvhL0g7UY)?tf1cw%q`3h6qf_~rgz!Idf8jY#RpD`I5TGkqf~Bz_jKa-o5^UF zTQHF7DO;F6bmEYK3)6@DM`n#5$P@IF;Rq{ehHn~=H={UMo# z_{%ap2Zh!-{OPX*EU&>?m_9heH$0zNqfCLrFjtF}*Wm2c6H7|U zDoS*{jNB51+Zk94Vi2%GD?d9kgK=#1)+|7fqBMmXlqYXi~Z! z$MjOJw{i9I`GtWX)l^CiB?c7PeJS;xJ!@8JU>02}F_Iogd{MF-e?2g^Z~M01IXRgw z@zC>gR8tv6>H=2Ra_^)**GakM1yppfAW-a$e`-hA_N9R#73H(_WaASpqq16A1`9;` zj&)4WjHDz3jsQ-Ed&w|Sa#Ye$?`E0mSJI{MrIimC5+{9o2MUo8&iv`Xy%XC zr26e~8&gz%zRc5tIbOe0Nk^6jPOrdzOcaK+?fqNH;^Y_0BrR;a5Zh7Cl;m|%Cf;~v z9okJEtHILz96Y#rGg3$Rvcdb$IZ!Dyk0rC)$b6JK-q?~nKHMb68Tms~?z?RiXzTdI z>rZ<>Uw(N-F#~73#=XT!TyIx!Qc8j57nPJVr6%vwvqam^*JXcJ!$qZmJD#iK$ZtA1 znXd+oqU@5qoWvvOFfOz!U}9`mUWf2Enay9-7k!9|XZ4#>V@mBfhw}HoNdKo1-s-2F zom5^_;`gi{e_1eL0!+56Ii1IC)PGctPZM7zjmA+v)UzVIx!Qry<4jha?SPuR=AC|LuL6yCsh?GvU=p-Cb~; z_T%S9>iI9yC)TTGPbLeH$5=72EKrV3H_KX3hxm5mnr=b%Q8M|)u0Ovlx4f`@p-IzW z98UPDllv-+gl*{(g(aQZ=ja0bVP;hL24^fxACX-;tLy;J@Y?&I%H!E0HWQ(%`x|cg z`IJvl_PmAZqotEklFxjZZtF#_EDD}cY+E#m?%{g&FB&A zG&pDZn2NHQHiQ-D&c6Z!YNU3a*dbEtQS-|K!BQ+`38T%-3FMYkD1*VdKa7>xUdR?i zS^k1R$D~6_DtyCO+XifmEUU;#{P*CQ*NsYCuVL_v@KA0?IwO*oMH-%6lpptDk2~a` zoc!_`x!EP!l2Ji2=a>hfqBy_YGS~c56tG3jnDU(D%_QzbO8kFt$(=)I&o6U_db%T- zd?~85l|Y*Sf|_Zbx1s{IC0-a)x+>s+EQvnpvZKUd7*D~aF&jk*^7E{_4hfdEj7&+LY$j|j2G}XnLmpXd9u2el1{b|LD#(l%EY8nun#3?%Fe5l~ zCY3saN1tmd!*dnvOP|EpP|CVQR@IC`d8}2WA=&eM!_+e*j5S{(eryHkQX}MDiPyv! ztU)=sWd}-kv}KDI(r$TJPB2(btM+POnEJFb*pmJ^!TM*S9u7H3;adXF;o~e^SJsn|w&U1-F&$IWG*urDMA!6-1LfF9#RVDJd3m0xZR@c%S60F=7_aq= zgmE~KhKp@QHufvDL-Mj_2Lkb_RCdbrwSG*+k$>#@$dj9Qr_f18IA`zxreZEq7De#3*g6>3mzIm!Q#EC)s}8^8J4#TgYj`8ia=Q^ zH~-J}=SGeXC|})AAKw`Ncx_OdYc$1)LtH=pCa=pPEu&z{uwhwoFXE)xbjWzsX@91- zZ$vzwlq@uFCDUimu^NldvNl`B+ttLj`Wi;t%cqYd_LtdL(%YAtEQgJ(DPH14y6n7^RF1Q!U2kOkzWu%t z@hVApyoV1D%U9G2~zmzR6RxD9O^I#6NZNIBVRA2Qwt`7|mNWc^rF_w#$SSk#C#mZTq4lvh(O=Z4doq zD}Ra~cudMjsOe&kT_<&aq21!$_L%aEXuj5F{l~EwEXhvYQRM>sQM>Qe&OgdBKTz6l zXhm@z2YLJxnLG=#lSf6g?(gjz-&U_9aSx@ohyyLZg0}b+dq1V#bF=L#DUNcjk4oAN z(n$-y-AyL!hYlN-$B=&hzeqnJP_FIhEM{$1T5No!lz}X4o%V0a!4#={a1XTKI6Xm` z;OES;^;5g^0BPemHIl=L5S=BN&-!SX{g+Of=p;$Mw4t`9%Cln$oGbB<=7i4>)>JIH ziqmGQ9w54ksKaT5=vMouX;f|if zWXjo`lp#|0W&7;CePi36Z`Sy%cKt4Xo$R*wKef`t_~xT)BrZ0r!yw6ZitK7m=UM-I z^{C@Js`^BQt6mGKd=Bfx>sFV1(!1^>8(sf;=Yae-IR0kGf04s-ILIT-w@2pxuODze z4>(6F<-aQ!jiZ7x(nPe(jymaKCw)KXh=BufpO5rk>!deJPMaFn;a@v=@}QG`m%@8; zKfO|(&=BO_zWHs>XXE`dzO7lJ$C6Q25(wlmX&0unruey_iupf{gy<%_fDzzRo;Ew z^0)UDar~D!{_=miuYVdiymplwINIOKg--fesrSOiCGFliwxJuH^sA(&Kk^Uu_9e}3 zuV0S}1U(zA%wIl>?YRsbwK9;V;OOhtyGMTxt0wH^9@{u$*)P%jhYcDiyU47f9-W-@ zxpC`P6NI-3mNNOzm=M59gmhf^lAwG-Gq$etU>&k4r6$T`jn>Ep`h=9k+! z7R?XmI1i?epULrCR&@mlrJK^nYmtRPjPpiXF{dd#D^XjiH5I>2)-m0E+Ry0iThLai zf4a9+52T;%3r^A6QCw<0wF3{bd`jB#+4wl1t;y_M?NxQ$D9t2&m$bi}aR0u>O0)Cw zgQ>HVA&r_w>y4@q|iV0+u`)XIgCfSa58^q#b+PJD9nNQh<>8K$Vop{bHXSTf}ALn zZIDP*=D*a@7O6k|;tt~z<548FPp|a)ZpS{o)=7WB^th?szF^z)Pw~X|%Zl$^`t6he zD@xAK&;n>c{$$m+UvJ^MsL0DhGsE+>IPxQR*`(cb`S(4FCKs&0u4Ls!w`kW;bWXUJ z@5Hup|9Kord3fj^!Qa!{6(gm2XbF-yTbFEUvjV|3Gu-^iy?sS(*V|YY6;>S?=9>Am9h)P8(mPmM)n>d`>$|Mm7A+tzM5o`J^L z{M55OYKUszrzHAlVs6A6nz~3$>29`v-0qy&U#K2t*PoQ?m$1>mH)_0hBqy;r$(%B~ zq9~_W2fI=(q;t8weJB4ZecUgTQFeNv-kV8x^ln3MPPZkBeq11joAmp}$`w#3rvXd! z#HB{72r`GueB=CW|IJ~z#X4>B4`-|7)peY>Uy2iF33UAng2@ShB+cCR}4hX>~tYfmfH7m--X zCVV`40-wao-TA%0wHKap{Hq=R)&Dd;BnCabShDe9QA@{;-FgVxS!~P(_+L5cW}~5( zRR;F-H){204h3)F+i^f-&3JQaM}NXeU%j!8{8q#&BvCQ1=`%w9E|ilnc4`FaY+@X7~IpdinB|~*nZjA zxF;9hC4)H~Y72P|F2)~JGT@}R%RQwysjE|8dVZGnYWuabsafO&QW7M}?;D?;$9^&D zS_TGqadBeYJCzLbrB83${@Pd$W0ZrpJD#YBaq&zN2RytR;aO^Z+dJj`m#q1`K$Exe zRdQPyM{xyP$uCULw2b5aS53^aH@fw1Oir*Pc_nTVCQn;anjC+d2>*$HCUIskS^Km1 zH?pierGGd7ZhZFr2dg1|pBu4*j?*3cN8+;>QkYXwlr(}8RX4s21-&2BuE*&>X}4a> zXZSM`&tkH-z$qIzZU6oD^Rr*BSAg1XyP)0N{%=!Rop32TuafKziNzETI(`{@udiFL zt55mM@=OYpPR$(NR-DuRRdG5bqBOE+H&%{BiBwko*^a-dcJHJ~Q+U}82bX7>$PWAS zd3J4rm)iz-!vCKb9sXptwE2zZCtPNhv-bOY`$i?kq&7pSpN0R;KC+z_i0|K~?pMdJ z+m?-^b6bDwzeyRXe2l82{fWUUo`=r2$(~N!SF$cUBpl~YwVc}up!dVH&zMLbuhhwQ zo{l%2y}O9d2fclzZF>L32sEL?fTLZwaqUK>Wg)1qQd?n-BD8{zFVdr!8XT|e25JJxohMsG!rKb>#*TRV)+g$o>i$v@d)|K48xlMQ*U zlfEF;sA7NNf{htf?C&g5czmCIN?ZM=Y_a&Y?$Eis)OBX!e1lg#j?NjU`ujFMlcjDU zC+99zSU*djtY2>(+qOte)Ng!UJiV=)p5CAOY(g)-9PO|h85b=}`NMkqlIJYO={;F{ zZzKLfN1)U{Y^1lTJA;adx5HD~uD|j7^i3XOUTuz*vreC%n6$@C&17-z&1agmh*U(27)2h%@?BwSVOjgRNU7sL76&%du@J9_=J z8@iX1-p?H3`p80gI+K9*sZ!qy$jsr(1M&9)RGDK(a;ATh_fD2BdTa;%Kyh|)Fhl>u z&tjL-IIzap0kv5=5vaVT#3N(|VQ=s+Hb>jHQZ{-nJnkk>eI2IbcQ5o_Ns*37CC*0D z6lf7`)#LbBAEdl@k<|AM&VJ-r9Wl$*I)UT=C3bRE1sztwc8hO9{0{7tp^BiGNjjG( z-#!Nha4UNU)`!f=zh+!sAjlldIwhaxCf%&k@`~(2TeHNQPC|Wf*>#g`gG>$=z1hO~ zbua&k@$a0(Zz7>Tiu1MQoY^d^84=%BQ0~L+P@V3R6T93M2Z0rwDKj`FKfN}Yt@A^~ zC-PH!>G++BWWCU1*or`fZ8xS?`=8!3N*tt1yze4E|EWo% zC3$_e40CxDrSo|oA>}z*KS=5qcl36FVw;ks}kzF|I}XN$Di8TkIi$*^cCKlHD!tZ(V=~HjPCfJ&HrKU zO#mZH>w3{Iot~cV15zEldd26%M)AF?SapU0K}4=eD*N6^dYLs-sj4J3ol4cDs=7M^ zNQ=swD_jP+f_T|MHW5UTVUYQ(1{`+DbCv0``n_l$oi$|S%i8+w}3jK*1^}2RO%^s_6cvi`g%2dKThXXUn2JVGaBkjp-}>CYSlI&NMu{lJt#S#WjZ>AegZ#PZP*PXRJtoy zw>r+RjP}ZboKKMY8hk+z(n4B_`hhM9fE`u@7C4~Lu`91Vo&s)N?#!8vDX68#8R;S$4e=m`(kUO5UD?n-iw#-@oEmaD0 z;##i(=e)KkE9e>6L1K*b#|z@m5pU`M59=a`-D^R<7og49FWloDh1}ro?F)ZW2wd>}`5k zz!_{8>exN3Uo8)3$)6%lf>y>4_gg;14Sn$7r=`4*_onOOq}S{E{_T0bmValykXd z`BNw#+!LXRw}t3}8aW{4qH&sIX1rg6jg9V$Uw1Q=h<@|$Au`t65%#M6^|t(ahVabM z)E8l?hU1fgv-6l&cpk>}>G`kIgai^EKs%qCxpH*p7nWv=^poSY6cVctyhVHbP>y@_ zh#ycJpn`k0*J+c*g}EIr^fp4b>B$%;Xn91gg{L5cgQ9gc)@&4@XZew6-If?vLn~-` z4dis8U9-p-W7Muhttdz|j!LkrU2)`GypHBJis={tnGK=6QAnRUJ}S2?FjfvG;FD&b zp9zMxXzPyxyyYevZTePswDT2w&kWFs@S>bUlt<~zF;o-iKY-UF)>xKug#D9YJ$Y%uY;Vc=rX-RTZ zmU61Ve@Md*FydA#>HpMQC-NFU?``84f(zEHvB?N;`S(Tw5rLH$4*T+4{;gfOG1T48w zt%4mf>k`XjCd(J=trY+f_Bp=^L|6qz(=K(a60P^jC}l(oL5vyGuF!dYJoOTYM!t&p z6ncB(cDd^k^9lBSVW*V=KXJL@$T9>8)m@I<%?(SUejf6eU_Fn2S#3ZNDAvU+OA@%S z3j8YeO=ZY-cG~7S7hqfq9A7g7EYOB=FuWXPGfvw!JSgSlmV7bB#{&#vBWEfws+RLW z1FLdl6VA%O6nr&Yde=FlO7x-L3=HS{TQXA6&C=xpiFg?Y`&+b5kDxh3qRBdEFVY?x zyP_w@-3Fe!D1dW{Q=Q&vcG@2sE_`Svu=r$6IBGWTuJNza0*WX!SRs3A)pij$R+B0gBXfjj&rFZ3tcK^Kh!xhY&99VqYfXINg4<1t=y<*U z6x_MUD7xgQqkFR4sgZVO^frjDbc-DF?GA6dus)1bVwQ&`?$mvB?`VM@xq1ty-Le;IWQfR7_WsOXQSOm1%0}`Js}^>EDZ-n6 z%#aw7M6icm-w4EfK%4jsjzUh}%aW-BA^8RTv|-gm>+$N5OU6OS+L9Meq{9mFhUlr> z#fSO+dEU%vwtcgFL{HQjC?~8Ak#(@N00i zbrZ43f%X#Nxmd}ZRO8RfV>S&-L2V)^!1NXl<0*oiyikD!EC@A3z90&@QD&j# z)^~K3uS5R0Tx~T;KWIvj_jk_E1A_D10+A98b&Mx2Z{uidSD(9kQ9iuCa~Z0GMHl8v z%~>2QE5zrsG2GrW)BI~isE~QY!3Z?Kd@*NY;ORI(d@{e%td=gUfMIqa_>|ahWctrU z0%Emkum0oL*#%skZhMnx|H!$59(Btd!$)#uBZBw}qt&g_#ad%`QSvI-EsyYsgD2~Q;51L>2@ z_=}KmFo3RXst%&NgqSLp&W-ky=W4#T>FG1lO@Z9CM|5S-v$+WX_DeM#SV;%OW(ZCa z2awV>IkafpU2y=T_mH|9?=my5h_4)3TnUMJ6MQf36l0Ih8O|$UfoT)3wI7v-H(JhQ z?H?xLL$w7|JmDfg>9{w({N(teZY(;Fj<2>|MfckTHn49soDcVHoKYn=B~s8BJx#1= zYzSkX_5D{$rilo@W$b5pGUiY(Z2xpOq0AF9N5tmHUp_e9mqIyz4p zMj1T9p+@zD=i&2c{H2Q<8L%Sp_JeuX?H)#Sg826`7KJcJW^K67kzBcl{D`jW8cecU zbRKz&<{@2hs<3E3SG4@VcNpPq2Y-cewwD6qI)$Hre(~i@U|8E?1YgF&cu{!>-@)ge9+4g%gz_V`U5L0g5arm$;kn(}ml-=le{&%}49xk3PaDcT zB`&Y2kFLt0xN?EU{8A!p?`s$jK7)VP*M9LcD*a8BzV#scMaB_e2uC_tGF+oiW0QT; zi@~hHS%x7XwR2`0jx%&3EWkZ;1>Td(h^*k+NPh_)%glK5iwZ@8U=|-%$$LX1$WN;T z{>k0$mw%&@FYq}&0w+Uy)0_jjx8d`2mjTpp<5>%`2>cA?el*?(zi$V-du4X^Y0|11 z-0Qm!C6%65=@T>ikUrk5#t%fRv7nOia5e5!uuki-8W&XpA93SnLwbEE=j|=ckqXb3 zEJDOr!vSC4pa|X(wIf8WU$+Q;OZ-!@NiiW%qxyXBnHP-h6n+9YsIk+oiJcRa6u!gn zhNrDXtcKviElo{D?ZK2!-f3e{PX@+#A)qr0>*Qv5@k6mjgl~k~fM~iAO-JH%2K+e4 zJcKR`^&`EM99V-$Zsr&&vd(LwbkLOBjp|(kC@$si%AV(d4@*UzfJhq&;n|#DHxu@- zi%teNYLdX1ttCA_vIAmH!~x`^GJ0*lS2S1}5 zjPQhw?1+>T`u!s@t7C|=F`_oZC>xhxT8WKl1^04$8%i?h680WgOetqw_0Ne9(e>AoXW)zK3yJ!CqW&}~gXCv=Gx5eUQJ-B*13Q;@B43AeKAf?=F(F!Ht%gJ zSqA*!pBpNM<#m_8gC!L=l(XfB?5#T0X(!Q5}VU z{5tH4sTlNT@FI5=yK=~##FltW47RhSjGTLVk&nj_79K%kp_kt-e;Lh9 z00^x%8p3%FujWpRta)l=Zb>AxMB40aLd%hn*rIfCw=6bF2%0Rvi_P_tu>3NR2;RGS z>afXO_)Y`7X{zS13;|aa$;+Xw6ns!@R4;4Yr%@!w^vk7+Uh@cVga4+m*LJ!}b%=RhN)=0%wF7 z+w_DZdZ?FtMw*KD!HgFCtPwsvJ(|y?-KpnHF)1TdOFN>u#iW+W3_F|z!7yU_aI(f} z#J|anRI1M%MZi(M9dl-$Q^=MecTScl$^i8Uj3cn4SheeS#+oOYg%LS|@Oy;DxLPgE znhPCbjxd@MJ0cI)n3rl@W7%w4K+#j7_~63?pW3`y>qpv1J98q*(RoBZny(;TvkvzH z$KFbuWanTc8a-Y9!T42Nnj6z<^{VFn45`Ecq15f`!|6ZF$+wn?i17*l z-UEVp%%JI%L=etHZdv}S>J5QSSG#fOfFL-jmKf>*n9bm!l+rJk=JFW2%Lpf&)AKQ} zV<-P&IQ_H5XkzK>imaw-mk%bx#rKUY&FOCsAf`Gf)Yh8>RlP2`(+wP9jcARL)-4SdJo>L+^zy z62T#PB`QDY|2%e3>YFg0X*u6C6SUTrI`>ZT?7RlQD03@*aGEY?6||e4cy5U@-z1A1 zU-4lC^yASSC1$oeZPc`d)kTkVSPWozFw}B@kg=Vxm1t|^(ZibM_vN-A1rezM$wF(l)Oqdeh&$FoeY==g^WA94}p zDw+Ff%Q@Jk;Rccd``iDzX+K8`z2+!GcJ!6K$ncV}i%}GDen!fw6!o5)!fz4MN&er| zgbCBo0qg)wunLvEZLJVQd47HZKgWt>043JO$-ncQ{a@{@zzSl&pdXo0YM0@stG6bN zfCUS{ocGTH*fQo+wvvRAAzzeTKf!*M9yaJL#%@aeH75ah^~JvT zFenU2JqP*0CS}3t1qEROBUMuF#&ZIu9ib>ASwT>4{ogZ|dc`%8W2{YjO6K&5XyVBYDE za<+^bxQ+O~dQKE)Ge&pWJYT~)gl`H6p0rM{{5+6i=QUNqpa@ zlDCC3{~ZG(V%UM$d!IEkCq3iuPb_}Ky%n=T&3~N?@;?PcNy=qN+E zdweH7&#qWqz`>!+^7amB`y-6!*vaE3kX+l5 zbYCx$5d6}GC1-RDY;G=5aK|z?@=CIok=7v3thHD^xbm}-(UBD&6UOJiCH#BG0yAe7 zSEdWCGW6-?tt-iTAX`dD;ABv06_N3;QJ>f@ZHA$wZp;x*;xpLndv4Dw1b96(D5>UP6qM&2~pDAO0U%++9(~oh#F&kpGd7CpXeJ0 z?!f~L9r~AlmlE9i_636~;H9Vfr*ZsP7Gn|O;r>~eX1T=z^M{SyFiR8vV* zeO6cmC?gOn0T|(uL$-+?x-PLa-8<$UUh!>4k@Yo|Ku6_?fD;4B|LCv_U}JQbO( zLL1p~@n$wWp}7^!Rp26c57G3)XM!^NMk8Nn`GPdOxUvdiS)CCpX)3K>=Z5poDcT~V zJ5_B4ME~>_{hms>VgXl$_4&X4+@pUDUg&rJ0YnWV!q)DOg+{T742;i+uiRngrDMH3 zo~$FG>=roulHu?hrr+A3`_&4~RkXj2pC;fx!zk`S?a2`#gfj%_U0s&ZU23u&$ z0J%z)6JS@8r!mlA4uoXVNpY~yW?qqAvUU$7DS=z2qJAqN zM04lF>Hx%xD6;wMgH$x_XQ5B(ej6m661WaU&3ZpAu-v>m`nGwQ`}hA@>xQ zlkveQt{Q<2V@REvhj2&*hyh;1=+g~4{P$0Y`Sw~h<#53WE;2S$H8&m(G!Ia zBr{wkjOpj`b8P5cmtBYbX!UI08hC-~9utYdXQzygu$8{$bX2m`Y-+aTomL8}1Lqd- z;k=90T@SiUfzV_d;dX5o6jq-*@2owVbB%a~YkTL$j@PIt)2OW;$RkPG?PkmKPZ zLC72e9(r2mk}WNZ^GB%Gu8`6~_;V=DjhC$>95FtAmhf}*M1~O!&{|K$pzokAS^=B2 zIs@qj41M#@{qP4!nG`I?uV(0*9)OG=Sg+0A`rM z1}QyI^VJHPUFc=;Y8zN!7lrOl-+?!H{k_Qp5!nKM<2ORG<#Q_eWG}MiA60^ww>NQp zuPeWKZE&ez0mp2ge|&-R47<6QtQBhl^|FFJe8 z!rKKIs4Abb4`hgy2tvw}v#sV{Vt&hhp4=ZrtAh_#iT& zUuqbqaUP)yQbYi1Owfm8e1~>5p}bq{8#C9D{sg7gHsaL4P0-<|2tVp+LXcw%P(Bjk z>-p?rav7$Ladx5N)s$WSA9BOB*NHTJ9_`MDl4Ec~w`*;s2lZ+AfL+~{?Vac#%|5c@ zrao&NjAG-`ipg9yLcA~b3q!d}Zd-&8%Q9QBdWQPAn0+_#-fM?%#|(_)njVvoQnX+y zZMWp~#PM-pPgLkp%+5~x4WNMb>Z8G;=O23YXdBM=&r9MM{m4dZRv|iJ_z^nk^8U9!SLkJ!w**O2hnd3Uk6RV-2u@I zkSPenuMw&Ut=!wgKi0!H4Ur$|vl)Mixocq-En?*O9^#cmJ8|#3$92dtPv{r!ve|4kGBp<`@r9*uDXe*3k0 z1)PC)-7i-Q)7>j(nm&bkf!!wRwdy!3m~Vx8X=f+JeV?A+@5%zU;yuo}+W(x_>fuiB z+f;Cd(WK;wgPd>xz}rF=+1S5*${`@Y{sX>}?6@P;_OLANSL24E2fY2F3<5@ODSq<% z*8NB{BrH z&^k0A+N9snP|mY$UDK`A+YBdxO5mh%K%*w?F^Kt6TZL~W*`A;4I z{52KXUhK8B+kp2kINEVULnZH9r5V_Yl}#HO>z#=Xr+W1@vB^iX`f-3+tw+C#^kk^x zhYZd~57{34YnYInJ#2+~lKlgl-ohdHOd*nV^OfXWekQlrM;uyzJG&K+!ey(y2MYdcf`2^W0e@D;^7kn{TV{t!0%{$)g1f?kJam~tTadL7sCbU zKU8-g1aGc_JgPTw+`N%BRs7hC-FlK>H3~$%9Tb=Ch70!kQ;bchX?QT0Yl=n)c4`%E}_r6#VpPgM$)=(`T$)31#`od-WkJs?Gzbui%#@bnDCpjD#Tgnr;xkz3_8efd@B zLw`Nw(vfH76TP_fzgNju441CdC$SDu9+4ZA7NY^~>~u?LdT&N3c{)0HFz?vAm8=MA zx0eWNzlyOaYEtGE&=dXSe)}}41v{EQUe)bA$erWsFh_!t$gWjj64I+6@i}aOB_@#u zICrD}kgvUKy@LSCP>kxhEiQT+Fn}S>$$#GBtWv$fr?DR8>oXO=Y#l0sqBQeog|H-| z7p+}seZw&A(fhz}MvwOt#v9Ou-meh^P3YMk`B`dyz77Cp;4JBnWe-PhZ8Yi`*G|eA z0{`URJ89ZN(KsFnd!ho`!b(>%g6|;4w-Gy4LLy6zB1ZO2ClQcNh=?5qcr}__PHdaMSH>flc;C-6FT9qzzLtjF!}OA z7aLtlTsBQ&+;9Xxj5RJ3 z!5`5zsekmL`)}~Uc>aJR#9=D(|NYM)j@tJ+;h?YvrDxHt%h17HTx)N;vuyH+czL5a+r21? z=mzTr9mlVs+%5Ybr`&ktP25)wxbGdv$sB>e$_Nq4?+vy^X)< zWQ|3HOx@b&biO)1SRtu9p*zUK0P0|RFn4P_%$83| zcO^M(1{*v?c%oi3aPC}JLx%jd@Oi9~JfG8do|hGj ze^NNQhIexx|JZa9HakAfrmoNc#$1$fKiPr7gRg7Pp;$Tf z(W_`^|0xG_I`tAmfq#Nb0oakcdSb`+34B5G@!@^9O5PG4UieMCx7XqQyh=V}4=*PC z37NJU{LQ}eehZW90y0H#A-Ye!?LI-vl`-IK3iS}a)I`=(Ie}j!0x-pRZZB8K&xCV( zvr1moYi=JlbH<#y{j2IQWApTR1!Y3{!89ZI=p)XHHyg4Vd~jOq+&WE~mg?Y);;ngG z9M~)lxfRI;#Q&{uPY3ZM^kI+e(%>kopGW#DLv#BJ61^wO4w-^~AH~fu45;Lfa^gRh zj^Y@Jyv6$8@qMJXggK+`BpUbR{Jicvk`rigC?&4OKbQVFOANs*(KmH`$o_Qgv=kRc z!=m$99U8bP4}(ob+k|URHRehVCb=0Sd$DAy+prmgQxjD!m9Ws#o)+kE-rA4>|5lNv z=@OHDX@2Wukl(h8yffAhVXbh4A}7hnCo1b{t=zFYN4N*e}(d5y-JrGt&7$+CfnXZLqU@6+I;gnGgi_lN7 zh@>|q^$cZ(3`Wuy{Ui$073V35tVL0o$x`g((Ff0!9x}5hdr>{l`-;c`(dU_+duvVq z4zGlM@Wb1`WOOfj7UXakzu+tcM2(fsdJFNe*P)8j;x0HuRkvv;ni&A)ZoSJdF{xJB zW|iew`JrDnOf*-vs?2(CsIS8_+T>s;Bw;bB6(-(_Xst&jDE-@l^LpHnH)mDd4@ zEzi|$NZmUn{6X-$4%`H}eE`2{ZI_`5UqMbTpsYZz{#-8r{t=acrz2(c`!X#x_&a^) z^>&rMPNmPge)C#{x%i0VXGdTZFYZ_U<_22)#o^rEs*>0Bnj2{G59+ybYOleM=ou=# zI2yaz2*{wFeJtd2RKi9to|G4jd{5pfDfp0(H zoLw8AbPjv5j=f>rwJN9~@Ji2B$xrp=m3~vHcCZ<{zpjgT zF#m4XF}$i;P8Z})?&Bh9>xX>0mj67}!G~+w%>d56#q8%B`|juSRr-@EZ5*_pR&$r) z?jWBiV9bQ<5WTU-LEo0JZ*&H!bODB^t7I?SpXaIMCwpCbXFCPm=^j5R9i&T3?_rs;6 zp82##Kz0k=ip#h~%<8P>Z5g6eItBys$yE7}9`ViN4FWMXfH~OiP_AEG z#f^-|ul7r3po4ATw9D19c=*%)Dm<-d6Yb7wzhGU?42*aV(xSz%1&))1#N^0Cacq3_ z%%q(J%939@ddwZ$P@>$+nJPO)pjwb1%)6HrTBA+Mt-sN@gyG8M(Vq9hIAEB;{35*< z!U5?dg|A*fej&rv!UGjLD_XW40UEm3ld=TAil(d|v7CqOa z)IXp;_78q-lIl}5WXB(&=4jp4K&buNz17OvpPxlAbcFw;wM6F3Iy3}3MTVM7U;3bd zoBl-=a!1f4dbUBx++jK`4)K{b>^Yk^ZD{>onmeGSTiCo;QG}h@QJrz5S<=+d-(aV&qj*F5anqGvzkJHfYhdKj^-_UK>_` z{tlnP|IpVz^yEOQ2Gak25S%`I-gPkT3jo_x!1N{xEeiML#>nIgDYye3-VlwDV}{;p zL#MHS=h7p@^@mZ0*RsG6jm6 zM34jmU4$~x{^(~-*(GguquZ<`|8MUKEp%3f!)4PrPm(U(TSQSFL<&Hit2T7hf$96&Z@w}ag?q}2Ww0+u zmh5B^5Cn-=k-$aA{y2UNp&aeIf4&IxCV#}kf&bQ|c8l07c_*CIuE)?N41m>RbFynb(S& zSFqK-5X!LJnap_IAcW4Xwa=H79@%+r(F%?iSe%ZsA8$C7bbz0l%m`d0$QD_ z6i|fnrELC};M(iRJDG7sa1LRLK;t1|m~B6@8}nV663oM6;=P|^y!SS88@AiXsJ@OM zjce5nq_&on7`HQc^Dc5xF9jfdd@ ztw|nIakU{q14+5-;O8UpKFog`#e;_6L-+OrC^wYzb`vW&5j&eAJWk~@(5a%Q1v@I@ z^LhPi@K5^kxgS#L11f#_b)}z1ff5;ggD9~Ej7)V8VaqOl(?39bd&x7)h}J~8K;ENA;)*%2R65r)iaJQO6ScEufs*KY3XOGu zWay@{O)=oAZ>j)TyV-JT0KrS3!c54|stuZJDMfUMPoyu&_G$%7zE=k~Bl~AtF94ys z=wr~wN{_c9hzS!#`GHEsQ>Yi%ApdSf`@jP{6YSleL9}m}7j* zAo%^0P;Mx9kHg1ZbcPtz_NbbHI$FL1yTpC)f6sUX3t9suQ6=a{X`}53io8q4b@ZF} zAK1YJ&|!ui>3e;ZqTV;s0sK5jECRdob^G$!g>~nH`*26EjaZc^D%=YxOSzLTHn}1m z%XoG(ezr5q3jO0&wN}qV=_p9Jw2cr*K&l1$T|%*^yQUn~w+Cq@Qy)-L!dQwe?a$ox z-s}jjkD^|4!53(hTl$XL^`IWwzc%gTR}oe~poG;A;r&pq?Y2)uF4kYLPeoCVf&`=7 zGdTAU-gb78f1+Rxm>Uoho7O`-EKX4-7}!{l1rPM;RZB(8p@UTukX4JxmeW|cSiOhYe$PS zta}cxwC0z6f0_OBecA0&KZ5xk8+zel$_&P9+JTl}*zs>?+|VT=d%D_Tc6k5(#vGSP zJz4%$gPnf#pU6TOWs!`1td`3 z-9vV5LDUnMswD=$^5cv2RRSl#JRz38E_4dx2;f+l7p_pcc+tTno_;?KrUS+Ud`{sf zs4pnK0%%+S5fr4)Jy@^QS%y&qmRi@WbQ=&>w3DowLJMzkDuPVisRWWzSU)4nVjEOKE$O@#$l@F!v}WR%S|vWxJl}A zC(mO6>!INbz02tpI(`|x>r{Ud;x96D8zkY#NV+ZhQqwo(UyFXc`Y;FMdIa7Fc|GWV z-`cCMH|zzq2r1GZ^Q;O#v)^;dcS^oryN>&0MOJZsOo3(WAfjt)($E-`#!P7t%!7R5 z#MY&PO)W_|rSIO@28t#HFYqB9em=A-NW(I|VcH)A?GWq;1|vQg%Jqr6U{=~f_;;f` zK7$YRqyG>K7shev<%8rb6m$5zk44ClDDtQrnFZO1kfBTtc0ncUAO`s-d<5#qx0{uO zJX0mGdGT^R#K3=cFG+}%|NW^M|7ZG+{{t$8iS|nl9zRus5t+-OmQ-?{B&-b)*Gu=& zXX^1JVV^Cr{H-PrHhp579;_+>&oBO6-Ku2?#5GmgGyc*?&G^u0>7MYq2DJ}@=-p2wwd33D*XwrG-C|b5b#`^ z^)vK2g^*fn-Zd3Y;D=T67;~^DRq`LrpUWzlW^=J6{sD72p_LLC6aBxA4Sn7tfIrj@ z!tXo}&0QOjU8)ti`YV8UxW?qq7_NU5tha{vuTLf|YIAA&A}sGv!^y8iWYHg24j^&# zZN8H1UKL?vYu#|;Eg8g$!NUUF;BF0Tnr2__?sx7W8Xm(DE90`$QH%S-*!~x>gGSGX z-+4sCe)N%>j@*>4DG8-q0%XX;dllc4vr3{KGnuO<#3_dv%5B7W&x5=S8|I0I_n7g% zz2A7D$w-mv@ZRflPa-%M-vsN&WiLD8NIs|6O@LkOFYvkkTo*q{!3utD*z(`%=C6-m zYv_%$e>m+TtQ{9{9NI4Y^qL41;!w>2vaW03SRta#TpDXOb#n&gs71qB=&%?y+>A3sTg8+Bw$AWkmhB`<@o_)uJ5l}** zAgN3ZkXwPqQ{ooyS z<5ZG&76K9d29ZclLAxWA$nU~0!TM#;9@dJ1U>?GZY&t`fr6$eg7mp{%9- zL9krD9(5b`(xUrWPlSCUc>7BY}~ zuvtxLz-^XaGJLFkGbXLsNnuXZ4|c~xEgwLZNGn&8d$JQfOeG`MvVOCD;yY#tfSz%Y zD~7H}u(K8yh<7inyE z(>JU#ncx`AbZqWjIWJu4DWv~E;CsBcHTObQ=l)hv!HG8>ca=hJ7V7A7d)tP27z+Y* z-Hq|IGDL7-M%CR|6&YH0i2Mqon(OhU=;ycxUII}XXM6+ zA*vDle4}}=$wU!C#y955__Gc|`mc~OvW+YNFY&xdk*`{RNAz);u8XD>>L zTr0ExjOPV;Sp#RPWpZ4h+=J9t2Uz|=>Zd8{5j*=3Zp~}}2qCR1$PKYeLz~y&a8b!1|yi4P7a{y@L-Jb2VJ3ICrAI#B9wNR>DthHd(#wSqjh(y*XXPkqJ1tBcK@yml`)1A8?3+sv#d#}C_Es1t1d&a+DkIvcfxC8)EHoGc!It8of- zvhg?kzPUmuQ^pVA+p2f92t0u-mUTAGIYzfnn>HIrF1a%@a5fo8yJx`h+?tuU9}f(2 z9Q{~CIeZ46)c1bviYAv*7yL(>`(~AVuf8RSIs|hib?yAJ_1 z^1k~1p@}SC*lsi~6i&~rZguMGJBWAKTG7Liad5wSm1nYgI0x9_iof4bZr0>I9z~N` z0}HK3^75Tt#OrB}=F}YOl2Knyh2v?vVHGOtNc{4miMtz}U3g}3$46URb@_eCWO%UT zr26*)P1WE~Uwgu@sq~9XweqhbKOK?l#Sk9l06Cq4aeOAR79yyKQwWVPOAzAHrar`F zv80XWm>GLZo6pipNB&+VurKTuy*^|hxxv|6zE5^n4ZgD4BnSJ%O@DaBb% zfN+OQNd%P7)bknq$$s}U0$Z`t<51$-v_ibU0+2(~E`p!Sj3n@6m9+Vy1|SBAqv~cn zn|;S4(p#a_`{Y|pCwlgH2ekr0kGezQvrCjRBHnSG(S#iOUt^jKORa~lHHi+^esP|CBi8VXq>>)+I=){X+%7g@V z7{~;`v*1n64tb zg1Aa{f|jVj*rId26Uqs05wB`3x{Jo|rWpJ4mh-c- z3$8m22Xb@Pke%@&(+|zjuLlf0NJUT=uK;ynDT)l0;i-$cRVI}nq-TS6^cVXY{baiA zSs!El9sJ-k_|bm%EB$3fl>Dq1AIBH}s{C)sM>D)U0e}rHFX2nOycU3uUl8KwUo<-3 zST%uMaEQUEHCw#DL%Ca{eF&FCZ}Gzoz4mQ==`}cY|BXuj+rQ2Hkp>S5;C8S$Er6x6 zER*$#p&Jur3Zc@P??}Woj_l!G8#T&QX`r?&XH2$zMJ1mPR}+5Sf76TFfiKO29oc5& zZg*tY)1rD_3&RLd|8kXi!MZmEZH(dP*qs@MjcKbrP+^~%&xI4|&`;00k*yYs?)ihE?}gkK0(3|j z`OU!zari4iSjT_|bo|T4ckGD$%01wXXgjnA4H8Yr%?~lkyk{r>dy9(jusO5y;>`Z zz~A+(wjge$BaqEDi8E4Xt|tD;emEKNz3j{*@NbcHv1Wxu7?CMuPB8iNmH50@_O>&| z$SCsz_<@{??(4!Zn}ph{R?1Gfl)D{L0+K0rOEi7zByDJm_tTHxQc1qVr|=%1!H@Sn zUvJ~#Le#2=ki9nhr7r#w3TI|G6`Gd8Iz`|9%!qr2e*Hxu82%Mws}&GlY`IeGrtIo}ie?8}w4V)k^_NYI=y+EFH{LJ1`Wt3m@9#UW z*Q@krRr=%CXI?AVOC3N#>?LJ;X%Pa;kjzej=7LR;w+MNSnOi&;n~zpz@)0wi5A>bS z8yLhJA$3}~7l#xnShh)`Ah;o`R zo(B{8xW&Xf+It0hBR!uWPtaqezK>|uwZuE6i5oeM11fG^CCHwo*#%= zi=rd{YIvX^q91)ymzPB6KVE@b^Da#FwL05YlQ^rJe*KqFi?MWekgs%aSQ>C5j zJ+F8M_nEvd7MBCQiVa~rgEt%624jDp8UJ;Z{~vZ==vN>}8-|e?M0YLnf7+uBB2gRWkNI*w-_5t+sKB5$lOSeZ-rM*f3y{o20! ze?N(~w05}tcg_aA?DM;D=u=eE3Qz5`%o&LH+|svtydsahH^VPzP+}IaUm_od5^@as zBhj8;H*pIu(0WS1UVwprTlYKo;lAtiW(J!{5xO>e|6|JUs^nTWt_Op$LWT`0hijN7 zpx!d44))owx%I@z8&&f1Uf2KERRWsXG5|k;c@5=O9lQ?X@Z^RIZ#g>$)h|=KX=qv~ zH`i?kivWXO(_Q zrJwp&*@x>HH!<8>gxZeb;a{obv*DKhqe{NiYfDcKBsUt-+9|AKVDCbgX%aMNrUM*} zBC5fEaPMpV&a(&$yS!Eo=RXguHHib-I5GpJ%;J#+5@Ps7@-x^0moKymmk_^i>q4#F zZO1^lMPGjkS`s^J=-eF)4QZ*=DM-X&9aMN+p>@wT8n3LA{MED{?|oqBTx+xnD{Kj* zMrN&k9pxZz*tBuY(7dG#oUbiuxKvx}I3N9^gH|FDg*fXO;>4eP1U+t?D_t<=aUAba z6$@=(-&w6t@b3sUU%x3YDP1f`&PQz=r{|2Rh~08#J#jc{85+GN?13yRGGtnMb)HFt zQ%%-7q7v;9j)eKEMB?X%BWr4h8P>D-&aP|Ra%7*afjd|w(4sP#CrQ8FPk=yOTNj7? z#>nDIXlPT|E_HUwTOr-9&sQJ6L+P`STW+l14Ur|((&z;h0CG-0_E`;{A|DbnEr-JA!>TXL2#`%h|*4I*?cXeK5g(a9ov&0cP${A z68>!&&zF8VTp(wH&zwg)A2dELG5-D|mB44tq8-KkyX4P_j|ej%=6k@rb!_&T>4JYV z0%Msy1b{d*?WlfjU)XKuy>)=B+Ot(x;&hgWuBjFJlbFX*l_5kzLtK4zi=pdvpmVqc zmR%dPx*0vv;J1hO#c#(3(!W>f=MFjt*F(5!Fl; zCST|x1OHAT{#tO11_u(@|8z4i|Jy+FP@=l5JftVxb_s!is=QSEoWc+3oL=`ayolcr zpBK}4y_d4rJrvST^lmg2ZXao7qRnIpy?=W?FP_&VMoNcC;~$;%$dx>CC$P!X8qxr) z)V0~yz~@n)4~x?vx_MT8S7{f{7gr%p3OAE`j-UBVylCw=m&0?CmyB?k2Z?FY1&g1- zP>_F~K4C}@17%dUVakPua;F{LEO;*#=Ag_&%zZxI_dY`z{5h3=^m^WBDheXJ`usu)%+}yLr@sCyVd*RK6KKOIJZZ2&0{s*7y59M4#Ij@!k znhwQGa=&}zkJ@iL)TXr8FaD9B=$6sX_9qkbxs2IFY@Ep%yjJ?#hi@v90ebye&m1|M z)WY3O@ok$DVOF8uxJbxfBrA0lbnfCAgz{&!L7Vf;{`bFA(k!Je|OvUd%w?~2j;>LEDUGmt>v2)vT=r|mwFb_{A8NL|4qkviPpvY59ff7pnf&8lmKhbx8vAIzF z{Fm#qzoDLF9$Uuv69(b~**ia#F6a-v4`da7Ke4}(%O|E7e_JJxRTzNrMKixY?>oQW zRO!2@viny#zZOjHn+=(Sxtw5}4z1p z*ba5h4lPgqzq+=7cju4`hormN>03FUojzbA&RzHPfv?4WOHce3{OS?s^&0efL`I=5 z4`0#tn6&>CM>iRGxlj9=Zx$g!VPVB;3JFF3t?^lUg*(w@j-WTF>oJNti;XTl_%-3P zA2aaa$$jBLc_3XGNS|~)-~m|7e@qE(NMVDD2Ipm)-UQ5}2_3gBB8{_kC>Cj{zU z^g#IBMY=8xB$FY8xN9I;=>;J!4iBM~zQ0t5z@S{($unJTzFdJWeoLBn z`p-40E~{%5M)cZUn}9Tss?h00$~8g!YP)CGi;iPDGQF5vDsDqmyntCOqT((L3OJYZ z%hgQ?QFr&o;gz|!glU23*h7W|r$2c-x~KCm@~pP<(Bm>bB=t?Keaq(FZX+*VWxJhb zJACa%K>EsMmmk~Mg%c#J79nR7vn|oz%esv$&rdJv%wev!l6ck=(~B~CK7J_Lo2xbI z^-dmg7-SnTd3U9q=|wC?8z~X$UG2Q+2>8VBE>$Y1go#wQw_yDtvr0{IELZY$L7S&F5lkmz>`_ZoM~*dFTp6n zDB$u~W%^^wWT~yoO*5Eg1=+c3@^Bm_kqJ)P+kM$A{>&qB7dq9!F{Ux1Mjff_w7bRv zEG8=*F{#AhwQKFjdgFEDrQM1d-Ks*NNqyBrh)h_3EbSGRp zh84g75j2`9BRI~PQaNu|C^tso)lGanB@wFOt0&*4T}*(R*zRJj4!_37=1u-sy%sZ@ ze!GUksd8?K zkzN~l-oAVtvv0@_uV7hmSy)%Hqve^&PZo$LrP^$ixA<)a+oOFys`=bpW@3E3)HN4& zs!rlu+aN3XvcL*F(e{wta6-eFNr*#WCR`Yyc%xdu_0lb{-OPcuOH~$V8Bz6 zE%CNRtVBEGsp&-{(wCv(iBjY8uNwRjl|E6Wrx+@TNyEzcO|GCKq6SEmLD2Mkek7kf z9G0@W75tm^FBL(l@vY96L>yyEQob|Wso*@Bqhp4|I4HC0u%@c+;#PrKlcgWk56Han z`#7cn`y5sg`y#-H`6YTzt-v)?--}P69l*ygPC3T$w`NQ$OVEn4m8mf><5=kFF@77K ze(`C#^Dt7qhBC}^C~wBt(Ts`9vAWlki#Mwa%}aU~78r#Q){7=h=wrEe(}>%d-+@=F zb`o05m}Td6x6F|T*V|KwUBn=kn3s5iu-^p%pFUcP&|zW^1i$?}oQ{#HnKxZlPV5Y% z0u)S*CJw~n>SO>dPhdTYE664&rImUsz7LPQV!DEC(bZi$)%kW2cnuab+jGpS%(4?_ z8{2f~=ZLTdmy4xlsSJ?E@6*#Qj+@~h_;q#y$xHU+iG~+bmU}P0WKsv&)z4>Hsmhjc zIoZi@F*o1YMUWXJG4RbVn!m@fB!HnNvJ(c5&m?}v2vo!mcMjG@f*LXoB6Fq1BV*0xB)F`Lz_s6{nWIvnHRh5^$y^qGjW!EooL|n8e45M zTk1RYLGY;|a-%Ct)9h~C50G&`r)2+Umc}Q|y>Qr|;d;nW^b9 zztXz?FM|G`99TrkfxA=yw-KK_PG%CUB7un0ouA zz?^6~ee`TkGTm7A-FA;tnAWo$Xn= zSkNgtog?){TU=E?ONO0*V>=_40T+48z z&+H&f6&_7OqUmVLDcA7_iYy=<*&fGuKBVtyE)#XawaY9qHnCmW)UXtwWVa+=+4d4t za|YCoYZNc@8SOv|sp+ug5urgc3&EPVn>lB6dzN-~=scN-5M!)8hr=q=_&ljXz8jv;&DM7GKzRxIY_@dS zKVUTjKm6d$?CpR?F`kiHpP7MXZedD zZyM-e6c063s1f1f2CIT)0dA?mctplOw%*x=h6xvGAurR)S2`Ydj_bCbM>J#Dhf&n$ zgvQ9u4>^gKqVN1vS?LS!Q-UtPr7V+;ra@)T?=mK5dMNEOGkFk#v>+oZnE zeJbs?8ILFbYr~Z{&1&41-z?QT`t<0ePPwrfY`+C!Pax@1+mb&m5DC@1&Kb-`5o1OU zUj79*hU{^sQf-MNvLR8H8XFs&34#cfi8M41HC%b!WcdB8?iDv=10*_A-+^idkIF7q z5GSy?1z*|x2CO+SG0M|_W@-a!z;(boS+6lyn$cF8=m#VQ=z2*|WlP#cz#1^#;Y7d^ zP9n1taeV#-lRzqNm}4?s)>~>hhOoMY+n~daFYGk($UxOFJ$X1nK6zYspBr1_>Tzwx z@^&4+7w^lU%R54N2I#G5PcU%N7*@!PS?D+tIp#a#VG`gFtneH|Qh?QBACnVik))*9 z<@Chcx*_UaLi&a*sOtPSNlEdL0V{_iS1Nn!LE$O^|WzdY=|=`~nM9^#5i9DA0ZRq3Qke@La@qo9?g z=({Ez<)KDn^x}0sLnB&;tKTi~P4eArxuuKYi{Y_^Z^HVI6b%YCE5-d|f8PQ5w>C+q zi|`0+{^pJp(r-ugZK znje5~x7ldRNi^;8-1%ZX+ABcJqiaaZlgF}gs3u1$vM@_8nJQHz)tx3fW*Cyxd}mj~ z^PfLW+Re~Og-Qv)R0LFGBFB7X~pDr(rRuaS(@Pnvd>J_ z>pFf(;bl{mdS1uNV97acWM`hR=}EGFI7@}xX#p5mY#P>J_1Yy7=Z%(|)mLKki*`?@ zP((-7CDA31+0Y6}z&ho-6rq}6NbGY~*vU4X8}vb(7Mcu9PDk&Tbv-uNnXQiNm14W6 zFV!MiU$;>(&g{3<%38SPt>K$4K8Dq%K>`6n z(SVfYhik_N)M=zMtG2X4OJAkJt5!0#3px)SYmEDpbQ8eh@anESGhBu<_0mNN8ds=7 zHdLvgGZtdiRb(#N?U2!Knaf;22xFN{{rIhFc5Go~Sp>mmoz5ZD970~>xcD3~g?go4 zdDU1Gsj2hN83k%&!$s_fh(RZ~Y`9`<^E`JI9ac+qM7JrC3xH(#63m!cWeS9!USodK zU?aDPppjZ2-Vv}N2kLaK*{EcJMDDbKJmA)adx8`|8V#Ta_Hg_%c0+K*M02+Sdu*ZC zhg-*QP|W^aL!bNKqAQ(yo4D34jIQbq}Zu90lmH!Y`hc8>UyXWex;#gUM}J(5)k6 zf_@=qss-l@Zk2XE9KQI5Tgkw1-?a5Jl7;y%9Lq!tSH9ZTqU%e!;nJI?n$RJM1exz| z1MENz$y~)K--s?=cP8%aa<*Dq$FBIP2tJ`6EbzCZS&ZMP0#7~~HN2(tEwyz1&)YrX z5_E959ba%e?l-#&4>wD@kf;|-R#)+S;=s*0#TZCO`0iVEz`tIl)hUz<{3skA=ByxJ zwPcC-Gx+v;;bB_?4dNqmCSM_orMTR>SRCgOm+GRSQ)KsDNzr%t_J9fWE6#JyKd*rg z9dikg#&4ECS@Jz77sjU?Mah4-7i_nV4pf2nq!zuAr4Te8`79k2*pva#Nd}6Dy14;-fqU3$nAIa{kDJFhl zy5Cdy<-3i`c@t#rdv`f|Haa!kT338ejYGwTtOCNz-z46@?)IYMNJ=PbE7Y{@pT-~I zenY1xK|M)-zid|a*Z>%AoLVcdoQt?T}1KR@UD<2*-h7SuTH#~8HF@(BNG$0zaBEXwX`zk%b3P466co~)mo^@A0oT=BZKd>Zu&6BhQ4(kXR zPdapcnCxWhdmxQAM1JKbP!9>^FpdKQWNiC#`_mn6ee@nuju*sFs5{yiF~?aV+FwU^ zh&e`Z!FV5o?zLY8C>arFh@3*#Kr#7beR3v9=;bd9rzJ`%R+V5`p5F9B@5+NNAgz`^6U6L6(T?S62xR6Bj z82t40zKed(SHzWt1j1f6wAuT<)#~h_P^)WJptHN}S5I#M*UvX=?@bM1FM3yr&fhvj z@>Qa8aQiYEzVB{ty^dh}GDDhU-|Y+7{nGrBV{H5=_3ZV%I-ViDcxAtFfK8%=S3olN0|&&O>uiIKb$#yQL7>hf@N-Z#6p7-FX;gsNt<*Gu zgssJKR%+!9%PDG-=TxR2x9?#wc7r?&$QxRzIg=r%$s|UvJYR>Un=vJ#Jl7`8b`S9^ zqN}!B7buoJC*>AxKX7ZjkW@~ zx&vJnm5qc0NO^*IIDxvcIB(RDs1u#HOub2chU1w zE{L&UuSdM!VZ3E&?i9v~&)~PK^jj&=rynKVb4xUYhjzr8PTe@bol)w>0j?~6*9P_P zAN_y$TfX4;Yp5^v2le<@)!D2-hARxVxg|8=l;kU?LpiwulStYq4j@7lGpK3dWogGG zvXOD^j>q!jv`FlTMrDG8IbaPRYt67Wcp0uA|MzOR^x7f}SEa{WddQ>hhGqu_8(gz9 zpqxMkw$@8PF1UsUx3F0wV45q?Lmn~%G4kMx#d@`{QQs&)9s=xw+-H1<$hm;9_U21{ z#?=%B@hE6#b~e28=CUTJ3)NCn-yTc^O;R$> zcG&?^J&3xLP0w2bP9JE#o)NxPLvMFH;(TXPMvQHB_LKPi;_3*eFZK}9NOX^(DMMld z^d|N~{v6;0>(d+IF(+4u_$gY^K%wm8Hxb_k=PEY|n-&pw%GBmXXCU9r)FQqD>r~Q! z0-6Tojt#c8VXAC(4-N0$z7ViIf`otP`BMnvG@qaYTAuqR{1<<^Bg*vnn80{+4! zZD}I(pF`tg&QObzCP|3ZDpc*C=vwkA%}E|0NFd52di2!f-1+CoR8x=;>!(o1UmtU` z3-u1nhhQ|Ym2a1uY*yMOoRSPbR)mY^kHgPU?(Wzh#y8njDeH$^031IymvM|fUQ~0` zbh|eH@r=HAMcei&ybQ|PPUgkR7?AeQ3o}6cXHNb zP_MYLXn!Bw-iwoEvtX6f^=KlfAi(d*Pxw&6A3At+uS)ir=1;k4x~RcQJ-|%?I(&0q zKd%=m_)Mp}v7gr*(683-?;AKTC$M2A|P){5vYWQ>9b!_zy9v+n8577}W)p+}UeX zKdzE{`TV11JRj^ko?lSui&grJcs%iXW<7<(AMga0m;v%&jc@{M9p?q7O*#FE5n2MK z5tVq25kvJk;cVb<`r=-*K@3&+YLds%esD)0939-?(C@Usjv3u!rDq<;epi?Bq}wys zHohv|XeQ{LUPWxPD9(dPE zHDJrlm@q4Qvx+83hg)4a*H^v)q(V~uh(TU0zAC^b4{jh?zpMwN zTtJzae8r9Z7s?mTP&9TdghR)M{=`GNPu{6RAqC4s3R@zQny5o>PVVjvhl9Q_ZP+M4 zr>R*HJ>3i?tM)(4i z!iACsK|U_#)!uuW618!|TPIGWZI#s33GqS(=%syF2CDuSmHbqA<6mWRKE%$y@WVz- z<(t&=FpnYRNwM*$a^rd%-h$PeOZ^TYcNd-v_m2=U6R<{zITL(yk;q_3S(@>kAIj;oa2RO>%qJ)|VMKc}+K`OW~@Q7~4cUm(pdzt!P(^LJd6<{ofj=1qh1T(QE!9=&!J` zz9wc!dXXuA$7k^IfCGZC;hOI-_L0Jg^gC37J4)+F+HumXvx0wVT!uWwE`uE@y z`?g~ZEv2bPjg3{h+9JOb=yfz72YV*JU^)?4#K(mNWMZ=4U~sD9$Wsyd-casLu&UeJ zCeGm4s9h}dO*v{N4zgvG4B&r>y!YD%SMf3u*shM!j4h+R|xC}C6e}p3$?I6DM^91~a`TOJwg`o(0 zsQ`nuJ|*>ioEZ_Ots=}1Onri4>L~fW;q>?^b@YcrLd(&bt#k#(B1o*KDL7c4cbcgd zoJ%BYD1+^;qmH-s!dao^W6PiH@a>X)J3ltBnY*W}mnP?f9IX^!kdL|sW~l;VY)^pjMSN#wYQCdHnJJ&PVuA{}n-G)Fv#H-PkmP#B zN_gx*@+cE40b8Wy`x&~uirlv1aK_i_WB56C@_2$EZI(0;c=u07Rp##XCPe*N?zNX! zlHH!<>p`_{7<%ij8%=LYyLWe>ivPRJN)3L#FFpJ*mA;$7H4dPM&tl8;)~t%b|EA$@ zDPtHxmWq@Sw(BZE>cbTK#@%J+vlM%|g9;7o`8K-XxAu`W?5fU?W{|G-s>o2yh^vLz z>VA_yVq!(dRP&#zEpPgAI12rM+YV&b(6$ssc!e+p%V;eNa0?Cy(SP$$F}q(_%Bc}dx- z@8@2;?~b2(>6-2y8orX$4teD`3h*~8=zl18^q9MET@yPz91o`+$;0h_y1D-l`VIH- zY)~TJLu1LV)kh|=Cgm*~?Iz5ykn1{c?XQjeI5>B9t>J#5L|K8~{Ahk>(M@|2dNByN z-PVbmJ+p64)gkr&Z~S}g zEVqrgUg*i8+?HG4u45$@QKU(<-LzeJ(xKtGn4v{I6qeQ^aM^cO*ldk6NQ#rs1@x;g zWv&{5e~9jY4~T{HU6S*sIiBC9(E)ND)rE zZ=NkbIKB9o)JFhQ+mx$pBom_uyieE^ClZzUz^ETSJP2?Bj@q&!0e2oK&h5HZ1*>Nd zi`T};OX|kKwe+ZrH6ouL=HE2?*}E{xQl2-II~VW2ovj0ai)$rgfMXhhn>LYz5NxF8Y>R=ng4JQNp6pi> z9!?Fo7UKKC`(+D({((gy^-mDo@&q;*emw?M}Ms$_fY0J7SVYqu_0eqBl0Psgm?ZWdG7 zT0#5Ygz;$O9kH*204i%A zq+^dk2i{FLizOR#(O6O@S_F^vw2=t@OuCU}j`S%+TXkueW-X;ak6_FW>r2 z1L@aQ`h|n|kE@!`HAj>NztTfu2wk6#P~8Hj%INb25gnRUBflDRssE&szYQ6fWFYxE zzsC&BcMT*D6E5|BvtIwH?|R)ckd_A0**LCZtiQOb^|Haadqy}EC34?*`)M+e{vidb z-N8~RUUh3ELf7sxRF+bmvJH-L1LYa%dk^2Lh(O!3(S0jmQ<}n^UPP1SBYSKhbBOO8 zNX~?kgPnn-)Jt;kjDh5-PI544_T}q+`RKo3lArXw*YzCtT2Vhis-Gy?_6f4X)pkj; zQHJuCOY!;qU6p{R_6#=i`bx~|_rrMCX6DdH|hoK-`t2l_j|jTkVFS z} zby`49Yva9wu3MlQ6S~h!nlyc*56=EdL!SQEgyiZ^tLG)^{$yN_BE*KUKQ`y-JNn-9 zqXX$zRr)8_^*j}g)TJvg{Wq4Ez2~uuj~ig&UxmkQU?BNwFK`H0h#XS1dzd%tG}(8Z z(t#AB&lCSE!NZrglZuuo$b?i3T*Qi?`!$J`~1sgZ$Zkb8b}2+h8KAoM*DFPb?+NVn45%tWmXZ*X|LHJg@;n%0Mxk1~WP{gjwb$O=h&+#?}!=;smA z@smu9fp|$`c{;7{6J=_aBKnc2{Dc{k(D1Z|-j-l0d)w9f!D~)JrBu6E(gDLpR~A=n zGY8UZVLOc&RMS~pkhT56E> zyFuF1TBB6AZ|Ad+EH|-L+N1R#VnLym`-UOQf=3(_XZ0o=%$ESP$}TGa%ov?@Zvecs zWijk7+Kf3-vF?{H?Nl;8Pfz(YHzp}?-AJ_sYh zb}xwX7M1)wpFaZQKbgD5?KABzGkF-y37VDteVQxRwX+AawV4xh7VV9VP!ay-MFhIo zLX019Kt<>FeimWNrV!Ht91N`7{W}ilyp9hj-p)%1i;;b+H)I^Y?v(aTLlT^TK|g(I z-l5xqwv5@OFW_#E=D+4RPzaO=A#}L6W!EZ1>`iiTHvgH}qfReoX2Iqt_n6i(Oz9@W zACP#AE9wDc14 z?ZnvX!rA4KdH(GKrsgKh#APt!BW_OYa7NZp?-0M!5Ma@`4KjR%gyD6gR*G`lB4f_w z5b+ewqDV5$AfRyDDeAzV>|_OTuMw@6QKw*?j>xx+>8cwcj-yTbc9m_+-+WUM!o%GX zNS3LNqz9aTOy-g8TJ#v~7ZWx;jetbac6PQ9+LrO#_Ibc~fP(kaC^HkBiQKeaJ{IH9 z&+rekUQ0UEqJ1^DYQ6Fq@6fa<_S!*vu8et4|CS{?o+7=$S(!bJBPt>0E|!E6Ly&)s zSRbDAs5h1IlvseYM;K~)RDghE8>=A7@=dO;pAdt*BmEZ{|40tu7K0ClZ&dSt1v!HA{&nwof=Y0&zx z(T&{4b@Tn}cFyl=EzDL;R>aQ|pkhaer@Dc5D_2qEL{B!hSgaN%-Hdyi}u z^e1ptmyx(YkVc1oEIL*YN@FNuKdz%v01W(A@~SSn7@N=x1m~Q$P^IX$jla-di!gLmI(BmUZ&@V65Q%yQgOH z?*W`i*SM}EjjONX%of$7unt4HK6xME5>&_SuoQ^E%dFl(cKj6D>9hO{F@+LZ9u4Yc zocanKl5&>D6Z{IFx_hK8mZO|(G6euk+kuwc#0|;z4~vUUUYZq8g~5j$^=Ewl(y+J1-Eaju5#gm?y8H^KXf7XY!#;G1(e{Ccg{fDk-b#t!!2{T3uR`5{wuk8 zVl;nfUpOrOUGoK;9bl*q0wPkxjblF2Ld-AB9QYV;!(cmJo*BB0nIC|+7Ss4s z`@dwQkoK*vLI0oCjC|9*w_D6+w0_yXLL30Z`|PQ&=01g)Ql&Efp&#NE$qQO3)f;0FfJfEs`62@$Q4}OpyHbN^<$?u4tw% zBnZV&g77$HHCdmUTG@em1%cXH_sQBH|8|uGJj?M1!55KUc@~Tm;I6X02eQZr$G@D+ z1c_n(MB4bY@m~p!UN9UDh<+uRm3TvjgU}COmYnHV$EqHuWM93$*3hT9zLnwNwBH8( zfj%(*mifA3Y2}J$a6$1)9>?^4Sdn~-`rZVI12ZK5HRbDCmGwG$o{}VJn9p5wh))f*Pr`YLa;4ESZXGWz5Onq%&e`BLfN_0tV81N9O zdkf9Az7FK{g$f`aF(&7GGB=(IJhUr|XD`DK@Mw{{^saMGmJ*OBp)}>R(57+Q z)@o?G=z1o)x!1@b#eoIZ;3jEw0e=P?q%%pUjL^>rx2-6TFW2dO2H)&LpJw~9gHY-j zD3^8L%VnMS-plakvMl!GT?i%{jL4Wc+b$|*K*^oWKvtoRLNlhAek>S@;L)YbxN$%| z8d8)mt!Lhc^I8*xxrRq}XSID1c5F7dSI$Sr33GBI#nLa`5?OE}cq=Liq_uM&hYGoZ z%s>Wbk1Zg$qHAqRjArSjZr@wFDcVtbV&7{*-E-3TJPAKqUXZ(We1m*Ec_n%(S@LpC`%o1QS6__+nAuw4_9 zjW0(*mb`fZi4KsA0{qvSm>%)PIa-fZGeIczOLm_LN9rFBm+l{h?VPmRF5k?OV`UnX zzibh)Nx*}a8_hjE8kQMfL#k5EMhv%dD-!AvAZYF0S`%7kF%w|1nLYSSZLaNB4KFuk zPh&xIF-k@He(ppjB!uwUJ6WHtUH%3b#B zC2oF(^e%KtVfP3n+pY>;H4zaq0nLhNCy0-nZ6};9r4Flw3SxsHZ(7j45p?lBWr8r_ zJ3kBf$FQgDuAoIT+$W@uRmr26`$*GJbO(?R*8!iwC-rTw0-R5Sq!^*Rx(XLo& zM$zb4B_u3=7;pv3Tq(!dsu%~`xQMY0F&J=64r3cTCX@?E?2z~+aY64vn-cm8*F6tY+Tp?$^iHUw41U?}N*Lgexmxqa-)Hc|keNShR_AIqZDqIz1@! z4s4)-C?qEDCvpBjeJ8ofHh9X74I--;@&0`m6~an5dHTMJ&nX`oi{-S=2M{pY&{>c? z3|1r}ms^9!GZwn=Da6)_UgHY#*mAC~R$g{bCPZ+krE%P@xbk~2A1QRSQ||bYbqf2! zLhpS2G(ypM?|~{b<8CfEZH<0Iff3n1ZqSF|ZnrR3bFUh(LkvUHtz0FgnbNbO`tJxie9poAaW3V?0yT|JNYjO;Iip0frMRHIP~(>}9B~xk}hM86{U8 z@}BoaIb@xPZ|oCi4_5^V?$OX)LVXGB++GtEl&bLN=d}%*gp##9*Rw|>ER$XE3M(~z zBJj-8lX!??t&2sNh>7S6H;{?-Jy8WW-jvtKLk=+jrleB%XH$8NpUHK5l74)=rosyR z*2|_boBD+%?2vIp@VDD)Kk9fa8Wc?r40P4rUyH3=?MQdVlMmtm8R8=u904@2(BiJ^ zKJ_Qa2R_|n)&$GXPRi*>EUZO>0a>Gt&=?}DiA}Vp#j>W=@)E3N1+rviLiZ;#;i?!7`MDQUGP8_so@79{%S4AWC-K5-_5*UM(7pAOa+aE~o z#V!O14e;HAzSEr%O}$P9gMQBcg~n=5Vyd!?Zw1q4o^(N8H4NbYdJV3>_A8S-qn@^E z-_MT66}_QIqjYcH9h@9xtQ}fZhouz=9RbS2T^gu;V!?Ddgi-N5>U||y+Xa4I(=}qH zk%B_M&iV~nl10AfIDnr@Z;LG$CjEMvq*Fb3PXE?nQE0oW=lZ%vhdL!@f+dqKn)=uu zeZwm{8cvLQm7?A;EyuVt0i@rW3&2Ro0yxNS6P7h;&-Ub1{`)Pfc&n7_)GfKLAq)@K zs?ikXa9Um^>7BkjGZE5I|C`SZMVx`9GXMR%;Fp3%nmE8^MxB`MFC76*mNDN-YxD6% zTc3INJ*|#(9xHyVKmKswp!?0jN4gImK5)R@V>3=g8vTVu%vhtqil^!5`$p*?6s`TW z`2EtMtee+m-Ml{Q<_(FPtYgRcgA-l^z4!}{j*aWUdhRy!bRN4g*V%pOlY>8X*gat5 zI&R1fB-%T0$R%Ok;o_mUdr73Y{?fh+>LirKTDcb~yj@Nf-aCQAFXzT{rEUrP8-F}; zW^`gyGu5T|lgTa~t1};Y1IU_8=##pv0`W3RI^IhBX165FmAdK(u+fM=>o}O3&>A5` zY(#LrXk*BxlypPgO}@O`cc|~+_1DP)SFF(nX(_AoLCCncevLNHE=(_0K)XV<<%&3< zcwRMfzW~8ZBu-G&=i}Oa4bE47ydvuhc@$oelxD+fGkgnB60Z^sz4ixSzPBJ>16IWg z@Q>8+BD9As{7Bf2cuqttC|o->HZ>Ii6m0aq$z5Z3#{$e~XkgR7tCV=3m+#sGH+1&M zKfB%$zCi^o%DdB!{4}GTH*ajm`sVMOCr31R;1J>hV!F*Bjsyf*0$12ke*CzJYy%&o zD%HLPZiY4NE{AD=Cx?m{Jc#7ysE$c9IeKKwU@?oLxOn<)Z@+GO;Um436>ixUByCS! zz!zm((^2{JDa6BKWDI>5iDOmPnZn3cdlO9sB5Hn&#BY=#nj+#fg{&-KV zGL8`tdI9T|f>ZNp(f;T=+=yUyEms-hl z*;ndQytmbm=lfCLK6%bVey&@FiWMm~L>4HCkcM_i#|1wRhg&njb>!M<48OxMl=rPJ z6js3rAo-jotnBnM!~AMtD%U-|t3-HQtbCPukVdP?Rp!bWo^ax-U@(w5uDxc~88u1wT!HomIil&_TNwDeJoi zVA@~WHG=7lpDW0S?35qfHf_EguGYhw_vlDFem^mNhTeX| z^pwB0#c-(No9Q7rqc}cxA?OKpirDZZ@j#^!8ZTc@g1^IilJdm=SlQAUZdkfSUg|_; zD=`7Ne+G0+5aQ+@9&3b1oq+31_VEv87(0yWOuP@K($iep=kxz@w6C@8F3(^(Jy6lP zD8I#Y@T;T!UR&-15nXOsOtQg-e-U3 zcd)-H&uhy$95OwAZeiGu=N|tM!jm-6!ZKR8O-VZfn#V7|lBELfK!%*pC2>wY$p<}( zjlH2iQ?HhMm582%&smX$djTa0!nj_K{UEO0`>iurK>5^Pe+^f(+w@*)h*#0{vY^5F>Wxmm}x)8R0q1Qlrh`XGwLT> zf*=w;4!{SL}u0(!g-MtYp~K4;kfByH-i*c1S&8fT4d`oGfGaTS#q3wSSeI zvmn2(p08FyLLb@HNaN?F?FGc>raC@ev?Py^kY?3S~T0h}X-(>x1sy`Y*xXhlp z>b$`B=yR8B;G88vN;2iDsqw%hJ!%z~7fDzA1pd{2HL$(WTXG{+j3-X$eO3^HKBL#P zp0A5tMSAiM>;fEBn_XTuD>~)fUi^?~01D_bR$uJD9i0+oP+BG9IPb<$_62n<#i%Z8 zd!U%+%nbN{>%Y5SX}Vs0MTLM0`{N}4-I?_&17%xWn+?o1zSqD@S8%$Wmt!iu#0W12 z=(r?rg-`QmeBS!J3ZBX0t=1n^slA4;ey?f!|51fsQsHN}*8Xvb@o1hwAiK~A1AFnC zuy-)lAXeIYRe()xh*;)v0QVj23hZ4z?{@{(oG)c{1@Y9T=ZlQQy4vg4!AAo0~_(6^)oBDXe@l<=4e{>*Rw->3llnKS^y zH&p=N_XFyCrrrP5wB0YO@L3f;vbA<^gAR723%;O&$NesNK?Todb-{nC0DBTc0U{rZ z^LHO#KH{JsLVv~Vm9>-W7ZZN|PUR~M-7&5hFS-zTEHC!N9#J-XF8-Yxlr9RzdToB4 zL;Qjn=jWP^^Jhrh;YX9>ycJ5_kXPxMFXvAE^%qs}0WyI}a0P-il(i98l9GSl#9Mf0 zdpia8A@<~gjhKXL0Dgn;I^DoY{K0;GUv!|`vVdTNUbG{jix)kKZ i@{eS`TG)lW zVz=vF5hY+WB#5_+zloD?C)UF_abP{9U7o(FO=Rsx=FQT6N|w0DTl;J-zWrRsCH#qR zheP?8tCnA)i_6kpq3i|;ab?!aRDqL(@=(wmqV%-G3ioWgSkK~~*gwYRS1OgvG3v+T zcH3Htq7__jFl4^M@3J_K;5Gerih4;;fB}v6aL`>LS*;inMrFhkfKd?Zx=2j{xFV5&!B(}YZ_-DwUfuDG3z=%?T z3&CcfizeCL{DaO8;BFuaVCET<)Z1W-qUDpk3uoj=GzpQTT*LSmd_`?DPG~&wA z$(YXy>Z@JQOxqKDC>2MOe8h`$PwC;j=iU#ctuBaqLcbkdB!FM*g7bg`)jI-OV8U*; zz&q}VU(+HCT#kiP5&mbn*z)xdbwfE7sc8Ol4V+C_dp~~>^#%jG@d<; zYw+&Kif0sMfj)O{T!GjUk{K_@w#TpH9+bNX7+mUOv|sGvY^0>YJ@L1X@pYt*YOT-T zV&^CWcnS8I@k~*bcEV0_gQC$I_@Ll(q_g+N9H|+zWaj8fbwy~_KrfJd`+A4Cm>N+0 zk~Zd#FFuL$apILIL*AzCh^U$;HhgWS9Rdh}OjP^v{6s&jL?lM@dJ$#>>#)DX5G}96 z3fxX_!C4dl07w%^h=cgFUis^Np}iS#vbG0iBjU)AG8`#0V#oRr;AWyMV18GiJgf~h ztAV=~znl7P>%`G`QGd{yzw^fE)ouaRDWjJii)&%vt(8b1teAcWp!1ffywpV70-Z~H zqAH?9t+&kQHm;^6X`%OI8|*`rLwUsFvcuUS9r*Dor01DH#6OM>D7Sz+BS1XCc`%T) z@B6thTQle3DF95Oj*(v{QYHPh8 z<)4VkXX$9BN#l3jyO0jM-4j+%o}oeIj4j!kvLtHw?0dLBG{KkL4X}i|2eEMrF0ksp3{#f!b^8t^-`W7UVAVY;w;qLRAu(@z9v;!ips5RVqyx1($7lJ-pD!%Xi`4~}T zOgCdC;>~uOT~Byz2fY*f6?*O$7?;m#HaKS zt9ZiRBKRU^Cfz>)*&zw|ytlDdk;ApF3fCQO+VMv&t=DdX??5;}&!X2z$-1pP>*p<|2aC-IyF z$g@ZEJaPV#I-&~Np3m!ftE}PS4xlhm{@0)#Sh?xOur+>c6Z?%o8I%*zjw(V%@#Z%i zGPgXIL7_aiG=r3$Wb&t_Tt^AH9`2@5Tg|}$WF>>1Dk{0|P>eg9;IF;} zOrkQOSfUg772OFwl+|Uwjrz2<{aa!_y*#_w+%Q9RAy~e&nHS~To4?Dgw($vL(&%Nw zKry|9dg9vs<)(7s&#CYa89G)BtT)Ctyd*n>ELlG-!Kp%`S?8JXHe=rM;e;W_11h-3 z7w~`D#E?u%hN1U?E`XGw_g(p1zoTC>LlX0^vAjZeYEw4$4$K)HeJZmmmMpAqozM+g2vO#qf_pAAwv&Ty1pM_BS z+*0zjoBI*c=$f20k@I$WU&`OdjZm&*`S(T=b+){zKivl%vv>DJHMHplGTz-6^?*&) zmo*dbl)N6dh1Ye zTxOvioSq3i*7kSz6z7|pYe#jx_H3u!S>wMG+IL`7Ca+<7)%VI+POd|^h zhMkCu`?YfHRGOJu%3^xiCz{2NziGFHYxi=qeSu(pryVhlz~F=N4H@T7%s%>5@NQ^) zwI=sOIHiICDuBC?qAaEiG!lXFg9$QE8QZ(@Y0Z1_S?tQJhYh21<;5{?51M*x&fN*U zD+pu`F<1;@$^v8s#+2W7#Af>e=_f6i+2VfMB=+VWJ65lg9={oY%wZ7_9*ja}naqGE z0!rlXL>c+qdcc zM$y}_FR)xf+ja3|JX4*e>sh3SJShF*B;Bd~LoAc))O(Sywe7o!{rWf8<5PLF-Me3* z3&FWdOTIV%akmdijb}vnny@FOo!hf>*q|#=vhLrQor`AAq6gBRWg2Bl662rO;R7fz z;6+1i0^u?BMa%Gvgta8F{tT!R?vejFzx88$N)O8D%*=fG2zSnnH~ob&^O+=^m+*b7 zA@I1&%M1A3IvJByVS3f)0mS2!yZPtc1pGoK@Zi0k)r1~_d+5<;#ce1oikR15J6%6- z70PDy(D7AKmEBJ?r5s5O}LbMFJljLVQX z!yCDNG*R_F;4eGE$IDjapRwdl_IL8G9i|U(FC}U~bZDq9;@$e>;JbVyp|i=ax}kgZKM+mgeg!AU*~YX6_`z>p`|;@(JwdJ;3Zurkn_sIA+>i^p_&uk;Gu@_q zG*);tJZdNS(gsDdT4K+mpKDPk?RoOe?0HOLTf>s1-=4iqqDWRNY2TH0uQtPA#}lT> z>SPixUBvI&DLc$ntLJ9{hBe!O*O?$HHA1VFXoRzk%DHJt!10Ie#7w=>EU6^myT2dr zT?JldotVx-z2v?#Y6$mZ_5+^qEP`Qmj1RnYd4BH9+2t@+j&mw}r<7NZ_9t1zWz@qC zldLDJi?#MeEm9Rb1NVCO1h0{cc5lt&T*Ud*tvcK8TblCa_o}e0!oeh8j@d(oz1YhV zx3`!OQ=L-5q|aJwDkx{MR ze(jc3a3-sE)-PJuOZ-~JD0TL5VfOHJqcM-MnAW4jBitUOTZ1`1_t9>=aL1GRvZzP- z57xz3(f?aO0})n5k5(hmAGV#=+;ofn-;bMie7fm){jP#AGyH`uj2G7GOR^geX-Z4# zdw-%mzoi2Bb~HzSHEqu)RCrN^aIjmzp2Eq4Gw5#% z?Mdxd*iq7^WH`o;7@vGQM)#@!`IaT+Vd*zzhc}$j=2OBVZ1Qx#J0Qt zdb9D{__3z`a96a1-%;VqJ2O7X_E?ygIkbw7Y}zMfKX4W3=dlQiSi;@xppt8ngS|oV ze+~at@r`Ay;)4)~;aAPr|9ygm>&0(UEWlAxpLMjFINd4 zuHhA<1Bl7jYWi6&jzgirso-l}09}C&!Cp z(|x7kB5#X5uKht>fW3GQrjNjEed+Yv40Qfz5XXvi!DqMNL)%cw6)F0peJ*93luwdI zAQF;yvOdhiyv#@W7-^d4AIdC$2%jIuhwY;5llH*$$)J3EKR%o%tOsjLUEc&gl%deh zeF~onKBPg`hu0iF=kS>~-)s20V7{Nl-=D?DbssHVVbKTAB<-SAz|;8ku9ez3*i+Vs Kdn8xt#{U5!OgSF_ literal 0 HcmV?d00001 diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_profiles.txt b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_profiles.txt new file mode 100644 index 0000000..fa78814 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_profiles.txt @@ -0,0 +1,140 @@ +AGXCompilerService +AdSheet +AirTraffic +AnnotationKit.MigratorService +BTServer +BlueTool +CFNetworkAgent +CPLDiagnose +CVMServer +CacheDeleteAppContainerCaches +CommCenter +DataActivation +EscrowSecurityAlert +IDSCredentialsAgent +IDSRemoteURLConnectionAgent +IMDPersistenceAgent +IMRemoteURLConnectionAgent +IMTranscoderAgent +MTLCompilerService +MailCompositionService +MobileBackup +MobileSlideShow +PasteBoard +SafariSafeBrowsing +ScreenSharingServer +ScreenshotService +StreamingUnzipService +VideoSubscriberAccountDeveloperService +VideoSubscriberAccountPrivacyService +WebSheet +afcd +appconduitd +apsd +assertiond +bulletindistributord +cloudphotod +com.apple.AssetCacheLocatorService +com.apple.GSSCred +com.apple.WebKit.Databases +com.apple.WebKit.Networking +com.apple.WebKit.WebContent +com.apple.assistant.assistantd +com.apple.bird +com.apple.captiveagent +com.apple.cloudd +com.apple.datadetectors.AddToRecentsService +com.apple.homed +com.apple.nehelper +com.apple.nesessionmanager +com.apple.networkserviceproxy +com.apple.quicklook.QLThumbnailsService +com.apple.rtcreportingd +com.apple.sandboxd +com.apple.siri.ClientFlow.ClientScripter +com.apple.snhelper +com.apple.tccd +com.apple.tzlinkd +com.apple.ubd +com.apple.wirelessproxd +container +containermanagerd +coresymbolicationd +cplogd +ctkd +dataaccessd +datadetectors +debugserver +deleted +duetexpertd +findmydeviced +fmfd +ftp-proxy-embedded +gamed +geocorrectiond +geod +gizmoappd +gputoolsd +healthcloudd +healthd +iapd +identityservicesd +installd +itunesstored +keyboard +librariand +limitadtrackingd +lockdownd +logd +lsuseractivityd +mDNSResponder +mediaanalysisd +mediaserverd +mobile-house-arrest +mobileactivationd +mobileassetd +nanomapscd +navd +network-filter +nfcd +nlcd +nointernet +nsurlsessiond +nsurlstoraged +online-auth-agent +parsecd +passd +personad +pfd +photoanalysisd +playground-devtools +powerlogd +printd +ptpd +quicklookd +racoon +replayd +reversetemplated +revisiond +routined +securityd +seld +sharingd +social-services +softwareupdated +streaming_zip_conduit +studentd +suggestd +syncdefaultsd +syslog_relay +test-common +tonelibraryd +transitd +uiautomationd +userfs_helper +userfsd +videosubscriptionsd +vpn-plugins +wcd +webinspectord +wifiFirmwareLoader diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sb_ops b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sb_ops new file mode 100644 index 0000000..8fe94ab --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sb_ops @@ -0,0 +1,137 @@ +default +appleevent-send +authorization-right-obtain +boot-arg-set +device* +device-camera +device-microphone +distributed-notification-post +file* +file-chroot +file-ioctl +file-issue-extension +file-link +file-map-executable +file-mknod +file-mount +file-mount-update +file-read* +file-read-data +file-read-metadata +file-read-xattr +file-revoke +file-search +file-unmount +file-write* +file-write-acl +file-write-create +file-write-data +file-write-flags +file-write-mode +file-write-owner +file-write-setugid +file-write-times +file-write-unlink +file-write-xattr +fs-snapshot* +fs-snapshot-create +fs-snapshot-delete +fs-snapshot-revert +generic-issue-extension +qtn-user +hid-control +iokit* +iokit-issue-extension +iokit-open +iokit-set-properties +iokit-get-properties +ipc* +ipc-posix* +ipc-posix-issue-extension +ipc-posix-sem* +ipc-posix-sem-create +ipc-posix-sem-open +ipc-posix-sem-post +ipc-posix-sem-unlink +ipc-posix-sem-wait +ipc-posix-shm* +ipc-posix-shm-read* +ipc-posix-shm-read-data +ipc-posix-shm-read-metadata +ipc-posix-shm-write* +ipc-posix-shm-write-create +ipc-posix-shm-write-data +ipc-posix-shm-write-unlink +ipc-sysv* +ipc-sysv-msg +ipc-sysv-sem +ipc-sysv-shm +job-creation +load-unsigned-code +lsopen +mach* +mach-cross-domain-lookup +mach-host* +mach-host-exception-port-set +mach-host-special-port-set +mach-issue-extension +mach-lookup +mach-per-user-lookup +mach-priv* +mach-priv-host-port +mach-priv-task-port +mach-register +mach-task-name +network* +network-inbound +network-bind +network-outbound +nvram* +nvram-delete +nvram-get +nvram-set +user-preference* +user-preference-read +user-preference-write +process* +process-codesigning-status* +process-codesigning-status-set +process-codesigning-status-get +process-exec* +process-exec-interpreter +process-fork +process-info* +process-info-codesignature +process-info-dirtycontrol +process-info-listpids +process-info-rusage +process-info-pidinfo +process-info-pidfdinfo +process-info-pidfileportinfo +process-info-setcontrol +pseudo-tty +signal +sysctl* +sysctl-read +sysctl-write +system* +system-acct +system-audit +system-chud +system-debug +system-fsctl +system-info +system-kext* +system-kext-load +system-kext-unload +system-kext-query +system-mac-label +system-nfssvc +system-package-check +system-privilege +system-reboot +system-sched +system-set-time +system-socket +system-suspend-resume +system-swap diff --git a/tests/test.py b/tests/test.py index 5cf5327..1849317 100755 --- a/tests/test.py +++ b/tests/test.py @@ -274,6 +274,10 @@ def main(): generic_test(container_name, "iPhone5__1_9.3_13E237", 9, ios_version="9.3") + generic_test( + container_name, "iPhone_4.0_64bit_10.3.3_14G60", 10, ios_version="10.3.3" + ) + remove_image(container_name) From 1e3c61a10e84e0f6a7b110a1a49e8071c178a0f8 Mon Sep 17 00:00:00 2001 From: CristiMacovei Date: Mon, 8 Sep 2025 20:25:50 +0300 Subject: [PATCH 4/4] Add test for iOS v11 Introduce a new test to ensure correct functionality on iOS 11.0 (15A372) Signed-off-by: CristiMacovei --- .../inputs/sandbox.kext | Bin 0 -> 602112 bytes tests/iPhone6__2_11.0.0_15A372/logs/.dummy | 0 .../rev_profiles/AGXCompilerService.sb | 692 ++++ .../rev_profiles/AGXCompilerService.sb.xml | 41 + .../references/rev_profiles/AdSheet.sb | 1591 +++++++ .../references/rev_profiles/AdSheet.sb.xml | 40 + .../references/rev_profiles/AirTraffic.sb | 836 ++++ .../references/rev_profiles/AirTraffic.sb.xml | 41 + .../AnnotationKit.MigratorService.sb | 394 ++ .../AnnotationKit.MigratorService.sb.xml | 41 + .../references/rev_profiles/BTServer.sb | 933 +++++ .../references/rev_profiles/BTServer.sb.xml | 43 + .../references/rev_profiles/BlueTool.sb | 706 ++++ .../references/rev_profiles/BlueTool.sb.xml | 42 + .../references/rev_profiles/CFNetworkAgent.sb | 191 + .../rev_profiles/CFNetworkAgent.sb.xml | 42 + .../references/rev_profiles/CPLDiagnose.sb | 766 ++++ .../rev_profiles/CPLDiagnose.sb.xml | 40 + .../references/rev_profiles/CVMServer.sb | 334 ++ .../references/rev_profiles/CVMServer.sb.xml | 41 + .../CacheDeleteAppContainerCaches.sb | 455 +++ .../CacheDeleteAppContainerCaches.sb.xml | 41 + .../references/rev_profiles/CommCenter.sb | 614 +++ .../references/rev_profiles/CommCenter.sb.xml | 45 + .../references/rev_profiles/DataActivation.sb | 1006 +++++ .../rev_profiles/DataActivation.sb.xml | 41 + .../rev_profiles/EscrowSecurityAlert.sb | 405 ++ .../rev_profiles/EscrowSecurityAlert.sb.xml | 41 + .../rev_profiles/IDSCredentialsAgent.sb | 292 ++ .../rev_profiles/IDSCredentialsAgent.sb.xml | 41 + .../IDSRemoteURLConnectionAgent.sb | 671 +++ .../IDSRemoteURLConnectionAgent.sb.xml | 41 + .../rev_profiles/IMDPersistenceAgent.sb | 501 +++ .../rev_profiles/IMDPersistenceAgent.sb.xml | 40 + .../IMRemoteURLConnectionAgent.sb | 663 +++ .../IMRemoteURLConnectionAgent.sb.xml | 41 + .../rev_profiles/IMTranscoderAgent.sb | 829 ++++ .../rev_profiles/IMTranscoderAgent.sb.xml | 40 + .../references/rev_profiles/ImageDecoder.sb | 203 + .../rev_profiles/ImageDecoder.sb.xml | 41 + .../rev_profiles/MTLCompilerService.sb | 276 ++ .../rev_profiles/MTLCompilerService.sb.xml | 41 + .../rev_profiles/MailCompositionService.sb | 1390 +++++++ .../MailCompositionService.sb.xml | 40 + .../references/rev_profiles/MobileBackup.sb | 12 + .../rev_profiles/MobileBackup.sb.xml | 21 + .../rev_profiles/MobileSlideShow.sb | 1381 +++++++ .../rev_profiles/MobileSlideShow.sb.xml | 44 + .../references/rev_profiles/PasteBoard.sb | 395 ++ .../references/rev_profiles/PasteBoard.sb.xml | 52 + .../references/rev_profiles/Safari.History.sb | 277 ++ .../rev_profiles/Safari.History.sb.xml | 41 + .../rev_profiles/SafariBookmarksSyncAgent.sb | 462 +++ .../SafariBookmarksSyncAgent.sb.xml | 41 + .../SafariCloudHistoryPushAgent.sb | 358 ++ .../SafariCloudHistoryPushAgent.sb.xml | 41 + .../rev_profiles/SafariSafeBrowsing.sb | 377 ++ .../rev_profiles/SafariSafeBrowsing.sb.xml | 41 + .../rev_profiles/ScreenSharingServer.sb | 419 ++ .../rev_profiles/ScreenSharingServer.sb.xml | 43 + .../rev_profiles/ScreenshotService.sb | 364 ++ .../rev_profiles/ScreenshotService.sb.xml | 41 + .../rev_profiles/StreamingUnzipService.sb | 307 ++ .../rev_profiles/StreamingUnzipService.sb.xml | 41 + .../VideoSubscriberAccountDeveloperService.sb | 275 ++ ...eoSubscriberAccountDeveloperService.sb.xml | 41 + .../VideoSubscriberAccountPrivacyService.sb | 204 + ...ideoSubscriberAccountPrivacyService.sb.xml | 41 + .../references/rev_profiles/WebSheet.sb | 1305 ++++++ .../references/rev_profiles/WebSheet.sb.xml | 40 + .../references/rev_profiles/accessoryd.sb | 663 +++ .../references/rev_profiles/accessoryd.sb.xml | 41 + .../references/rev_profiles/accountsd.sb | 605 +++ .../references/rev_profiles/accountsd.sb.xml | 28 + .../references/rev_profiles/adtrackingd.sb | 417 ++ .../rev_profiles/adtrackingd.sb.xml | 29 + .../references/rev_profiles/afcd.sb | 680 +++ .../references/rev_profiles/afcd.sb.xml | 41 + .../references/rev_profiles/analyticsd.sb | 438 ++ .../references/rev_profiles/analyticsd.sb.xml | 28 + .../references/rev_profiles/appaudiod.sb | 537 +++ .../references/rev_profiles/appaudiod.sb.xml | 41 + .../references/rev_profiles/appconduitd.sb | 627 +++ .../rev_profiles/appconduitd.sb.xml | 41 + .../references/rev_profiles/apsd.sb | 510 +++ .../references/rev_profiles/apsd.sb.xml | 45 + .../references/rev_profiles/assertiond.sb | 426 ++ .../references/rev_profiles/assertiond.sb.xml | 44 + .../references/rev_profiles/assetsd.sb | 968 +++++ .../references/rev_profiles/assetsd.sb.xml | 41 + .../rev_profiles/barcode_notification.sb | 577 +++ .../rev_profiles/barcode_notification.sb.xml | 41 + .../references/rev_profiles/barcode_parser.sb | 51 + .../rev_profiles/barcode_parser.sb.xml | 41 + .../rev_profiles/bulletindistributord.sb | 798 ++++ .../rev_profiles/bulletindistributord.sb.xml | 41 + .../references/rev_profiles/closured.sb | 156 + .../references/rev_profiles/closured.sb.xml | 29 + .../references/rev_profiles/cloudphotod.sb | 23 + .../rev_profiles/cloudphotod.sb.xml | 41 + .../com.apple.AssetCacheLocatorService.sb | 640 +++ .../com.apple.AssetCacheLocatorService.sb.xml | 41 + .../rev_profiles/com.apple.GSSCred.sb | 275 ++ .../rev_profiles/com.apple.GSSCred.sb.xml | 41 + .../com.apple.WebKit.Databases.sb | 232 ++ .../com.apple.WebKit.Databases.sb.xml | 42 + .../com.apple.WebKit.Networking.sb | 429 ++ .../com.apple.WebKit.Networking.sb.xml | 42 + .../com.apple.WebKit.WebContent.sb | 1234 ++++++ .../com.apple.WebKit.WebContent.sb.xml | 42 + .../com.apple.assistant.assistantd.sb | 811 ++++ .../com.apple.assistant.assistantd.sb.xml | 41 + .../references/rev_profiles/com.apple.bird.sb | 920 +++++ .../rev_profiles/com.apple.bird.sb.xml | 44 + .../rev_profiles/com.apple.captiveagent.sb | 160 + .../com.apple.captiveagent.sb.xml | 42 + .../rev_profiles/com.apple.cloudd.sb | 800 ++++ .../rev_profiles/com.apple.cloudd.sb.xml | 40 + ...apple.datadetectors.AddToRecentsService.sb | 375 ++ ...e.datadetectors.AddToRecentsService.sb.xml | 41 + .../rev_profiles/com.apple.homed.sb | 1115 +++++ .../rev_profiles/com.apple.homed.sb.xml | 40 + .../rev_profiles/com.apple.nehelper.sb | 810 ++++ .../rev_profiles/com.apple.nehelper.sb.xml | 42 + .../com.apple.nesessionmanager.sb | 770 ++++ .../com.apple.nesessionmanager.sb.xml | 48 + .../com.apple.networkserviceproxy.sb | 509 +++ .../com.apple.networkserviceproxy.sb.xml | 45 + ...com.apple.quicklook.QLThumbnailsService.sb | 836 ++++ ...apple.quicklook.QLThumbnailsService.sb.xml | 41 + .../rev_profiles/com.apple.rtcreportingd.sb | 658 +++ .../com.apple.rtcreportingd.sb.xml | 42 + .../rev_profiles/com.apple.sandboxd.sb | 67 + .../rev_profiles/com.apple.sandboxd.sb.xml | 47 + ...om.apple.siri.ClientFlow.ClientScripter.sb | 583 +++ ...pple.siri.ClientFlow.ClientScripter.sb.xml | 41 + .../rev_profiles/com.apple.snhelper.sb | 212 + .../rev_profiles/com.apple.snhelper.sb.xml | 41 + .../references/rev_profiles/com.apple.tccd.sb | 604 +++ .../rev_profiles/com.apple.tccd.sb.xml | 42 + .../rev_profiles/com.apple.tzlinkd.sb | 27 + .../rev_profiles/com.apple.tzlinkd.sb.xml | 41 + .../rev_profiles/com.apple.wirelessproxd.sb | 356 ++ .../com.apple.wirelessproxd.sb.xml | 41 + .../references/rev_profiles/contactsd.sb | 456 +++ .../references/rev_profiles/contactsd.sb.xml | 40 + .../references/rev_profiles/container.sb | 3638 +++++++++++++++++ .../references/rev_profiles/container.sb.xml | 29 + .../rev_profiles/containermanagerd.sb | 589 +++ .../rev_profiles/containermanagerd.sb.xml | 41 + .../rev_profiles/coresymbolicationd.sb | 150 + .../rev_profiles/coresymbolicationd.sb.xml | 41 + .../references/rev_profiles/cplogd.sb | 230 ++ .../references/rev_profiles/cplogd.sb.xml | 41 + .../references/rev_profiles/ctkd.sb | 147 + .../references/rev_profiles/ctkd.sb.xml | 41 + .../references/rev_profiles/dataaccessd.sb | 796 ++++ .../rev_profiles/dataaccessd.sb.xml | 41 + .../references/rev_profiles/datadetectors.sb | 275 ++ .../rev_profiles/datadetectors.sb.xml | 41 + .../references/rev_profiles/debugserver.sb | 224 + .../rev_profiles/debugserver.sb.xml | 48 + .../references/rev_profiles/deleted.sb | 512 +++ .../references/rev_profiles/deleted.sb.xml | 41 + .../references/rev_profiles/devicecheckd.sb | 512 +++ .../rev_profiles/devicecheckd.sb.xml | 37 + .../references/rev_profiles/distnoted.sb | 110 + .../references/rev_profiles/distnoted.sb.xml | 25 + .../references/rev_profiles/duetexpertd.sb | 640 +++ .../rev_profiles/duetexpertd.sb.xml | 40 + .../references/rev_profiles/eapolclient.sb | 332 ++ .../rev_profiles/eapolclient.sb.xml | 28 + .../references/rev_profiles/fileproviderd.sb | 634 +++ .../rev_profiles/fileproviderd.sb.xml | 29 + .../references/rev_profiles/findmydeviced.sb | 865 ++++ .../rev_profiles/findmydeviced.sb.xml | 41 + .../references/rev_profiles/fmfd.sb | 761 ++++ .../references/rev_profiles/fmfd.sb.xml | 40 + .../rev_profiles/ftp-proxy-embedded.sb | 389 ++ .../rev_profiles/ftp-proxy-embedded.sb.xml | 43 + .../references/rev_profiles/gamed.sb | 783 ++++ .../references/rev_profiles/gamed.sb.xml | 40 + .../references/rev_profiles/geocorrectiond.sb | 500 +++ .../rev_profiles/geocorrectiond.sb.xml | 28 + .../references/rev_profiles/geod.sb | 675 +++ .../references/rev_profiles/geod.sb.xml | 41 + .../references/rev_profiles/gizmoappd.sb | 636 +++ .../references/rev_profiles/gizmoappd.sb.xml | 41 + .../references/rev_profiles/gputoolsd.sb | 594 +++ .../references/rev_profiles/gputoolsd.sb.xml | 51 + .../references/rev_profiles/healthcloudd.sb | 401 ++ .../rev_profiles/healthcloudd.sb.xml | 41 + .../references/rev_profiles/healthd.sb | 739 ++++ .../references/rev_profiles/healthd.sb.xml | 40 + .../references/rev_profiles/honeybeed.sb | 641 +++ .../references/rev_profiles/honeybeed.sb.xml | 36 + .../references/rev_profiles/iWorkXPC.sb | 285 ++ .../references/rev_profiles/iWorkXPC.sb.xml | 41 + .../references/rev_profiles/iapd.sb | 412 ++ .../references/rev_profiles/iapd.sb.xml | 41 + .../rev_profiles/identityservicesd.sb | 727 ++++ .../rev_profiles/identityservicesd.sb.xml | 41 + .../references/rev_profiles/installd.sb | 426 ++ .../references/rev_profiles/installd.sb.xml | 41 + .../references/rev_profiles/iomfb_bics.sb | 292 ++ .../references/rev_profiles/iomfb_bics.sb.xml | 41 + .../references/rev_profiles/itunesstored.sb | 748 ++++ .../rev_profiles/itunesstored.sb.xml | 41 + .../references/rev_profiles/kbd.sb | 1258 ++++++ .../references/rev_profiles/kbd.sb.xml | 41 + .../references/rev_profiles/keyboard.sb | 706 ++++ .../references/rev_profiles/keyboard.sb.xml | 31 + .../rev_profiles/limitadtrackingd.sb | 441 ++ .../rev_profiles/limitadtrackingd.sb.xml | 41 + .../references/rev_profiles/lockdownd.sb | 514 +++ .../references/rev_profiles/lockdownd.sb.xml | 41 + .../references/rev_profiles/logd.sb | 562 +++ .../references/rev_profiles/logd.sb.xml | 38 + .../rev_profiles/lsuseractivityd.sb | 467 +++ .../rev_profiles/lsuseractivityd.sb.xml | 42 + .../references/rev_profiles/mDNSResponder.sb | 151 + .../rev_profiles/mDNSResponder.sb.xml | 56 + .../references/rev_profiles/mediaanalysisd.sb | 745 ++++ .../rev_profiles/mediaanalysisd.sb.xml | 40 + .../references/rev_profiles/mediaserverd.sb | 1083 +++++ .../rev_profiles/mediaserverd.sb.xml | 43 + .../references/rev_profiles/message-filter.sb | 317 ++ .../rev_profiles/message-filter.sb.xml | 32 + .../rev_profiles/mobile-house-arrest.sb | 611 +++ .../rev_profiles/mobile-house-arrest.sb.xml | 41 + .../rev_profiles/mobile_storage_mounter.sb | 429 ++ .../mobile_storage_mounter.sb.xml | 42 + .../rev_profiles/mobile_storage_proxy.sb | 399 ++ .../rev_profiles/mobile_storage_proxy.sb.xml | 41 + .../rev_profiles/mobileactivationd.sb | 660 +++ .../rev_profiles/mobileactivationd.sb.xml | 41 + .../references/rev_profiles/mobileassetd.sb | 710 ++++ .../rev_profiles/mobileassetd.sb.xml | 42 + .../references/rev_profiles/nanomapscd.sb | 770 ++++ .../references/rev_profiles/nanomapscd.sb.xml | 41 + .../references/rev_profiles/navd.sb | 582 +++ .../references/rev_profiles/navd.sb.xml | 41 + .../references/rev_profiles/network-filter.sb | 458 +++ .../rev_profiles/network-filter.sb.xml | 32 + .../references/rev_profiles/nfcd.sb | 480 +++ .../references/rev_profiles/nfcd.sb.xml | 41 + .../references/rev_profiles/nlcd.sb | 148 + .../references/rev_profiles/nlcd.sb.xml | 42 + .../references/rev_profiles/nointernet.sb | 5 + .../references/rev_profiles/nointernet.sb.xml | 21 + .../references/rev_profiles/nsurlsessiond.sb | 789 ++++ .../rev_profiles/nsurlsessiond.sb.xml | 42 + .../references/rev_profiles/nsurlstoraged.sb | 534 +++ .../rev_profiles/nsurlstoraged.sb.xml | 41 + .../rev_profiles/online-auth-agent.sb | 478 +++ .../rev_profiles/online-auth-agent.sb.xml | 41 + .../references/rev_profiles/parsecd.sb | 726 ++++ .../references/rev_profiles/parsecd.sb.xml | 41 + .../references/rev_profiles/passd.sb | 1119 +++++ .../references/rev_profiles/passd.sb.xml | 41 + .../references/rev_profiles/personad.sb | 638 +++ .../references/rev_profiles/personad.sb.xml | 41 + .../references/rev_profiles/pfd.sb | 199 + .../references/rev_profiles/pfd.sb.xml | 28 + .../references/rev_profiles/photoanalysisd.sb | 816 ++++ .../rev_profiles/photoanalysisd.sb.xml | 41 + .../references/rev_profiles/pkd.sb | 114 + .../references/rev_profiles/pkd.sb.xml | 31 + .../rev_profiles/playground-devtools.sb | 650 +++ .../rev_profiles/playground-devtools.sb.xml | 27 + .../references/rev_profiles/powerlogd.sb | 277 ++ .../references/rev_profiles/powerlogd.sb.xml | 41 + .../references/rev_profiles/printd.sb | 645 +++ .../references/rev_profiles/printd.sb.xml | 41 + .../references/rev_profiles/progressd.sb | 461 +++ .../references/rev_profiles/progressd.sb.xml | 42 + .../references/rev_profiles/ptpd.sb | 483 +++ .../references/rev_profiles/ptpd.sb.xml | 44 + .../rev_profiles/quicklook-preview.sb | 201 + .../rev_profiles/quicklook-preview.sb.xml | 31 + .../rev_profiles/quicklook-thumbnail.sb | 13 + .../rev_profiles/quicklook-thumbnail.sb.xml | 31 + .../references/rev_profiles/quicklookd.sb | 1173 ++++++ .../references/rev_profiles/quicklookd.sb.xml | 40 + .../references/rev_profiles/racoon.sb | 118 + .../references/rev_profiles/racoon.sb.xml | 45 + .../references/rev_profiles/replayd.sb | 696 ++++ .../references/rev_profiles/replayd.sb.xml | 41 + .../rev_profiles/reversetemplated.sb | 368 ++ .../rev_profiles/reversetemplated.sb.xml | 41 + .../references/rev_profiles/revisiond.sb | 491 +++ .../references/rev_profiles/revisiond.sb.xml | 42 + .../references/rev_profiles/routined.sb | 811 ++++ .../references/rev_profiles/routined.sb.xml | 42 + .../references/rev_profiles/securityd.sb | 475 +++ .../references/rev_profiles/securityd.sb.xml | 41 + .../references/rev_profiles/seld.sb | 690 ++++ .../references/rev_profiles/seld.sb.xml | 41 + .../references/rev_profiles/sharingd.sb | 1210 ++++++ .../references/rev_profiles/sharingd.sb.xml | 41 + .../rev_profiles/social-services.sb | 934 +++++ .../rev_profiles/social-services.sb.xml | 40 + .../rev_profiles/softwareupdated.sb | 335 ++ .../rev_profiles/softwareupdated.sb.xml | 41 + .../rev_profiles/streaming_zip_conduit.sb | 500 +++ .../rev_profiles/streaming_zip_conduit.sb.xml | 41 + .../references/rev_profiles/studentd.sb | 613 +++ .../references/rev_profiles/studentd.sb.xml | 40 + .../references/rev_profiles/suggestd.sb | 693 ++++ .../references/rev_profiles/suggestd.sb.xml | 40 + .../references/rev_profiles/syncdefaultsd.sb | 514 +++ .../rev_profiles/syncdefaultsd.sb.xml | 45 + .../references/rev_profiles/syslog_relay.sb | 336 ++ .../rev_profiles/syslog_relay.sb.xml | 42 + .../references/rev_profiles/test-common.sb | 23 + .../rev_profiles/test-common.sb.xml | 41 + .../references/rev_profiles/testmanagerd.sb | 606 +++ .../rev_profiles/testmanagerd.sb.xml | 30 + .../references/rev_profiles/tonelibraryd.sb | 286 ++ .../rev_profiles/tonelibraryd.sb.xml | 40 + .../references/rev_profiles/trace.sb | 62 + .../references/rev_profiles/trace.sb.xml | 42 + .../references/rev_profiles/transitd.sb | 101 + .../references/rev_profiles/transitd.sb.xml | 41 + .../references/rev_profiles/trustd.sb | 201 + .../references/rev_profiles/trustd.sb.xml | 41 + .../references/rev_profiles/uiautomationd.sb | 488 +++ .../rev_profiles/uiautomationd.sb.xml | 41 + .../references/rev_profiles/userfs_helper.sb | 426 ++ .../rev_profiles/userfs_helper.sb.xml | 41 + .../references/rev_profiles/userfsd.sb | 551 +++ .../references/rev_profiles/userfsd.sb.xml | 42 + .../rev_profiles/videosubscriptionsd.sb | 279 ++ .../rev_profiles/videosubscriptionsd.sb.xml | 41 + .../references/rev_profiles/vpn-plugins.sb | 459 +++ .../rev_profiles/vpn-plugins.sb.xml | 60 + .../references/rev_profiles/watchlistd.sb | 760 ++++ .../references/rev_profiles/watchlistd.sb.xml | 42 + .../references/rev_profiles/wcd.sb | 951 +++++ .../references/rev_profiles/wcd.sb.xml | 41 + .../references/rev_profiles/webinspectord.sb | 369 ++ .../rev_profiles/webinspectord.sb.xml | 41 + .../rev_profiles/wifiFirmwareLoader.sb | 358 ++ .../rev_profiles/wifiFirmwareLoader.sb.xml | 41 + .../references/sandbox_bundle | Bin 0 -> 471472 bytes .../references/sandbox_profiles.txt | 171 + .../references/sb_ops | 143 + tests/test.py | 2 + 348 files changed, 101598 insertions(+) create mode 100644 tests/iPhone6__2_11.0.0_15A372/inputs/sandbox.kext create mode 100644 tests/iPhone6__2_11.0.0_15A372/logs/.dummy create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AGXCompilerService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AGXCompilerService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb.xml create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/sandbox_bundle create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/sandbox_profiles.txt create mode 100644 tests/iPhone6__2_11.0.0_15A372/references/sb_ops diff --git a/tests/iPhone6__2_11.0.0_15A372/inputs/sandbox.kext b/tests/iPhone6__2_11.0.0_15A372/inputs/sandbox.kext new file mode 100644 index 0000000000000000000000000000000000000000..40c5c7f5513d217e11a26e1253ef7d7f420280c7 GIT binary patch literal 602112 zcmeFa2VfJ&)&{z=4IzYtkcMr*h>pRQF&)#~!MK47#S|f1vMp>&M#aW}!J>xHdkx5t zUI>@;Lc&c*yZMul-Y)6A_j{AvB=0*jJG(1e5;jh9|Np(`W#`*Db9Uy;*)ua|W@p8- zKY#ICCrQ#t_`3jSN1U&Q$plLQ-smC>9byq(M_Lx^t_@|4(ZPM1P$D&PFWJU?kVm(OdE zBvdQlpV4S{8Y}HWyk_;C|L-VP-`)kYC(%Z*4xm?DynQ1AUMSnNT=X4rV zxg>dcJ|a%lrc>0{XmnW?snraaU(5tGKXETBFidJ-C1kXZFI)7R8+ z!FfKr5OK3KaxT+~yDLe`N{KV#S%c*KRDHH-f!!goE2|AxPLs`C zY+oehNcr-W(_(X3ZI((YNs#nttrnZpYPac?M3dWWwHr+(E^CcN%8-&Ms+Xf>7FV^& zRW2E%YKOhlT4|AbJ1mtJlhb0>m)I*SEx5~W8{pJCETtBQ#a3d`yX<NHaaq=4hsjYFmtra@w>aZU>{SL+b#mv47FNJ@D&gm$Lt3WkaU?@q5A2M>N)VsuFv)Nq`qs;1bSseOe6pXqHQS`M|SGnG1 z*V{~0mcK}@VWUS&vKU4xR_fi)nV_#Sl^Cn-mDZ9vqatjn37R!0==+)H*!~*fMvfRA zFI89^HVENz16=xwD!UoIugT#W$S$q6Qai|lV)Qk3t64uNTFSSWT*a13mtM9sJ+Frp zXSUSDxmvWe{%^D(^XKaZBLRw(qwO?qa3aGN6{ghM~(Z*b8eHOE^#$M@$byb^6DvI5urBJT38Y!{x zKwKs?e@84eVW*@teWSY?qnX7>3Ny0ittQE>o0Esc4;?mq#K=*j$C!#s%$8Eg>U6q= z$o!fOi|WH=#8@S}SZa2$rIjY=i}Sne6&9N`w%?FJm6eN{f)fc&$yw(tF;!L?c|Bzn z8jIbP6{-$g4mX;)S=OG+3DfEAwpkWY?a@D>dejrR>Z<>u7C&^zuy~E>s1M(2v${kF z${mS*Lq;!>dh>QqJtlEjO_kQg7JYT4$pwX0iB|U4bO^&ojv6C5i}4S(%0qp*z0z!f zPN~}hRd1?9<1*Lj%Po~=eQ}+>8r?!a_n$1E(sa<(4;?*3QsPFF*$kJsqykNxiD<8} zIArtvD`grvMkABif@y@kjtk_Z$LY2~hozPF+CNz)XBFCvy@a$BKSFZiNl{el?JRXz zEP9Ohgl0TLP)#&w>rF0wzv{nEs^KFw!dPuJu=f9|IHM)mxk+%M*R-NJI?F9Klg(OY zvN?PG$$GJ%`feI3@VG{f8ZM!8HMuKY5_5?xHR$hS;h&i$liO8pcUTv*Cl>3lmX*6= z?ZwosDBJ zBnqESreXZW;7o&dmEDa2PQ8rf0~DuFpCcDem$7`rq1#xr%HlFLA<13@XQ{z}!!vSP zOpcOre(gd#g+$~l!e`|)w@o8QEyizAXLcQHDv|5TqukNpcXEm<1&^0nsp)f9hh&kd zY%pYXkj!xLT@Xsc<$zH-Txc>74i?g6oR=25Y_V=9D8+ctcJY%|wt#X#J8nFn}qluJPNek@7T!|P*q)IzlB^+*RnGL-P^&L{BlW7xk zo$^5vh2XZszc<^f&~?RD+U*tYYMxMzjz{L9OEk(7OEry8(7uCuL6^!GOO7qvq$WvC zjgb|oEdw^itkb7pa@OU7=`xm;PG$1)7>#-VDosq-I0s8)ZOdkH)!H2ugCzL^E_gAz zG_w*fMpvLj>~5EwTH`RmQfvgVa+~83n7vG<`cuO~D-bj6K}`wFVjz!Gk%xR0Qkz)pFR>&1!>Zjv66U z1c1+5p+uFQ>El2f7KPsM^2jPxGD#+36HCiKP^s^ z9}*%i>b*E(1S)YU*I1=dA|>T+vq&&oirr-*Qc4Ag2oqJ#iWX3md?|vaVN&v71oRC} zNekT;2dcuPibX4ntu$dhKoD%DPG?Pth|zQuN`}LL*{VWBLxbX=dpQ$_g(lP@<^;1M z1dRtY&MApZbxO>QzQAUN(wsE;m9ul!nyQ(O`Fac1d+<1ED5W`;@VWj%*KWk9cnMQg z8=Ndutk?vH*KCH!POOqJYvl_=l)zs<=xNTt80FUy>f(Y}B2Xv6+SP&Pd~9N?LwCUh8B}HKu0dL1?ks zDCHIw=yTKcc}Y2w(%|FT>Li-g)Pe<7wm4WN&FXpxO=(#l?zZtIpM1VNiuE?HaQa`t($D=E=xvOXu zPolJr5+9MV!bYVVomiaVBGy$EQ%TIXHp3-1mDw=zSxd~7CYVaOS)#!ceHxZA?2bA# z2re%zt;s7oysvloRMO=z!IM>=t$de3xk)lrm0Iy$s=CeySD3Bj(JB%(4`znWfzf)t zA|csrm34Yq8okxYW{tI&J)#vkt4*~w%xdKo7(IqIlY<<#8k-R+qU9ttAIc8BwZ0ZJ zD?L(O=r7CkibOD$g>KZ-tk;@yvAxXg6ssRbRvs-2@;1X3v{Xg#_T#qEQZY#J_Rd6}zo>GS$ z>oj6nR9gvJ+?EWBs!Jq8F+2e*oExeu;l|q}Ln(%P3;7Fz1TR@4ezcglsbI>mVZ7qZ z6_&bUy9o~(dMc?PpGI>@Lw$|aQmZD$y2{;E#WrYN!UTZ^xmey*73V{aVv(t?%t1a1 z^$IS#y;7szp%Ppar`3#QgHnwm`}f!Pg8i6m#&VO>$i|s6i$lV*u~flhgF5g4;BDwl znww|=5V z|6O=)HWUXpgr?MTV++KquEWus4T~kzj^w7MCyUmj#(GOtu>~vGX1&c_sV^xvp}nCK z)OM$$$!Vs#s%b(Ny{p{P^vwkN6e&(#IF73^IpSPZ)xHEa;r3yX-AuDDUoBb^t)lx< zu^Q}xR-5qB6RY!OG#AI2XuxQ4Kgf1;=6DcIvOof9tE!F983d9(7{P^Mtcn zS%*H)**sSo^v&>b;e=Y?iaOln^%NU9!6;92#^tyxD<>#i@D*t78|J7igEPNZ&ID!v z4}q;J6PaFfVEvn{BZ=NYW!sC<6{O?LfMZ%lOZR*QPc;m=V<9WAGPz31>B5Y`_0M)D z)E59wLrHaY!m#*}v~HD@ou1KDL_XuuQxXiH4TFFB>m*H=C(Ac99;&7RP9FL-0}}Te zl{poR!hnBxwJ6?P*wB~ZNsG9VDcx98g~fm0XREYMc%d}walj9RbBZObboMHZ^&xOw zTv$$*Gq*Sl9fPH^9wsH*n3y+Q@ErlvtP=bRI&WSo?jTR63i z70REL4~LPq7yKcbmb2rMojp^uOV-0r&Sj<}%aCfEnwwXEccl*ak7PHB`>Bj~3F_Eo zlnt7EDe}%}22Fd3_?tY{MN820DGy~C0|%v88zpC)mnEzpvuE)#P_!5<6!|nZG(IDZ z)<&193?3YRFO1PHr!Xt4BXQEQ3K}ChkQmW5EW9X9Ll>_C~= z)UIN+R98-TWIoGZZM?AsH6)+HRoUWlG~59*=gnAcuKu2}%oDgpX&Kb4d>S90QW~_J zv{K=30@+L?Vaj}yK%B4VSH*lOX`EOPR(v$Fdst$#n#+nkKyKQ_TbM`)opbXp!h zgDADaqx_M_De7;3jCrkX9|mODueGq0D^REpWI<|Tg#HbXgLIayV;)DbPNnl?$1 zGmHMQveJ#qk_u->HsPVoKC}C|=jzAnwf>IVM*X!BlRn-P^EDtNn{*D0=H0AVJ7Gk& zxuJ>YGBsR{!8WRAUKAUW8D59$HHhYbP`projO#pX8_01m9JT zbU393?baB1=4H|6=I67C1!Lt+Lq7*QKj!rQlP6(f)xjuM0EV)u*yy3dmA%KInjM=9 zr?5YW_1d5?}r-B59I4XQa=q<8Y6Y+kGK>Yig18L@qrYN zS{fEDP1i|1b%+6D{uMe{8Y)S#?W7p#eMyS)hQ?y|Dy6?qi1au)eF!1aCHd956;23;M00351Lv7!x^QoHT*a$IJW^7=Ofo ziP(-SMcomaNXYnsF%bijrBp^wk@-^@|Bs<*(j?ID3r#0v{J@wWLnlj97(GMgpThWW zADJm-gMKnJi;(dHV{RXrLpz&6&z1S7GXCQur%CysKNgxt$oPRV$43@O(;2-`=AX{^ zzYU!s%>w9)6g11#t)2n$FN9R%;5BfKuO9>f2Fy?K;GO2;lm&^POjQ{&kkF*l>e}}FhWc8U1RR z{~+VlL17j{7@DJ&K zK%Wx!6d|JnV=fu+wDc_KQ^TGiWOQK6XQ8L1=Ruzy_8cLj17rR@=mqH|(C37`NXY2G zn9oCBmR<$DIP4WdMhC`x8v2^_2I%EsuM;vlFlJ%be@btHZVNj@$mqbB>aK4|?||+M zdz+Bafia(izRUXany~i>8QrAQi7!*4_JtNw|Bn8DIz}WZlD=O;Jd*nTPw)}T#!%M( zdqP0{4Dr(;Cf(;K=gp8Wq_0^y?R8&DlK!KR_PVbSrx6$QsEIU5p(!Y@3_aQ$L>i>;=DPA1fUiWWF>Y(aFn-;j(-G?3;0J;psteOe1L{KC5h70Y(lKXYMJVA1^zlmj z`H%zk*JXxu)SVBU7IJ~^LYe;pmTxCY*MABs=}D40>n;LcPRMk42~xBq&C*>Az7Zi^ zbeAxFUq+})L;9sU>55^%%XCtYFzIsm9MXy~=?X%~+f^5idv(EF-TOd1+@T)>Dg7&5FI^v&Z*M}#Ym(!Ab^Q=eLOp>{ zQi`s>PV$6GDO4Wh8mNn9azztDu0guNOs-f$$Q46;C@Pi^^)WE{M{s#TpQ*?lFUviY z$vsRripf1(H$s*h$mAX=%Z+rDH(Hm#7C)g&!krXPCe&SudO}{@H%XVu?n|RM?n@^G-y{}4p_?q<$Jzta{}jmg zDyZON?H~*JtwKB-acU+%Ral9Z>*XXTj)VYda8f7A&bYj-G@ z+o9~qvhrXLBgl?SI-PVmvrs9@tedTy!{nR`)UmGxYfztdxPKnY->93flSY=|uK9Ah z1IYg#(e2PJ(?x{z2`LXH%4ImUyHe%%hxo=xk}}kJf9J#nhm)KoE2PdHr{e{v9aCm{ zag4=NcR!V-cr#Dah!Pj2QE8IY9cOmZRO6J40`+B~ z{8|sMe5kt3(`hE-M@XNS+LSr|VmO5Mm*RR$A#vS?7~(FHI<~`QNPb94h%qE1#1>K- zVh@SCTsj{zEdhUGT<45bY`?6ey^(PZ9W%9W3p;0*;x#0;2^iTX4J2oQ%W22!HS8oY z8*iL~EyUP$M?30}I7#NlWs=#_Il0P?s}$@QitF4F`V`B|ofAPOr5upu-6cgp#Oe@7 zh&7}p#1!HRu^>)Yj*z&xWm23?ikm5gR6+7$uvD_-6vS*`HGyIS#S!AfP01l{#LS%M zatU-d=t%80WK3Lz)UjCVI7Av78#`o7QhMAHsiTeJA%&cWav-H`mpWcW^nQ>}H3Mb& zN8ZP#StH{0VBZVp`n*fU>sF<<63q~N>}r||uT-(c82XJLHEQ_iVe!Mr$kGp+I%&6QqlCiUvoKWLxuq_)aAX=*eqqni)MJaHsphMsj%Kaq>!ps>{xrW+>bQaE{EwPVDqaAWI(Zw) zLLBy*g@q;lGSvY?Tq9f4EWVzgd0XnQ?N{NVn0coo7pnuNW|%W8;}>)t16nm*v;pkT4mENbBlwquHkY{R@#*iz_)Q_`7|!U|6eI|OztuRQw@IRDznP4!08b{yJyIy%>cyFG42;UxULe+ z)dk}%38@Gv2Udnu@y-!En5p`-*X(MOm0s^-yBoeO9p<&nif z(HTij?Al=85NFYMOm;^;-|0Y!X>3m#d(Mf@f26T>Qp25j+V5P9B}!I_m7P=VW!O7F zw`N+=@08jNRkR{W8kr^QuXqx3cquO3;aiAZIh&k9$dS#}Kx~u& z8b7u=m@!J1TFc!0(;S1mPt9zob{Aut6Y-@$B3AemYjpvJFZ%MQj$}(Ly{pK9F`n%x zlVAOyEu$p1Ws+E?q506>FtY)ldr*zhROn9gllg9ZXhYwKV{;7Kr|Yids!OzXE+RLI zeN<%BD%+VDU&DsW$;u8#mRZS9iS|cxWM4ym)=c2ZRaN}?sEWwq?_FZK9!bPW*nZ;_ zI!P?;oJB8(oMwaBWT~>-h-13EKgy7Vucwk7_yEX}gb!EPaGhxC&{0aRHM8O*hrpWDtJ`!e| zJ+TR%(h}1<=U{+MvD+Qk!pWUACFS&d-8tiEd3}d zE`PGDysm?Q_@iM+NyIhH7l=mvqS|dX>z8fx*?^oSI3=n7S@~sWpK(jl6~HXkU&>nu zHNFS2Oli`8rIMLg{%*n`K;DKSDJcb`4fKt#R`M(*^oeR+Dz5Ei^eoWGEoMVHf?~Y) zL)V6{6-?Yt^Jma5vn&v%V~1zH+R0^1w__7`Hf-HVS)|p#$>o=c1rMgtXVKXfN|;X{ zw%J@WEY@Os5|<|1TE=?~Rf5T;>H>QnKA_`Wl=I~&Zl~KS_Xw2DBs+a@W5~}sFnN}# z+-|2PMf8kGc6(W+g`#BtMOKH^P;GKx4})PcOci@bGOEy9IWg3*HlP1%9*tQFMiq3 zlH#m#8ak)LO7YPedo-EaPLguSvYN~WYmzy)+Lh~eQ5h-p)^lgJfxt%=q$QT_nqdwy*5MHaPHicZb-qX;$XuAGDySY5l<}T(M0<# zlN{_37iLgFMOD@49aAu~#7}up$Jj)9Q!DLmbEeg0phsXy#*1+hiq#zVQ4VRz4y(D0 zDIq7xSuxe(U~dEMw!#czm81b^Q*(X%5T*S(@na&iky`O(sQr<@kH63!Qe1=-V!%|h z8V8#qULke7P=ZrQ(`b4#BQ5mF7u#3WjsqjC0o|rWZnkCv+9CF8D}Fm$t}9Ua+2&_z zCGvEF-tPXX&58I>897F6Mz<1i1UeVm2`gcA56$(%* z>&EH}CTHa9>8G3YGcvNW^yx_%S^C@@eM(_|0bZ-;=~L6DXW%0WWJzyYNWK)BU2RTs zvL>8@83k*+DQ>3&a}P>`ufhh847Rx`j!1haIZGVYYS{ssM4v6wmj?8__-xIr#QF16 z)g=03F0}z$+VC?P_|}Mhi9}-2vZ0^;TjpmU^rL%=Evd$g&_?_L#t(EY=xhw^vBZ|5 z0ps&Qs0|$@-GslPI90i1jlye_Jq0{!xPJJ-7}}(QU!TEO!Pw}Hdwk^!ejk^f( zmpTn_k*Y8`VEeFWUl*|lS{ERG{>5#q%dUL43w|tHYw98Ni|MyPeB4X9p5;04AN(Ol z!d6np`Tfi7tf;FsRaO}6#mv^(cY%Cn6JQ)|!Ve?n*-LRiRsTY6k-ykdhhGY@*Ty=r z3lZOGv%f(tyAO{s)>;bQ7M8;eEVkNOEgMK|%gUkIf#xnriuZe;Y`>VPpr-hI-&KcC za2>Vy@|8Ln+#=EXNppRu_hF|V|9prRj`H_OTGl{ox+BF)}IC}hrU5U zTSUvomLQT!lKjtCWw}s?3ii34B#i`b^L&Nhz0mH&#%xCgniW3PMTb}yE7~$E1+Ps4 z++R|S$)ED{1Gm2v6TUd9vE=X%Z|S2Md|87(|Mnu}GS!-Cw;o^gW$jxZSPmvQeb_{Q zv>wsCzSQpMTdmmQx>)=a5&kam;WL>RurC-TX_yaP*uRjA;^-0R>s>rT{1^p(f`R=k z&{^sue@#lC4%5T}W%LVL4ozI(QR1r$u(3Z{k8WNsAs4d^tZtzPh8ImA*ZTH{q8`F- z`38UOqxRpgi2V8IdbDYiKD(wr8vmQiBj;aUi%uP@Y5aS3#_#`m%lz^dVw%{AAx9r9 z{{ z4J*9IrQ5ur(#_H_FJ32leUAnfulEl3Hh81uw3CM(JhbW1$wS0R=~aiS4wW97gRtsQ z5l&9YVd=iPdA!-6@;rG;mdurTXfiu84`m*jgrn(w>OJor6lrfAd{e$YbFcxq(&6#` z{oq3fPbfT`SEOq3P26+e!6OIn^Wi=06XUWrDzrzg4XmNUgV_g#h8nJ}x%#}T+h0wk zlT42vc>KT(2M!^8{J_;XIb|!b`LX)Issn0mJziBqD-O^>8frKYOhX6vi(Gf_Ck<`e zzit19{i5z3@1*@{`^PCfoL8i3k!xt+eyxW3@9)>_PLG!~)Qi!#+!k0v|JtY8&%dZ}3(&AfSe(>>aWflBleG(@fI@UE7%GVlK~4f*y%XR{%55Dj^DK+WeEH4x&)`kOIPh#x_I6K+dkUgu#@NYz(Li9w4?p1ohx>#Hq@}Q zVdn#iFQD35gO|6m+MO-4AztR+f@nzFQy1@?zcYSkF_To-P)mF2wrgmRtRaurzlMDM zq3E5_;MZzKT%VIa)Itq)+SzgE8#_8F8hUZZi#wj)aSGv!J08aA@xHj@z8yz_&5yRX zvTK!m{cC9Vj-5MH8{!fOt!VLFG?a5ZP*1&W$D$n#-bz`vi+5bKpOY~Q|}C|kF$1~xyqj4HkLqdk?#kLBCRV_dp@>2|f|7%jJ#Zg07U=5F_G zWr6&mnXERS-yTRq_1^z%`(c|H?Kf{*y)ARwlx-v@$vbe{z-^tjg(4idO^1_He%LB% zqQy_Qw$-OrHKh8~A8Zvm!qeG$-PT5>Z0}Ytu0^UAxeYb-sRQ{#e6)Y_j=&lkj#7k% z)^A<6b=KDPObU{>aBJb#?5(K?3%4fYqh&ZgJ|dh$RKR!z?OYm zW^FmZq#zs0-IBW{ZOb@>xmyx&a*Cmelw8)f_tcjv`TEyT`z>KxB!%aX)llZ0!CIL* z>o~Ldjmth_TtYQm0jk=QoXfn-uH>s~=wr>y zb?)Zbn`bIKXVXyYRzDU8(a_kt~n|d%QsJ5p!o!<25rUww7-gF;MPB{u} zeze_&5|n&Z4QX3h+@{z~gB6~$X{dFr>_iX^{j^c_sUO|=$j0p(AKgf$lZMuAT)T1k z#u|icH@a|gN;yk!sv{GqZL^`lO1`Rwv_AED8{2IRRd~*(q5o{~9qj{+Wjvq$cLi%@ zsttX-;lmAgZ}@nF&`@huKiWQ){WsSbqg$wjGse8+B^bX zZ(qj`kuKr_w<3KLPLbXgq+aWP&+%&z8~WFk*#|$ml0T8R*1oiM^V&^oDMr0+*4nJK z{nmCzn6)+%Cs88SUdYnL^A^Z!%VV9^c3OJ@PC7cSJ&zq7an){ZShIW8-d(-=eGSda zeq8h88dZl_V_dUy&89V?JdSF*dUYVXKytnQD~B;r=_(I_RTKBGF;;NSQLwvMZwbKk+%&C9+Dq9JWhUA@w_a^lKr zCMngnHLYwM?rNKcM*7i^c3u|0GOk4$I+qo+Z(FFLh?QMee!L<=(a?J<-dpj{6)zxs zZ^d&sJzlzc6xjUu^T)E2D;`|&K$Egn8&j{&MML!C3r*|9pSSPsnCn+uyP{^r^-Ky% zcdl@*s9aHk(7D2dlT!+tNXc{l^EKq_5Ajk}y{K2`qM`OJ)KKDz2`f6UNK`b`npXCI zTSJ|KXy`tVx;~WUN%q8f3?6zuWJ4EuF7kZW@M#0##|Sy)pAAjzk>W2jv~}icQ1bOZ zbNylYcgw$7F3SFT`PaBsEl0iLHq^SA>**jGdTP143cF$XRm-cFZ(vf8hD^&%%QKfJ zBQz~f#K|ec6)ALPA%%|p>UL8b3T95ICrOz$(ET|7g9q@l%{l-9R0r*gNdp)+Vf;#jb>yqShbPXDc}l{42M8k(|HwV@G9hb;|T zI)X_mTG?N>JLdBxLKj*M3G489-&yk3l9t<0>ojyCh=v|tqH5^+CD$&oExDdaN*XF# zQnsXUNfyGgB~x&6$^@k*qDF+{K-Kmdt+$~*O1}Oz)OE?_f0~B!@k3?W+R!zxO}+PD zi&YIhvG}pY_b+~8u}D9*_}JoW7au@)Z1Fyv9xq*OV(HEEqo=J>TdyJYZmyw?i#I|x zad^CI7Oz^Y+R)0yDKC`HAL4WSH-czL+Yeb5mn*rI5tH9qxFCU09b z6s>6fEsWVbC+*C&@8aHz^$HJ9*J?(49ksaK;wT^9K<_%Zt^5!~L;t8#_Ydu<+f_Hc zZciPRPBNy|rPamN^+%Xi*B2+JgtK&27yRmCP({6n(s~2BG#K^dr@kcP@^y~h~sqoICo zI`o=W*19)};Vsk})go_Y*-otuoo$EJ(IEZM zAg8)c{kh{)$8Cb>tS)U>jN_buGL@PUPtLh0DlxNz~pg$Oq+ zwBzKI5|%DBBd{3MwrOaDlCOUa^)!~Uf@|oj zW*QQ;@%@T3WTCY1$gU8U7uB}4>(p)2kiVS`YQ0dE-pKJ!p`b+GU4|85s~sWznD z`*FSfTDw=_;k>E_)hmBCdG}8ecW0O4x?SdwJERRTnEfoL8i3(Vq>SZ7h2` zh=#tdRD0?ND(|aYTlqjGmCkIavaYhavJ7Eer3EK?CWNzCx~Pr7w)@mNCEs5v-aPp4 z3Oc^25Ow!>Kd$(&qNO(Ue#Jj3-meg{5e6E|_)}f>NZ?j>Gh`4pw7OztMP9{fmNT=V zinNMx6~hpwRm9_j4I%93Q?ihv?H=PrO1@-6LNfwA-VPP*H5zJH(N58x;88KO;^PIO zN`7b8(APmUqW0p&;<+Pq-%f;9{35pG_v1ShB1S-Q}Sz_!2Z$W!uF z`ysW?9&g5iNej{x9$v1R-t?*-ZvljCgn?{`kM`23z&6x-foem)SiiAeXZ_AfIa2lTEK)=fA$Wd%#umQL48K-J3B`dNoj$(L)0emiEX=C@<=tW&Ky3J)*8sa`0~ z`yt<+I&eS4^RWfd&=9Mtp^K~+SYIi>h)F@UeWv`G@`uasMfgnl-8hMISNToA=11H6 zp&d%TTthvV_f&R%kTmPd*OjkPc+RFFUyt!@qy3$y@E>P1sTF_T%Rwc*`<6#BqBWG$ zv5bXuB`8hv5^<4_h!fVA<7F}qYzJV6HjS>;dnz@x7u1S!VI@uP<8hIyqF6x_If(oG z`9mVj<9#=X4NZj%qNg5NKD<1nd?b^UO8BYlr?RihK0^3Y*#|f|XpA%7Puec`Lug9a6dF0Pf=*-c-gTsPuX!M1!<_Y>(tuk z*7|-(T|rw~CRSm!8fxA8kZ(V9HVt(NqM-$4s)lmQvdexd%~dq?W$BltFPA=z@XOLC zOCK-wcBa_BkJBc_XrFDm{!LZTcs9X6@jIiy^# zHmy3)LymPbbu&fcq$9#~DLW!emzXXzbyE069;#N0jDnVHq@Fs(m}2Z{Y=GYB@OanF zTQ#qAp5WnVnO8J#);!C+8S`>+&cJnpHv{K=2czd{-?{eR-@nP7l%u+WcJt}LW7!4B zPmE=s&i#1q-E%*kOQll|*U!Cv?xDH65MDob2To48lBN4f>S23fMQyVVWgS{Om%=Q} z>0A0+dJRgx{%z>b?1vJb3#=h+Pfc&7Yv-zOrJZw~b1UW+BXrK4j}u=lAS_U7qSey> z?Vh@zg&G<^ckJ9FyT&sOkUfl;J7TV3Za;)0=JvtKDP8|xsG<2S)R4c?{;ykOyhPFb zU*F2gf@tX5IqFz;|D1d0)Xuqoj_8MG&6zbPcTPIOS#wfxdc1Tsnx$)77+ntoRrEs? zZ@o|5Ny%5$kanH=``O>l{%p2yxuPG}A|K0IvXW2o^3{(QgJ?+G54}A5#o5=+ewj%@ zcQ?*%oV{=MR)meSH{;}#l})7NGXLN1ht9N6L)O`4vq#UiDjI6dyiAPA;u*KzhJ*z+ z$X_jtoIP^(h}ptAn*RFou-U_A`~N*gy5qisS{tIA{jH#>HuOOd4QbaH!)ISH`=g?8 zMMLivy<7Bp(Q^pjEqWFwRtXS30&IS0S79G6dbsHCIO%BlXn&oOuiDD4EmAdfsOajV z{R$74K%{Dsw=&=Lp}j@^G^F}NQO^e+?X?!hrMzDI+X;{A)x%p#953qGvJTRY1=D}7e& zEJ`8S2Fw~TOFyeC!U3}`$H^(@vvl9wvJQ3tmFLM*&Xc*?&kAEl`&sR0h2jwRp)Y3= zsrMY5Dbn`M+$&%2nJKIz>)_Ivi)SuUc*NZzUB$h)$31i2Ot%m3T%Q=1b&f)d4PryX zz3N!jZ)TsF&&+sw25E~lbaKYY88^=GB0M?cz>IyM)75&G&aGSx1I^3U%~;Ehbu-q@ zSc5~ogI}puGG9qkZAiO5ls+SMMv}rK?p8G;uFhp%b}*=h)LBRDjKMShGd-3`L6Wzo zr>3zieVJPS*0-`Rri;5(4Qao?^Ed0DC&_nup6v@ff2*)+E4wa;h8~^X;1$2Fb7=b2 z(<`PQVv>@E=1iY6ecJTN2s$H^%PN=-zK2x$dvjGW^8>pG*S(?P$k6BhK>bz+r# zqo-4?zrXVPEBh-ncrMd>PVb?K^U{Te+O`*V@C$)^>K_VK8+xel{=)jghYG1|(vZE- zUO1~T2cf+%3nx*g6i#62TJ6yFI8a548Cy8EFaakWEg#E%DiC?9HuOV*Xgm1UxZt^h zrxhN~D^j)SZ!A08yN<7dXy{mh+7B%$s4Ey(u!KoLwT&r=DY&BGLWD5|7vSWS-}6OH zv>2!#YPp79Q}R_cr1hy!=0BK!zryp!YN+Rnfo(`T+8@bp%y;A;VN#HWT07bc8zSjj z-w(}EYR@%9b}=hoSVwF35Bd5-XC3W>XlPWvYD4GepO^n#-ua4#KFs?t?@Zo{2tUkw z9;e4kSC0XkA8ogxElR#zL-a;*L!PRks=SK4QiaEoXTh~d)uR7-S@53P5=28<8_LR? zl6P5N7L$VP;o`iD^M0N7{WQXF5pv3h)0*qY^9OuQ{+5!jww0-6y)^BGX-z#w(oxIC zvfw^-We^SBKTYka4@}!PZS%APOj6R&s%fjH*``?#u9{YYlT&6WHBqJac-y{@alDeR zs-dxvjvpScVOq?zfeH^VTcm2yzYPV~(19Qtx=^E`&!>Jm^>0%@pGu{ZhHjX8!_=Kq zHz2%W>Qy*7Wf@D?YKN}dKDRGd@>MmY^%!SQoi%m3!gDqaweF4L^FcH;cB*Pay{GD@ zewEvsNkJO=DEFh>w{l-b_)+eQI637BVDsZqQ0X3Vh@M*ebm>~83sfn0$oY!7J#ie* z7596*x8~lQtG2S6a&KZKigaJR@8C7LEt{8dIl^8FJeCcI)M6!nbMD66dAXaJq$GJ! zZc%Q2?i7SYxs!2n$~d_uqK+KfZbKuKeEr*yKcCuHFFbZGvyRJyXvn!+9n0F~hUVUs z(@xRQ{+#_e_1K0_Se;|b@p$RV2yA||eJmTKknO&(`mFLvzH>=l)V@yr`T9}QytN)qiypttCFv( zA+-&9yyooU?D-0hG258!e+A9IPaV9czQK=%c-g+Yg(qdFWnYm!iAh1}owGYb{*yUT(a`sq-)DZB`3}PGGvC6A z`8L8AfXxr>%#~8bSl04+S)-CKZ)MB2FWY`FQ}i_W&4$cXne__K(#)lqe_SiO;+5w8 zkiS-D%$%EP$TTu3D1Bh&z|3Bm;Rpw2UV)QS&R3+=>ghaCd7k*aq|El2?Qqi3at-}F zMdYXULt206&m7BQTBxD-r@TAm_9^c(NvXECO}TB#4O0#wylu+WI5}mjQWH@l!c9{) zOc5GdKV|)tt8miMat)oWANn(YksvFGhDuQ{;SY_OGHS}dGR7zx`Y7Y0j58T8BK#=h zd7SVV5k3ZNew+eTXoyl<-^y~7d{rCLj`pb;$r(us50^l+K`r_p%Yx5b9|@wN3o}%I z=;_HPCeNNcb261qwN0FyIC5r!Wm`*qY9nwlsQxvyD4mY8fB7;}$u~Zo=IhfYO`Bv$7dpcKE|=anU7dCC zaxL@PFXQ`%X!j7`Kg4aQN4i!+f!Bw4KJh^`q@8uNOAk%|C9NHklxq89+K*{prhS0$ z$F%owa>^^f=11H8p=XqQ)mEnMsh>=HJgupQg#NU6F0+pLE!5DSv|VW%)Ale)Nkc2s zR;DdYb0S=cPw!TOPFH57CR#nsPcx?Zx1pBquu4<%RYB9z*zW>QS6TxjFS9OV?_L zuG{|Q%RZ%CtqrN=v~IKyv|Cs_MM8QT#E-Don)XBVTqwjUhugMV(`I9tsxstC|L#hp3n0i6#c?u7&nMl>*xwNuAuLZK9b|_J3%j5lb z%GW6k2&r_^;O8lHe9S_+5)>|-Z}=fn#q-goXk}MRQaRLno@C`x$`dJ6OW#AiLwn`R z!}F(m?`Nl$(_bs2bYA|+W;P^J>b?6?)L+i6N~uWcpHii0s9Q?6l#5f&L)a~)9Zrvz zu6|0^mMpHn234)?x%fl(D*5`iq3e>bN%kr{yxis*qIGN99n-r1S?Px$8d{dz;9V$} z8=D-R+%7qm#i+JlBz=+eV$zcczesu zfvQ&DOcbJev|XC2mww1s5S{Xnmq55vN8@e>TM5 zN|OXD-)Pzod5{y`U+>lWL-xc4i4zj-iIl?qpJJ6}uA`;?&o38En#o`dih-<^17;{J*6P9!NwgWD!W zPCVM9?f%d_C0|uTb0-Sx@OWGIyRfa(&gzrO-!DcII#;tuA!od7vKn+ z_{#*spAh2zp2F1^6SSHU*Pnu_wwSZ`LxNWz-c~C4`tOJQ*^tnm7I{D9tDz4j1X^R{ z@;@0+L%yT^=?TwFI5gojlawUiKVkob9TV0g+&^I*PEM&;Y9h2l7`TMl--*{mi9`Ehr|2FrA zyy@w^2FwxO2#LkpFBRSjuZKm3hlWb6L-e)x`M{#%(kbF~N5P<4VB z?Wv~I5^@uIBurzHk_}y!a9Kjf1PS3~3BQfG40O8sc8t)97QY0Q?h%LZsaw8I{g#ri zs-ZW>h_>VLzBJ~AG0!SIyd06LMSr7xU=2OPa=ba9hI~i+|L(UzPb#%nHFP!`(rQLr za}BlhcVYQcy%ib~_qPSfO8%APvnPJ$rP)=uCvOM`z&Vl<`fZ8fpllA?-fKu+br-Ulydf~bAF+?ospP9_Nb6J2A31O29EFF=pteHw>Rdd=r<-Yr@}n~9z5Pe3 zZxlZm@y3XoN1Pc!DU`lz#I6zbBU}h~jd0-P6bnmls-=1OT)1sE^!MQ+Pp%<)qj++- zsJX|xXZWt++Y}zoD^j({HRL<%INKY=k#7a=hun}s^wiUb7Yy$`d^(eYY8yE`a(I{F z9S}wiZ;z8xejX-jqQ$oNL+>m3sy3wk0`IM1XNI->eOc317QCm<3#g%g4jT?l2n{_p z?9{NG!yaRjl7{%VK|6*Kmf_@-*8eif_F*mgwL$+o8`P)JI-k0w{t(Z9c0di)dlw8- zTiLi_3By8$jZ-xA-O%rbzB%+Igx?K)0jI}HSC0dmA16Rx0gw$I60@U2@q?U(%#GuNAfXh=JAeQwCJL%c(tV^WcZ4h%UkWap3# z2oDUo3MZ#5(?~7k{J*}_^R6HoG7VA3vg9F&Lq-fqRx}hdBxXpTA(04UhJ@q9_hkq> z`PEPdP+QXvSq^dSs`q>zC-lwxq0izzi~A@}^e=cv6n7@>4TVSCEz(sy7k}uVK{TZG zsZYf{9Jf906qAA^-w?MUZdKe8gd5`OaB@mj6Dhf@Z6EE+lzjd7)UErS{ML>37rq_X zAIid05~F=wTx{IuhB!q-?-<@Oykd9;;X8)^!HNHe4&g~)^MgM_mEQVUhiXl#hCbda zY{TQd%W#L`c$2b4susBoHQoCWXx70c?iWNu+IOyp4EqdKhC@t>|8MO<8~Fcg$nU!j zbrp7S5DoP){IE^Dl|CK&NbJVg)v;uGWb>7=m9f)e(-2n1rr;#X*w{FhuC^zB6%*Um z|Bd2wjL4J!Zxm0(JQed~jA%a|@6|E;WA-XMoL8i3QT7;pzMcv^FXQ=44yd7RD3NmK zd`n}N#w@`}F{0JQ(BWnwT?q>3_6>(E=J)tgDdvo!qdA>ZMA;s%Rm1bS z{C@B|I637dVDsYzP}SO=%RAR2O1^4O-8fjS?f$`g2k%yRxCA0qi{~=huMVOit;e`> zuxD`IV1&>B)wZ?2YSA_gWh=E;HKbk1PaT{*I8os_n}%BVHfVc54NV-}A5TfxP?y1- z2fsb2i=v^|2E8`u`9V)2d~MLb(;OsdM|^qkoNlIQsW!VMF&s-xGZ}dN0CzqIcu;cODPJFR-t&Ep{{yTv^ zMy*fXJ~}M=rGf346m;iv1D_lCb=$dR1Nj**Sp^befu&gsJ5^7eZB8veNP~Kz3=@v zIpsEB^P}zGO3zmE_20_I_Z{1Jw8GOm4V`U`G40)!^+Qp8yZ8O9PZX1aH1uJg5Br?y z^CH3z`#g`6Qyv30KTh>|q)*#y$lou;XLo_|^?la%DeSYJ zX@F`={!n(GDSfmn`DuMxzmiYyrO*EL)M!QXstrl?qW$1E*j7BaqU9R$9qj|#5P#N- zgJ`JdDs{B)+~>kRXL@&5H1ulkS9_oC{W!u`dq0ZP|=%U`8dOzRmxn5K{+0cnzCwkq~ zs}bReUWagU%669CR7Y*^hjNvCRU6X!)MK&1VuZqTHVw7ThQ14;q04)zt?XX?-TE5+ zy?UXcGJTnTuD$?anLZDv$4gh~EWN3Q8lcm*^+W32s)o|^JYPy1uOF*#Nh_l}e1G+n zWDV{Q^?omKPpzGo_0jjzf7`PU(*ViTnt55E!5C| zcMqEXcdn`p{h1mX5JW>S^whMno_F_L)AL^TEXjuOLu5T`d)nv+$$D1e;7JMt>viK=VC+Wzuz*C@u}`lcHh_i zDJCh|(9Z5VyKm~g8sX0FD{*p4tx}UeRzrVmPu)5jiVC8k`FIlfa-Co6_F}hf-CpZP zH75jP;IZ9CcKb4NtfHZJBHxL8Ch}o~??j%&iJc9R_e9Mfhjo4}^aa zPNkEES~GKPdry4_E0@YvHKd)n-WGmqc*||5b^Xw@E!5DC@NMBocI{9!v?+X3_}cJg z2sec<#fe`#Ls+fUL~BX5@TzdNCpnk5K}kx!s)n@wkndP_HXCZ4hNKSz*^ux5c>8P0 zuPKS)zorNqT2)TRgm8|l%JJ*VjH1NM2 zQh6IuX%hcy|JIQPZ$h{<+yfjNF123^90z zinklQzotm-i;$iS{`tTZ;9bB};C;X};OoG2pcyy`c=0t2-pRl!#4~^n;1s$1Ou4)) z&`FML;Cf&Va4RquxEnYXxF0wTcoQ%WNb=@~OI^!>1&AL976KmuP6s{?oB@0mI1@g#L_P-xl5MBX#81ezOzu=n6 z@JkL!QSpsk4goLu^#igOsmo75JMtZi{16Wveq&_CIVnv>Hfuvj#|ZgZz4gNbAF|M11g( zb*%jO#;XV+H}yu6uKSSJk0PX?a1Kh`+cY_z$^(*AFANUUN0MaMk-{8F(@z)SP z2&D23v3wf5Uc^a`M#OJL{)d781RepN1YQGt9C$78H}G8tJc0Q2z^8#X08ayN1X8_j z0^W6RgZF0SOZB-0_#N<-LsIvbVHZaczwp`y?``2y_vaBm1|<65fKTB5<4AuG@!NrK z03SUlwNJRY!Fwm{iQ45|Kx(IV1F0R}11v=Py}+>9s!b`P60`ukFs|4WcXuD&yR;c1AF`V@Dqf1 z-cPc4m&SjDKgHtD5VCUq2T0{U&FrPY3x3%7v*9n|{!Wdj332~(EZ(K@`S2H5{6#`f znAG4!I_&+W@YliLz44Xsmw^@_#k(}V8vYvNf1S`n?GSX><%vUYAU(eEpW*MZ^fQFI zUU*J#0=q+=w`BR=mgReg-S;lzqjciG_{az0@3Zs|!aqWOy^efH2zl}U*Rb?Y!aru| zpTKvKq6QrKl#rzZ@!UVBIJ0A*Zr61U-Y3@J^r@sQpPJhGw^gMq@ zJoJGEuN1+byADY0B?L&%JvoN@PkM(Xb-f(++75I*uzdv4&x=^RQ|jMvTZ6Ylgw($~ z=;s61Ar5-?`#)&#UJxO5e;C*a_mLexc#zxqMTnFAcSd?Q)aznk6tD}B+QTJ4Y7dtJ z>yI{gF9ZIJ_~pPl#IFFZJ=!%QoXOGP1+wxYfK*;2F!w}*w;S+B+}9m=9q#J^%!hnY zz!|`vz}Y}O&1lil5i02N{ z^B+vu{WH*G!2b;papn+$9DOIoe<1Y><0H6VFah!HkY^&W7s^ir zCO_QZO#)KCkqkTvOaUGPUn=l+#M6M(52XX|L3|SMA>d@-Bft#c6Tm4z8ox7vuOXfV z3_&^BKpLNOfHYp`0?99!3M9W^8u0in82^DZuIB@wDMuS3JaQZum3wqW#7a31j4C|3it=Ik z0^5(k^Irq}0`*!8{04X>@Dt!V;7`D-fWHFQ19jlv0BjH32e8Q2X7J;MLl zidis?3)>=gq1;Z5+X+$b4i@jyxGQ331owYH$9S-t_%R;rjo1UU04d(3abLuKcHa|( z%>MzshfcaW;$VcNdma5B!{dioc`qGrz|5QcqehA|{|LzZqa!SSO~kb<9pgXfxEcU>v$7;!earz45k)Tan*o(oq&)b=_?d_cA-U zJ>nR%gTE0Sc5s{!^}e0OyENV*+rgcL=s)g?xEuNPy~%P2i2Uz~co6X-^n1up_uF;% zQQY%4^fUJZj{zS5-Ud7Yyb*|W=;NV?li(+P0FlqBh`%E~_{hT%ryxgs<0FKS18-_r z`lF;DjGK=!J;ygbPRQ(n=&!!t;C&K$qVek=KpH=u0+K)RKPdMW>FJ1P!1o)*KcMHR z^lXG%&*Q)z@?Ty7lK=9mT;6Ly8rNQz z%Y6e#^8AzO`R#}^OwVsde8u$q79r$+o5i~{z7z2-i+@fCeY_X(A@cte<-HGFb=?OP z$Mb9O3i?NkufhAVEYBxElK)f2_gTc}?7jvs5YO!kDu>DarObyo%K19tN5rX~-vEER z?punp=l30up5OOCdVW6u>G|>We?|P8@nigFd_P6}EXRT1|0Uu-avX^JevSA|jswxo zevb%?q;@7n0-*;TA=*z!WGIV=5iE&`H&)fq_7@nRt9tqZ&F62?dA#DDRT%Ofvi>6b@# zMSi`GTtUd}4v6%K$Z(b(5!nOj1CB%zvUDK)ukI9Q{uhw>T~UZ%3_bQl{8re%9!P#s zFW|+GVEhM?J@)}p`{)aN5#wk-+}9cR^=J8F{0IFB*z-W(8DKP!{INm6lfc11^2cI; z1|)kP4y1N8B9iQAWaN0%{ZUHtxp$jOM4UpWy-{$C=n_AQM6K=MPAfxlgs z5}A(r&X+L$18)YV0oMRQha8hwK2$F9^IRZhL{7ndt56OQ?K?9vi{*pyAMsnI?8qEB z9fhNO~+{^x2Vf5hs1l0g^ru$9+cP4^M40M$QMF^a?~iC6OjzNMlK4F>or-f^^cq zS>~hociz&-GRQ~sQXt~xkrnKIjQ>n83s`&#^g{HI#>&Vlst57`q8wYKU5*1GM|GqF z`H=hzfh0fTxX&3`i#W;elGEKlsz;5?hxG7y4=#$F;^lT)2m0do7e}r_{`7p80O|QI z1=91a2h#Ih2K?>1<&i5;4|={0KzhC&AU$8u@qAaZeCYWiKhI6l>c}8`S+WEYZ2cJewr6-0h0fG$rktr@UON- zO3V-54kW*K2ax>Uoxpj|V*U>#e{?tSIQ)k_z-Lc3c=rOof&ab_NPgFTAo*nnfaI55 z4J5zpAj%_u?-1hTe|UlCq1;9w`E!SX|adJOUNq{kzlVE4h#0iFD! zC((cZ{`)^7pF*7cB0}pFLj@8|c|bFTOG-tPBuUDx}*?{iPRBa9d4f01#{FM!nZt&NjE@|}qOsA&E|*WK-h zNd@1-@31q+X-D?q2jmAx{}EaH^e5zlT*nDGj_dpx4u`+M5a}mrC&qKC-mli)sd}eL ze}wYT_IEfp8t)sJ&f*MA<$PyPuN?_7Xt=P#)7``hi;KW_aO zq3qTrsQ&+J{kUAOyiezj7~d7!-(`}CH$6Vc^~Z?v|GwzCqrAwvs^F{S^W^vOR1_J1 z&i_88$NH*}KHO7Tv~)2(Qq5Nt#zC*Oca1O3Cwp?0WZJu0q`hlQ_B!!ydtPfV)~W8R zO};qiT9JG;O!hi8eYH%kEm~ZHo_$is7a+gispqQ;^Pps}2N}Ev#HiUu)zm#kYyfH|Kvi47P#~z&qgm z5Iya4{wKfoMO$R8vpc!Y7|&h4c6PmY`P!q`x)&7}-3>Rx4sZwT2;~<$LB&P)K*dG( zLd9d9;mi9u|HFgGU7+?`SE&8g4JzL04nydBK*ec2>5tZbFR1<6n{>rP_rn#=L%s)K z349Qi!ag?tod1y(C-tS=G0OFW^2hz5{BShx80Z_|lOG@G8|KzO$jvv{(uepScJmK~ zst1|4;}PY@-#_9TPP)bmQqM@=qp+Ma(l-Kjf}_!^|D)V|lFt=9=6js+*L*|dCwyb9 z{G@^>VLPs0ayjQI-&n3g;|i&NoNv4V^eOa{i3e68pb?;ZdO8c^puR+)#sRdh6dh-}~0TQpxmhtw_7;O!hh-xcyr%%5M3#S-CB~jaF`x zWXf$8DYwOBud~%Hx9z`j^FJhCuCv{@%kq6B+WOf6WzRmg{^9?vf1Lkq|9@)vq*wm< z$R6Kr)9>-^rM^()Gm&=j|EB-K_qpl6;7uFZyDvr4L)QB~-`9+X)<0za_Dj$F9uRH) zK(hx2q3qouD0_Dp%B~!NvMb+0*@N$(?BG$TeSZv2+xEThIQ1s7Zeh%?&JVsHeV*%d z-xiu3`w4EQo)d5f{26M${Q_mjPEua`{#U5=cnZpXoQ7Jbzd^0fGf?aIER;R{9Uj{L zhwm@dSA0&i^?Dx44*v;dhc7_cVdY!lT=e}7OW;4S6kc-e8Dw4l>x=PgU0xO$&nqT- zoid-tWK#W}{ECb#f04hOzp~{oFOt84$zG?Tzmmz7MO(+QQ1L4HSkG1bS5waKRP$Gb zc~G*~iSu7&<*pX<%h3+$76)Df&of@}Fcy36g^Cla!!+b;VHT_b^}MnsRGeAM+N-^VS zef352V+~-4ama;_ldmC^pObzVYy>A4Hum4*mtDHae}iA~R1?YU-y22xcazCp=Vm|q z9r+e9=AFW({@biv3x6{!cdKN|H5bX(!ep=0(k*wJmHWK#cK;pZ+h5p9wCjg4hYMT# z+gf@X(b8eekA?00cfxb9J^C|+cZsHlF)2Urr6}007#&Hqj(-C>k%KU;(@Swx@ zlSyAl`n|}LOY@oO=svy=d4-vySyuCNq#x9h?GBWs`cU|!A@^z`?l9@z+Lt!~*nEzqe2@XfEegBA?Px85fNBtw*{zBxD{?S$*{}1KYk-3h? z{Eu6Goc~Q;=g7ULZC;2DB zJSf@gE}X|z0M;4Vw0DO*3J^BcHgn<P;oc~Sc{O^C?@|TKc-^eHbK7TFwa-DVlEvElKG`q4M$`5aF`?t~U z-zF=!+44!R{PB@({;j6p=HE_zp~#0K{pI<;>38@)GW`zT8J3^^STsFk{qB@(`w!YY z?Sk^hyP^E#9;p5J8I)h%3+0zThkCyK1+2mRehD?-U%?g5e*ZpL0>6f(@PNDjq3!=~ zpw1Zw;bwRU%0C~bUs@MOtbh1_sCDxl)VetewXcss?d$KM=3n<4FCMq|bL>9UkA9Ec zm--3ne$)wg9{tbc*Zrgu^RypN@>aR#`&a)N#wX4>B{DvzP4+rx{J$|i+K;3&&u5jN zdH%!yJNfgVWUq71f8NSf4nW(Fs<&(51?g=+LfemjqmT9c<60GJT&qEidmQ!0c&-jyW$j!Yxb&7M<`?oq+o$o=tNr4I+Naf__UW}y_11v8 z4^k6q-_~;LuMIU%b=-F9LbYEnAU~N9@CD>2{efhz=VD<%~ zi?(k`w|(0HeXf%mxY6_tMccR6L+#5(P~*}Vs(&|Fxh9rRdgYIg+#I;c^fw2ZQeP-? zi%5UD|8M$R1Iz*W zLhZXd;bzzlYTw-jwcp!A?f1K(_In4Y{oWC3emhzFod2Qb^IoWR(-~?$?}J)TU7+@9 zSEzm3jd6(a^aymf@#qoIe$~2)p3{2=dIjW%dk6Zu_1y2)^MIv480h2H_mEp3GXA`u z^5f6@1^Sb&en9FO7|4U=oPmJ>uoE1NUi}^9=97G`U`Sx7JC2ZY4+kFMIyDZ%OppJ! zdWHucb<-i|?Gb^I?s!1@F*-2H%8w4{{=UWu#@FhP{||WL>%b>qT{zy}9~{H)eY9Sm z3QS;r+#J#Dj_U1NI8}PH zJ22)G`tuA_JTTqTpA9@``MCd2y5fQ7nU}J%7XmLL%l?S6KQo~0&r4ADhx*tDuLWiz zXGLDIe&jl@iu7NL{n|9|$UfO@sB9H@O(2xWgFQ1uo;*`Eba_NUmbe<9TTFLK*i4AuS;vp>rN@7O+B z8hDR!y;!(R~-D^tT6dK(b`=J)sI!yPu~BdzF4Ouu$J<1&T5hJYfSb!?*~dv zUMrgYLC?Id3v434-&r5{0Omo-US~sKqvhWun*AZ&?9XQOxz3ir$EM#Zn*G@ZWnVso z8kg-*{rkwu?XY~(D}Q`sXW$dl?+omszEI>-k^XZ2H~pT#Zqx7K_iC~~pNXc2?3>Re zoBe@if4+n(oUa34!4kL+mcsq6{efn84#3T+>&OxaCb_mMu9EP$xN1*J^w@~Z% zJE-|R3T4NRSwHaqQ1f~mYW@5GHLpKHt*f7)?9d4)JM=T-5#u=-_{GNMq}d^@uc#e5 z9XMtC_;lc$ThDK9J!dTaY~T;KzTe&YklFv|l^;8FKJX{$>IcN0{2jOe%Q=4s{(_z0 zMfB?LKW;wB=L#+b{&mL_Qton~jO*06TroZV-|F!s#3V%1A$F)-LV0A33#1{i$U<%LQswQwBqv-$M_lrZ;bHS_Jd{?{qu7P?U7!UQn zpBKhZzBbYD3)cbHjsONTxQ16+Apx%E=g6&~4ya%R0z4w-y;EBzIY4pR5_q_M={4WDp z?{PmeNAX{nU#4o`W+l{5(7w$US?4(>d!70T*Cj;lFzM{q2FlNVZJ3Y?^Pps}bA3W1 zE7wLeJFI%U7TzGe*BBa}Vu1Hp&vk|-j5PhjqS@17Q1w|~Rk{yl2tMp!=Sl|Mc* zI$@OQM<+Z^eWA!>BK^hxoBqj!Crtk&zmS$a9V40^vj4|QHhT(VniR8Nq0V6wpzPg5 zsP_XVLA@7{PdVAM$x!q8H0f(Nk4=Gdj!!C>YV~sdM^?P|4BQN-L)qPDq3p|ZPY^cAGfM3!BB1!^7f{;~Do9uPoNmxSrinB;({VY{}*3a^UWiSs)#{Va*uyP-Y zw!cY_d5(5ff7inIl+X6L(iLZ|HhE3L`=;mpf6}$jOIbfeG0U&Uk&H{EXLE318ZH zePy!O*_ZIOmHSn+@lw5A3lB(d;{+rY96+~;d98^Eb2en=%6_B6#s~D_G`8cPNNcmWk zdH*k1#pJ4@*-iA!W3^yB`TfpS!8n))C3~H#gV$L8c+u=8>1H>*=yRRw!MdiuRy4a= z1IjMebo*D!?O$yxSI6>6ul(^5U$CC(eZc_rg(7~D{^I{l9}Fg#J{U|!pB_mRO%Jgj zNs`TOLbE?9mX7~NmYqq1vUllF_AUd;zGOn#yD*f!%YvH!Y^eFqfwG&|!OgHf^~&Bh zfLaf^Q1-7O)cjo!HLs1J)=9$wo|yK>^Jnq=)Z(HhL65&J_1=j7f8(v2kri*ZwqnVbJssJN>+RJ_%~E#DF<&LY05-$yjF2mt6R15}*V5w@V6PEhgIJy7x1y-@L1=U_D6x{rRz{`PC` zsh+xv^MBCeUB13suzS!`{T=)l^p4uqBiIwUDfL0`ySsV?TTk#*5A3GD6FlCl_&vn^ zq_-qqdjMXG{2=uzZfo|m>{K7VY@~JGH#mTG5$E(1Sr`3H_BsQCd8`ZBDbiWr1C^ik zJvcZB=0V9`XGn0Um76Gb_$xE8gBBV!4anC{Xf!Wr$(}_%gROtM?aIJAmNpCci0KyK|uW@rL!2 z^FQ^)I&*^sl#g@X5-I<-$zEq(aK6a}qS-6-%%>A9Ccoc_1PfsvlI+3yiS(EA zzv)*8OH99-FLKFVtr1NRu~(&%&0awp_jOQl-Um>2W<8X>+5ly*HbU8}O;Gk~GnBpB z0`s=;`#-4Xzn?;_qg_z*yBlhK z?SZm$pF!Eby^KqY=ZoOyHa=ej_s@^6GsyXKU+}A-&Y$~&hunI;cI(-1=?8)b-TJ<9 z>qDm8Vddxid^mW7boB#L&(Ywwu$*%=_#Ny7zelhB9&__aK38x&_=7vHka9l;PjHEJ0Ve>$jhv(lm2&okIL#hquN?C9^*I|%k` z9*qaiQIFR3d8qyMC)EDB0L}lq{rwwieE)$O--}S!bIJBoS@2(*ugk#-iRS-B)=!zq z`2WNhlPieUPC01)pWkJe|4%gkpIDXh_Ecroh#t(^_?z2w9HC)PFnwW95(8qoYd)Hu|F>R)XuSI6?1|2Mrav7YID zi2>@v|BJR?AmxLJ38oJwCZosyi>8P2|B|ErpM2U!DR708o|pYoi8Hut}_ECN#yNM2jAJ{Ky-xeYyBJ6LOVU{n zcPl^Zp<`kPmJPeR#)F;MRhKLypVu~7bZ z9MrxU4`n|lK-D|ZZEuoWe?HWDn+(;jr|mkXB)*a;zdSv0s;&2FlJU#Wh>XW{lfBNf ziIWN>KPS@O3yIIuP8^Jue>w3*D?h_6|B_q&Ww-oHxBM$2>+03SIkXe!ye3lbER*s7 ziLaYHM>Knbp7r%c;ym*Eow%5itw&kBEn!O>N{uLz7xBe9*7Tfg|B|6r> zLdjfTM5Ns!lfBLYw|~WA)c=zY|DX7-dp|_t-D+q8}eXt*iA=>um#E z;cQOa2ut85SPHkeb`09O*b23tx4~bX4->a1M&Eyfwmv?hy%C-ri65i4^FP-W6{y%d2!m3KQ^$D@xaiOcoulEulcKYhjHPjKB)D8 zOt}Q*Cmu`)1xeSsfYg%|N`&Q{q)-TUf+^@_2b0}=lFt>ShSInmy;la2)A^SmDv$q% z?U)zI<(zORi+*bzL-g6999M?)qkiZ*ORpblK)UQOByP+NHAL2af#hoxy590N3bo_< zl@9%<;0+;gbnQ`!ga7S)b|4JgZ*I_IEnLn*HH932HlXK z`2znB*V5k}usZ$f35Rn3pcmBho!;}3^}T@sP~Qg_2=%>!LGXPzIOMVKD-A)8a35nRU#)d zp}u!84(hu~z3HeapS(wZ|&UKy+O}BkKMdUk1-2aEu;54`b zJ_E-=^n5Sr+0b)b|0&8tzL)fT=mqrpUXr+>=*7_MGZaV649y5BZhlEJe)eS%doj~w zuk(ubJM!x@Aopcn z&fB4RR&Il6_D%J6Ei91U;!J3Ev(V&7sL1r(|0i8`bb;Bg;?P25*)LIX<{~INycnLv z4p0yA!8@Tf$R`&s4=ts>8lGjL667hx%hev^uqyPfjl&A1GY%_7u4|RaUgte`97;s< zTdS?!wN`IdqYd|ubA&X!cL$+$nR=4!PTt) z&64T&7Oq!zbSsp7+y-S|KSZChkl+8oE5#p$c5polJe>cL7f}9V+Qt8eKC$+9hCU^I zAL)?vU7@|mm6q%lYj-Z*BPR4H{!FxfNq_YFy!pDnw3P35T%F{x`{7@buDIzdsQ7jt zl>Td|cK1X1^8-+E);Cb`?LnyT1RQd&=P;B#KLT}K-$Gs2cQy~lLq}~Mj)l(HJbW+G zuj3|rogYF!ntVoNe18i4LjC$KzzH~|_-D!XU4Z}6Pg*|C|LE1PQ&87&+VcITdMU^K zfBF&YoDKa+yK&C%BJKWRGVlL|&YS$FXz>Gj*7t?bCGz{7ze9h)JSf@g{1dup`7eq2 zns3rAPW=~su5&q5AxZUL5o1EkcNzUq9O^+_>B^8Iib=>e#?GXZXfLAV1Z zLiy_u{nYwTvi{=#q1H(X)VfK9iYwBf;)-;rb(KN+6;4)CCM;49)=ebR2zjN`8Nlh8= z9>q6_jQ7nV@9E?JVMFpE=U4YMOS%kj5G@H9_qfvoJ2Tz z|FaHaJa;6uvh{FBlJ3iCUq|oDwM}Z1r1++7QU~&DobH4gzjl^>SJK_c8n5533frR@x9N@C;41K*Q9RrUvU_uT=%4&x(@R7 zFg^a?>gko#+f9eWSNA79fUNO@^y8tV2d(@=Ns6zOuJ~#`>`Oh0t2WMy#!3B=uOj}* zOY-=45w{G0+u=Z{cxn(-JT(~VIm-~J=PE;?e*gY3RK3IC1@b)t^?Uf?P~W3^6zY3a zBcQ%VH4^H3RHLBo$Bc%GvmS$rqaKHfqn?0@qn?CI;25|XK1F{Ozm0XTWJhkbfrJjs6wbg?e6vdJgm& z)N`j41@*nEx1qjQH4o~0Rr8^~S5*KN z*Evw%t15*0UR4C@djUmI?*S};m0&ScT)7bH`v8lez8A0<>OG<*Fhu!xpuQ)t6mEvg zpyI~mP~Vk$7wY=}E1=@Ql~CUqSOpuC{vK2uS^^b+u7>(<)f!k6zAu@4rBL5Hs5(aR z(mMW&lKjdCNt>_>an5=XyRgAzud^v>Bl}1366yGp&B~8I*_yNk=0V9`XIs*TR_=gk z@sjH8TKJLl7B4}Imp(T6lcb%d=l(zGikCjcZj_bnO4^OAcu7>evA(Izl>E`xZu)*VJzD++*5Nm_FMD#3e7%q1|B+>v4nx_c z|DLmdi(Y>2J1D<*6e?~w1{F7a4;615cgz3amj4mT9{mK>&WR+&ala=0Y{hYwtIx_RrY$a{r(DVx8ZUE>J$s`9q}qIg`E4`J_Khz93p0 zfS!5#E9qbI`<;K1{)Tx_ve&tobjkAnD_R^tdO*Jqxr{#7xsp^dS@oBR76*8s{Co`5 zc$9(U>>&=QEK(omf74e>u4?*f$=9GykHm?lhuH6{ zC7b<*=Eve;5$nJUm%-|A9)9UsxER);T<7AN$#to(M{zBY`f7{j=jy$nk| zO@AAcuJwEa)Ov0L*t`8(@-}X&@(B}D}et#zFOayp@|^`J`9= z_(*>8B-7_7KTUn1$YhcJ;{Q!QHF=8Zr}EzowV$Vnribk3>B-O1FU4b!emy6>tq)QA z`USYcc`5ltSORCjQuwmF&!FwAnNa)c6{vmnD%8Gu4QgM_g2&j`v!V9M>u@ytXAYFz zcmpcFe-mzobLpSf!CTf(_6gK_m$u8?x8li#Ob8lN?$$NyVBrO9jEbXaH8`gO^QXSF{S&nhlmPkzO(8+ab5 zcy*)uTyPUqe7PA8WgNGVPjT;7sQ9r-PfzuMr04U!>cu;G|BrONFXPNsoUw!d`>A#Q zaq=$KMV#}A$hz2Rve(&_{3-ocoIyJ4d$;nlzCTOe1M{F{ud_G#b1V0gXmN(>?OOPy z^cH78i!=6_{B`nv({m0XU2(<%)?HcIH^~Q)6=#TwGY&z;8Hb_b4ArAJ<6B#&-zR^E zoE150{m6BWiS%Fp%are1aNWnDKk|dC|IyV)>uHPr1o}SkXZoZ0{RL`$oP=5*Bj!i# z)hY66|DA@~kH10Lt20pToQ1vM?@;#Z54Zd|sC983s{TKr>c3$2>tga>wtxOkE@K=o z7XBmB|BEJjolD98np`GYyO*K*amB8m^FQ^)I-Zn@DVo0+k@DqC_B!QLDwteRG&_Z! zd90LDjr@M6a!M@BgOa^Ym6WQMznW-vigdG6ap-fMt5Ry1{%XqG7522l1c7s}o>gtB+n(~j&)BdGar4E4O~2B>w=1Zthl>FM#`K)-HE z@%S6Un@RuQ^J`ON?f+)zb$-1S>VAK7sQdjb;CR>)%0Ao%b-ulwaA<>KuG8)H%2_ z)H(P*C_B{!z74y=r(rj!?=^RaIv@9dIv@9hIv*eBcOoNMKfO~t_T1opsJQ3>_z-*$ zu7eLjJ$LAn;%Ri4b5viLkKB)R#ZUdA;-@^Q_-O!C{4@~i96AWU{b*)cN!Yc#!lb zq3-LCfqHK66x4Hsu~5$k#=$S(c&PK~1gP`rM5yNglc1inpJ=b^|{u!B) zGL?BgjUL+bfoV|BGoFEZo-rNjdB(F)&oQ2ZI;TDlYr+?(_f+J?lo{0XBlU=O{ztFp zCND#shiAe*T;D6OFXQzpJcj-?sPpYCsB`pesB`)2P|q#qKt1Pp1L}Fnn^5QOxlrfw zx1i4HZ$q80=RrLWnGbcoE`T~;J5cBPLa1|o1ls%mQ0MdoQ0MJpsOKyTp`NoWf_nb4 z7&b<~1Wu&i??By8Sqk<2=w(p%8J0uc2k2q%$FJZ&jLQzMOj(WHigQ+p*sb?W_ByLm zO0ZkyJ)Hl^SKC>m{Mg^pl=opCl6#Rq1yWe>i)q=sQkY|`L$C}{{A%e zo}vBUkoDZ+jN8sxsDAzq)xSS%{4S)Nv++BhQZZHI_ovA9T`<|}{FU;zU2nNm$b9^h z@-Ox3xx_^{rTCI$doJ-``en<9|3|NWl|fyHCsp}kQp=^P9OwU3Pi=p3`Bd7od=;Sb zA+t^^rBRLYOl|Me>PxYDJpPE2@p-4cq z^#Rc*rUp%)n3{q%K*5a~ro7sV&iK-HQjQ=QjGI^>{lx z2V22o@D8Z;**aDGyG`ny^il^E`#Zz}f#Zw*NeDZa) za-CA|L+*fl59|u>h4qU&E1hw{|1%G9o-V0fN!R*>d~dj0YIj$L^ruH^FXaAeKY^%VYR|t7l5;)M&l}NPW{%pFyv62x(_}>a(s4 zDgRvR^T-D&50PI;eG&N>GDMz{`V#Wb$PoGE)S1XXddt_7^)w)l=x| zNvEEo)WxP>U{rm@$jY}6s=h^Te)6$ym!w`hR^{FiS-(q-+SkbT`{?DV#Nk}WyOjIi zIDI9u;`CM0FX#S0RGeM{6{oL;iqqFX#p&-u#p$J#Q=GmQS#kP0c$xGMpq@jmhkKDX z!0oiV5i0)P1Qma8hKj$pK*ir%q2ljtQ1SPNFn$yMAO89!zyE`Je|QH}9R9I;9iJe# zS>2fA~A??S{Lz^Zp;y@5DcYyXene_!#*=hl=OFfQt9OgnEAV71aNS z*$4IiV!np@|1A5V-fubp54^|yf2ecFLAV+of;tz>p5>|1A0A2dRC)aa{6F(F1o^wv z=>K1tIoDHp0M~ac)l+#k`d8+9?ERhNsnK)84^ZcZAEC|-KXJW^Ur(e)&kH}3u5-dK zQ0Ih`Q0IhSq0R}XVC9wge;BhA{||NF^$gUx;Vew2Kfgo0$MgrRK>9hT^TT|AP_6`)?RP{s(T^ivNdInV(B=9pn2i)OWHkLp`^<0`+^VGN|Wuo-|LT zu}dZu#K0rSN#RnsQby)px(oZ zgF5$I1$FMZ8tUA04b-_O9_rlVg*x|ChdTFM3-y0oYCxTPYC@fRYC*;IwP76X)q#r3 z>q5op^`OoPKB)7UAL`r_fI9aiK%F0gQ0Ih1sQ>E{f;uN8L7g{}q0Rv*Q0IhHsB=OZ z)Hxv?>U@v^b>7K@HDMSwCOr%4IcPT2xg!VaoO2x{cZm40)+T$MwrOqBqURFQiSzDM ze&W2l(%Qj1D4E{@q}^@ho)GO^LOS2^?`ZY!TZJD(R=f95PuIeGm2T&i|I)?xu(Mq( zy=z)G%g6bjbe&ter|I0%BdsU0&Ml(OExq7c^u6I($J!yjd?0NI^2x=0(jKI~8lH#J z1|m->?vpkwO>snCTHiFqN&S>g+}&T~y7NrtcYtZpbIU-{`aOv9?=Qyx!ylmP*Ewb= z{VL~qIBhuc%GI3zq2AAb1S!jgShuG8_!(l zaS?rV+y*mlPck0zM`NJ;-&0U=z*w$tqGw{-ILf#Bg!4b_P5udR@IlV~Q1O&_knzcf z!_ZHLI~P2iHjR2d!yiqdU;7qJm2B<8n7-tD1|C8`9sU8Ig%{v+@FIL3o`f%O9WkDl z(q6Rdc`0oMtcW}l{kX+1i?yF)JS6MA^H<VK8~M?9~k%|cc`A@#hTHrwiXJ&p5N z%v0q1?_Bl<`E*Ws6Y5+x7izrUg6i+vP~$!i>ijbw>ReU;wf-Dfg1%5Pj6lt2kvpCX zkafMqP}jQ<>UtMJUGHM3>s>;A#aZtl>;Kj)g_{3mq-&m*L(S8>b{#9yKCpFHlD5*; z-73kfyZ1!KyF_HYzMr-lPAOiKw$|3|`y%_RRO^s@YenRBuKa;Wxs7S-t=xvR53Srr zk#)W`ZIiXPSu*Wy5vgaZ$vppe>-o^?*|}hQ+Q;-;>)|6?4?852AOCOj@@d*9c0He_ z?SvIQpQi1m-EoU|i8jBG`P-Ye$MWq>`^@s~P5Y93GZuf5_Bnh5BG-P6aZ`GHWMA4> zFb*EFet(npwe@?yWcqzTq#xgy>~#*h{XQgOzYeDzBVU|zL?qw0CVQRl(vF&ZOtkYV zdhFQuX(!0w|4OVHhzCuKIxS|K5{Yb zAJbn<`(n^lU^=8dJcfhQ^oZ1upF!aD?;)y zpOw;M$*=tinYSwGmEjvu^=RIdPvPnc^h0(v4QhXt3lE^-`|wpMD@ZO zVJW;hJ$k-}F{z7gNpDJhIkXS4=grbvAZ!2L%KYzJ&|I?3KV-gJrr%D!>lfW7*1m;u zl67uw1vPGWK%L`TL!IN>Sh+jX+uAz0Grb+@vd5yG|KU{R_E2{HZu%ebbV%=rEPD<) zCwEG}kN)&1zDJ}#_lkB-?hJKKmK<2rHN6XbVsY2>Zj{seiQ>Lh-P3!JuKx=p_NBd^ zQ1>08=j!{@d#CICcz=37@@pME05#4JTKYrjeUUXEeW2z8nR91<<>!3ZKRu6h%{!!? zLFofvIcHG%K-dWmL9g{N*v%*TT*1)vhq>NL_;E=7Vd+oOFRjx@pw``R@~PcNq53rf zs{N5r{ToHToeM^%KY^@yd(7tTamhAs(Dn!Q(yuY;PmxdeYasI2^l@%`kn0$qJ`ugz znc&usOuk9!`N&#-koG30Pb0mP^RyWC|JLqQ$<{6;-!thikZ(i5v+2{Vo@XUn{^u`kcaUXgAmdk<9wEIQ^@>?e zQThV(eUEYfAGw^fB)u56f(zkS1xwNw!3}UR>_j@x-EF<-`TM<;TbjL!FmCfjW2XggSS93U$uf1$8dj4Ruc019fis4C?%~7wSCsIn?><3#jwbmr&>4 zub|Ff`=HKWUqhY0_CuY|4nUp5zJWUb9fUd$9)f$ne?Q>y(M~ zpYQw9-pLZq|8PMm=YObpwLDb3TmdSMt_b=5ZwC2^S7Jrm-zqQrUWMzB-KvTlWF1w@ zkYBkfBMz2>SCig?bWwix8aRn@j;EaLk{8O(RwunK`TqNza}DG;=AkC618YI`t2R`> z>bT|WBFCez2dhIL)OGoxt}6g_T?tV22i^WALfP+-+kTSuH#s9WLveC?MoNbKYN}-7 zxipdMPB+=>WMmM>A!mxTpOq1&{x}#dUq2(;%ICP{uXD@Scgr_$%jb%$uZ9^-XeZ9O zUZmbeCVQR688?{RM6`GnJ?reojArEbJ2z+C1oNO|uX9UAQ_J5>w0M$^>)-P=v}I<4IP-62}M+M0a1PMeGlmana7@#>w>&$zd!ADqT=p!|O{?irUcHbeetT*hS5bv@(V zd=o5vVn#l);*UvC^&;cPo>qSR+tV3SNY{RZ)bmWnR9Mb=CSw}x1fNB(eoc4tNj_Kb zT*mY6yg=j^GGA%JWQvb}1S6mt5cVEqT4O#O7>DTOxS(a~h zhTd;eI;>O;&dG@Sr8l7b(wk6zX)csscnkUt;Q#55?EO4s`IY%l_fHF;{!g|8VDc*OW&69q2=TLKkL4%Y=;d!j`I{Y3 z{^nySf1`TjZ+6-~*^}`pa#m!Q^&{8WEz=k7k@;oGum~ z6Y1agCVQRZ89$hOLbP^%glhLEyFTv!Q(vs}bH-`P$2q@@|Ak z>9>q?91sXGCkPaGLimb)ib3pml*@&U?ueFk@BMHA^W(ZWV5%>>{Be1 zy{!yohpIr$UsWjkR1M0m#X;G%tKbSJKJ#i=0RP7{v|@$zw=M=JJn+r z@A}J*a{ed%f8+C1WX0!cnbG&!(xIL|WkAK}nNab07%G0xf{M4Zq2l-)$}0}P4q4CF z>O(zuYXJ3o`CO>ySPfw%+PNMoo^J%zpT=%~Za`N2-vsLU*o{!n@os{8-gPt7dvLcv zy$9D69)ZoEo}=9g^&G7^)N`~JP|wX;!qxCLsOOKjLp?Wa1@)Zq4%S7k(>n9?G_8v^ zqW@Q}r!9ItPdqg(`o3K|e%G&a!d+1IxIL6Tz8mTs(Shrb9qx#%xV#gTJ-!E4;JL-U zP|uAz!^2BC|HGQ-yFfkX>I%1P<@^tmkh??uuD=J=^R1pxzhmeH|76^HLp|rZAL{pL z55T`Zo0&I+aB3y+$3C6;F7zZcAPvO&0&)=rNMaWa( zQrLZlXKG~+_xm$F6@N!RJ@fzMwv6XXR?0coEakP=OvT9 z&dki0u`BXpq+=gnQGV>>YniXYJSf@g%*vc?k2&xxc7uAbyOGRg$R`&UXBJUk4bOtirN~o?i`5?I zf+d*?&2BAHI{ss^$aO6-nePB+Vp)-wiqZT3l$U>8ZuP&LxdK_|7)X01nJbaABC9e> zs4v%fPo#W)0YtxA?PBlO*m&eR?~CZIzh-aOqW|P5=YOtScJBiyd$%6S-fcjy_t`eW zMdaH=z5L(5%*|H+mP|cQ`HA%Zo~LXhpZwj2P=0kg)bosw-10l1`u{PMAN~Z&5ATFJ zXMGCwKHM(1{oPP@eGgRsK7;DtUK`J^GC#NR{37$Hjpvsl*Y}mleE&D|Ym<+PjK}`W zgVeA0-44Jh#otJ__uc+WKVGXHQ{L|=jo!>J5H2oRT z{PW{U&_2_`b(K*=+h(r zil&G7@hg(ek3(BGo^aHU$G~N*|8h|Nx;)f5qyp4Aq+&Sw-c%*zSoTkBSoPumq2{v+ z>3YAaD%5*b)u8-#9NY}Af;-^VP=5OwD8C&KcSA4S3#-F-kK+HSSL>w)lz*-X<*#c& zt>@b0(|WH%zv4ake`I|xpdJh?!vDj?*e5@XJBa^>`u$J><+bjD$cj%Aq2iYi?23I) zf+xtA4E25Vl(3!u!x_jc=wBKvf$6XmlFs{Mnc*<<73zceRXkbYY*!Yw?{c8t8@mqb zy|MaG?=dxi+K;(V_t_iLzs|+ihns|TU%ZjX{52NszW5DL_r;NUf9%HaO~|^RE(R9e z622KevG|s7Q|i%ua>zcvHQWrAgPad-pGVJ$EyFFsI)Akcw{geiHmLEv-O^iyTO(`S z?|_;IWX@x4m7jBB+wh&FYyKhiv=6s~<(&56yI?2S0lnt&Za1Iga|Ip4o#?;rk3-7c z6TXjrYhBz6H7=bkAO7F!>k{tj>LKO3g}am9j`0_>oF3tx=rxXz{`C&`g8cuVu+EE0 z*LhL#$OGYMeDWY%gZvO&2m8Q-urE}+(ht@r&gc)fZN~pY`TGH|8-8^lTtNIX2r7;k z3`fEt;pp!NhK4=%KK;X_KSTO3_&j_B&V<9^>+n%H7mk2S;7Ird9L04iP8yB83O)w6 z!N=ha_ypAZ`%l8};25|MJ{6XKnh+jq>vmjtGVADK;dqgCG{I!AGci2Lr&4Zz;S|yA2ds2U(X{Y%(wi4OBU(D-J5JArpI1AP=R`|~mC7P7gkL1R z0`)?^BQzuYGIFl-l4$v0rR$4c3D1P9;cMud6ul~%9#*PXG%Gxt^Z@n1O2MMn!*h_6 zkYS~iqBp{CB4;AQO7TT=!*3(kD0)k@dSIniMf1Y*N$)^D$nP2o!Vc-W&kgx~LSZ<< zyq!XZmF_Dl3NIpm>%s-$Vz(a1cg_|n-Rgyvx)&`DzeD;1MN33Whn4b*mWG#;KCEb& zXz8%hV@2ud>cW*;j4A|1cBRr&F2ABMNV zJSf@gY!82A<-QRu{!+bN3qO|L;xB0N*G`i^4ev5N{-1QkU%RnCWo3K9pCK#$5*2^# zg^IsEhl;8Opx>V*BoN z_@wQ-U&DVeZan`N>Gx@qx&I$NWAY!OwR0A#-QVrH@&D8p>zoV!P5C(Iyh!;!P4+q$ z!hf0kw`lPQdgkq)@D=j=olD`1Fb_)hI{$_*TmCDe#UrF!JW_@}*YRY5;2N z(?jfdykzqO(C#Nxhbx?#S=Yi6SOb>AT3ONi1kmD&+Hf=Lr4HNy>q7aDdQfqN4=S$k zL&X&VIO{0>A1clX(!SP5qV)s+54BE`pw>w;l;2B%@_VUJ^IUJ9{7XhwdY1f4M%Hzt zt6U~jxv-^YW#u5Nd^S{hWXjc7e*9+rtOlg3eMmjmXXV0j&h=RhVJFxaz1nN!=97G` z;D)Rw?s!4U-I#SV*Q4vc$@HB6O}-_osnv)7hjWfL%fkQJy1$k3TKDpc8jtZjr<@L3 zQvQGMcifJw`yH*aqWU|azWdi2>V8KXsQVplq3(m+3Ab>*ZU-G(?EXMUC_mc?>YREH`Q+~o4DOKlor)Z(BF_XZ2_OT`YV+Wc@v8ve$VitB=Y3MQf)oRJ;9bz2pC>FV@M+ z8bbLvXMjlgfhK#ML0N-M9wOR)M9+R4n)N98{m!tghhZL+%r2yH(-3l;A_2RFm#q4wnq zQ0wzWsC_vDYG1wtwJ%?$UCrZ6YoGW3pyu;csQG*iY9Gyl+DEgY=9l|*{`{l(f8_sN zw{IeA-OgnlYMs6XwNBrL&#*q{L6w{DmMef-pFIY9s?;U^FU;~(Ie&=Xb-f&YU$@9z zuM42!$6|NgE`++zvk2-w&tj549S`5Pz<`z-k0ACOOZc^o8T948_ak!`dt1i#?hXO*#GJHI_o@g ztg}Ds5bHP2IUurrzcJbC9LhS#`c*tbI{Waj^0N=W%{l_}pk&_v%Q|Z1&Wje$sNSxH z-%D@t477OW2a|uy`pNX%|0iAX%n9~iS=rB7zaT4~5f#szgoHf$cZu&VlJzBmF=eR#~h)iv*oj^X3Jhy5b0k{yel ziq=kLsCKJl%Z_pWr@mOHT6R3;iM6_y4o6F*#l|dx@TT@@Cf}zu&nwyE@E+ zlD$ri?3$LpmT2~pbhDSW(dRmKvV*3tE1JEm2W1a^ZvXsl{{mJn!SYG3{PB@ccB1J+ z*~!!wiX@5j7yobi)a(?~r)FoOPmiRDria+e49R9MVNCos{68#W-m~B`m<@FwAqVQd z!gZ9>Jl2P@YYm|0GZ+0A_}7M3FZchEWltNy&9E_)J-q?So;HE9r#Hgg@FpmGdNb60 zja#7Z<1~f3kJAk5KF+PwFZcDErF)U1R=l&(?i{71Y;?e7fIp2h{zJ z=zW8>*=@2Ff3(f+KsjB{olw`&&eHG7z8hKB*WRrcnfRxp@)Q4b%S z_y4l*g?#@ny9;{t^FBA9WWN8G-OU|uh}=E9rfAn@w#d}E~ zo$aaE4XQt~JCD3a-+quMW+?JF#FKGZsz47HA)hH2QfDezP3n+jF`G^qNYfxnV(I_yXKv(VXq|A(u%@Af>@_vl}M zS=93)+{=Bo8QGo+6+ACx>w0v5?q$-oj%UKA?2ihqqV>Lttp2_R)!$iA{hSTepV#5t z=;uIPANBcfhi|ej{x=?Y3t92N+u70ItIdOYE;k>J!7moT@z8;a7YgB8V<^8GZa`iGt0KP-uZE?tI$R5D!ga77`~W7x^)Ll)fEjQj%z>L=L%10> zfm`6sa4T#Mx53-thp-LY4)1~=!H#eT905Ou17XdHyl2Jz_?^s${LQCu=Yn0?_q2(= z7rLA4)_&iE9o@I!Go_myh4%dIbJo3{4}Jj^XMG9v9Pul-gE(X#yp6cvYpDBg`z4cp z0B&U;eFG;VAB2i)4nh6?=`cJ-`Vpw-XWv3SZ~G1^UONi)9PSv@bGh%cJteh0od1z^ zKKTJEPWcfkp7{y3h9}@X@MqWs{sPMwhm%lo)UQy_F;7A5^V86~hTs2De;w*SgS?mY zvrzl}cPKmY2b7&S2NgG+hl-p2go>LkK*dXcLB&gdL&Zz~K*ebn8E3_vmyi{A{tFd% zUe1pGUhxWCL_1}q&*geOInn>q76b1ge>pe?mWPT%D?r7M6`|t2O7KM(o8y^Qi|eS2 ztluS8fr=Na=6D(%rT%KjQ%H}4iU+TP`{31Z5WEH|PK}3(Q@v2*PfLPh4F%g>v;s-$J?%o`Qa;=a~Vx2PVKTVG!Y7JL@o`C>GV&B^h2yVCFL za-#9<>6yAe*C6L%~;Gb#mRT)bU;>|EGka!2xZqh zLHQx-C$76Ur#JG+#a(hbQ(q0weL205rxbTlKZs9z=E?eRA^by84PXPW{~L>kld z!6oCx+MT&>$ybUe<~)sjX!|6Q|L4N*|KX!>GVBYZ`YAa)56`_pswTD#BYJZJsD|0BP)_<5!C`yl*3d;=oeeVzYD)tSfHSpNV2%!r959D5pS zDk0`9vz#;M%$YMIvKCs5(1J{*L{e!{Oq4cSl(Nq~hY6vfDI-ghk`gT<6%~~hC8Slw z@A-P4+vEHB%|Fk_`+8s3bzk?jyx;HZy6y&3X zCch{$julypsQ&=j3F=W*heMa!~YqCFbV ztwT1d7&~K1-yr*;<|E*BtFZp=o`!-*8 zZ~8zq`vL8DQXfI>o3_K{@MEawp*!Gwo|o=~+Shyn^o8gyG`+~2a;?BKr8{7vK_kIoi#QWdC(bW4bjO@k#!+hlLsK4G@_vvcKm0q;=&#eD!e*cs8m*xLkGWPJ8$o%@pWX}Ixd-$K&vi{=ZStlsp zkbNI)*=(`Lm*PwAd&D}GslGZsPs>*HGvs-4UEe8i{F1u9dZcGk4)Xi5G~cPnS;&xi zUf-9Fta;wRC%bi;WSi%Z-<6&2Yvj}XX(-z7%OG~DvCoSvy9D_iP!nG>WswI+SU;xk11?u+CFwChZ$->+pr&7(H(cx78(`&n8CXNjx> z{J+mrb_>je*T8e&)et@V)pow~eA+*@^L3(r&9C#J#<9Jncko?+tnuv#HQvaS>#Y3j zFFX6PNY^}p)D!UeV5$@F`C)&Ujb8I5=;o7rv^>X`OFOjgV5?2^Yo3)0`FiU<$R8%3 zuA2|lt_aliqfqTDfSRWk5@W4wb(MDt|Fl{w~z(ue{Lm4W<8-KXY+6Uw6{m zAYTN>GftAXEb5_l*m(D}@$Mzr#v5{Nmb)Ele%t|f zZ@Sa>0Qrtrj`!Wg{LuV`$ankhK^}t)sb_-kUYHKa&pMgpyU!=Pa=&Ek#6(f|X|mTT z^Cjb^2SohfWZxrJZmMsJm3vS!1&@+1=sf0o+VVXv+PT~` zsB^dJ);|2dwGaP~T}bsjW%;C6{>F)Cd^1e{jBh6OWhR~#ZCoJw=Y7wa{(0X5^z9R~ zMAJj&-5lRscl|*6ZJzXHqdoIQ`m3y5lz%9Po1vq0`ndwiFC?J+!a^v&un5X8RYLix z7hsjM)VCN`!zHi=zG(f${vWxPe9PSNTMjj@E1>4XOHk{v3Thp$g!VpF4^KvX4f}s& zJIA;ydH(PUvd%GH^(D_ARzu~hfjYNX19eXE8q~SLTBvh_b#OBBdZ_b=4Q{=!LwoKq zOZ$*FeEX2ooQ=M>>CbfMO_Bb5%Ve+fwr>;tr*n1E*@tXae)b{n`rd)1P_ozA;(O1^ z?GtSuqIydzwn=a2>d^KJADH~1?<3Q5{!hC03)`6wCr*6q+kve8f~ft%PPhjBC-5-+ zNj$0BMcQ2^z5V`c57h6!zJTknUthwE#8+5Q1FQw65{6BjA z9`zgeIoJ6XE?tfPht1J{M|(AX-$V2NP~-Ze`L~~Z2drH``SkycT9g0e@7NAfUhDoB zsC9n`s$GYnu6qQkeZNB4fum4%;Wwz?vHk8|_YWw0@TYtIzufEpZPz{KJJqlCe%$wu z&BK2svu^(r>6hasdz};Ry7l!hh1 z@~I;8roO)+`O=*RBI&1@>~+%pr<>eREW-|!qi6m!@;4)YhU4`&hNV!l*JvwUZX zW|z)}vOAe}9sIvthyA}_<<7Hw(kp-CM0@}Frf=`>NPU@!4kFjZ|C_#({{qu@^83-Z zPjnVd4_V(n$>!Igje7vfo&=%nPBxU?$$_#vxlr>l4{AP!pyp#3YCh&e#XAvL<;46^ zSPctc4J@>N;`|?3_A3r$_ljUGEQYdwU7+mWh1O2|Kh!+y1~tzwf|}>uq2_-NDErkD z%6|2tzfwGX{JpK;`uIc7BshrCaCoqq(f)+MAJ*ZWJY{PljlH=*>C?-SnW_t-h*NT~C|o1o4WZ-)AP*(k1~ z^SIUb$@4Z5liQV_b#kZw4p<5$d!6zA zyR6*fqS;y1TT*e4^k!$F+1Uvu-{-&I^z8phmz|x+IGs2#$zO&nJ1ff0J^*EBCqvm; z)uZQ^58Ajs;(rLaQ(~&MBj`LV(*82bmyvkXO@GWyxAHb`rg44Eo9R&F_yp~$@I2*z zlKM{Fi{FRZkBW7WPuk6AkYzWYg|dq?q3q&wPL{1qlI674z(sOv7Y`^NuMUz$_tf06R(&I=;t7n|&LmiU*N z{Gw=f4n5wn$!wf?uzw@KcU}7e&8}>LvMcXF*_EwOc4ZrseS06uzI^~?-#&z2^1J+x zY(8xFe~heoAj)3tu=cS3hZ@gMpytmmsPX<3YF>Q?Wsg3GvPYlJNB$f6U#RB_|G^Z>9f$Sc378H&f#mxmDez3>RJeuw zb>Mz@3Y0yo3-i#|gX@sfU@g>p8o983Ao*Rn27%=HHs6!8?lifQ#(3$i!r(vK; zK8zWk%FnuK9%u$jp=7VqBGA&xbr#L;sos)`Go&}W2hHxC zX>vxOjp^C{lPXY@RQ>ConL4%9r) zg_`Fl?O}*~vP)qodzcSp4ho(zUM?-|1N zw4b^P>b|dr>d$MS`tw>SyD=2XZY1ApxGpd}pg7^Wz(_aW2sdA;rC%So(anDY)cqh6 zAKaw;+W!Y`CSBKo)H6CT3Z^=v1Gm8b@K*F{&loqKq0A*L{HrmhZlR;ufVt*5ky$T&|PmObSe~ z^;jk{pC2&U>r4qurag*7NM}7hsQj$Qsey-VJx(>5{eR#QD>qlP^{9GFDjt*G)+4m_ zIL+kgfhSCl|0iAR@k!>-i4#u+o<`Ps6tx~_K&{7Tpw=VxunuPhW+Hb=JZIMrI?s!? z4t1T3#B4Wxj+<`fQkHSw^SG|YWj@sSFMt~VlkZPCl-IhdfLd1xsCBgvD$ZEsmalZn zzu=Z%3^krh0@`;i4=lBL{9<4g{dBBinMnJVo9uN~1YRrCOx?D<*rLR|Bg}t`RNHK+pKB32d0oVSN_I{cLVR3{@uWP)R&pqBGO*`zv;IH zwwiuh;3M?y6Yqdo&ftnxRLfMD?Q0raqMNO&v zKH%%lIp*pg#4?`;yWTzN*AL(q_1?lyQ2zaA%E=#xOOk%^7yROqEr$Zc1#Ms2GNBx@ z9*+dh32NMb4g5hrr8`GO`sp{5dG9~)JN=~fNIK*Fr}DEN{|@{`e*XWT$^8Gnz&}>* zoFKIIsCsvA`cHb|s^ftZr0Y2_MD_$zg30Hb5IHrN%wI>e=fILnD(af7=fKH&(t`D^ z-cv=+)ym4Dt@8%RX`a)9=~j;C|Dhb-0QW3dM+z{z13#~&qU7mv=$kkvU0IgA|u$AehNBmMEbL=99sRl zkBr3Gx-ayZqRmTa<9{yH_@4(gKib)K&JSK-^|udp;CggrIplgBm2UGu`s073;FAy`l*M>d${kl>ZpzCn^{-(ZpJ4l&v5T;;a! zYLRijCOE>%4G&&x<%UY8+%S=H!%gP@|GDKxxaHO_C?#LexjuM{<-0*NdwC<2JsfH6 zWB+gM!~fen8)f;VSN_I{F~QNM9}^r)eVK_{MXt;Fzv;&XZ!`V4;63QuCvF!_53!eb z2FKGMiqjzDe3$f$``x0gLuhvNURdSaADjTI;eD_MPPF@G|Boy?I0?!Qmcd&10F+&w z3}siRK-tv?q3r5I@IyG2>uOy*Z0+LxKd5>6DAc@s49adk4)?)nQ1f&;<)>6W5qt`{ z-s&esTSt<2Z+bfT9QxyxGen!e&%j$e?Ej&j&&`B-K8K$2&j)8C`#iHm>Sh0L>2HFAUF?J!}+iVmb?7`tsfl9@%_JGg8J0I(C&XB)cr3qJ?H<7i`RJ}h}~vf z7K>bWNl@>()myz(wDkmuzm^A=1r?_)557!!_0I~Z{&~sLtAeYL)lVy-`U#nG)yhvi zSsi?ZboDc&o|@pRFx9CEu7>^LYv|RlYutR2kCv|uu5<4LQf__lb@zTYn4b6lOs);S zVfFF;AM%vSjls9j*IWIjXyXD&-xSnyt$M597P-I8!L5|*M!&oR6`#Hf`@=0z&&A$@ zd|$F$`BI&2!S|`p?_vLM=^t1X|Me2XUO`U?F(0WS~>Xpi|2d1k8j-*?0&ze$$VsppZzlU5BbxauY%t&j_J-` zk#XE-GT;3PeoZ^&XGzCCeXIP~r|*LMVJVdCb-oY&VCDW1&Cjadl8OV;TigrHAO39e z!Qd~Z=lq{^`NKoz4-W^AAj=<$@`t}d`NN~|F#SnA*sZ^Uzaw`_{9)G*I)93^yG(lQ z&);tPF*n`HrA*+y|3$BT*neDK^Y1v+{5t_PuRPhFGKZg(r)F#2vH#Cj|J2DoHCz32 zipX{9n#}wE*=Z)9Dwfsd`sm4DKRYl;`5TDjKh0#$|Fiuj2L?fV{@IZ0$j>!`@^g)$ z{G1oc&o!YwwW}#qdz(SEw>i{2Z;>s()H=Imw)|47?6YVm=l>$tZEZ5=|JfNPpC#IL z+CW{mZMOQ8_y4Fb%{e=}o!w`qNcnS2_B!WgpJ#GA(fk#9=EM2foyeczbjWTGOQB@1 z(=q!3%il>fe?>aiS-+q&`k<4QoojlZXnw;F<&$3d8z(~9d8Q9# z=Tl#1A}rEg{J-g=*%8x6v*YO7CkjN|znDaxTm+hSjhOtbtvvUpfCr zmLKQ_i|8g;uf4KzK!oKJ=zWuCSy#EI^ z&X+=s^JP%>F!?*n0ohk%%Z?1l9^&RJaq|td^eeLmyZHw}T^AYqbCvRApRUTjnsi+c zQqR!rYhbD~H2YfE9}Y*ac{R+32fCzdj!7{q?&juk*;ek@ej79;oNO_rk6`f0zI_@ci&TI1l~(Q0M1`^1b8P$oj6)9GJzp%!N81odq@BitzUq8-+D3BdFc|U_pO&gy>I;@)Vb?2sPoq4Q0JyA;C}cL)VXRE z)H&=*sQ0Z`LA`JNGHgP6HPkuoD^TaVuR^^yy&CHLwFdqO*Fc@`z6P74Uke{2eI3;M z&<%Pf&uKSgd%UO9f3L$X=xbqP1vVTB6 zu;lCPz0}vtv(Mxym0#<6_?Pdpzp-`vtU-9I zaNn|*e?r;Izo6{f-{|$7nPb$O;`ulGAFJP!laj-C?Uw$R?a9%1WsZw{SLTFh*MTXe z*aPLe2A6*M;)a_1t`EQ1^K%l;5sT{c2AGD0_MuRJ+ol+IxDA`qi7$ zFh_p7QBE7$ajc@TNISeH^Bf?jsmX0b`lne=OX}DAxXs~|$`+FCecY4jtt=nE|3|NO zwuWl=nU*g@^-_-Wf7+4ew9Pq}>!v$riCp(=lf6!6&N(KZE1JJY&wM>Erz80@obz+q z!BQyM>$K15VEH?W=I=?Tz3UfTfIjGS%E>l;XVLt97L-5tLABEl)y{yG3tB$umA`Q! zHz&vRxj7-~%S_~nHeL{Yeool*`8hH4?Gq8v^br45AldvqO#c24E@VE%;W6e>5!8Gt zhI+rC3)H#&g;3}HU162eJ*OM2h8Mva*u%yT|BtNa06n>$#=95ta_a95<<-3TnaVcFQY!qo6GG!IRA&5KLeoVR|!;nFc8Y$Ur9O5`$16O zR~iiUeWf8#&jGH2n%7s8|MJRfa)#4igDS5T>93)peOGB1)OVGT%bIwu%Nc>Jc_X%2 ze0@$S9KYoHoExY|@4-UW*~pw5ZTv>&Xuqj-lzfgbD(B`L#SNo!ZX>_ie+yLmM_c-s zoUzEdk6WSc1DUvGobnU5jLW&5boB$Ip7A+%z*J{^&YiG7yc@mx{Vq43Px|$8CO_7@=HzT`+qsh zOkOUUJwcB>S&{QH`7@lVoR?rJl(FN@jXvnSlC#eAuZm_*Rzul~ z8n=CG-1fa@<6O26Vnfb)({ISBrM}F>>mu#N|C@ee&KsuRnDaLJ_K7z|(?jOb zCdp<`pxKelu*%tz^A4dgmK>P zj?>4;vL`#B?8#183qL`x@!e(Z!v90f)6byh>E}@Mb2rqy)VkFC(RWT1M}JAWJ^#;1 z#@BnH()U5d-Cv_ueEtnoT)qFvWSqM{$76BscTn-|_fYZe4=|to&yP^w%RB%T=lui~ zpZyFK=N*KK6Mvyz#leS=6)zu#it~;@#f85@#dAlY;@01w;=bRZ;>16o;=w*9F z;=aG3;>`B56_@>!(>ho4^WPj#uIA@|BI9}7WUu4NJ;8V?E+d_JnUYI>=4GASR9Ffn zd!18q>sqGA)hD=tgVRa|y@ZbM|nWuoG;MsN-K z#!zvY>e2J|Cge}`w8(9W+$qt_+7Wb`i?qMY@+t0Ui9RFI%GICY>XY>pG2UmQ&xaYb zNAsf%)cj}*HGj_HIw_va+_UX^nYqM0DLu%4GX6Q2@>=ibLD`jdu!`%R@7CKMsvRAm z>`+H2J9L42ola2prn7s!EU0$)auo+<=lXLM2L*D&^z*Tbpve7Yo9uORa&t`%i&lRg zRC_|!Ue5oiFU`r%Eu?(96A>vNHJR`K=f+Gf6wUsiXPo1?UCE!}6z3MfQYhK$bjiKY z@^=-@{*Z3=ryKg9b5ZWartdDA{pkT^UwXRj>*cnux0UN-`J`9=#)-bUmzch9Zhz{_ zO!O0JFaF>3m*rk+`pa@l(6>)qE}9--XnQBwg2o_}d3^C&5(bf!s3K zA5KB9c1?EkNj_TsVD3Y1|3l=dxsO``ZD?|ML^xP+q zwJss;dMfux%lA~S{Jzp*h7ZojO@9CS87TYwEZ6fB_G zTW&7Yxyd}JbCdZ{=Ozm%FZ*7OEW7W(c3igt>i6#nsPmYGQ15{)f&)Ln|3jU#yZ~pw z#jqpgmO%Y~+@)|S=`XtNU51>slKnr_eXW37(Z2*Y!7BI)TnTj^vkK}w=4Gh!m};o= zm{*|AV_tCR_*gJ%RO5-xuEiucQ3yus449;W?iA z4L)Q%#wGpQ#$1p2xi@q59mKbCH*p{PS;x@))7wyfY%}TdWA7l#555a^&a;K|gNgTY zw<7DiilY4CHYk7iK9oQF0JdN8QSOIuF#N*o;?CUdw$47z-Gv=ERwJ=% z+;{I1+jd^@Y3^sPoq%lvD?ZQN?aHui-ike{*X#(a7hUmX?hm9Ft@tW;ubU3rc3ZJ8 z_iI;%ZF{fyCih!chHd+;*q{5IE5o(}R(!8|tX^pE>-`AjuMa@^>z|~SYwe0_)&dut= zKD*if!=tQ&G^p5^)<@#*!NKz zBfrW#@j`ufpb6A@TvMp?xMoo2am}InqXpD?TuZ3)xK>c-ac4lC$F+vrsqajv^SBJC z^SCxp-$`u?UxQ~sefQyPsP92!LVf??9H{TAo(pvzcOKMvTsx@ePUpkVVSBg=c7PhM zj_@|*3!uKk+6n6WFP)*rD+}s8(+Bk(3P032UH~?SL8#|f*-+ni&4KzpY%bI}ULMr< z6hctnQ3ykQuOJ`l`xp_Z?_)%vzK>A=Q%H|NeZRdB>ig|+sPoYx*a-Vj4E244E>Lmo zg;3|BU7^-(H>h=c5!AZv4z>P!Kz+})C)9UodqI82wl`E9+Xrg?UktS_E`eGXeWAW{ z+Yf48^oLp(mqM+J%b?c9$~&rK~{V%D!#rKD!!fo z6<<>i@!b7+Q;`oWDa)Hkea$?ROy+%=yhp8nAIy8e`ggL@>E9_L_w}I3Ugx2_r2U;L zTD<y(v4 z^fPq-#Fx)lKLwpx68{gkESj6Q0KI;fJdf+_ zTr^*@)dN#LAYVDu|9x_}Zi;7NUWHwMVO|2(MXp3YVaX!Vevc2yw>a+w%eOdh3Hn3S zBkqMu;ZA;^GxjQ#=lma8ar<(peZ&f=>%IilA5~D_yIu*kk5~n@k9ZkYqpybQ*H>UU zd=+XRvKs3DpViPV#f@vA`r|dI_-!pzzpS%yt<76+FWZ?=5+fAnhiyHNMJ#qzzUdhPs7+_Gp}-iNeD)4cW<>N^9U=Y2;0 zSrFO2gCHI)-;?(R?a})jkn(%;zO?dt^S-k3d-L|&b@t_b?Oq2`-?w?+Sbg70Z}lmk z_7C5|g{-IVq2l`=;5PUpRD6E`YTxk_)V||qSmhkbI|!@cFR%t4w(-FKBWpi$gzISB zennnRJx8JT7r((;_&eMT|A5+G{7HU|?_W^wIsXkc4~{|2gMXm*5C6h_@IT6FeH@3H zewa)-W{CVIX10L$uo z&Iz6C%8>l+Lg&F$sBF_BS0uKI&7ycZBNq3oN};C<|Hr-x;d^k=gI~ zm7jf>KNKKc;|HlHClrKy|2LEk`TlPx5549?uA5IX-~SDTX{Y8hue)O$H`sP}TD-%(y1>SFcc|B+Lj3qxIX|L7t5ZlQ}@8FKyZp&q37 zre2Zn|A%^$uKVu=b^plJ(Zz*+gPam+ih+;*_T;7b$iHT`>{Kq;^aG_;@9y|@!?%i z`>(s9_Fwmel5zFD$ZNUo1bEE{oPR>aSNB83trMZ*>q$`Ycp2PI`U6n$?_{Vrb&B-V z`yf;t_z+YaI29@md>AUOegrD+eH1D_ehexOd>kqcoCXyKPKSyEpMZ*UpM;77pMr`5 zpN5M6W4*u4XzB?7r(B0%|1f*#czb(BfV(F z#?YH?I%Hq`R%nweL-xgQhc>%1WMBMF=v`Na?2EUk9;+AfeA^#WR zgV2YhpF)2?{x8Hwp^uS+&UVrALH>`!j?gEhH(R(*xi$Ze3t@WQ>Ja~5bHow;Bi`d1(_=jY#q8ip0$ ze;fLNeCf`9k?VYCve)?`^gVW1=jWso-~Xum#P>gi4v@bTO7=QGhYnh~hGA&&z3MHg zI3&Hr_b}yU?AsCaX`Ww0N2yQ$?-yEp{~P}2#EIWSe;_Nq7ZuRW zZnz%x&fJ6lH@QJL4Y^a|)NljJ1)cgL^^}!E+HqP~_mz=I7txeoZ1#DzCO#n?%7a&Hq*WSIZ*97*ZQk{_`I;zdAo3q_1F0#_tD;D{{L^dqsciU z_kBS)i~1EecY;$YJ4?2>`DD7!^0EJS+Y^9lf6($}t6qz9AoDLb9O1g@PM*khLneEj za5&%Oh-l~g=$VJna1r@4oLIO3mO{y1r!XA1{6(Uj?~_h@*DokWA9T8edz$`2(a!g~ zLY?1tgX*`7pxW8p%Jr~(cK&br-r-)R?;XCF`Z5!JL>q5N`M%*xOy4(r8T$5#exm7N z%cJF&O18KL+WUl;!-dR~E1=@W0Z?&c2~>PJ5Gt;`l5+JugTjN66~{q~Ux&cP9?t(^ zIlLOZ{%_Sa$PGN#hKIWO#VY5z@Gw{nhr=2;!p0r{kF5B&6e`}m9xkU{H$Xf8hqcHf z;bwRfwDW&x=l^gU>9;`b4@SchzB4}tE@2+u3Uk-t|LF(K!`q*gM)`21d|_QCWgz9^+dBoBm4L^>oc0UGnAIQXI z)0LliaeDX((se(OdY%qH2~(Y?!%xBf@EP>#hZ$}@$w$kd4bS906!${p=fbnBJo|sx zn|_g;>dX$$;Xc&=koxC_=eaT@-~8|bWc4E?ek>0=?tMernFv={xkOmcBh(+z;)F$E zkHuk?Q1R9au={$>|6y;qgmx)Ti1Gh?Bg8Q;hV?ry_Wy7i^(;rP_vV<4_?MT$+mO?o zs&F;yA>COivL05M>~*TcFLS^0FQl`sUr~P6_3H4euoOz>{{V;ASh;PY`4`n&Qn6Ng z^Dof+%X*VHgkLv3=l`VZ{HT_3K5^oW@J3|$7g7G@O(_5J7L8)_cyF+09D{DrOOFT?xkw__DwiL`gG$zEq) z_-m8*i*}uFpsxF^-7oI}P+yw!UHB);r#s(^l>fnGuk&O0fXP3JW{=S`Za;^QkUzuu zC43N;Ldjm|Q24OrKO&kvCf)4uujqr$(eN?T|0bF}{vFER{^7RoPq%%4S-HP0pY+P# zIPq`zAJhLEK2Cj^iT^~}%lW_QJ^3e0@5w(UU-mdfG(BW})sbxL4W>+Hyy`;P<9bl` zFAeIw=To7+YhRyo8pj4u>;E*U@k~dr_d8CvdWlnzWj7naTG$xMZhE2CZ4)TF*%Zod zHiNR8&7u523n)L(63P#>g7O1rP`}2zHL~W}nNagA18SbNf%gCZ$fx;r7LJ+k(X9rBa=#g0(>#S5VFcY^v(c4xO- z7Sw+6FyD#Se#4)iv?l?meMk_>u4F^)lX9T;Nx77hUCBe%J}CsXPYOfr=klTUOA)C3 zQWR>xQ~WOTOLL0yyE5+SPO-?icQM)Pbj`nzahKg8o%!2M`I*1n z^Dly>P_ozQk>AtG4H3=msNRx_-qM@hfo69uHu;kLzNTmYPrB?*zkJ!9{`r?8%kGG> zJC{M(oy(!@4)w4uuFM~R+$m9F*AF@aMcQ2^J?mnSn?Bf0w{kWQuHw3ymsdm0$7`U* z|5|t_qNOJNPX!R8D8ANc{k-*qF@|9u!KGEO(a zTdDVE*k?YCAZ{{=6ZT>5Ze4512undg_^%((VPEA*7?RbsC9Nb)OxuC*1|jC zW;h;dz1#)0UhalkFZV#LmwTbs!36g{?}NJU`=R27iBSDA394WC@vN=e2cXtP(%(Or zKP6v&^uhec-24x@`KMa?!}*W8fM!K#GsprZ3=`huKGXDwK zA3lv<_x+TcPx8_78Trq+;{hr6Y<^GtvF>*!_oe=M&hqhGhxY|W(%-X?|95@PLDu@5 z%R1Ea?|D$?HuIs*cNRdc*K(-u=R0um7wrF`p1UWYp1UuEdhWgm>N=HB=QuAwJ!fAG z^_+c)d;O*G9QjmkadppI@EL2 zTBzrcZ@}hoBfM}U@Bc%c^SlN19Cs6(y@&IEsOPwwVPo>Y1J~7Z{tvHvo%4UF=ZEh> z*{iKk_G%kEk9NNg^?QyFAkY8vKZHF0&;KG{`_rBI+iiV)oWBb@!}EWUb-vSNp8w}3 z_our=J^#=D%=EnfM}D6F=kIo9sOSHx*ZdmP^Z)!GNay)~{$4j7>iK{E*RBlp{6GI& zSB852pZ}dJLp}djJytKY=chkHd;SmY`9HMh|4?@NAe5c{1qZvUR28Ij%oBmWrJPj~(lx&B`!^Sl52zgaJ`+oWT+|51MI_J8^R zlD`y6_BzM&PguFk2sFD*I`Mu=MD;gko}@;!PpBigYytHto!|ePtl$45n_W*spXNC= zQs4CWf6`^w8&Kbg6Q@Pek!9CK+4a+*?0Q2eyG}jW^~RAV$ojsa7wUV6$h4 zk2`t(k&j++Y6L1CjzT>jEP!fP461($q5M-EDt<14>i1%(e(&Pm_k~dQxT|~r-Jtx$ zMG>vfUXkt*#Y;URed)hr6+K1zub0VQr+1`}$$dq;-o;SuyTtAX|4)5sPQS<%luvj1 zi6O26qBJtX^rev-s4p{dy=e0Vq8}N#(exuD zx1evIxJfiU#E*@VY;gs&xMDP{a>ho+z-o9atbw;#zY>oi%kPha^82^LT6hPP-@g;e z4~~cO`*%V4{kx(3{ykh*^Y&i5KK>tS{O*IA*Y`uk=M$m){3NLHE~C8W`2$e%d@|HL zpF+Rz{6F$A`D7m+B7I8bRLQm;q0O^L;PJ{wBae|j-^2dj@;x4zhCB}$qMsgl0{I+d zXz|aJQ0wI>D8K$R`njGNk!O%K&qc*Y&qA%2negM!J0>&q7_ zKk?1t$P&`k-;jEiMV7);XIbP$*dMMyul`-`=97H1{G~`0_o;XjQf_6Wns#YiS3&i| z%a#xSZ|Sc@UbTAh|M2y7HIdb@n^O~c1HIPy8s)2eEwYw+)&G$GTNhc6tp11SH$+}X zR{ulvwJJ}4@>-{-S9Wv|=beNge* z*KWJNfqD<_Td25eKa?N;4l1ts9xAT+0Vhlk-zcm%!9hkD;3e}6R6EGj$sTjVe7O1ksAh+X-^WUupAYhi z{CeG}{Cd4;8nXPlD8GIxlwYq8<=3eX``a*j8gi#ZdK4Kue7Z>c%cM8I(+JA%G=?jA z@5~D`5>4FvP2K!fU&_cnXt#y1R)H=?9 zTAwHVWn1#eADso|FVBYZgPBn6IR~me=R*0*^Pv1?JGZ{`q1JPIx84p=*XtOSf6R(r zVD0G?&E~$3Rdg1)?<|wOjxXvrIa{>)15oV=TEDUXr@k~NCz?d< z&28UBR<66{lV157CwfJDn!Z=G5A|gxdW*D|_y0_PN%UgVUlP3(efvaT(ew~I*k7{Q zL1^QA8C=LXUJm64uYfvV8bE%HX9=>-aRx%!_bcH9=EWeW@gGb+jrS1bJ;+zVT6i_w z46lK*v)4lT&!JHMa~PEW91bM{E{E~@?F?a@1^SNlb1 z|7Yw@D0?&>>i<&Rh5lgT?&uYKe@y#5i2b-XI*0T$XF_xm{hsdJC(`fto9uNaMJLkl zvLB=~f6A1f`7=5C04#-)`3_+8K`S>$H2a}?ODd*HZ}tP?S00HzM*8kekBaskB53yH zamzO?I^D|g{GW8$lP8!@Cr&&WeF|CjM3g;w8p@u`fU+ml&wPD8`Ydv%#7t{f(0NYe ze#)e0zRq&fXS?ZE&cY+IT}-w_9M9 zvn~1_tcF`*4Se6V)6mxA2T<$rL#Xxm5!8Cz4z(UXhFXt1pzOd-sP+7bwTE>BH4dLb zjqhhr>+^G{b-0`SQ!4jFzeKLL`U}y<8`A!-qD}c;)9y`;dqCovucP~-ifg`(eoubY z`wdjR-&*>9OIQ8hx%DgG(efXnKf3(_DSsgPv+5_`Po~HJn|v_(3;I;r4{6t-=n?ew zRv#9vT}k=Z=pV>_&ry+lzlm1vcdMWCf7svoJNl=k{~i4c9^dqL^q6}+NIU+CK5X~* zugG_^{)--0JBWWF-_JUsbd#aQPbme-I4iXv`94w|sP~gjfr_*0N{02I-iJzqdLQak zsB^XYlvljf0QpniOFa#KM|wKk`YPxDQ0Hh3;f=(DjiAoa8bifxUdk)(o7X4#eooT@ zkJ-UyP;psvsCcpk)O$`X$**{-6|&x2KLhIAsWnvGbtY8Yl>yJfPPT!1kH4+-AK?FC z7Iyq>sB@`IsPngTpw7q6g*yK_59)lb9n||n=R>_u)E?^nq7G2+Idz0O@3{c#9HvEI5&J_j8^S%M1z3;60^c-@a)qiEdAY`3yK(2Rn!C>T0 zi6I47Qy=?(k^0KYA^K}{pV-Z7tv`a!P|@t1(iJ}phgZq}bKkN9BaokBzLvtT@YmOq zuK3~xDElxlmh>MZ(aZkc1m#C=hI$WW6kNUs{}0v9(NOk!43uBF6}Dl$jCHSfn_KTV zsQBV`sO#Nf{dIT2oz`FD3m&xox=W<}cbn{W?kTv}eu@y_rWQZ_e-|- zQBI~$vV82v(5qb!K;6e=%Qr>!QjYikEZ;)~Q<2qP$b5XbU>fa6cODUG$D<~DoyQ6u zH+h<9aVmP|<@ACX!^Zt)V-^PeiH^Np3T z%Be0`1*_r9um-+jCmq2}XeD1Z14l)rr!YQAovyxv23 z59&RXtx)fwY@_}rp7#qrK-PQ`wJttnyiz>d3qG=O+g_k}xEK8h%}?y0-v2!h_yk$! z0lV-UFK)vBLp|U549ZV^4&|qIL;0ya(j$KX<)^-+y!_Nx$ohZAdttxz{Qe)xFMSQ= zkG_HOf8RpApSvIG{oL=Mp8I?c_1xzNw|!q;nzZu=u-o?iUnsxzGnC&t2<5kaA;0|A zA>=E#&%^Lv{Lv98d;cp`e18<`xyx@*e(HCq|0nwg)H%bSQ0EMPLHVJ-q5RS@C_nWN z)N_P?p?=@>AJluV$D#bo2{?uNJh7zTOM&uxsZf5e4wTO@_P-S{N8C${w*EK@0Co~zNBI7qL{|NQLJ&yQ#Qzh|BuOzcw;SMvLj7I)?HJR zy-u@ObCX+$wqHSy9cih0up?*0TES8%+3U29ooV?m63xFQuh&L;yIxX0D|WUkL;PQ+ z>Gga=dYyxui$2YBUaXzz@&BaD|DBJ$KXIactOK(ApD6#=5z7Bv0OkLv2m94I7DGO; z#2?F|zGfa@EDw1~r9T#l$^YfV0x|i&pwjVw*&_F!W3t!DjV1kGo@nP1A^GPXFcc_*@2!=cA*!PKkUu*=XmsTSP6RF_etV+&3;^oKE*RQHpub~j&aUo_T%Jv z&sF4;U$`2|FJA-IU)Ms}pP^8Gc^H%*84l%_uY)=V8Uf|UOQD{tTo2Wb8=(6CM)$r) zLfOBYp!(%zsD2q`?Ybp)kB#@(*k~K?F|oUByl)lh-?1X|bWm=uhlalHreXAPh`H8#qPK3Pn67jnzxvN(5)BJKT~55!E`vy>U%8qu+{g7Wa@iVq`t>Y_BxNd^-U95=hI^|$d~Rs zA(HP&lkxwtr%j$ATD*Xsb^c6j7Wp%rnXzYKDU|GWo{K$i`Dck1FOW|A=EP=O`{u+P zYu|#{Tx;Jv$+U02$aNQ(%>Vy&+vkWDZ&Z*k=pvlq^S`=I_0@7GXv=Nl;hL_X}v{uuEHb_V}%<8AQ? z=LSEiiZv3j4!9(5t_Hck@X;TK;G3FWRT`7>N9L>>n$S|A)O9N6D$qzp?*lzvc&|{^PL| zt_*p;<0(ujO!f<;U3Cgm;SQ+hJL)fJ@3GY_{Qu*yG-SnLrxqr^Cs7~jeYXZsaoA~4 zaacO6q@L5E_WKRtAEY;O>uU@ZkIj818AmiJ^jQ4V6e@md1{FUwhuYV-fH%OFQ17F( zf(zgoP;o|UsCeZ}*l{EKf2e(Z8>slEEmVAS7F2w5HrH1?mWix*=G>bVr<_~ZgY-1# zyuuEJvRCay*5~;q^WJ}9`@&>ALOOP;qw-^?Iu%|3OQB@1)44Fq%JmQ}9#Op|6@KY$ zzYQ(k2%4N-m}7eO|D-G4$SqX7kyjW(R=go9-Uvg*8~IT22K8XSqJ;&>@@Jy_e$3Jf z3ya+JIGjm;A(OvrVKH*2M3=&@v^VHnC~}`=qIudqM*{^&(Nyp()e2bV#upMU0h>|FK= z^zz>WpsrWq<{JpLF0Le9_cI8}e-DQ8-$T&rx>q5qKdy#q=QVEqFV57u8Cp1ue%CsJ zR{wCgko&j}%Fd2}vOA?vcIJA@%ii69tom+*vM(b^*E+w+?sHV(&32!o3U5KL`xIqo zN5fh;25yG8LaooSa6R&EQ1*Kql>NRPj-vb>Q2lwQ+y3!T{dE`V>c6{@Wnb<=mfgD- zY8)m&jmv%T7Us|WP|r;!l3)Ed396sUNcR)Z{4zmyU`pX+vjbBKA9eK)LXFEqmOi!c z5oF!(!%){nrrcx7k6nAL@Nv@BK8QVeqHr2ab)G1k4*SEW(Chk7y7?p@Eq}UjhC3dR z`kpO(#>zii_#Exi_|JsucVy~)zHpY6WB-rL`~QV=(5pWo`niSkTp42T<`*tNK8JcB zcCx(CLGFMId9GejxDZ+WnSkm)KyeT?!D zd0F9dluI%T#%7iu_n_?QR;c~qHmLpK`%wGC z58x{De+Xr_KZ3H`+oAT2A4BaocR=kocS7x3KY`jO?}B-d^HKY~#b<>c@5Ybu|Fq}- zerK_#@E_zf=ZnI9*tc}&OA-6^mC3yKU$~d~rsrU!W5>T%e(dTk) zyM5H`$Df72A$LmrZtVyd-fNIxiQ1&<- z${wFi{kmR5sCD1Sy>4Uoy56|Zk3Q&hi2F_7QM7%+1yK8dPHy`;yY0)eaz4u^z4A9s1mgkI2je-^ zmzl^GX)pfY^m*}I)91w_=-VekqUj;_CttGpFKGQAg$tQS1yFt|2IUV5q5N1J%8wP% z9^U(p7hAi!#4jXW<1A{PbcOO0-Jr(zB3R}0jCY6Cum`Mxy==Vj|H$%}y`lVEA6N@7 zhMVCfP}NN6T-Fk97MVBHt7rW#!rb!`|GNW+(D;=7>zB`_@-}gY-?R()i^b=^8?DO~b`;YtMbCA=V ziSfzIr*vnM$b2d@+3QS>KfwLS9+J+wn4r9P5Y~|*NW)D?wNyVem zn>~bP4<9#qT70_cdHzqj?BNs4JD&f?pF);B6lD*ehO&nnxA2FnOhD*Lex*x>a_6oc~i_ znzJgtn)2z+%Od5gP4+sk#9uXewPydoUr+uF=e776SPCV3owf0GmVdoyc8heg zTN}^^o!8@Uo4!^wyY&W?UE1ij?@hOTZ&|rbmQQ-+Z=851zS;Ee#J5miX5w9u_Tv9d zzcv1z>9@u|MBhHKO*B1ZoqQnK>=rb8^%1OccEq>CYWOj%fjeFM0?n>`0&AHUyP)jK zr%-m~Gbp?AIh0-54P{sMK+S_MpzPC^Twmk=m9>NYKh*r#2Q@#whO#f;K-rgXp~e|I z(n`B3~Q{gUn+ z7U`EGCVQQu@n7i|tv}Kk-`|v<@%xmPdq7?FJ{fSzCsZi^$4%GUi9_G!dMRk!oCF&I+Gk?-V z+Fd3+^QOL=-oQ<_aw#k5hjiMd{yrV5pBqB;b0f-WTpB}-%gOcF1X=5%Db#vw2DKiW zL#@XaZhbA?`dYd5odGpYt&0>#v@JTbNO43)(YdtuSVbF=_O>zq||w#ny;cAZS9 z>z-rx%Q*n`vHvgXNO|`EBIVCFneYD>buhW3XzLL@<8?uipZpn4=b}!q6iW6wSw%j} z?-y-7l5XoUfIjF1i}FpME!uj_fm(05Zu|1w_Jyom*z!rQ{EZXQqKN6EMKS8jOcaQ; z7yobicu}G0<3$&uZ=WacP~&tFT+euRhd+_tgK}CQJ)!!& z7u2}+hFU*;$XDg`ExH(1!%JWd>}TVG|3}ui_lJrXE`_!5GN^TZIn=to0%~0kfLhlj zQ0sai*U`MX5^6s_2x@+@POaV{DY_Mi>7nGL1&ss|CE(Ot4Hn1 zNIa=_qJK)X`3P+sXF$!TXQ0OUS-aj${l84E|6I{*t}~YUo`?FsnzNw(ucp$6dDcF7 za=$W{>u6oigR&>{q3p>5D0@=w*6%>gp9-k!CZOi^Lb!X=qN0`LKVDf`^n%sT`M=4F zick@81hO{{=aB7`SAZD z>D4CV|BGHVd9|4I|FjGLU$mb5`2V6c5dUv7{=aCQ~1_aT%W`^ehI{@>ci{@>=w4$CLK@;6TGD*D9qyNW)ezRbj@BG<+L zn|^oE=ceCX^fmhSi9Mp}A$H=+qOa%=o%cb;bFcJ_?>@2YIqHFC_r8Hu&UZ!M!fLo5 z*1+#w`vuL;`~YRYeuTB~0F?du3Ce!`3}wF#LfNlhpzPNnuB&-{*xJSZA8P*n3N``)K6mlYF$?Tik?pXj~xWnie-NPWE3j)8qfG zo)*RYzewv>NPTUKTUmPB;xpi;MQw{)!yV;qi_cWP%8cT+l;6FnjcE2EDW6pwH2vAd zok<_&$t>(3n-oUF?s*b?lZfX{hVDlNA+^uT&U}w+~{gDEw_rqi84<-tW2e|KtLpxV5;`*|G#ZdOK3zU7l5XwGw zrJTmS8`QkK2=3n0z4$Wp$18gj_q2Y)|C`*axHq!wAf%p)i~GQINPg^K|KdxE6_53m zjJ@b5vM&3Z>~$_JW+ozECSqqUFCJv&1{PmoDnne^k;Pb{2->w3d1pY+P#I5DF5I@6CRzMlFr6Q!cr5s3cA z;u}nVWAPaD?GqzK(?jO-&BdeW56x#tf88QI{Wn@PKMBpw+zP9lam8a{HM|Yhz}xM< zIsZqlrTuq6*_At??8#Dk(3r&Qp|hKm=HqNkg=CN*+~>xqU@E5-}7~ycaQJq_t*1r-PgS@*LC0b`+eT0 z2p&bAPP(6wi;?%h&!Fz#XF%0=Ce-uKS+FVm9IF1aq3S;es{V5&!!O`v($90-F&|mq z$yuAv{G z-pgJE8=)_OdOv$L{A4-je|Qt&YoY#UU>)oa*F(MUwgFzD{TreFr{Ej-Df|{bL%lb_ zs>I(6`%<4RaPB(p|DoQa+Xe^0?NIOS?SOjU?mMXW?e6dEDc2Kz-`-Ph67|`|Jjp}e z4fPyjPy5JojD*KMWuIEbbKGIFgZtYbpdZ&zFIc7%hd>b!6Q>UqXVsOK4{pq@{khB`O= z3UzKc1NA)PEVSSML;L+d)bosUP|q{YLw$ep0@U{{FG79a^Ac=@{xZ~am@81vVg7*Y z;Ga;>Vg7>pUgcG&?^ON`2f%-zp2PeL^&I9JTt+`#hkAd|li;!M>PNu@%87;X3?WxYh@7i#LVlNc6=7q> zr&2=XJDy(TfrM8^K0-ZjMwTC|0;f=3RjB_5tp>*-S5NTR{|D4S*8Bapz-q82TtK~Q z!JRM;#uC3ad;onN=!3Vy@vtu3PP}@sD)qe$j-!8Wm&|;-1M2&x_2Dkoa|5X7Rt;ec z`8I-jPxDTAC;PF+@CDk{1nPe`?}GY$LQ|;sG4F=Wk(UR(A;a2QI0@Qbj5~1D`O@jLUL^2$WoC5V8sSm!oob!Kz{H#AABSCgQAo3kg z{68EC)8IUq4u?YY>{BumvKY5B)DN;R2_Ax+FYmdY=Cizxmw961uuFA>UzrHDMU?-on>J%Lnq^)BJ?ta1ne1{e4BRi>8NV z+7^vS7)f}$qBlhghkRFcRKi$|G3%)>>a6W&Gk6~3J?#*GK-q!+%Ua7zcvJW@0^ z;eEop6}=}~I4qM_^g+Tn!uu9|C|WoyGpJ~M!bHOBg(rv>4w+Ar5+)O#U-Xe^;gZJ| zeVp(K`jJIbL<@)P&pu6XOr9#*`kn?SQU3z?2~_x`qDI=Eyjhm{F+IUk`aJ8kDB=I) z1IWdM|IPm8Gr}hlZw9iT`8yN&CFEIf0{k3~hqK{0NWS)ex^ojE&#S+HACb>IcmRJn zpY@=7;swYpS%cM&6jE_n1~BoF(5F zXJx`_`XSc&TBKiAnap?p6G{>y_f&*)pRh*pxldS^uomV)$zErD!UjusR?OG$t(9-b z!f&MKKFQ?TWjvb_HYe~M{%`UBQ1?z-Ousc@o5jcf6Rvxx?FqVf+L7=bvhJNk-8=1s zx_9~>o^vAkMtgQA97aApb6>(9@~h(6Yx0QVeF;C?Iy;oG-`3dyg|p5MinQ~P$zJCN zcby#;?fLqTlppOml5m`S^`7rh_#xx*6P(WPz{%Hs=W-0{c{cHge=6Y@J%4ji2r1*72&{GY-o(u<{GDL6#=x$k3@LDsn`2I~A+7V7sv<)Gr1 zhxYs*>YNn|b)KvM)z3FU^>an2ey+s-G^qYwWW8Tq8R~uOo1yxv3VOA-DpdQbLERrz zPn3VCl~^ND{^6FyhKU;Ynj-yO%Ve(;mss26h9d2&lUR>@^?RsW;fUh8l9^BVe>eO# zi--S5R{igQYHxju*FgD_4*zfQ8YM287->J`+}Aj<3GsC9gRFp@g|?uJE- zZ!@TIZVq)GiidHq1zbq@J>*l7dbLD;fOXvp>iw*H;e;jle>l%+lXyQ|2wTIYu&wn6 z{vTQ2yM2Is%6T44dfrEP+0_ z5vD?&L;X{zPCBiR z?ojLF38?kg18O}!DVh5Agj!E|Q0w(6sP*$S)Vk;e_1WET3J1I63T<45SUX-!e2M%u z-=K}h%TVL-3XG-vq0kFob=!>}(*0H9utdARN*qbJ)>l4Mf4y$uZzR5ntbQB;)vw5; z8>RT%kBv%vi*StxR;%FG{j7fYOhTyyCwNBr0<4L|)FgEc$x4sbh{lpI~J?CrY<{q^Wo+IBd^*hME;OiG7=l$u(709<3z0UccLEQ_? zfVwA`3HQKRQ0MQ@q0alWq0aAfpw9hsVHErV>Rdh#s@(Zd*8DT}e7U*ZMj!a^6}+xX!U9 zQ0KYTQ0J>PP~Q_=3-vw0b;Q?sY(296M{NVtxoRUE!}k!nr=?AFu&0(l>>yJ?9q$6+uJPLKb{|V~6|1;D%`WV!? z`Z(0N{1>Qm`3W0`lZjp5jhw$u5w7#jX{i6J`xWZ{>druYXYnjt1%HG3U%KC+{^ySL z-j4L|`NYV6?*i2Sk6nb?$6bQj_g#kC2VQ|K;UDlp_$T$yzR{Ve{od8YT1ndP{hfFn ze;DihBjOMLHQDQ2PrSzZyTQZxpLEq7PZIIj??op?!8|D0>)eo3D#`q)X!||o+p(~W z^tRuFw!bTDa=E1PrpNyiuKnGON!s7VCRISz{!Y~X?k1@HT}7z<9r@Ib_EbsoA~y+F zw({ehn?>rKFMZT8{B>0r7p|66gZjlg)kXBY|4+Dnhjk0oexfGS{zK{3GH>GGRn~27 zcpBD$^1HXf9q8*)Z`r+iQ1Vty$P=YPtr?qnq85I@ezO3H+J zP_owvC1qRu95G+xNjUX;I4Rfa_i$1dYxg5b9jtyGCDZOsBIQ0}ve)VC)~}1meB%3m z#N+q>Nl#k5u3}U@#=RTVJ^$lY4*uWD!T(!7_po@Fj{_R=G=AWVY_vawr|4Zrz`Tk$h^N{cVB@M9l;s256P|p|O zRp#qJsChdGUVww4_9a80_AM{MP0Y8Kp!SU~L(T73p!P*Wq4saD!V>rz+z5w3?cat& z?HBUlR`@#9{_PFwuXQj2YJI#3wI3J>wI3J-HBaAynx~_o_Em4gxZ*KM?~+fm;&;UA z-Kj5R{*Fz0pYWbD-V=$JK2`EG^dG=}Gx`5NsC79GeZ3julO`hTe+ni*y^k+h>uZv& z&&f$2*|<$k(*8;7Gx8kslcXt0+BbZXR7gH*$EQ&3m}=qEk{o2UrvR!w$m|coiqHNg zoK!@(+6Bqyv!v-T+W9Q07>3|X^lJYMH=g8+1+$VqcgGtNe|FLm>Z^X912ukgp~mkE zsPUUey13%`if8p%09D^Fq3X2|s@{u;->i7C#Z!M0pL#7#T83Wz4w1h~T24Hb2a#7K ztwL70E1}B$8me5vX=h2&TGGcAuQsaOHEwx?vwvEbw4V6tZ%F@aOxj@iZcNhtN#U@} z3dp{)OojFM|D?#h@@6=b@GY5y0F<9T2<4{_LEY2;0JXn343}~a_z`ZTK1ZPT zGe@EJBR?fY_D4S>A6$q3huQ}mPm1hwbdNKYcAZFy_}{W=5r21ze(FZ}X(<2pE0ljb z0~-;3mU;1^2mg<(=NP{ue}Fuq7vHNyf1dCz`}3w(!pf2jQba`V56EdTpAR5|~+<@}4RdR>F6*LB!{{5;8?Ql&gm$+RnKCiz7tN9@53 zQ1+k{^pU^x%C`)11LR@so9|#BTQ)iJ9IYIzNqG5Wci-$jZ;M6NzPSQ=?Ne`Z<5h&( zH&=q%H+!M-s|@vA?qDzAXi6{`jEg5BcC{(~|wjO~L^yKi&z7)H`2#{A{`# zp5caDx~LfXGmCO%*FsQsHXE*m{ik_qm-cY}C%yJp4@2#rIza88IzrtOb%NS=J>sV8 z?B>@6$}T?&mG5K8@;lv=yC!Sj)GaxWe!5!txJW&_o9uO-NbX^Bo@nJg2~~biYbWP_ z@{4hvN`8j)vCh*X>3f;%b$TcFG5HxWzZCUH&p17s+@JVy&U49qVIGw1b^0YgZ}Iz! zw(lX__ALX@$2%`1zij$}qU~D-LG4QhyY(C5*6&42_mahvUhyl1hbF&b`k~3Mkzc*= zt0MKq|3}g%4~wKv9)Z4LIA1h9#Gkw&+4e2a#_LU3#JG=yTj3}uJM#!{RGNBe2QM{uKCNJ8$8UvX~|l51<7j&k8zyj z>GVUaQz+68VUxYi^yDJ?LFXmH8P8(HXFO*le+KiQWUn(bd6uPHBigznJnAfVW;W~r z=fDZr7nRqs@C&80^{9Bq(a(opQvU@O{$=t)i--Rwd@7y=F-YOUuE^+m%UA?8Z{$7hdhW=UyuTkE5 z_!sFmzz2~xQa|vzu5ows<>D}JT$rR0mIzm$B1{OW}-i_{nYZ~8xz z|1kZZ$^W2l82(E%J!C!nE!oyDwD$x5g<8MYpw`)SsPCA1QX=11jY^5E-)N}uya8%m zmO_7&`{&Zg7m>>#YkkJR5?B^$eU^h-pXH&}=Z#QyA{NR{RDfC!H$kn3icssJ68UPp zy~vtZm7(U_%~12N3VO}6s>oU=)sQvMs;9`F*GQ>F_&oBz1?v1$6E1~>bAFFY;XF{P zy$AoF;we=Y)`9BB$T^{2O5GIglk254bj!I7s{OZH_#G(?kY(5EL-hwT``|{3&;Gel z%AJI(K9GFwN@)zEox4(+z!1C}z1r8*jVJkHL9>+RDUtDkq>E3vhkC33T9}^mzsW6A zT3LSF|HG5}?oH9YTm5vO^zeSDep0yl=T-J)+E2A5AMLvyNQvyT9)t>i2sWkP+o9L} zW_zf8R-hlh|0Dg$_apDsB$2P)yGe$x5U%~b?%RAR9g_Z?v?^qt_d z+wlKT_kx|F-pl9$yTM1{M)(-ixu7f5`x4!t-hVhT)l+$Kq+Q-Q@QIYjbJ-r$TlZ;C zBI~&dDT7Uq|0i7jU+ITF;}Q=F8hq^JNTrt)q9K*2jPMW@FLIF24um7v6{R3m-r|_xsR| zKhDj6yqnJisC5+iZo{OMkLVXY_kd>CCL>q$@ctk29NIkvs$QQ!wc}Ix6!KK!RU+Or zWW6_CK)$kT4zlhc3gI`!!wbUj2Ur9Tk>7M!0*m2B_!-oCodH)O&xBjyEVu)H4kwa+ zHk=CQz?pEa+m0`g)nD_V`fEN^KQBOklzhL0vO5c*`fm|be=mmW*CoWiR=hN2IqhlU z!T-bZ@GDpj5{_N`I%Nf12v@?TaFy9j{6F%C`$|$)yW+(p-kG3w4n2i5V`N`5<5p7*6-;RaHq__15Z9V>C@`;p_ zrpI0quJw4z*5m1vUy-#QMXkp(Q0wt5Jjc8sANub?%J0Zc!so2~c;~!m>rv(CdHO{d z7rx}`FS~k6Z_gM1K%Y)O{YgDEAO3=xCs(27$$$H>e~72`_Ak_Wy9Tx1t`kq|$;0=s zl`aY@T{KjF*K)KjO8H9rBI^uBwWPcimV-;-jXwEh{6Dhl7fXJc z#}$zET=XV4|B7yTm7wb3g_`%3iKq2@Gt|1P0!v_3sC8EjYTZ?bT6Z;|*4-^o>#io$ zx~@fjYF8Z8`ewd1c;}1Z1$B_CGGA|nbzxnf-eaTwgWMWsvrgI&|7^Ie z?*aFHe^Kk}L8#|Z4?(@>*$(PG&-SnbOn|ySNrZYIG0Ep?c{kz7$R`L-fm(+?SP7;= zy?5z{dhap-^?QRLgapSr}KOlUniSqk4WY`&{<@>x|r;B9`!M^kslN7IbT=O51=2q zLESq(4t1~B9exnboAw0MePIu%=YUUA|JPwpWZetqLETe61vkQ{;Q`nS>iJ@CxHJ5W zuMb=R`%)#jidr%(4-hOCuOhhK$c;7_JcYGA*kzUBJ$DZWq8%MOdO!=FOg;i*t|nDVg0Gkpcf*NPqAbStM&w0ei# z@`|A9O*rzAvrZd1AhP z$2cGAcZ>^Q4@fxQhhOMhjNII_NQ~0|i;35Ym-v=hK1)TjAChC7uY9X0Kh{|;QvM2) zz0OMC*CwwL^GlOIdd9cJH)5K`ca3kgjqe(hz0O+SI*UJI8qAL-KJjYnUTy>B>)gH( z%CCF_kE;0_`XB#N4}7JzW42fv5@$z z^S!=Zw$67;W}WX5Y1dwpz0N*&o$nVJhXcMNmhQ0cprtz`nRGvhq&sY~*ZI*+cf?J% za@tYi#XCRwPFcL4MLV}2gF2TVxBBt?-|ENt!N&ch#gks~D}{gcoi_cizO&?4FMLL% zT>QW3fA{@n`rmz5&^HX96HO2CQx|*}>5nq>H>7_qNl*V>7H$4R^S^(qra1M-y^1C3$9Pj5`EfWFLx6LPH%V=7@tdaJW$~Mu%>VzSHnaH6MYEg4i@HRA$HN%xRSWoFVXM@8;5FD%;o(-P zZOAvV@LrMktnW*`-}1r#Bc~U(R=CY07}bP)+CrTlAE2BV&x5HCk-j705POLKhq9mT zQ)Mp`QWKG7FGbnMBq)0s!@WWgatbov|4H>hzWP`F|?=8S0%aGCy)e=0~n*^8<3<(lNCI|I@JxK1zDc$4*f5 z@evE}Y~h-hT?p5_RJ@A?kEM2X>j6pMEw#H_pT|v)|2O%G)E?-gsUKvXJ(-$^zRZ%I zqRn4O_*1EUEc|Ja_`OqmS-!m`Gfz4HBZr*+sn3|cf9kVv{q+8+eJx)9)aO)Qalh35 zakS<8Q2Ek-F7>3{wsQSJLudV0&4_DIem*Fm` zbkQ4zroKu(-KiJkdG2eL@8ihiuXt{G`KhlHPwNj-zc&k!h9Z>GLQe3d&=`NC09 z!`y%l_Fxl&Tm^#kni6ZN7 zyuz)#2~h1qW_?Xc{e<*!&g9gOU>=n0bv{m=V(C8-Z9NiB{7+K{^81iDXIko1i$Bd| zuTzlfSp0znko8!oa4RqDmWOQThUw&^b3-xIx#2T@FWGSV%+wih3EVPS=Z0CLtwR{s zfb-96_y1Mqz!sbX=E64c3z!P$k)O^5^O4&j|Mxq^FA3LqVemZ-53-))?uB}eyARe!-Vb$tIRN#0tAlU^ z@*(&P=a?U$?hg*bx}^IN#-Tp~Z~L0(|L_sg{RH=K=l&n=Al)&j_a2W!ou7Vzx6ivcDQ1_=7pzcpE z!V$!~1a*IU8S4J@3e^4SA5izFe?r}#{snb^dKK#a^lzy54F7@peb~PWrybW|EA-dl zOXxlR$a{!UQ0I$isP`9dfI5$rf~#O@sB>BwsP{r+pw4GyVLez5>b=kMP`@9$5$b)* z8(;ExE6~3c{E_z>Z-O@?SA?ypS0#VseA4eDolh$J+at#~H~XvmWlySztf#6bd!6e3 zYW|2{CY*I$L-ASHHT}21JSf@g)bht!y7r>^S>@ZYu#WWkI$uEZk9AG1=fBPLJpU(L ze(`p{{Nf${`pEK&qRtTwp!{M(cn&*AKI}X1^tVJlJ@YPqWAdxwY2t5zJfiq6mB&7| zxxcAje)4XGvmb3H(yrzvd!2YcBZ1sPjHU)r_tekuO_bZ%x()*y^ zFGQyN2mGy(n}pl=A0YpDr>#hS`2`UDgQ^Gn*oUlt;+=LP`ba+<*vt7J{U(@5Kj_{h z3Ch1F6JA0)Q(zV9<%1XLk5qVoa6g>N{x3j$`Q;$;rs-+^Oyup@uXO6OdwPasD^KBX z&&=}YQZIh*?+;o1a{Sq_G&12)Lur?&_v{~r>!?=;i{HuL(c*XV&-};}^#|dQeAf6o zTlgA(7t3djf2)!Ef70um(iK*M-C$+-I8;A(hwA4i-1_%`YWI^+_fkEf`Xi5cr)T!^ zKLtk=Kke^tq-X zKhXbz)qkLWFy%$<+u|PtC(qnsvc`W1vfA|`T!{PaSOz=EqQ2gYZ|$kMZ`u zX88~I53~G-``<)AbY{N)b=vth@nO{1nIrsfz{wDO_3?x&-lpjz{iBgJuA^*R-;!+O z3Mqe#|7{oxKd^pz&;O3~%e#{4m$4%8-!s|kyzjRE1Ce$Ap??zbVx4g!@y46%btd>H znmkF&FXiF+KlP~YeB}R>_;Jq1{>d;8O7=Qa{GV9-Pepq^OE~qL=AUZyo93Tx^$Yt8 ztbUGU>Q^XIZrEh6Q{>ifx{Xh?r`SK+(#`UJX6a@~Cf!VtbhAwMI-k4gX1nQDPMbr# zcxSGEk;VH$wDaXW7{~a`xB7AaZ}sE;-^OX7#gks~D}|T%7n^>Ge;N7J3ojKZ7yobi z<^Hcszg+X5^W_TB^pJhr*Zx)XhxX;r)=i0(v&O&L=EEBQI?`*tt%aIz$i&;|UvKd? z`Zrj-jmnpK^Ns&o^3}Y7%$v>rO_px6^fqs{`uUoy$K#3F7x`V!HuOc4)hz;bD-a0{Tb){=SkOe2L2y;)AS4e%g9<^ z7a70Z(=SQ3@q>20z5?~W%^&cd8Grh(+W7n>R&Pr_(Cp^lurdAn4{Q$qg|Z9Rpw8*n ziJx2S36u(W>U1uS5-BHIj5>sUzX7%&9x}gQDjg_;tn;^6dq&wn3>-4EY@l2q^1Cj` zJh?GY9!5j%+s!`jofaAY^LuqZsTjB^pnZJBKvmMI-zq`%o7ciC2dW@zd~b#tZ)DO{ zQ+&=p)dJNCSHDB@sTrsNqn(<8TVM#rq1X7-a^p$9SWr7qhjwV*L;AN~;8xnbdwShK z18a9Zk^a9;wEh3>mLKo`L7l7WL!CdQ-&N2s(8%)T{vSEoxiiq1^qNl)eUrdlt_&%^ zY2a?cgUll_*=ZJtCtU4s4%L2S@@Wyc7g_DU$JMul>W5ZtJoLnC8@SK%X&bm7?kZ>- zXbo4wHZX+#0phElAm_dZ0}oLjjXxw_`#?Lm3+lZAg+n`sBu|N)E0RdB^G9+Z@_VNg zsPl&p>im%kb^h?fm4pZ2G8lw92c(f+=bCirKKHY8!I+%LJ$n|<0lQ<@LU1w6hF`%P zI1A=N?f)N!+IM$=dT!AX>bXTHc;_0<|4{FDc7}T2vkM%?zVlId2jxE&h}@HRMb^H& z8!UzXad;2i7 z!)M@S_$*w5zAx1K2+zSvr0WNdvQK^JQ1CF4mvoWyp7ntwLknc<^2z=?v zknc<^3@mbG$af|dD<8`j^1Y9xfv*U^8eS$^IOO{e%L6M2FGYVqo+GUctU``=z7{PW zg6nz0Q`vX6)?^w4ZSHXzpR)oOTfEoOTH6oThwqjyi1q>8HSt$W6jWtRC^s zQIY!RTRc5~{~3K;_*mc<>KX4G7p;Gw?W>hvch>DmsOQ?JsNegZ(}7=+ui+=5+4nQZ zeTa7!S@!rh^ONTSzgs=d1ifL_%5Cl`n(e{d05`;JSn8Tnm?`d#Z4_&)Lfd!Ob{ zWSs;4g4*X_g{uGGQ1$x<>KyPd)cN2V)cNPSTOUs_QqL%;a-*UA=M6#m@lwIcL9NHK z!O}sk$1;*xk1-INHF`|b$Vv-;g8nfBc-Qtllld!71j{Thh$3*Y}I9^d~DHnVtlingC`47Fcx zV&(As-^$_nzxC(c7EgM`=llP`=BAGi-a~%%!YxFbXApg>U`x}t3bsbi_y0xHL-rN- zOSXLtwDE2OwZCo)wf}tpYTx-F)I5ENblP{cgW6}bCtUM00a@dp2sKZW2-m(j8J55l zxDooG_Bp9g`({7XzBvH3Zw``P`{Xoa&F6Gv?O!sGweQVD*8Ivs)_e{@?T@pe_RBd? z^E(%6-aiaaEXV&ty|3C4YF%`K+6O-Z^?qt+sP{g)*f>5K?1ns#c#pw_uq#{&31^)? z9_)^+bt=}L(IfZ-95S;<@JZ^Y?-W4xvw6XuHg0)A?Ps-4A^WFZ!KZ`TKlKVeM||~X zZ>aw3W8u#P`y#7AJ1+zWzz`gSUi~!CjVJkH z!QkK!cf29;i@}#IJ^mjCX`kdK&MU#8v?q)DLh^q#_?p^FevtpU85SIl+yOnL-2C9{ zt{zg)5y3Ys-H70uZa$EFM+QeBcP1Sq-ss?47H@P=`$&bu(n-wkF+or1RAiptc$46} zL65hcE4PO4x$^t8Lw=>V{m=D>!7q?woN>WP%=cJlyvTf?U^0F`IFa_tuMn>DzvAos zADj$1|C`MDKlq8I`$9CoqI^3RPLH4_*^&K(nZ}(Kg^?C&4c++^Jf9n zeERSGt%anQeP0A+zZXN{FTGO8kG&W9O@Xp!VtiLY=3sL7i8w!$;Y# zd(tB3mMExmOEmP6{s!2Jc%{-J=O6ypz}9t{G*9VOSagxSIUOz#Ay<9oQec@-BR22j_pN=g05C-QRQmCtuwUeSoZb zeF#;raZvRd4^^)TQ1zea)@u^7>iH48O1jDLRroO+1*gE5;3v|P|EKT=A!hU_IN)0gLDg^z7P6knrGxI9_ov{iu8-1 ze!sF9>RxCGT*|yy3OAC^GPrs@&;OzBkCwx&gs*_Q7h4JSyX3E-?wM9W-4B&O-4Cs% zUvN@4+P4YTr`*j@&+WHB`H`(q z_gLGY?%}pW-DmB9y07{U>i%jc)V)#U|KfM0U7}tw&hE7Rtmjx~kH~u7Ycjw4OWVhK z)_#z1?9u_n$1WX8I|%cjWPS&bcG%Kg63ve&-;RYxq&GhT&5!(K^3Q3GDgllJQFwMB06m$zG>oIwd1l5-G28x|jT8VI+OE^qVbx6*qlVH+?lX zeRVf|4UzeAOL`s3;r&06d~2D^`9Hn3$#q2YU+9@9x2E4g{5YpxdR>?YCG-AY`t26~ z4$=G<;nc4|dVQ;3gY>(seT~x_TKyVHrhRvcl-t;3uhYb>-(8~lzox{CckWJaW$~Jc z=Kq>Q`L}p02mf#7;Qy^ZTUtEn6~9vWzVv%de_wiQ@~aoVU!+{#|2KWx^fsn%o8At6 z!|(&5=^_5_A<5?dpv{x^Q2s9g&Vh+g_XSDBt3GxAZGsQZO(Q1=aw)4qxx{6DhpC7!VH?2(>_ zjK3^+63UPEgbSgo!-wazmHp=XDs~L^yiS(Pko{K z4ViS$D?axC&!_h%TBC$Z)>yP>c)HH*hj||d+IwHGlb`(l$=4$Od<3%m{+sC$ z{YWT3Itt3~zXj#@M??AFx1s#)7%2by4(a9J-$j;R9t&HrA9xR@!uMem`~d!f{zKRZ zc^uSt>BqyS$P=KxPd^cAKQRd|BmPHF@1ISEKKL=*L--W89c72~#v$9r{y#gmCObSn;tB)6(kdDHwmvzUr&DV&N`9&@(UpP4QeO$YNPc>yz`A{_C?_y#%B}te8{soeG9Vg*F>$q zt?+Nk+eUwAoozNbf1hER$2-%%C%vB2Ld$O#lzrOm=CcQC9q)x&$NQk{)qbdT ze1QD4&JH50eTSgR{lV&WIQ>Ut)k~DUI|5~&j=~c76Wj=YhFUkrpzPCeDEssa+yPI( zdCuwdlW-wC1((8KZ9KUDrye?=pMhGxXWe%G2G#!Gq1t~A%07H<^YlV`#SG2Ui|K#R z|FO;`k^a4GGXMLReuZ{uo)XSH{ZsLor&rVeB7Po}>~;Q5|Hsl*%z!pem2bzwYtq|1 zg*Hz;CP!sNo1XJO;hLv6WN4n2$|#Mjc`9n2mVuh5F;MfAe3%!p8Rd|hgv)0jGjDDb zZQiJyxNrqG{3bWt(pf)LqFnWZ7iu0e;sxBs4dR3~5U zXKFz0S8jpYuhfLv-_&yRi-YR#+EC@xff|onGqg{+J)>@h_9^u;8d2}7g|~^+`*xH0 z|KE)ICN~nToCZ+kHnetg{wKc}=gy3~NgwMp7D?a4WUq5qMpKjT7H$85o^flI(USOa zPJBjlmoe^*Xxg+AW7H{(Im-zVDs;eM$7L2I{uZQS~`wR8_y zJn0p`Qn+2lL#A(+kwAX+!tF)si~l!$QbwZblQL4#Hw-6>riaXDpJZE~(AK3N&U4Z- z0&pP=!lf|X`W63=taX+FwazkO3Cx08XCbI{mJPMea-h~(F4Q`Em~u5QI#~Jmf2i^7 z1T~(IK&_w7Q0u-6)c8IMXYF|`L+4-3qpmiOx|ytbr0{q4teC2Ev4g*Vg82V?-hC2T zey?Xn#LwkH`MIZ{;y;aEeyx|A?$pG{Ik8WM$Ig$>K%Ez#g*qShC7#Y#zu9*>`(=zp zj&YvP7)U?II{iiZd4S1YXJEz))K}}AaOTS(#b>?@$rudtpk%M}V#Z6BZmekQT>0|< zf707JhqlgNHTkuSVW#K&Pq^0kaOMgB|CjMPvevn%b^Zp_Iv)YG&XteOH6v|ay`3=% zxk>mft4F*uTBQEG-%q&w$ru*^!<^r8RWLodJZJ{*et0r^IG#$|kH`H#yO zPxwT_p^f(hsPUc%H6Q-710NAj>v1xa9rzf^4orb6=M$*n|gPJD=Zhj8b zyec%iP@ECA`CF9nIsJUKaJoqQicR)9pJmK2`E$|Aoe5QsSyq4SIr+snvoq$CKGvBd zl76nqUgwL9c_z;n%`Tv4oEKy)A%2{*Fyl*@2PO0We;JD{{u0sb0^w#CmZFb$mSvQf z{wvY!!g8o}zrwBGO1FMrTe?*iPkP0#6ke0D+VpEO){$Sm@LG}ja{f2{hK%*5-;l8h zeZ%lZ(ex0z@U3LC3()#~GnC)n0=53PLfw~bgYw_oq5Ss_DF6K(l>gpIej4BJEnnXM zCtP-8H!OjB;6}I?%5Lm~vK#xM?8X5oyKxZqXZ#OA&9fh%=GkHL)wur%HQq;{?8i|k z`|%UhJp0+k|5(OJ(!E2v<51^-U!cwfC*V9N{lq<|WLKEK-2c1dkIX**Y{r=k?Yqxr zTy)F(&CUOJ3qO}}0a@jrhbkYLbe9yL^TDNz%Y>^xAo={6aRo*@e`fpvL+~nkwdXH4 zo@BoNlktx`9uWE8jO&)3^FP%2KytL>$&AX3^dlty=*$~j8S=cZRAy;pts_XiVlvBE zyqHX#8x*c{gMJ@UF4GfNV=?dl!$*;C%>4iDX$552)0@!i{;(qad_C{~L7gMKQ1-Pl z)H&j2sB=UWsB=VB(#zgfL$1sIzdF=CVGWo~dAGRb)kIEZp4EbRYxw;?%vy>6hncg{p5osCL{2b)R@U)cxWeQ0JZcQ0JEhFpKmJq3$^wL7g}5g!^H)PLcbo zCYc`d19w5)A2x;Z2X{l=i#4OZ@(0b48-qo+&^=GD?|ME3#Qla zRHXls^*soEjAwA>5Yu!2Pq_T|i<$D@FJ-=rEdMRaf4>6dzlTEkZ}P!kyp}l{`Si^E z%wgnL#WOr}6f(an&wMXa`{6e;U(eKj_zi{Q_eO}c|4oy<&d5y8k;tROsMgG{w@9zw zPbgpQ58k$N#$=9DIs9Ji9jNbOzY7Pj-p9frkn-&Q@qKIe2bmut>-}O;_l%^czLPS? zBR2_8$ecud;+=^i<>wbb^dG68@N<)`zvG>cMf8z=tG*lmk6!mypVDu#_fw(l=`<)i zU!e5V$AR(_g;4bj!x6yQ+BB zi_GT@?)YyMk-u@}Z*4w|DBh&}ZC*q2*_OG*^4XfX%ktSKGS7BqZnyGxNM@dWCsO`S zlfBOOZoa$Re0OK=ar1@r*S^fXFcu!R{0?RAxBL!BCclFs`5iKu`+qmT!y@bZ$IN5I zi*=5O#5-!T*ZC>)XOoYKwl71^`aYg{n)q?fiOgSM9+d2LPG+96_@_nNml00=&Sd^- z^*fV!!RmJ|^Q_hHH_6oRcad_>ne27WyY;&u+P>~0@#39JnSWcn%cAY;u0ZYE{;+bm z|F?4R|2Do?EuQp>Un%@==0B$YH}g9A)eBz}DHs25`lu{VmijR&t8|w3b zl5JlHqqLsNz#`U344ebYLam>2Q2V*^Q0whRsC`{5)O~OT@~K3*H^GXqBH{WSLM5nq z>xJ6qRfZ+-X1Ebnf!gO)h1%y;gIi&BsC`}yt0(>+YF*can(wus_ET|C`>Wc-_fh{k z$XfTeLfM15glpef59+@9HYhuAJJde)4mhH?e%9U8TmGQ|lpSaYWd|BT*?~LZjj%EF z!X{95;Vvk<&=ks!kPrLD_^f7dA#4tp!WLPwyZC?P+A~^a-2;crgt?LT(V*=g?#+tq zEAE5kY0v#o`-|34{=E(K65f{fX@9|Y?(lODW_3Z1aURM_WSnE2b|T~4-ej+nn3X{N zblxPK`JSZs%=eV6WS9pfdmUd^s-^29nm<#%9SZ}}+j$e3ze+PXJuAcX_9^@mwoOIWq+T5vcEl`?Ddmw{GM(;d2T*WLCvqHvt-Af$?9d} z);sHY`sZq4ACdY!V>13ftFOt=i&oBaQ04Zs_VN6m{9>H`S%XO*>kJS{|ANWf17r;{ zd9Y~q2tDI7Bx@+~lKSXR5W`;xY?6e(Z@TlWxZ+oVWQcS;ZXJ> z->u*4ZvEb{bR#UD^on08JSuCX=|^RaCck>&w?yiT|2O@ZthY@+ChI-)4a4th$GhtRnq8OxOPCiEq3psWD7)|xlwFt%Wfwk%vI|q7 z=D{aWcIs2g*Z5Dhdf@+|=0^e4{BWS`L?M*j2t$oC=Q#V_|8!*i?!P!ozx$t&^%-0O z`JZEc_dip#cEYG@yX<`^JI~A}oz6XTvLff4xlrevFW}L+_ap*AEn;2ky@bWY)4E>buKT4>=Za{{hPKm`rFWQf?GfJ)%SE7w-Q<8qZRpa-@%SN{gf~ zW3tzY36(XuoM?6lJ>yzFRFU{`PHgB#m=NN-mnxx;cf6q*rmrlT zUAh^{?o@H>SJkawHA`3B;z_UgmBKYcx0t?WD31Kk_7yobiI-%O8uM@freZ%mr zqUj-ash(uBOVI4n?QovcAan;@2tseM)sBygqYM!)&8rN1(^XFbDJ9QtFow}d?i1M@vwYGj~ z6RJ5iGXEg=H4la!2cmal8-;+ zgVByZlnO&Ih+g##xbY2_K0XD@8eMSOx>aG znVx{UXX-(E+2bdXJ7GV2LVd3!59;3NDX8bwPrK#TeI;_w(L3ZZ``ia=KlTiiU49l0 z#~$}3zU=mM$k$2V59;3MdAOAN^@p;@1K`ux=NF*vdj>+i|1}88t`CN?&qLt;?VSJN zS@L@co`)|(ANO6az>VZH6#flgh4K$=UXi^X7MekQVw~Zj5v+$;CtqYeyl%4B84-Ge z@sqtKoOS)C;mP(ZM3%i4Wv|CU+3WF8_L_XK7ZXDc^68nALzBp_isz%yG~^M*lT{x3u}?!E z+xncMaO~bEBJKLrWUn(dghxf5CYoI>uzZUw-zMS0P!Z|kov=u}`~pb1)0IE=sMy*a z?|derw|YfQXZ&WO*STR9oQnK8?bN!R4Yh9PK&_*>+B8fv-tZ( z^CyIxKRJLt-Z>ch$@GUr^Cv$*`HRC){q`eNJ&#zrqZUtk#jg}T7W&!r$3nl5U%l{g z(Z(C1KN&h<`jeqE=o^MliKd6xzh5PrKY=zM&cY(*$8S*f{&%SNde1?zw=tEP;PQ`JKO@?CVu1zwm~6c^aK9|8_%mnQZ1A@k+skuryo>3D0luiODXDtZ{{$d&^~)cV)=@j?KOi z@?Jo;p0jFxN1lgN%)TjG{-9!ZRmxL4E4k%*ExdAe6=b#hW+?xLj320``1qr0+0_YG zy&?J3%&r0X{eSi?kl+7j$Dvn0)^g)X=J)^Eb*QKP{@>Ewnq80js=w-*p7X!ub6fW9 zZaBmr-H}}%S?d{6kA~R|EPcal`6GqPAIYEGnH_l!&=|Jm9NvU{|JN@yMV4Q>+toL7 z<2Q%$OYxFn3n;&I50qbO3FVhskzRi3USvIoxDW1t_d`90Xbpop|GVY384&rt_ygII z_nl9^A2|m+lDbR$Ib zW6HN(~2aKZ7hkCd!XJ3+2c9LisWBVO{jg zei8Zf%mLZYlV252f0IWP4^VmdvBB9d*g71jaQxUHk#-F>+3O6+j`*<`MZ0%@$?|y@4O+JJyZB|%=0%b z-pK4x$dizvt>3qx*5ha>`|&pIsq7h({SNVDA4J)kccH#RG8TS7`oWKRYU`f-ePr3; z51{Pwhfw}(98^2TL$zZ9)bB+ny5&rQTIV0RKK6E9_IkqAZdhYi z!8h3(V6^j1_C^?jo6xI2zIEeCzF4q1dyCuu5P56%c1zFs9|ozfv089)z-+he$8G`2&*ch`Ugu2que4uwhj8r9S;fch{GR(~FvzKSfnBg*dl4P|%!fwDW~!#cl~9YcPnXGY~*C%-Bl zPmbgf#Zfuvu{))6qI1muD;&F1N~B$-P4+rvaw2voMl`!q*7A+bDMvoM|CbX>I^O>i z&Avd&t)Tp|FE@$kD~e`cpsiak)V!<=HQ#O~zP|tV-+gUWWZ8*oPeU#ko=q&?UCP(&3uM0BopTT6#yZVJ%582k-~Y>LVe&nq?SIiT zZ(8QGCVrfAZ%!+i2PJ!*`*QBL_^n0T{}N7pS59k#p6~zVB%1yK(e}R&LhWxKf~sdb zsCu@ybO{zudd064PR>a(eR7VE{OW~ML>n)N-k+0ddVfwj`i9|vXnM$cPm^r+7nKFCT%jmz^nB^QMcH z&-ow9A3O#%uew6nxo%K)?s2Gj(Vg^~XHP(VFRKTXU44@JSN8PG**7sVequIuNAC;j zy_2VNJaHX%;Q!$hg!hKBH+{(WfA@XQBFldDMX&wZb8rjn2W7vWhq7P&q3qHCsQh1m zdjDh~RKA0t-b)z_uMmF-EJl72=IZ{c@;ZEybZ@|8i`lQhlkiPA3;jsA2#%s%va4^o?Hx_H_MvaX^^os8*?T^p zjF0R;-=$yk2pygh4SdIG6gxdGcg4*|f4)tEkY^eS59H@Kvxls4;UqIc% z&x6@;KI{M&K-~j<3CEDnLa6(mMKG1|TMQQvZwXA?hX034ke5Myzx6Aq`=aGg_dhG( z4!9ETfnUShNVf{kC0+^q60U|z;Tov#V6BDUz;&<|?OYF|;a|DBKiZh{3**4|e{#04 z{`vlo$ok)8GT;Bn+06Qp|05hbwpH=5W7~7KLB9WEGT;Bn`Oeb)BAWkGzI^{jdh>tK z{NHYq_vGv~J^r6??YsA3zxe)7&H-fkKT-bgAe8?*1m*vfkA45g?A=c}KO#2?AF+Dy z{U4F~=UY6zr|~m-zW?LukGuLvK24Y}C(!FT_emH;J_WTuJx%^mo?ml*M=mq#jL3KP z&We0z?>Euxr1aXiokK4>bsoxoU4XJz|J?^&BA)E@WhlFS1dy<^yJEKMCD!`XZ}AoI@kQaWch!Q`j$2s|DPN2{};wV z?0nhWa=8&Z52MsCPIinxy}DW)$?ZZt?1$W zk1V@gm3Z3ARp!`BjxE0od@(XcL`{&wF`{z1P`{!F>h2@<8q4wGJ zpvL1i%B@7Xw^Oe6(|16POMR&RY(PAXcSB_Pkw(b6zqu3YKBqC1pJ)R0zUy6Z9R8#! z)bG0Qw*GCF%kzA@Uuh0?zY-6Z!WOUt>Cxwx_q5Dyg?x?r!TfTbdvhDw{|8b2WbM;i z=iZ;IeRJ#FcGO4x)&{B{+gkVoxep<${~mPfi%h!qiqHPOeQpBbY9Az@Wxgg+}uvcs`taLz5`T$cXZ>Sk7~HYtws8$@T_}cH&q|=ymr|(p2SQT)GMBzIrp%eRUaB zJi3MSivPAED{kEe_c8yrL;XH;2UNVc6E1_hpz5<5sy^jVapE4RxbbtS`}@7{Ap8O< z9^D5O5ATPHhrfi1gAcgZ^A)n*C;#95{2}I%=J{c$dHyw29Qh5@{rtD2)BHYyta&NeK6LIM|sP~)CL&bl8K&>BtLOnOU0Iw)#|A&ef|AzW| z1{YyN_z!Ff|Aj5#e^B3_xCC#3t;Z{l^Q5&-)BKK0tCXhsT|s0%Tw!veQz@-tS}cx3 z&%BP8Kl8eBS^|th$$bAWt*WJKEm|C>e7%L$WVbjDS{zs1xX^P{L z(ym5U949J{s|8nKuMHK)kq_%d-L!_tCuh}9t4DsdJlB{!s%DQVZHDUL~& zo^`K*$aSTdoakJa7K>vViWV0(vV0q-H6dTcN7q9=XG5mE7HLh9TNO1+Ye9agPIHm` z_%4vyZ_stJPPMf5NOf9?wysF8xZ*~xSM#+E)O>9VHJ{sI*ZpTIR2Bhhl)2JaIfP*_c|Ve+HW3qucxcEfA_RUto^&CWm@|` zDpH^BCMP1+#PfH_zowGavN0s)JZ09Wh)2Evs`#*NoF9Yg&eCFp@zIM(6 z$uBD{8(G%}8Q(c+A?i`h$rY(bp2>+$AT4NeNVNS6JL5c@_B8&*Q14Qdbh<#Ani)J5`HUxX~qQRosA^X?Ml5PKjwr>qZRy;clS^L#1Q1R|?sC{b$ z)V`GuwQr5YzXtxVB5T}^g1s0YuR+DLufrO|xo<$l^>0GO^>4v>_>YF#$KHk;;25|C zz5}(7jfL7r$H852JoVOmc-QLB{Xf(^nE*9E-iO-PCPM9NA3%+_Nz}8d=fkwg%9rvX z@$pA#Q(ReG=uA(W3YWrZa3!2!bD;czfSG%oq{Uo0&*pT)q^;8@WkvFDovh?i#uq*u|xq`Dft&HnX|3UKKlD5^AAe-HKDi65ZO*N#KQAwNQ$ul?lK`)A3V%bb9xNOuzI{h(8DAo=|Qbzb)?)Op=$ zsB^mCpw8#cK*djIq2ij~q2i%)Q1Q@tsCej>-kvHE_$TeG`|$Ch&iMx_{`nUw9{LZq+|B+^y%qmlMpj(pNss-Vq&WCBaX|&xoP4ii1>!;Be}F4b=HseW>%bYoX59lA)eA zH-LY_6!;Ik4(j}?A=J59BdBw*#!%;H*F(i)O`y)bnnJ~O&7k79=1}on3#hp72B>qu zmaq~2t)Sw!)==@}jZkr58>qOlEmYjs4l15Zg^DNJL&cLf!P?~00V;0n2o-;Jf{Fug zhB_a-1uBlc6)KM9{?WeEcze31QW@>Wd3EAOcxQU-z1=(Q{jbjHeUKBJyVJX*YhS!a zWF5QLWWM{CeqVYl?nBRhc)$GF4(n(c(Vztap#dp8uAIeU9|r z!beTk@7a(W#Csk~?}6XsZ9M;n`hDBu_$PRtNbhO>od2U&T$qOc<;&^mUS!3EqT<2~ zsJPGv&#+D@-wK}0^f2|04P27eMUK>AKnfds};@ zI?s#Pt-iLuzQFZrz3&UP-uHuA$NN+NH$8*W2ax_C^K2m0x!H?Q`_f>jeMRg<|Gq?d zah@URFI%}o(ubn|5WUz2{x1%E1zGXOaHu$N1k`oqyM7~~uJ2W-cx4n+9QYbk{P#Lk zJopAwecp8I|CU?-(NO!$+wOIYv34Jy{*JZ#*z~E^?&Cz-VZ6zS&b#UFnLJgb-6o`e zK>msc--n}0CrYM2+5cVrB=h6^A6fOB40T-}nco!UYwZKcZ(90vWL+m@+|NiarXJOt z0+D(+Ci5Mj^dggsMT-ZqGyY4`XXBsje4Jhiqfm09Gc$db`Og+D9z;)hYiG>Cp6bj^ zUt;!oqQ!&rq2j#-Q1xC2RqsWXZn62vF8`WE%hH#ceOdYn@@rJIT(t26v9C&BY4%m= z>#;X4S}mF#vY&sFzLt7ve}~Mwb+X&M6E!Y2z+&dlr*IzJ2o=|T1{K$Bg6ikZP~)zQ z{1hK4O!!MJ9fpJJJ2f*+zB_pU2qHB4HZX}L&br6;4b(%+ynQ*hso~? z*d6X8UyY~z@F@He{k~=F|Hz7mzJi)J2hl4|Jp>h}9)?wkQ@@6aW50o#N8iHt_`dfM zxRmSr4z7Vmq2l0UjbO@(Gz$6 zntlrM{onLoAm9H@KW*cm{U5)op5M~XpjX@qiCfR6|L)3=d3-+ooQ;R`>53CIk7IG- zh4equ6@Ohw|Ie-GU+(q)ZTgGp|01hh{()*QWa6<)@+VHblzth#`U#Rx1+T}e_^yIC z4)%Z*y|MPb0?JSFxq?dGcyDYRLF5E)75w*MuME4=zLG0ARlQewWBm)USMy%w%8>G_ zdux(j?OOw?-;ha{=&g;cdMCN|tD)*&%k{&~b=39Nv3%=#>yfX!JLcxc*I{;!A#?L;pAT^4yZY z58Fb_Z{uNnA#W^h>22kW{oN5*cYASbZ?!jKe|JRGxl9{xEFNnM6`!?(io;T&;+ppG z7RL8YQ1MX*sQ0=%Ld6@M$XD^(%`koiap-i)h_m#-8BZ z;l10db?#1)b>S|P6P>%go#{_KpF_|3c8~m7-|q9?3!_jnae()JOP4L${;qtzg%8SZ z=Q_~#?}tt9>V3rQod2WO{@u;1{rgdGcVz9~qW15{p!V+`Q2RIeux|RjPmn%-MNe-U z`Q762iR`cG-VEx)@Bc)uBfkKezslF&MHiEcGOgaJPL^ovp!5s&a{f<#qdd9ZJoD%L zpK>(515o2J2sIu<_`U84dn5R1e!~3MJW=nHt}OER|GdvwJ)aiy+fkpG{H&LKmhsSg z$p7}+=kVA1-W%HeKh%EO2WtO)!L3JMw;ui6dh~}{_Xc*StG59AtZ+YK@Q7Adl8SQ=B{Kts4AELMY@Ez=_&RFk6vyT&P zKO7IW-@OafKJP)*dxE8V-~42kf6byv-Ve+^$vc_+8WnvgT0cYVQ@kIUeTsJm_U1)X zMYF@Y=L)7vw*3&=xF~?y{~W0OuMp}vUJ=xDy<*a-A4;Isqf)4K>SOHs4)jd&)8Ct$ zW%+adk6!!U9Jm3_gYTsK3weKw=y~g8WsPVW2YCJBreqZKYiQhu} zmcylR1zZWyGhSDDS0ih@!u;1fYrLPhGGyGZ^{zu!ycpwp@2BJ+zhZ-E<2NR6^lHBu zRr;BC6MC&{Vp~s(iLw1>i?__y)h*s#ZaufU_1tFq?cSZpYM&iY?S;&Gyj%XP|GT~A z=yjct{b8?n53Jzq^?nX}zJYe)Mms`|gWS_m%%Z-M_Lw*!k~&T%YFE zC8&9J8EPH!WW?5?xQtl8RDc?PS3r%wictMgDMRZ}m5lfdtwRYJ)ibmXRTi0FRZLEF zs%Bhia&^(lsRmW?I6GZ&uDM$%Kne6b?7Fjb)*B_06RjhBb}he{moG8$SqLo$gNQ8$ZeFX`E|RM z&-Z_z`twex{=5rnes+eMpLav`@4*i|$?r4%?nPF7bYF%ixsdaR|9$`ce)Niy9zd_} zA3X>kS;YJQQ0H(DL&Z&9q0Z+XfjYPA26b-tDCreHbw_@Z_~tRVZYlde)VbK>@LBXv zz*O?>300pow?65}s*e}yyHOcX=VU&pb22~FIawyud0-aQd0jTV7Un>mukn2*doGy= zmmx3WJzzZ#3-aA2&C3wfybMFl%LvqS!zlI8JbV)Q4eIq2wCDeD4DvHj-${BFCQ<)h zuov_1IjHZy_lBCU&%@EM4{X49mtKJS{!(A~Dd&j&ppSOw5B0om0Mz?k17QO4i!f<7 z&;Oy`M;;7y-t`hx{P;4|xziA+^Qxgx=SIVz&e>jpI)54tSHKZa&j<6NzK=8#>U{21 zsOO2JpyJlopq?kTcqJBZzLnvrbe8=XTDT(#*56CcTG-o-piO^^82F2r`VbQ6O|A1e^SN=FbX9nIv-|CHvbKx z#iz0IrpRvP#pG!j(_I-7zs@kb&ZA`4`ICb^!Bdz~WOnv{^on1LSr;x}F3BiGR{Sa| ze*G9Kew_)=Fz?8Rb!T?QD&&*1=4H$wzgnKT8B35ymCnmpZtLfwjQKXt7f8?gxlrW# z7nz*sEY66XKP?gMyC_SQAM<1x)OUTzhx}G#taPsjQtl^KZmXiz8K01Es#S@8w5^=1dMp0Di0KGHMuL;bz(xr~>lzSw?Lj$Ql09;i6@bEtEry-?>&UqJcq zgW9k5L+w{zLe=vCRJ(iy)h-9!`W}K>&know{@Sh2H`Wf{W}LEqIF@n5`r*5b6V?w$ zMcU(-NdFzr_#Tcb{UPHg>&N3FEuQve_H>t|PxjMJXcX zvj3aCk*}fI8~GTQ?B9(=vqSdpCX#LchBhyn!D8l1bEv;N-2&=7>IVF3kZ())s;8B& zHG0hlX#4Gr=&O3#_}ZdZoDMnnY3ECIWl`h0J$k?ACSM0PJ+$+*j^v|x*a^Mn>&;N- zbhkjA)7=W^p}!3(Znzz8fOo(x@J^_>;V!7Sp)=eC?}mHeJy7%eUa0wfAJqKr0v9?D z`tFBI;RA3be8~Ef{hxYizC8>TPjtmz^E38;WUU|Fpx&c=6eMdmrH-Q33~1kT$s>P#&n4i~_gq50AY1_>l-IH(EZR7L&5}!^z9-%5h0WTP zJnef5E``tA_i^GQCuXt@Jdc|kMpyIPv(93@~ zR6I6<`ldShzSpe2BgN!X=wF3r;V7u*m(pJ>e%&|5u6MNW4XekSlDXcuM6P$V$%)R} z?)8ollP?v&ObmJtGZoEjkcTHyhchgOrDz`@dZ0_Tp*sx4-`@>hBHD@OdoWD}ajk9H@A&5bEy` z7s2L?|6-`WUt9wF!BX;59QZM^{(kXHI0?>z`n$%nq5gjL9H_r*J=Yie`_uEN&q(C? z==JxJ7eM_z<%MuHTm%=x#ZZ4=c?moOmqPu0=VefT?|C`g3s+csuJNt3_FUy#Z|%8S zq@C87%=iC&YfWA+T70?=>hC1u7vH*ggKs104itVWTKmHI+lxQ*ZARa@c#~*)$ln_- z^KDf*MO#GEL;l|IHs5yi70DO!_l9@)b|I%aJ4N$@{JrgR-)^`JevbX-;yt3-A%Ayx zukQ==`n$t0{<`9QzWvCJks*K2`%B*ezzDPxwxu?_GRSG(C(TSp19cH2OwGzlx@Z@k5J$^PNSXUwlS1J&gAi|L!}F zKDYRsXnGj`dhrF{A8;Z3)6!q?{f%F$^OtCTkng$v>$?ai!GGXXcnQDeMgNKB2g&cU zFV62t8C&e}L({|flHv+}=10oxVw+cXt{m@=#rc)|u{d9{;(Yw`QPfl#r$tI zInlYzf4lkLAzD0!UxO=1cPFd}@4`RT>Fn=fes_y;eQ2M1U?bY&Uic#NeQ+q0{p-T} zZCo5Ev~gkQNe`k|{QeMBeEu+0eBKo*o`1w`k8V)={-aRs)Ez2bc+9W3u&2L=Uvc5% zejoL^SonlUd-XIq(Mj{Co9q*<94}P48P;#?|K!K-|NXh7=lB02>9b5ubh7<9Cg+OQ z-q>lsJbwiLWGCnkz$lc=^M8NX{3D{ZA9{;Nqu5iOC;h$6{*-9#^)ytx`HWk?XWjbs zvUJaxpX~ClS=7h>yxIHs`;uRyq8CK!%l>cn{{DVu@9!Uky?N09(d>{o>P5*Gk3x$> z2SdesFToA)WvF;>2voc`6e`{u1{LqU0#7-^{UiLIHXh1_7XRf##g8K?N8|WasD2v- z)o-ssog2LlkHR;g`tePu`0g#zFLcKEN5iG?ZMYJ?WBtqffA}RhWBn7ju4>LWk?R_7 zGSC10@0mP7wE2M@|M&eLng2u){|`*&?*RKhH2EXZ`gJnY^DO-6-zokA(j`07{8M2R zO6L1N{u!38K(zUU-qryJp6B`tVFKg62x^@uhRu*mU@KS(bzbl>)H*ZM%A4h1VCBv6 z&$jaBn4IX$_0O~N7Kk>U=0mkR{&9B}F7_{km*66pP_)>;g8c3+Tq3d`E%h(6^z8r0 z-3pgWZ{q>74zBdC!e74!hpcz2{cFfa>m9Ut{|VH*UyD9~ejSX!_2if8Z18Wk{5}Gt}|E!`f;r2AYX-CmRV{;!*EpQZb}aKHZmeg_J_6z%#U>(W>LL#96{nqKm6 zg@?6X#T{q8`WnA;v30B7+JYngZ~Z#2KjJ@5yJ>uX2Q|Krn*Nyo2V{-&@1e#yGUnHhK!LR<)^p~DrK+^r@KTEwdKhKz* z^M8|n_n));IR8hV;GFmW&Gl4s{t&soKTYQE0Qvti`ESwY3wHc3`YUJ3{~rpx4k`tY3nO9jos*5(?(Boetvw`_1X4W+SM3XuH&%E0F8;H!8TA9~S zUKi?B8>*glpz2u{s-E?r>M1|I1C)6!=`_C}`efy6GGtt*WHv(I%DGNt{5KSB+(7J& zb^k=ZO){^y^madmpY40*r*WnE-yDC<{}xc|1bXfV+5fpd-KVvJy1#6lsr$<|nK!}} zaOY&*U$zx3KWO)5src)Dt$k+fe(ffx`?U^G?}v88uKTu5Q1@*&qt`h+?<3g#%dMFn zyPvrY>OSUn{B)mk2eQto?}U0k@GhwH-Of<&CEgA7{@^`O&ynthI;Xx59!K8=>b=DK zp`J@U0QFqzL8#|Y4?#VbdKl{bxGU6ir$?ZkLv@24A@3z7HQH(a z6+b)<6+b)y6+iT({+efLQ1dh$YMy$b=2u3h;)kqEU#8**e`bLGyjYki(ym!1v;Sx2 zm>dwToLs1K^D?!sbN^3%2~IHcNzzwyLL%wICMPufL@mV1Ba8zh=>( z%ooi*DDx%qYg9B?v~dKn56OJl>_ak#V{cwGR5Uwe9ePEwtwYe>cNzhUnNRsp@xe%_ z^PpFu-lG}?^&Zq~Q13y#4i`FaWxfHI!Z+bcINJJw^M7Q$C-t`5Ph*f3SG)rir;LRg z;5eu_Wjxe6_%2kO@*e5b?-Q)Py#EK){}ZA5{{yJ?c@ot6{2}Rd{&xOlPmQFm?Ejgb z8ugxL|6*R%=l*>vewsJ`dyX|7S@Ud$JI@N-dFHtDtPm<)k(;g%I>=LvJ5=HXnZ`85w}{>_J)e+!`I-@;7K>-iq;|0zfFbuoJV zUEw8A^KU8C{96V!|CU3|zZFn_hj=B_{96SzA6G-o-!)M4`4g!5zZPmfu7jGN>!If5 z2Ff2n`8SS_-Op{z^i=xy^Zz}+*_3&VdL=lUGq*9GsySsM<7tb@iO#mnt&AtdUFew? z+vU%^*qONlMxo?HXIJKKOLt7P^;r3O3-`!w_jAzJ)x9Qvk-5+8od2WOI=i3waQX6= znFo*+--x=O`wD9PJqXV*ew2@X=YQDd&ymcpky{mgWA#XNz7?r|zWF5=edp?ry82jp zov(gRx?gCAAE<}M-*KpM`6JXg{NHzJe#TGh$qA@+>?G7Wb_!}8`^8Q7tDDbhH~nu= z>)07v$IfS-wfXaV=HIl}#lmwU^*nEKqVq@QpC%Kgi(ljr~B$Nryrne^=c zBI*A%nf*WWlF64vTgR}|U!JT=S?aF}S#dB5B_}#pWL3;k`bwg$W9V%ii^rboBxF@L zdu7qqu_{pOR8^>UxDu*<)hyjr<|n)SYZleas$uq;SxMyAs3=jSJl_8^d#$Xi&0Z_3 z9`@!%wMDZ-*0H*hZ5@MgKhaOuK&@l-;dIuYYoXSmWc=064UpBZDNy}-9eS-F4WZVP zM(7thO|lxprSN*V5;o29u)px!3R&w|GpKc}IotqSK&@jpK&@jfq1LfhQ0r-HxCh<{ zwT`xdT1VSbuEtY4sQaf>sBzXFYJBNEoTH!T7j(dXSIce>@><(AXgE$42i_PHlZ`|15z_uBQ|m(`Va zzgXBsq}}f~neYE+J!o=Q(aL!Us@#XIpV|M(FTr^vs|V?;Io(9kKWcKK(>?1klY59Z z4zV*1AJ6jQpX~I^dICnFWbXg7(#_v1+BigS<1hnzs^iPbGrM23ahM4;&a&M4WxMsu zv2?lSC%gP>76r2cW)EhC$*)mSNVIVVu}8BaW{+k)gS~mtlcL!n{r0qE8;8)o@9-?t zIP3*AUY>(`kE}Pm;uD_#lTQ8K2ddp)fa>?YP~)&4)OhHRzsA`BxB(7?8fPy;jk7^e z<7_b0IC}|doV^S+zJ@@}gP~CKU>NyoT)hG{?uW<5bylbMHSQTl_$`Ga;Yx^}^Sn`6 z4*vZ9KkF^7pWpwBT>l#;CpvFsy~*`!{YOtfj+Q_DI40|D7=@A(op-XvS~^Fx^p!&h|2>l@WW8^8_J8zR|0mLamoI;iH3?bkzo_;9L#XwCGCV`Q$%pYVJ!=Yb ztD>n^eyTG~q~7_mGd^ax`T|#P>EaGBp9(2g{ZRzfUd2%T^}qGLl=K?!A4AQvnNag= z7SueO?fTDg^O@`BGY_i2=i5A6oVCE(e__@N+UH{7B9ZznHaXE*lC{+26{3~1465Aa zc75#s|bUVyXcKO#V+MTt_?7Oq}kYA&s za*_J-{NL<*vpzTb-mEXNH!u1^G&^KI?3Zlw4BGrU02exkvc7^#;X$|(9(LDjX!GZ5 zxPfu;4b=Sk7Ha++fto+xLCv3|Q1j;))HwJaYX1H}`Rf1URuA@nsPXX=)cE)rYTllJ znpY>G`kD1RIl71aKPz@0_bXgRTz4AoB>&&=Q(Srm`7!*?LcI_5zc}?AcEzdZ(f`2r z0RDjbJ>;KI&+{%o-5>r1^&ZsUup;)0P`^+72kJemf1&dI4+bgc61;H{@Bcy7$CDka zPh55^&aHr~`dk53|B6uepOxTOOZfdC)caKlP~Uf`Ogddh6=Z!!qAJvP9j=7>oD|vH;0PPTR_F%3uAk5Ki{&?pd6h|hG(WST=4Uq4{LP`h!##oQT++XT zUmlzUgHZ1ch<%YmP;p`y9$C!$fADSIPl&>S+j##^`ZC`CgAXA;4c8+-1G^wU3-w*8 zUUps2W%owjO1_Za_4LVp-t>L4UqHVGz4#35YxaKGd>5DRIrJBK|6zd0`ws&}TMuQ| z?_U0y>anEFv9 zXX(eg>ECtJzvrf(;HH0HWL!_o{)lp_IUk6WGs$G$|I40i@<*cWbJ!W*Q?d*2=lnl= zD&+j%WX}JyXPAG1X!{&~)UPnxvHBHe&$R0+%`UR~6-(y&N<_*nHJQKv>(+0kX#3}hLhWbkpvLuj{Azf(|F?9!|A$`Vf1}&q zpCRl0qD@fm7j1@mFQ<%jHA%MxS@G#sxB+g1Ti|x6{dEUii@X!=g1g`zxEpGomP5_M zJy7%TbExsSm-4lbegUYYn&cL);v7~HBS#i&C{=; z=IJ+3^YmM&d3pr)U|;b~qKRNQh{Xq2=fvWLT2OI9Z5Se59qOh1 znBO(9@72rch@9YDlhYta>qC8!`EaetiB5x@WUfc|C+JxhQsmFN&@ksZ7=@A(okls0 zEnP>^_C4k6Eo>sY?R(Jny=Epi&uL+H_J8!+_io71zSlCR6|(j{QTtwNsD1B7c!u^P zAJ&WZIcR3+^^7ocjVkjef8W4n%`Ye>p^Fzd3rb0JiP~Mp56=h!26)e>q35-U-u)cya(Vy z=i!_O;ZpbzTnW48#Lh{etuv26tqgOk|pP$Nk8d?1;s-K^M>gQ*n`k8#_=RP^lA-5{( zZRK+q7eD&u*sCIf0s-6CKKRTH7w*N!z?=M5` z??a&SAL^zb=B9teO+Or}U#Gknn_v0vd>aXM{`@LboIVOF-hK@#&VHSA?);0r|6~30 zR?f%h6P(dGW37MQ7P-zbCiC6DoOj&*K~MjTlRy3QZq9h?pLb2>{lAl$@!^>K{@4GYzVLrbG1)`OrT_IR(hAiX1CH z)hQIMe^id*qGFg_RN~r8UAv`^Th9H_Ov+dP%!2Bd+4zrK$@xF^8|LBs9}b1{&}+Y% zkNgVq0{qpV3#}fDau#E+Pk)I`;1W2W{Fh>n^DNIL*812!)9 z<$Ph|VxP&0&isJF_1WE$%uD6<2-j*6$m)e&1TUBjzW& z{A(5+%Qv&NU!$V$Me57`Z}uN^j+_0*oRip_7yTrf9kPy{kZkKLw0=GXwa)$m z_rPDF#>Hurbe4@dDI3`4?3G{Y^d^ zXBSDQIPV{*_4i-60saTI{$7Gw_b)@O`<~p`x*wMt8^0Bx*5xap#%IM`wR5H1c>FXz zMUBq{sPS1Ddz`0gZWZ&ZnyYhbjZetFepPO@T*U`hElRA0(f8xpiO#r(SMd*aOzbu5o;g>nHhK!L_-`xv~C$q-&6S9re|9 zrET9Ut>`?t#VG#i858d>iH+=%=ZavRvZq+M=XxB}jstM>s?bKB>}#uH2_ z+;dZI2Umv8TCMA7etpY2i47N(vH$04zr7{*R_uBYTx?fzd+u#;DZD3F^SE>F9p-nZ zWajZ*BICBR$$SSOmwF@LBieiE_mW=krQZh~*aa5D`=Q=Te*o&e^ar8dOMeK?+!LL# z+I|1JYp$pI6`n_|eG2z<%YD?n4w%xnth@A9e`xP(_b~s*bJOj*pUCa$`a}HFq&I)r zTb6ipqplqy`*QuR3@yKyJ}Wod)kEr&lbdJx=ZZFOA?*{+4OsgGbHAOg_6dpD!zT0m z-)*07r_(;w<2}(C)Z5Oxo+7`#Wl!f0%=ILH6op{>b>hD!chZ zJ7;{2ajf&m*GWHV&l|aKS$S`Y4X091Xur=KZTa*3AL@6VW1zmD_72o{&&EQXPmY87 z{@Hk_-;2Hr^?T9xpnfkpf%5d+{e5JecTR-*uIvX;=Z}-1&ObkdI-i^j3-~(+A3>cz zPJt8PRM?gFoCejd)5%xol{1h}VlRMKQhx`k9}3|&oSziIrzo!&>fE&i>V2D1IF585 z!vV-Mq0VP#!TU)+8|u4pbKpbBbK$G_&x4O3&lj;TfHza0g;3|Mi(ooj3?Ib41l|Xi z!hxJOE`vVo%i(v_Zw1UoUI{znw+h|{SHqj(8u%dje*&+iersWS^y{F$hqoT;Ja_|~ zM*Tj8P0(+I4dG|7KHLP8;AU7ImO-5hZ-F`w-U_Rt-v)L5yB*d>-T`~zw-f4nc)Q@& z8@T_6Ly^njfB5f#&mn&f_50kt@DKO})bD!t!J}|L<1NwoGWURu8FMkDfzI_nt z9Q+Vey2DVv2mTuBocbHM41NpWqh3dB{(qnQoz4HFxyQ->V&O57asRz&=jlJdONpPDf@?zh2>`3|XD>~)fM)_?# zH;bGj-6AqCZgum&O^hoc-oG9D_L4jDI=k0*r(M@wlI^-6_Pg`=Zlql|;ItT_mK3KAEceS=5@nB)04X2fP#rTJJ^Zp-x@hg0J zQ>N(p{qFTonZorWXXWKsy|TslyLROlh+TH^`+unKKITDv_b~wV-Nzu*_aj44-?I!u zeFriE^&QM8)ORqSg!j(n{2%H&m`_7}AMzQfzhm<(T*P|Y3*LeKIjHv{d&39d^ROoD z1NFVg7hogO_l0`C)DJGE9{u4A{06{kT<<`5CGv~#!Hqosha365=3uDr0lWmeVSgFc zM;-$8J62&I?9Ey%+a3{DpL5;C0mJ9oQI-g#$=G4*rCFJbWDaT{r>xJ=hGt2`~=% zeW>pqOoY|o2Tiec2!DHyBz)$g;3Ok^m2KAlL=}_m1GoYT= z6+k_&bKq|5g;3AyilCm?6+=C*D}j1mR|@sK?qjIubu*!!*Uf@okbXA2h4SXW1ITk> zN9^;Uo-@vedd|22>N(>=sOOA}p#DD3Vt5DXm%xe(+5e%QGcJRA&bSXe{vkmP3@Luv=hhJU%)-%8AzzxhJo#%Xty)yl{5o&&Y zmKXcp>n3D9N8JpAAxVqHgF%Zp11CY8 z4vQF9Kf*fbe}YfLpJ5+(0*)vBN!XwAPQka=bN>%VBL50!;&&RphWs164*3kMO8w8m zA=K}8sJ}~f4(fUKdH62*`~meHkUycmCvpM$XqUg>KKl1>sPFAwg!;b6Kkx(m|AkZG ze^Af6FF}1b_cDBwdUyg_U*iJp0@_zA1nLE1-wC+_YMrbIwN6%oS|{V7*2x5@b+R(l zI#~s3ovaGAPF@M$A^&Pn>*Q5X>tuDP^`-_q!T6~OwN53%o#dMYwO(BfRnJ;b>tt=H zb+QiBI#n0mNI$8*1Lma!u7M}YQv&r(pAxthorq&_m8kZwRzRKCy-SfAeb{ zXk~t_12>}o9X%v{+dv!Bx3%_8-pcd;fPRmf8fYJg{azXJd)1o)9q`ldRmJA>I|Vwz zOn7fV@y2a|n*($Zd9-H4a@Q5qJ zl=S)Cl#k^LJAAaedms(Hv-`0?4_6OUX77GH@PsSFl*PMy%Foil8$BLxAf0+0FX#C` zY_}{UkcHo>-M)a|^@AxJc4ta&=^*ciWCwE5m+j6GO%LOD?am7X(eK+G5KRx`FRTj% zBIpn94vVIT@!#%_2A)EHeD{;0>0!bRbDj=7i~i*9XGGJ(_|v<41$v|ZefM*s>0$hZ z-OmSJK!0g>AJO!XzvD3=&=*c99uVjUzeVm3kHVL&zXt~fT7SPNnf@Lml76tseE-kw z@0Uf+>4ye}kiO>pp@ET>eneoHrGG^->4%Fd-{eFm-%UT#(pN5jH82XlnzT2JuT%b7 z;4S3j^49}zxb=o94a?t@-mU}2Hz^+-7=!+X^0!6P!}vDk?*!gOe^dF`z&KYAQ*JFE zFTMG}_|E0;1>QHm38Lv?e3$Zxfe+9>OnqQ{kMc=@X~=2i9|k77elW#f{!w6xD?@%S zHdTI>4~)+(pB|Wr{>kzgfdW?#Q+ky!QjQ(h`B36#1rOvx|*Sov7K zFn)CTtiT-fqn}(pPc%J@pI*Koun2uo`9jh3F#ftlivvs1&njOc znjXe4C|?#>fqq%}a?$iK{;4@D18dN)E?*T`?doC52HHt_e*Yg>Yx+%M{ATp);3?MG z_0SJDK)q-6Db#yb8{vNV89WF#!I^V62ew##W$rlHB9i~sz&6W&hiKoM+79)-sU5K4 z+?|2lmTs4uZnurErgO^!pPPP@)oru702C+t1w}IAHoOUHt*m-!k{B zz#-EgboGZs?h6hFzA^pRuKpYIpFi(N;9Kgou=q&eJJ#9cQucr3CG(C2j>6mK91DE! z>LL5v>A(+gJv{tU03e>!jiR)8mAow=t2r(kX5UtlBnD|~zQ>A-Jp z{;)%SQGUT0^!mQUS=bN$ZhH2A))##*;yikNui_7-hkrtScj5xncPIXW`tHQvP~V-n z2p7YDpuRuxFI)}(gZl2oC8+OCT!#9dgeMsLoqL+}cy?@m+!!eIr&F+Gzm6^Pwi+L)Ohc+ zqnY$p9!wgzgZ&@Ay5ojmOY(aI8795GqgAjq@;GFeG+{@Z;Ek~Lt~SB8=(nSXNxOHn z54MBLwzm(an!SDSChT8hhe_Y<=n(7}^jv)c87BR@qf_u^?7tzyq_aD23Eql4pEw96 zHQjkz@OI?pJGuWyZn^W0;GM1=rnK34SFp2Nf5`WO?+!j_{o5sYkM-}plIh?3M6R=o zNdEVmp7;ON4(J~glWy7hQ1D?lf0%Up&aS~nsBb#u!zAC%Zo$V*epIAAy9Xb$_I%83 z&mPiSd%~pLolgXNl3#%IFe$t`D)M(f3CWlLqa~2>OtRA;YARJN>~-FD)RIoD`%!3Vf1%mYj*Vt_ObNO1$$fi-fsHmrML7jX~WL` z!52tB$kRXA7rqGl!GUm)r5_L+Xz2&K>0gxI(!->~J6{S8#(#k4rQmS$e>phB{D-*y zLxaOyf0**^&R67T>0#3MJ4Xcbx$Y-tbN`S0-0YFTS6vw<9p5=Bn9tvjI7z#RdLQ+5 z=9At#eFMKk3*HQlA>Y1bZv{sOW9NgA^TD^Jw{jrwt-cc+XMSTvJHLa8v$l^9zK4Fn z_IE||hm2aWMA2 z33{Ge&yqjyGt3Fj#y<)r^ZWncJWE$S1oQPfBISE{^Mc@#pw7z{1{b04@5wKK$cv@V z?}rSj-_qbRYu6Pb?Yca;+VWc=#$CyM#Y*VevPyE@o}BxMhc~YYt|gz4=M#~9x&Ma` zY+WB*2jBj9z16R8*#^=2L-q0&Zj@~ASwPZl3YJ-Zo5lR+sTbs&a7%D2`RMO=h)W8% z|Hq!-*&f`1zrIHR?R|`$_+P%fE4Uk3?_-F1AEO+uBHbQ%#<6zcIrD+wUgS%qUj&a@ zx%)(GpZ#w6UqZDH`nVNb?^p2Tti!>B=xccn$)EGa!@-|yT{{x|+Saviq-S0GR-_+~ zn4IW*=Z=e`qP>rNjQUpa{22V++W&{(kF@`^vg2ah1Kaugz-Ip`c){#H2hXBUE;Mi~Dk{Y2T>Qm0Sdrj>7OA;lUUHZ|pt`5~DpEysQP%X=^PN+7l zgp59JDD@C8mDUR-<9~SbHDZ2W%C8S!fY(C)709ml7#cvmpOXT0&VL={_AP4|>OnrE zN*jf42&tbNhps2lbF?p{|C)rFBKJauoEtO?HAj9H8FIhhLh16KK^C(;EkmuXUaiE2 zgXlNO1!Xse+92z^0LBfR**27ltp05Wx4@X(K6DfI#`L3jx}-zs7T2#M)N}t%a2dQA zu7=p-YA?Mt)YW4X%M1^w-p_UeU%0jLY8S3uRkB`a_xIcY*7J z%#$qX%@4+H*_smyQBKcUxg!0Z7Yexk5dWa`<{$G5hkB9jfmu(6A~yb_CSN!ENs;tV zg`Oe3`tNBsA7t`*R(8ur>4z3R7wT*Ny+eIm|L0wQWc*){-TWcry3IKN)cgOU z-v1Zzd(q@XXHY1%FAf%I_m@J$@Q+{dvdH`%5*lj$!$kYOdCdMwXe4qQ&v21+BSif3 z-TX$1b^qAF`w;JID<*_$EVAB+jT71I5|=+Id5yIA

$>lE^GQBa(ly6Nf3&}X$SFCgR-XMo z^m84OD>-R7>FPh_A@yhEWV$k>{XkAO<<;*jsD2|;E+;1+S^ds+^?6X^9dz@dk4f4Q z%3+^Ce&*AIo@(ou*9D}@zjVv_KmXE%@qCc?C*)rqg7Pm9yYEvx0_9&Gh4L?tQNR4l z3%ap!`cuDEr?FR-4cHKa^kS4cnl92Fkzmf$}fU zLiv~Hp!^Hx8n!R)$8~7kKM%F;Uw~To{h`+F0Q#x>_9E2yz2uI|%TV`gV2;-F;G97= z-(JZn&e3{)Rb)L6HreY8$tg0qShRMALbdyv*#-PR^~E~Faz;@;&KWLJeuT-K|L2S} zd6Z~zD|+nx=$x_SPjKGI83PNUWUupP&Rdp$tY~p7=@z%XjXv3VCufrB$B7oVj)#g% z-*x*p!R_BfEBBt|lV17bBOm0vZ~6~%KBB(F$cLiYTZn#2&ScY1$%&v(ij;_^hs@(r z$u_T{*@ZGFdo~ryzLZ1Rmye4 z{6Dhn1rdL7ih`U|LdbUo!2|9y$9xb-Wz zgY~xo>i3x&q2k3&a1q=L)t@a;{n-i?CvJm^8^4Cy-*1O|;Wtq6=nklOcqddmybCH0 z-tAt`9%Q{w{@;FnAL~f#{9CAXz8@-%{0?eA|2^fjzJEa0I{Xo89sUHh4u6JPhrd9@ zZ3m#@xPwsdCm(`Z&xfJb`4K4laTLma9D{m)`By0WaU9BioPe?)zd_lL-=XZsNhteq z3d(+*hHHsS&p^H3d=@JH`vb~;oP&C9cphH175@(vFa8Dfe+Cy|WB5003jcvO!hfN@ zKXDP>32z#!IL?!MQ?Ax`Om3B2t?x=A>)|q!y-t#HG4iqL^>gb{UmediCKs32&ux+`yVoeUL9XJM1f^s58j4(3Ba^+(wYkwa zrm<*oVWQRBB=>siReW?E)N?ju+H0QM6uCvDS#ERcOLme(>f^gWroTbgiJiL9#v|Ej zA(~xLy5fqPxn8Z;mQd@p71Vlejb8iDWT-gk7V3-f+?IQ*)q7iR8`7(>Uc^)1aQ+Yf zgm+lJJ9G8?u{-ZtAb#{QN_dclW?Fi*>IzjoH z&QS5?{ZR2{7xy~4y4T@@@;52&_4sZ4GjdaH{L^v^Z2Z$j`jcU@*U8Kcm|P$-zFE1s z)UR`vY*<{LBiYVb{!7oZeE5I#>R&$8^@J>6SoPXD3#7hoxep-g`XKZB!Q98_N1XGJ zNIxDn+3P%#`>4r}iRQo1GtVE-?Lqzor!coWEQFGI|3CLh%ilvZ|3y0Ot(@`{`edhP z?sKN^C7S<({>C(kp*_q+f1d)A!4Lf%+07&x>{+A^HKi{Y^h0 zcOd$t$cv)sA^z)S$>zVH`K>|7if3OzmcM!xD&8Fo<+p}F`K=--zcrNnwaEV(vgU0u z?8W>T1{Kc^hqZ`vM?l5(uS3Q4BjIfFkAm`JqhSRc1J}bhp#0dIP=53+xEYS6-&zlE zTmRYrL#>l>Q0rqnlwW%n%CAj;nr{>7XARGLxsy~c?L*?@_j5mRWpSP}Irl@j5Pk%g zz$rE_+5aPJ-IYMie+TN^rxa>m5`kKeWl-lrQ=!&fIqm0^f1Ep$@eh|z6B+;MqJ1}g z2Gn=ck&9}3X64RC*7F6(x}KXm$L{;wTs;@nx{jXHFUXyrtN3_9?h@+P^?w32E(jn%uQk9{&&h+#ku6oOQWha2>jTkowo>e(B1P=cHfdZa~&JLi)8SccbOol&j~Y zO4oBzefMcgF6U6lTcP5DZM6HpamjXM#UN^f~UUvfOyzV!sbGqN5&gV`-#ZRZ8;+oS? z@z5Elc<3xtJalJoPxbEb9OJD0&3UNvv_EsB`<(k8j{ffKLT)t9`5P+!`3EW<`WN1~ z1^-XK75`j9R$S!Ci~dhi4BSs#Pzfec?`2TuK$W4+fvV(rZre{BQx#d~U$O8N_OsQX z&W)-=ofFl7ifb;1Z;&1b6~9~o6}QxcinD4##Vzr$7USxLD=1eRZe$#U=E$>UncRcn&s#f5U5`&c7N%otq^> zor5)jIzPJ(DjvHY>fEa-R9x2#Dt=3Xitn03#eFwGodezo6UpBKDt@~ODxSO?qfwRa7?ColTm?mhPYSNps^$gxg`yv}*@i}#7xv5qG5-M_p}dC|C!bo}A{ z%8x(nn%4yuLdjmomzQGY`iK_yk&eAfmA+`C2R}#oU}?I^`aK(R!>XRlya4$oeZ}*C zsNc6`kw4axotIqUL|f06o%N+9~Db=~;?-Zoyz&NCu<>#zCOXSrV4`{$tS zeP1X$-jDvj?irBxJmvSY&R&2zH|r1OmtKVOE8^|k- z|BC}(MOOSV7%C1N0(D(QZoZ*V*Y_G!yiyDm2M&XZ|As@wgCn5&^Sayrk#7G-LHU`{ z?sbf@aUYxahK>81c^}%iza=sbV@>utZ|A*Z@`obhHZE@h^(!764~xs+mCXIb|GViE zEg$Fq$m-`LsOx&)@_nFsZG0g0eUvvDS=R}f_fzu9=trDWBGM1XWWEEG7csd^w0ICb z^M7jI4Du&9ALo_BLMYkmOv{^Y`Dch050XxME2qpvpX|)a`^5CKMT-aLK*f7=q53@! zs^9ai+ycudz4FIL7UeB8{i3|Z)R!3fRJ8d6(J#$gV)~_dtI#J!mWif^`12KcE9sZ~ zJ7nE`CcUjYQS+h#ma%?T!`W~RR9yEtR9v?f>OQZ7ns;ANpW?&yRzLfH(l!6SLe{+9 zfL`(DM$#1rZh{qXGh7e1K*bSTq2j=8a5MZGZiCxl3iW*hGvE&D)qL6se}cP6-?0e) zkF0oT57fHZOSVBv=_B*I`^gVos?|c6M7jk_+!sYNMs5tm%>eG7s z1zBd`S^Umcd{yLxcuiMW*-Ru9$ z(l6xwgRF7+8*03eiN`J~KXKy4yi26(K0)fK6!ZiY-&G36zyPcqjE?tZQ28XEDX9{y z8jQ{(h#VWNPW~O}t3f~GE4h+WBY1f*dVeAMxZoA83~9e+FrM-n-&#=j4ViM@;8n=# zcWqaHB~<_GxcSg?9d(0OTfKFI^{7|#5)yx26ReM{`3%XI5Nu%i5`v09m9F?R2{xj> z|BW{rBP-ra3`XP0CQ$L?bx`@Qck?%eiZA(n4);GP$a72nAGWzz)Y8NJLS9pLW3WXq z`oANv?uN3Pf^j3F|2rb;T&86(8jrPtiqBd@#bL=%am_98PUiQmQ1Q`iQ15lOfr>Y7 zr(VTxcfhKPi9;uQhE=2e>LWb0+iV&*sLQK5*J&4g0DY`;cd$cHcJ3Y#yKt|`UZ+E_ zJ@-@3=SauC-KYH6w@$&1unG|(}Nkv^53HTcP5no4nX;D>cMV?gV~g?x;Q78OMQ2GLL&Y(FPKk%`2C;Abrh9A z%dhtJzvyB@q`>-}>~s^&4k~@_cFzB)uh{cY@L|i(`9JMwem?>=A0LI9kB^aWxaaX; zck*d{!lGfG!r&9GEb{+U=Id(mXC^HT6-lV1_7oqPw8gC)$06=syU)Z~6~{Q_v?xJ`_z4>z*l@EZO`aw0Thi<^LQg z|5pn294`X(T(69Bx(`#K>`^(Co%$HPz5_jt`t*Nu)2)8a|4EnMn+Yr6EVv%dhVpxJ zp#0ukD8Dxk%J0pmyyoKqsQLH_)O=iM_kB@t3Hj!c?^C!CE{01W>CD%q!DYyrudryC zXL)diD?{e}%HU_niWj3?6&Oc_3R6N>!!nc)3@&reowjXp6^5(AF;Un zhu}|?tGf6{(XJno{A#3v|AF99>gmilAB6IAhhP96hWcN)BT#-&`6@Zbg1_2$ zvH!R9<5o{AkNF?lxBZ44*M9tWDEogB%Ko2%CD^IcQ2W0#Q2WZW^i%f!4`kW@b5Q%p z^HBT3KcV)ce?jfLFF@@p|AyMX;vek%_g}70>*^xZI=cjAhdlXFI~0>2y)TuZ=HF#d z^RF`0{iu>JJ5)WtYQF4HY<|sr*`aD8>#MrSUZ+O>-Mj)+rLCB*TnKkul(_mruo;KzG;3E^(97{iDpkA`Wy0_ zoBoFUo6#plZWK)qnYTAdws{N9&a{O5{y)DJ;QFt_fGI6 zjA#CJL{@y%Dc_S&%K5{8-+#ZKbj3+sNZ0p|y28}?y#Eh%4wnKIH~FE?=Tf20?b4vm z?b0c)_$dSV3F4bf_}N1IKh(Kc7VJrSHcY189H{=}y8X#RR)2y}-;K(LIwuQ3os)&3 z&dCa(&I7wao!3188^8yl&e!-plRcMw7%oDd&wIdn9`-2TZPL1Y3~F6I4z(`3Lp?Vv zq#s&`Pauz=Ur$1N{tw3>KLz!jq@J)g{qF^PvHqTh`u=-wsP*~`90mKphJ1JFS*Y(X zJqK5Fj@TE57>9mP&+DFtdcW%h7>nE=*51PNf2jA7UxYgEdI>6id>QK8X&}^j)gY*I zqgSBL*N1G4_#${){qiF3w^te3Y<_B!w6k286^ zXz?j}*8jVzhxI=(e*!FolD*D*`I9Vvg=q0Cq}TbA zgFe<%njbMe{-1QkuVvVUOP8kRmm@2F6&1gJ3>CjlgC|*c)Pvobk-rrA*!0=?GpVnR zXIB0v$i?Ne^FKBFIX{1nt@F7`$9~Qex&HYkdz}UO(etNIMEfqvLew&bp!rE;SS(d+odXt^yBJ~!PK-oiGFLv)U8@FUDnK!hWZZ68s&qZ zGY+yBYoYAPI@0wW-7jE}`@0?%z%S{?Yo4$2Hy|s%fM#ztBJ26eCiFu+)85nnbac0u)XH`KW7ff|>+Zh!Yd*|Trm ze(!ht^PP>u_xZotefT;52fGhH<{!2D@RP`R{48?+4(9&?i^~t>AGZ5=P-MOxa_`S! z5&4KKAGP~cTz*XT+q{F+^IQILtLH@iS*zza5kGo5|95Nuq-5s7DUtS1o9uPYxb>cO z>-{7DoLetsJpRl-598oPtM8xuzpTCslBw@+k^25I+3Wo4)^|~4{awnh9Mbypgdq81 zM6Rb&=rWTli{^hxXZ=+P)j*%%#D=QELMYkmR0~zN{53@LzogT@xX|U0|Njfs4(WR1 zLsx_pH`J6&|7wY}8*j4L@rI)FzP4!o`%3a9J9R=0EZSB3;SjH`=Hi$N2vAP32J?JhVz`Rq5I)N*aa?uKD(dzfBL2MmI4(|_|eCIj{irN z{YZm)k1`!94#_|-yO0U>Tr~jo+%*dhV7+HUJ%7z1e@=OBD8zjUm*00W%{0yncuxc%0F$g*Xixf z?`Onjx6+S3l)r=apM?&54wk{ba3<^r=fLOTeE0(Wy$bfXb_RsF4*JFTay^RIUJB_s zaE}82cDRRA|O!hjX-Rm7ACR{9gBQ(y+y&Zbf%Dp9-a$`lxy=^l7 z-z_)J%2k>=J~V-RiII0jyB{#2>ePw4e%7nqSMwjpHMOoa9&5@z2z?lG|Nock+)(zB z^4tIaiu%9dDIt%=dnHiuo&y!{l|uawaReqY|I48Mzj!L_3(Kibap1?u`v2l-a3Y)z z^}oh5p#HylCe;60&k9BVe|k3k8HzlIbp1c_T&Vw3o(Gq~`EUVT0QLXMpTK=^A=Ljn zFM|5N=TG5wxY)*Xd1#4^=hDzB8_#7TS0p)GI`{2KioW!ps4L;iPod*~a|^}oZg>a}G%LOYS0AVdDodsk>T@(sw4 z|1aJX+J{`HY_Dkbz^a|gz76dsJ%fCZ|9}22^gZeN|7XbmL;n!^(VZW#YHrz2p@Zb_ zQu=e~7q=eRD6RB>(yd-tbz<3}&=JyqFFh<;I;>h)b~N-W>AlO2iIxtlzEE~N^c(4k zkrSe&!>WVIeh-}@y{PP@Xz8$OsO)s;Ea?xGoe?b^Rvlh;KJ*8i2hUmg^P#`Um+bs0 zT0Y44T>lAOfD_^0@I!c!d`XdiMau`N?@}lx>}m97nI{Y_9af!MRw>N-Xf&hD)|H(r zR}Dww{3_vSoG)2%KKbl9GqmqPLC&3Pgps%SGW95=Wi|bWyu=Hx_iPQ1F;b`1m&*W>u^-a(DKk16w8-x|N zCxja!D{dDRw>N@{+pmR++o^}R;rehQa*Ie4Yd_h!PNd&O)=omCshi%+O}BF9&zjS& z{M-#t{`p22>$C{Bw(Gx1q@J5i_ByS@E$MF+>TLxpdpQ3me_baze7lXqt>Ig29Bwt) z>)aM@W94rbi};;(3Hiu>NBC~b-!^=wmbJTVSMg`iHt`_*dMtQ90aA`UwXgIi`}I*FYG+2E9r{geNgdv3RHaVhl=M@ z-SJ3+^84vf`aa?3s4p?{tVn2`2MD zz~T2yeqXfvItl7|7WufpAB0ONm*9L9{ty;I$$bAOJjKeDh_;?cH#^|Kvs`~EjAhg!ngiHJX17+z%M@&CwarJpL@<^#kIE(tFszkUx6v3JYD%c)29 z4%)h30k!T|lKu$kpTX{M74;=M72$PO-)hn9z#5pyID8Ie2i8K_0qJ|gFW}J9_2JF7 zem91{wEO#&WY+Hnk^XHonco41qx-teV$96aE#VzjZhLsEmD?tna$k#-+io)7|8>jl zuyS9Q?hNlH-|o^~qFq14F6{~Lv-G{9rAz+3^jq1hn1k4>{p33nwOjR8mi!R@KCJWl zAHoM2H_h)Kq2~8bmi}}20J7%!FHrLwnR17epXUIF!iP!M`he7PEPMoV?jJr11MoO{ zt&3mXe3H+UoCyEM{nGObNV(s`r|6f~=SkCZ{%`W>@ENO*^MBG~owMP;xSlxY50UFT zXEOf-6#moXzeHOv=*fQ}T&+O){}##rkIC%+!xt@owF1a`xfHHk5Ph!Ufqw3H3=F_Z zP|r0kgLkE<|TR{D`-XQC(dO=OvO>izRr~wP1WUmufaE0}wrfBPp zbn@3KXlVJp1@V^OYcl8m1y@@Bh9c{wPQf*_*O`7@1=Y{1q54@Ds-N|s`l)<;2dJO{ z<+Q#a=?SXWWXQa3RFFt|3+Gyq`QKQyc>~cm(f)~guP?aH%G-X5eCGEopXQa;e-in% z{+mPD3DVgQ;{Ulm?bBL7?JsXC(EhSz!Od_n+%!r1%T}V*2W?-LOn&XxZYhZF*KUQ{ zuiXaqerOx?+PB>fwQswFbe+TVK7#FE+7@_hKXVtfPM)Sci#(mO-Fmv}$abEz&+&!xITJ%{o^J(o&>IzRS9J$Fil zdJdHa+d$q+tev>s-cM*)h5M7qxXF(PpyG!tsQ4ipDt^eJ|5|6cQ0p`gYMln5)>nRk z;)iYpp#sGZ;etoFpBG9CM8>t7$@u?*2TguNw00hXYWLv+`E~aH)EDbKTJQwr6?6Xku!ERSfkW)G(;`poYVF&d7oha3Oph zE`g)$K5+hztoNiwyZ31fvf_$2pyHG_VFi2(Doz;-We4Aeic{X9obLNL>o4#BLEZm% zq3-_#DEmAS%09nGIi0_qec4m1wjcjr;Hg!w2mXt7RiFL)hvd_``R_T_WMr+gDegKe zao3sSuCr38auK&&8Fb(KseTRV`i_>~BmS6qt>;D4pojG7Q12PffI3f@3AGMqL9MUZ zQ0s3F)cTtXwf^Q6c!n2w*#Fax*6RY&^}oWOK&`)pQ0wpiF?A+jHr4+hzhjv}k~`U| zF;SMX6Rk>0n>HoF%-p%_>=F`6G14Zbk|f)lxn@GhzHeE^ZX}X@ONBxaCGmf~Kll8e z=l?vO=jF3}m-F2|-*fIc-azlBhLhj4?T7xYkwo^e(p!8^>+_E%lJ_~`p$o!&7VU(_9Hir92NIlP+>~;R?alzz&L@VbaRJniKb@KZ^ z`4RtnTqQm6UnKoylZpR5u9$pPv~>(S{pCq1pQ8RMlM)9bP_ox4n^G=C>C20@j-j`8 zEFODHCn2SZ*(->)j#Y$Orz%0U!!=O#t8D46H9y(qUo~1a2u4dA$E; z_G&5Do4r~}E$j`W)kU*I*0GwBZ5@MgztB%NK&@jp!ilUuH$kmKN%*UsYa^>)lcDOie0bZRNQ=fPXyB3M7gLww4WQPshHw?U4Qd^`9cmqG1htMe zhFVXX!0oUp)H>P>Y8`D(xf)L`pzfbqLXERlP~%JQ;T-uczo0e#Ll@;23>oc-tHJYe z)*m|`{H_#F#lu_&zq49Ay$3(F_q|Z9;J& zHV&bk?~nsE4s)T#OCHpFWIbWoW&Hk6I`w-msCIuDs^5DW%e|7iN}>ebIv#vp6`7q$L>0k!^*g=eWZ z`7k~vri?>w935}vw{#|m)H`2x#>XUAU*PI3UEFTwQz7N5KcZ0WH5sbE{v6T>r1#e5Skk%z*0enKsYnqFmXKBhZlb4G&&#==!D^k|rpX97cSqURh zve)@GWwrUQ5pABKw|TY}drN0s$`-Sih&IpGL(QWNZv8g8_1k3WHk+U9@~;}*ma^6C z+fufZU)^Y_NPYSJ-|Rb5zBBudlpnA+jD9bg9WozwNw#?gZGP>Bvz)ytKf-x%4_pNI zx$8Bw`LiFcVq6@6nm-4j=FcIh`EwX*{v3gtKS!a)!7-@$`xE7>|BqWei2qRI;}@v$ z@hjB4JpnbZPD1rF>vvLQJMljyb|3dUoX@`QG~7b|XYkX$^epnT`27L(KGgsAspqh3 zpL!nsPn-wv7u5HV7odL6y9jlE_&3yhQ2)Sk*e^kSpZG7-dsdgB^8F76DCY`nI-B?Z zpz7mEjnyYEHMY+!gRJ_Lg{pr!sQb_I@W;7){|EJcRRYxc4i!kJ>!^sVb0jK3o$GK7 z)OixEdwcBtp=(n;wqLFSwLiWNYJXf6>b)W_)c1jjQ18885B2_3HMqT$`+r!Q_oQk- zeNR{u>U+Uj;ws`l)Hzo-!Y{Gk1od8260FDd)`r@jCqwPuZ-)QEI#B!bx={P`TcGym zw?ggD>v4VBm)A$u`%n#_-p_9cwLiZNYJYw^)c(8?)c(9NY(xG{p!VlYp?&`cwLfnT zwLfnGwLfnOwLfnKwLiahpvQX;=~}18{_aK_ct7%;usytsdgaqh}pxCx6y~_NfoT2$am<0ZM(?(sdVYomReG3m=i) z)@f+#^kXJJp8AB@iT~)ePIu&7*Q-~bOnnMj>$IqK`e~?j`WbkZd8K@`Pw#|(8P5x; z&mlLCK5zAC>2wyUf4=$Yd$catYcu}3!ldYnu3tCTFP7gh=2Z{sqxqQvH9u3K=5HGH z9qjR^`bhsFe(7)w3_!g%AofNMLhTbn@X#FI|AQa!enJHH+sONW(wFf5AAB4+3$8@Y zh8>V|pw5-bwd=}D?TNgBd?DZU^h$ln^u1DFM!yujm<@ZIy-zCV;&PrtUy=78UJ-f! zp`U2$q3rtZ<=^oh+xHDXR$Lee6@OlXYNyws-lrM_<^Kj$ym}KVUJZsScL-Gb=DY1S z)NQx7pw_WrQ0@1&)%%^)&r-Ed9G?1as`kb2NhW^1FH*nZCiDA$YV5i12$6C>O8t;> zD#KX%Pg6%)`j6f8pSbBib<>Y>(|;y1u1BYSNja6B&qc}^V>0jmrH(cEOVQ#ScE5vFj^NjavOCOXm8DM9M8TnZN(* z)^CbvadIktEuCqpv(4{o(c3IJS zy~h7)x4+jQ>;0m&Q12J5gL*HggmhI&w;oyh(+zMH+z8jhO;GW5GhB|m1#X2~;dZzU zYMz!t&BN_b^YA;U@wkKX6-U2^imN-J=J775dHn-^1NnY$H`F}+5xvIg9%Rkay-@RX zAJjbE4>eB@K+V&GQ1kQ<>_l8W40T_21Zv-W6l&jm3~Jx}6V!Y@4zCpdoO*)mZ|oud z!%Fa1SP`OUKk{4ZNjMLlf{WnqHjeoIAHTt#)2V0BYrTQ22Y;lVwQ=xAYQwRy^#Jnx z`F!fRR6V~wpL)r??!Vl2xM2E=ssA9Weg1}OFJ#jFD}SDs|C@Rlz2+?>pR1|=!7|R( z)GM$Pj7y8Pn+M8I^0|UCX=T%5;|C&_ON-}xH9cQ14?EJ{lFK*=X%*69{S2{JOsnL| zkmu{yq*X>%e?sb2CGA@CtCFVkouwB~7gbH;I}7Z@f3p)m3S#?%>(gTUg=$dygz7Lz zx*F6=@tE%#hA~0)B13u$b7iTWUo^@Es5*V{Rw*3g=G1&F4Rf88AhOF zuTwYe7E9Mgw792yyB5}y-Qpg!xYxkshH1B%o%oMlaqspt#l1#pjgb}iM8&-(P;sv* zJWKnL59>v%wC2c-qb;obmQG8Ndgsf|dU1!VZ|&+WU0heL|4z!)Jh%(L*O|w6!v)KE z{|~+9$-Pkh$^8ob*Ea2b>Z{+Kp!q!jwH~yCnx_v!&C~W!^YkIO9X)|tQ{ho!o&+Pz_|d=Ka64QI_s2 z(fUXEb}bw&yY&yW{uyKP7inY7&iy}n_0N~qKjYHIBddQz_0I&T{+S5XKjcIIMAHh8 z8%G^0zok=0soxtOp8vx^ za0YtCtC`4eB7cLw`g4}mV|Lmc>^IV1Vm&w)&LsbN*yB74(&n4rg0z3f^F1?mX#2lK z_^JOFL-qd>sQzE-re6ki9m}Eihb!EAu7v9URZ#W+)~(O#H0|$7($?5~UYoX={<&1R zPNZE*O!hkK(>9pAS+sIDLe*oF)sy&7ehJQ&wC`*@Y!ykr&1A1rnzr5K??l_TVP{~(gf{b2sPMccRGXZx-n@oVYqNjq%zy`t^A_Cf8d_Pg~v;MVV; zr8{JPvdh0}^k~`)VMk0j)SvM%PYqTleF9vGH35YF#c1H9pJv)XwF7 z@%U+ciW;8@P~)=#_Bc-^Uq$n)|?6=s-xHSLGr2Ps{zY6wR|;UCwL=vjpG|!Kgs6`Zt^AhV*LS0SKD_p z_0@GJo1OcA%cqX7uB(UaTW;~)>RuP59`$|oEPZ_+`x3ie$a~}seLQzh4sX8A7n$Tq z&fFZCL`yap!gH5K5vd1{)T&@HK}E;axtx575%r$`>0? zFu8F19lqAC3>!3F(Z>9Gm)t4VnO#Es_bJ}q?YjrN-UAm~6y4{$7tVw2eVWJZd~MC| ze#y+^2SmngJCivFz(>82+l%&I`a`7Gd+85D2X=sy;UiG*r9TSwUixED@1;Kur)-Z* zTH?Nc-O=Z%Qr7dNwNK&pr+iPl*8!7zmpmiA)gRjX+MUe*IbRpM?&p1-U4MxG3(}jv z?2U@L`Xa6!B6st3cV%e##q=q@R96qFPns{?^7n~0Zz1gy^7*ZO0=|P2)jmNHd&p#d z|99Kx;6&P|O1vjBiF(`fu1xalU6SSN=kp}BSe)(4p`Lx24=`!K_FP{c@(lV(TvO81 z*W3Jf{tpjv-_Z*W$Ny#69%8Svqoj}Jci&>-Kl&l)Ux7apk5x{;nXmc=Q0}^o{YASD z$oG>2eQ#QQUh@rd%Y7YQq`3L(}OjP}c_=dXv`K~`Q{%^@{{?MK? zzRft+^T>BdKW6*8zW1%X_ryBmsVB7WGlyIL{QeL1UFQg>^V2?rI``}&sOOU-q0T@1 z80ve`PoTaR{S@kZ(NUDA-`zh$*7MHMQ0K~i4)y$T4Ak?_FQA@Jj)evMor5o-o)i>Dz+H?tuk(X%w~gcDqCH>!5$gH&9;oNw zd!f?pgZdtLKh$&T18_b(2tTD>hiv{I^BuPNf5dm3{4W(A6&d%(M0=k86THHBk=$?Q z&%R&rTetBS(dGw4f5P`W`Y{_$`cAoe$o%?Edgedz-~3Md&ZA$w;f(LB>j&}s!}q5< z{~+`4oct_*nDp}YzkL6g-v!@A*AL?NxAf)*S%)t9E}P%KqOC_TY5C0md}Y#A&J~|0 zJ+>}gb@M?cpSX1FmJdu?JhNhgwgN@lTN5{2}XI#q?{;zmjO{9%SBM zmtGmZ2(N`HunJ6vUh}UiTKhoiUp+k$9$HX6{dzcjd-e2cusy74{xwANhs@_2(`&&Y z+iy(20scJm#`GlfyGdj{<@rDQLECGmH~3K3pDdal#%(I9lU^^~Q?rzHtuE9);}+8I zD!Ntro3;OgJol-e-Vpn~bq&P)0D8#zi?^jWOII9el74%-;&CI%jHAXP>6@7Bb(*Hf z;%qaqV*GaA|4;W+On@z51=tc+gsosD#^)X6uX7$-r^n8BY(x3+3-3(7m-3r=?h<*9 zbhpU7xW~=^UNNqS{r-K}Hx;!_Z|7d${dQdsNVe;O*dI*i+(^4_$oXIor5~6WJ0A?% zdHNm9?~(K;+P#rN`~zF_3&ajv`Tig3+{bjNb07Us=RO9Y&W{X2oo5+>ItMZg zbq;0(>Kx1r_|SBo|3jUFnFVz|WH!{_vB`n6S#NV;TkLsI??v{6kHVK=RoDyayvUbf zUDEf4`hBSnoI^eO!b$kO0xNU9{opmoufoSx^ZP$s&G(uEpw0sr2%p0K8oUwtb*S?= z2f^y_4XEGM-h?gTV5s~0AyDT?=EGsgL*Xv?7F7L7jUr z8dip%L!DbN2A&|keF5L#`RrJz^G&~mN70Xi-{LnOwnjez>YUJtP|p)5LH%A=0QGyF z1Gix>g!;WM3iW&4WT@ZkilBb4D~9^L?klL@>!v{cUN;qfPx@)_Zp!-_?na&t+hCso z^*iHCsNWgCf%=_s7S!*Iv!VVz&m7p6^mAdkS;T*+-x=pa{m!@mK7-#v_#9jWyTHZi zo_V!cmzE$8q&=6yxr~oxaLp>>KYWOMSKwC@zm?3d8gLc!NY8V=#a@AaTn#n9)}+VI zdtHmH-%;1W0Qr_c{f@dGUL|gCz;6om+6X(7ZWDU_-J#7;=gDq?->xJ6L;b$H4QAq3 z3fD7^x5Fd&eFqmUBmP4l>AxqxW^gC6esA3cS0n!bgK#%|6#fV|FyHpTJo4QO$C2MY z((k5T`;mL0KY)A~`5>~+=Qxz^Nf<`@!^rii*AaLC`6#@ddK`oL9r-7?n07o4ql~Mc zVGZ=Zz%2MH>;+H2k4b+L_NBa2@Pn1y|HGlkzr!i`orZ5CpMf_cpM{mE{~z#m>h~wq z-=#VS^?UYt_zC&^1$7R{1*r2xF2ZiK%inM({reBpdApaO&iD8ievbcTI3E57^?Uaf zsB?3#!uP0$$FKD@&fmhXxLU?v%O5)@q%71rSq^HQEDyC##zU=>2~g`~1*mnhBGfur z32L3Z27XBXm7&(jYoXT3Dp2dqb?^k^rz+Gs<%L_wHxX*Rx*n>Y)u7hN>QL)s4XAah zCTvPSslKnwNcP_VPn0J6Z!~?f|0Z}AISF2bwc%xWGuNqo0gPY1q>jHX^5@%#|HyxQ zQ_p`3{BlM;|E=&sw4T2{cHPH8%5CUx0N;nVp`U;r^1SqRe$(3ozb5|1=GVmE z6#bv*A?cg@o0-13wRh46e*gFDd(@WxR{q%c%8>6>@9?+APv5JG4QJlzZv%V4hy2=a z-0Q!~Z}$+k4n^e}$wwse00{myNE(eyC>;)ZBo03UCSXB8Yd!2kY{ZLC^q4X{PF#M|0-Y~vK>D&JIk&{Z_ z@xSZV8z$E&eNTG34j5mrbhv*6`rAuC5KRx`o0Wd({{;OVr62i6x_X#=PwB_fn;(pC zSNf^{GxHlInjXe?C>`zp9Q_m22gY|Q9pj&X{6gs${;{qfOzvL#rGK0&L%tUqFF(r% z#`{Vq`lq1JD4palaP=@bx76_$x-v}eQyTS8c4e46u(Zfu?8-1Xzw|5RWBJ1P;iXgk zU!xycI!!b^j2~S(-9Hok*wPuI>0$iD(r^5;(ML;XiKd6~H_x8qpND>G>0HtDF#em; z`Tm9I=a()JO%LNUzh2~DihfDyV*e6X50h8XPSW%Jzkj*u*NXA$(64}}SZ7zl?r;^< zdsg2fDKcpw6AR1n0niq0XPU z441(Fpw6AR0(I`hRjBhMJb~DG5^+%HPLzRrVOgkiC&~pBZz=@J2NZAO0|}F~ek6#D z!wM$z_kRMF0+JIZK|5#S8n~Q&1Acanzzu;ItH6Pt>jK_@C;85;RYe=m@a^gzp5w#U zT>!f=Bc|v5f3*Yp z$Hc_Dw>%zr!p$Eh-nXS=;7RJ+h4Nuyw=GWvo-_Grk@kEh@T|4xvu=BKlHS@ACi=EK zALvYee$vCl(3UQN7vODMy9BzT?~5KL_TTbipd0cV$S`r}mhOQb$Rm(p;>TN30;$NO zkYVEIThanP1S=08efp+xjUtkc0k)t+|0-mOd}g)6(~J)4wFWrH6^Dw)73WO#1$wzJcEG zRoDmigZ(Z2D}jENzMq@^Rp~7~Ox(9+U|<0LuXqLq2AltDf!EFdb=QAT;0@OwCLi4L zru-~DOgy$_NFbl<&X~siKXTr*p@Fwt873azGAxkK-;X#+yNG%p^&RGu-aCC4zrEkQ z7Z^dly-VH?3=hPf4?>;~ejvS-19@-t!@x-M`$)9schEa^)5n2N(SNh)6Vd!3<%|l9 zM(=e#({-R9ZP(*^gbhBpRp^)bH1m15-#}*(nmKN3qGA`yco!5PRPQJ-=H|l|Sz@ zd>xpEe*{YA`~ScUOIIZb^YtB(^4+)Yo50+Fo|nxE%tqhWlV1Rl=SZL52N_bod4c)X zt_wxlbwOZ><+o6byN3IUMbNW;vE-VadG06fTemc@oP2_wWg_`<{|_JCurja$e(=>w zt6%SuRigEW>eaPywPbtG0+McRpv3Z9C+5FIy&%sC*9SI`kN$p#IJbcNf9wgKO@Yn$ z>pTKz?_+Gi|LWDPfo;foA4Amp7^QGA>9)hOjP_-51z{zM5yR{CVEEFYt@4Yli~+ZCyJcJ?q**k$ya6ve!B6j*BCr zy^nm9`j+wh95`m}|5M;++J8dHaWU@EP5gaev;PvfX!c(Nf1po_o(P;YKkomLmrXqt z_#Ii#{eOe4xX(l8z1-7*Gp-)S6>dDM^mX3Fu6(|q`lp-kxxioOb>Dd&>bW~I{eMAr z>QDT)^8XI}Yx(^n(!a!isP`a|xsJHtW#nPS{{`ac-}r@BM8@USfG4PYkm&EbX;1!# zf0~f|rAB;yJT-#VEWaAT>aaXA`nW;VL%dR4 zE0~1;zI8W<`MoLsM))$k3G%N%cD=_?8|wX>WT@x-H&br!k~+aoO{`vx#X9}zH^~JhO@qyl z^}GPa^_$W>*b-U&+XAkKF}YRn4(zwkkK*Z~*1@}7zcx_6``-!Y!@J-Th&`_QynBM} zT)%r=zx!Ojwyxj(P~-6dsPTw@+=vbBgAc+E8`}pTcI^+jcI3D_H*^R-;_4yq({>C# z3LoFtG58pK8a~c-XL_CpK8ZZ6xT9$0NM2d;RPbq6hWQzuXM@k6Ut9dF+TEVRK>F{w zU}x+B&-0?KSK_?lF2NVzQureMHGV@^(Z&gkOI_P7m}>plJ=lZ%E^>X4d6FW%`N6pL z8`6S7%IQ4SC(`ffLBHz{@efFE{xQE$Fqd?XPR$60ZTv+{zIj@PNczlRHtE%WS#Cba zyM28%d(q4WW4tY4j>)x|BHJ6U)1~mB7U!$>~;DF zV{vhSNV^XVzJY)I!q-IR_v^ty=KqFh=bOjuZw7}VH}eb@NjF5qKi|!7s95u_4Q~bC z#xLv{CR%@pl~@nnfjYmj^DCbF6wlrZ>i%Fv@cp3f4~7RnBEL(8ABfa<%*@Of|yewzQV=4VsC zkUs7s~{qi@xFcKb*Lc=l_(i^<)av`$tou)|F{c>&@4+L+_I5!EN|oDV`DhhJNo~GE-!o z;Q2rDgpygo+1LvhN04=MPH-M_Qgp6p>qShSA6($dkab~Ua4E9J-y%30E{0kcmO!lw z*vW5Ma3%iBrY;w4Uao+e|1tfl;A&U@t*b{S-J0M!)2|indy*JSg6my>$o$?A+~~@X zben=(&=+ppELvQP$y?P9CaXO*6_o~e&`w(ax6@9$ioTO<^8nKSyMo_ae!GG@VR_`; zq#HE#2a$2W^MCW(8~oAy_6GNu-`?N>{63nxKe!K$g~*H(p8vyr>kbAF)BXX^A<@P) zM1LfB41F)pQPK2}>-j18JMzh?zXXrNVZ}d7W}oqk$hbch{ME+&3CWE6lOoq~%4Dze zn>+4*w{d@R>e=9F%jZn+g5`5oB%kxaKP;a=C6muNk$ldZ%=iCpJ{K$>&i@TwBp=TI z4PLSImxKRU`b&~Y|F1~;%O>;vznlJw$omUdgJnXpdqU9WMI6+;h{@$bWlb&@su0q9 z4dp}e=1=@b?p=}~y^SYG`bwdS=3gmP75nN9*Mus&{t*9bLsjtC`V3k3u9F|-6aOuJ zV#sUh6GJu3|N2lh*B|0vU3&9}^h?c9ZT!EVT1zDV8$vhXulaDJn+}5(=OBjzsk;oB7W^n=KH_U!zOnS z^UKjc*tx%XB-9aq{{CO+QOMu_Gnv2t7ka|{JBs=0PyDF&Q=uoVeouv-xB7JoJ#F=S zMl$t#R;1icCVQRd-1XTT4p|Caxop*Jl5 zH)Xf=5ON{ttV?G0+FUfN4;E^{0Fp8priDWj_IlGvh;(kQHYpkpHftiIS}zkoGGG z72|jza4zYNpq~e|&zKMOp7a8!{l!A4ea9ke z$Hk#aVXY%eLK|t1YdlLs%W2m%o)0W@`vIBzniZjy$P-G4|H!$XRiSTPJLJA*b!ZLp z4(yQonzf;I$S24L=6CRvgw`Yfi460zJR4MA9sQ1}a#KB-~`l`0K=hphd|cBuUeGWSJ0LOYSQj(-o=L*%#%MY}?~UHuQP9+~^3A47XwJ&bF% zVQ*-kD?|24`$LCa`2bWo2cgP61hr4X&i&Jo&@ZmvQP=O7>-UrEcN}Uw{|vQ%!auI@ z`d>pQB-0)+u6gmv&?(msa{u&O=yz9!+@GHborWKLbtZJy)x)@FH~bm;1NPhaXXu=( zhkSQL+-yWg)YFyH(m-|gipi2Y4=ReKcRn-hZSEEt)7xsmRt_~=gN@#udAUe z=+_os4SB+`euiO+9dh4TA)Ej^Y^)Gw z+*x@Qq1pwRICM?83iery~*Sz zV{x;($o*i=a1GKgg*V|pW<#y;4d&192FSfjZj|2YBm4LbN#UE#UR$)k_n2(yx&McS z8|s7`;J121-S91LK9GEF4c8+d?N=c2y}tZx-GDrIYZz{9ez%2hcl{uKjifg}$o*-P za0~Nm8gAzLLHwFaZ+?*HcP+zr($1Zywh}4-j&N(&AL8Fedh>_e&)yYoYyNkO_}>%0 z*Y$_^-zUBK$NcUOKTNtur#>L!-!9x9f6cQ8-E_#Ldq{RmC;vf(9l}qT|0ChYT>nR1 ze`Ne0m)-nf+?EX;!%tGL?->U$uIq}Y!cQZYV}8K=2=DVfqk0!V8}35-?!}!%(m!Xi z*LgnN+2k&wo%8v?=%0ZoEzo6?E68YXa9L_L(#MNh*p1=PW&gDAd7iNj1%MRyQ zy>mso-;UYy!hOu%GyIa-`-sfbUg4MVYv$qoKa+dQkH51<{3qYPHuMemLk@dh5iRbD zCl~e)zY1S1>>nPWc4WT*?S6b9)ZaCI4Yv4-_y6GCa1eX|z5yG-H=*LzV5qn?1S)P( zSlmSHL*YyCEjR!UgM;DQFaqC!qu{&nF4DaR73bcE!-|K8M^f)ZuHyq3f+L_8eh9CD zAHm8HznT@Nd>sCSbXBM~tXXZ!r{Ph^wUEWK#h-;oqpwB&Fs}BLG2zc)|EXibU!bpx zA0+ON4S$KOxDSc@75B%}{=14MNVahbiT9JjPT1nVXmKC1eiw!(Bm1XBjoNP` z$2~KpI9vp~!mqGP51W?rObJgzAD%K*ME}%8$&;wZ*Ra>r{DSGWzRd{lo^_ zM85AL{=-giCtO~@`+smJl)ZzqJG_T_Y9I6?+zgRPw>Nwcc@OeF*S;SfK|bL6$$qln zQ1~bFC;nT0y#EK4|52#&jzN_#zfR7n@NrlM{tVX@oeKW~cNUxq|EhK^J`p}ezWdgl z6z#clO#Ur=#q7U_|FM2L9sY}S9m)3$>;TU~mGcMGb^i&ktmF58sCt}-s+ZE0DY+27 zNIrfK&;OAdJAYfg>B!`d-zB%af5VsY^Pz{-??35np9~onSHoo@v2s07<;FpkEB*3< za*?udCybB8+POSbJ0qh{h*U&YJ6C{eU&$v6Dn%+=dfxwo9mrSm&VuVA*TOQ+b&)Et z6ZGPLhICae9q<3aa|MZ!>m#x83K>t;B2VDIyr4#;y5&021vW!8mW&wp`@N@ z`9ZFuLF9Ji3q=h@%l9^@eJV27)hN=$@@p(wevo!(8fjs2GttIvbEx)2rd?V_?lgNV z(c1M6*RM5H`?hiYu~Xl>BKKIjyG1Jp>i$1+zt!VDF>Z57ThaFOl6RFn5P8tjwG(Z> zC%Kc;KJqa3LnRN1b&hd85PgTpqv&f*c|@%93wntDG4%`k!pBA17ed;nW8_Kn=cq5_ zx}J(WP5LXy5c@NcXI&ZM*D3NG`i_hf$bPAFLmTc_+@hgsejoPKa#&Q_X*xWb>E)WWn^vZ2Yvo&VU`@OiM@nhg#of z!A|Jq*TI<+=}3G`DxPapJ?FXgL~q|aEl&eE%=< zoN;I5dl-R|`TjrhgQYtm+Itl8?^^hy?DoC_wD%D9n!GQv-|W2qkA4B|cp#$p5DrET zA?rN^QSTufhKsQufoJIl^5Oa8&yi!ujiWzV`7NE}BG-{GJI@h+arM8tdP^6#a~;3` zQ?B~$6x8_o4W5Kkzfk*~j?~Ri`<)SKzvK*9yS#_^PriEo{wLJ$ROg_6cRCOCJJerp zJ{R2lFS_~v4HZZKiD*CiU*wX-fqx@q$p2E|Ws!RSXR_D161i&EQ6>XgIi8GIxpCB^ z4E4aD{wteNf%KJ~aw6%=o9uPsGZIX$Am*3DA3Ob4F{29pod2Iu2}Yn~&i~K2*8Ho8 z_IwyUyONH*(9|u`s9q-rnmOydU)TDdY>z(BfIU7%;Z10aQF| z2(^#C4Q_?E!|kvU)HrAi_aiqUKds+Qp~gcqsP(-$)HrDY)qgFa#z`yE>Ava?j}iFTM*u-4`P#ZKb?>@Yj6*-}l=0A#0szn-Nf@CaOt-=k39&pZb8KI-F8-}gKL*RSUJzli)K)O)Q@ z!9MV5%F%k#zJIMNb(S=ZdFFJ}|^J(4~kA44E z#5nfT55-XP;wz|mF$L;7$f@{id{0BxJoy@Go=k`OyUR16zRQ{khw=T=H*nc1;y=`R zOS7TAkDCLJt>F1TEQdS~7I9tkp}xCX0QKGGLa6UCZ+la5cX7sP+Lh=38B6Kk?jGVl z^+|A+WqivxsO&5k83!v&_BtywR+;>*XmJ=j<9fC7VO+1xSOX(ave#LcQDXk5MT@_& z@;1nB<;CPp8Jk@h5}&u2J%RejK9_#nhCRVknz7yN#DDaP&)+fLuU_4e@jbHQv#9vI z6DmIMf@c{w-WLsdcz=X2ndc!<90x&s2L~BXYf!Mf&Nw z%xmGW;wqWmO!e1wBIBxRW~?8)B66ZDUoYZcP5ImSg5*;xvxenUGc(!psU=c=Qsxa- z{*96;|0a?0lT79uKsVoHH{Y8x>$v$s+ToVWy09|5&GKuId8_4DPcr${7s;=I$zG?S zo8N6B^X&G_X82Wh8j1KdHreYm$!uzJGtuG)cIH|0%+~lPIW03=zzCGg@Bf*1n15^0 z;s<)_cV}iBtKXfOZLNOyX5MA>yIV5#yGNwldrjv1Kev8uMfz#^r2Fw}={%76i21b> zE&ejfIrBL<4?YhU!58fMi2ulnGhLwKOjoFR@FLW_=|+A% zJl!*UAZs2##!E_Osw;~c|7n!3aqNSNC+Se}#gAR_DF79pf^ZcK!Syf<755@gaW8{( znx~mi&pEQ7=0i5r{J3$V?(6b0b2D{+n3vhdwfBTd_mb&*W%fo^`7cA&2bpwz<bl;Cs?Ts6 zpC4s@VEs2DbCiwG4@JhoM<#onk(nQxJW8~3K7lItQyX{0fAZt+|7DIPePw5~NczuB z=I{Syeqr)h(dHF)=GB*(lkiV+#%GR$5h&T~Ovs#Q{*y$TSLkhC6ku=ZIGIz-UMSkU zh(e9~$!`6M-1-$;y06SncKKJ0PRpEX_Gy{Z$**qoYthC%#6B}~hS_Ik&cWU=`i*FI zNWaaNZ1V!zyqF7TISVr9!Fg~#Tm%=o^8(s=8O|3mfb8mN9<3pGyHL5 z&Wzc&K%IxQ6>2}W4QfAD3U#j4cDQ8$@!!p72mIgtNDta~C*#!*cfm0H0qXpS-S}l8 z|A;&Z`4>A6c5miC=o6fMnTKfS%Fcd~c0OP-aX<4Q?X2ex=ov4E<a&;pE@5B2 zlK2mQrGG9{FZJhtQ2luYs=u#NF7N+md9qY~T$c6`f8hVWeMH%;*nBJpYthc-q3RJ2 zm2U!6eJVh$6BVJ>iAq_qa;||ICzYYfyB4Y*Rk9SX6SJ<%(te?8R?RHMFR#e;CYsFO z|IMmqa!t|luMV|7)Uf(;|4)7iPOYrkq_6DUAd>z@lfBMOSxF|>7HxgNPJbt7-HLyb zQzz?Y7=e;G|2OLv^S@QJ^#Q%D5B0F~_y4k*n7x5$>qA4R`G1>RzuVpVHL`S#%};ju zSB*ByYHIdoSuMz~ZnU{beYyWPd#kLLW^a{sC-#QXJ4CZX)`vEdZGC{&{&&I2^!MFx z6}$&({@)8V|L=pE|81e>|NT(&{{g6R(hh2zJP2nw4`;Q9^WZ~p5$s_7!~H+9)`>@; z;^U)MAMXF5`uB0D{(S*~rvnQd}ji;d2ji+gsIM1_L&sh6Bo2C0XjWgI<`y6*BPUUtvwfnN21Tt>4I5du2bz7GCT3#@`+?+xO&L%Lz!7w$eIU`dgNqfTl$t%ecnq@_kF!!PxLRt3$Qob3;V#G*!#jA$gjXTupc}GUxmA1|E$>G zl^>AhvG0TjqTfe-UV~$>zYafvlwbZu_(qne{PQu{)}O)DU+d2hsPT}`_11(#X^(Cm z;y-*54$JbC^RN!Rjo%*fC%>eb@ZBu#x8ZxF`~U0zaAd9jAGr1rQ2rl6t^XfEt^XsT z&h7gc?&G=9CvXmapSt;tf{FuYb3O52p&!llC=PrM6&J=p#e*-P&hZ%wb&k)Mq*GiN zhpcma#zURsGXd%xpNUZC_)LP8VFA=RJ`U75K7~-{>_nl?OPLIhBNxFo$i-0S_KGduAgz2ebw=H1n+E3#H1 zD;|l8N2{RX(YH|JLHX$Ka;&j=x;|?ya^vVat4~X(MC3a1&Cj788?Y-bY=pXh+yoUD zHp8Uo7B}5iH(f0MKBOzf{s!C*HU7S%zFI$aK+WUtZN1o)wbSacE9(dRKE)r}`trXx z^&@)4g*{MlYA;kh_Cb}iAF4hFpyJd)s5o^9s{V(e>VL$|_bAjlam=m9Pf+zbZgJ~G z*3Y&s{*rZ?{<&26t4MpCFxl&z%sOTAY0=924XS>>+jVgNPksr`nXL1quk4%^N&kn* zUgyuOb0(h`EpB0FeEgMl3I8PLV%7y1fs(z>-&y~d|0U7l7J7?Y|6*_HT+S++t^EHJ zEpA<*K8j0M-THaZtA26WN>?UZezJ>Iqvf;9nZ0~=Lbivv6)%z>@!#wfvn!arVs;hm z4WpGrvqRR`%GuXu$Kn>W_C|00avfCsstWb~kQXjk%=tfX0R3`3)cB}Iz4#6=ySmk{ zMs`i~8V91rO)bh%f879&z#Gw@X8pMd&T^8oli)m98!m!3XKUXvqySo6s{<9+>cUm< z7N|ISD^wh)2Ng%_L&ebsP;s;&)O%F7LA^(HJJfqrji`s>USp_v+5~DmH-)-iYz8%+ znnT6OSo~|1-7;J8r&adduKfwXxj9XpsG@!#@$H2X2v4oUxb z_7mtk(jH=Cr(^b$*fsAU^?N$|DYz3V9!d|Bvf#6%|Nn90Ib_9+=d)w+p)=I^pf5n3 zAKC>fesqOO|Dv0|8&sU=j{XAd0d?+d3e>r?sZi(6ra_%M>w`LXcFbF`bL{-t9*Zjh zsJIe@iYpRhaBsOPgeQ0HRh!j&)&u7N$_2KW+u z2=;<|;LA|wV)ceP7po7{^WnZw=VHAA2O{@_)sbI?>#0wFSOX4#Iu~mo+=bt3w1?s! z_e1u5{Ge=)_j;ZuzXA1K{G0H3I2gbC@Ed}x@8|QOzMs$jQt|7pYzKRSGc5Z(=5=M~ zZIOBXj>%r-A~%kXv+`Ry<3;Mt z-~B_c?*J!4{{Ek9FL3Ra-qw>s?ANR%{!bnuin~IiXFUPL;IF{1>yNZ@cw)GfNkCoXgU}d;2TlZmWvRB!9 z_^o8(*=iC0H70wVwb?vBL|!K{9!jz|<5$^PFQVUIGJgj+dy~nVMT=Y585di!zr#Pt z*_OQ(MxbQQ|IglT{@;lfx6o6+@3VJU{l3rMWA)pez0>NqOEUHQL8RQ>CVQP9-TLhj z>Hodihb`T~?0uGQzhu%K5J`8?WS#@K=?=T;mQOl@UrXm`_6hSlCR)7w2`U~QxBBt^ zztxZVW&QK3`N=N-s?k%~C(V8;`*-rI8~shBT;jjk&t#uA`huskw;jDw5Wf8($3AR*)6QuaS^EL1-F-cf#&nHQJgEaz(W ze{deW0vAC~PAm>Wi*IpoEBy{tEF9=6CT_ z%&Fwc(Bj-RP~*EYdd2B$;U>mq6_`rC*TEU+t3t(JFI)u^;d*#IR2-^CKAIoZVLa(- zK+ThyQ1h`CR9w6PTKp&7rlOm2l94qJl5#W;YD>0uhW7jV&G3#Xb#jQmv~yk2-UE)s z<9a!_<|uB}%V|VDDz83Nc@0e8Fz0q;m3tdhxyZ!3#_}f~H_mB-UiF6L(>$jsEaNoK zX$CvNme|!kEnGjz=L%Zo+(CP){~`XZa~^Qpp$&G6|4{Y03##0^q3U%HRQud(*MFbV z+4Z-z>%U*JT|cBg?Q$N(uKfr^ZlCjzTMnfD59gHc7b~ZOn?G{WRhjq^JSX_PqDlT_{ zipyQ0&YOJ^>KxK;P=C*{JJkJJ52*XI6sY^NRH*y2G^qPCALS@MrXx=$e){1Q7=XIZ z3qsxhg`n;$!%+8?5!i7CP$eyZ&B5$UJCCVQQJIj=At6lc-1p1vx7*3$tw{b2-3=KQ~$ z*DT#g(c-M~?OHfUc8jyn;_RCy56&54cH%#J#o7EE#o3`bZy_trii)$tpyKS?P;plI z=>G6s{L6Sg$axRBarAwwM@wh8Nd5E8PxoOXuqQ=7bnPFx_ERo8E*NNs#Hu)>j$}NJbN3mTu_y6RV;7rMxLHf$hRFU-4O!hio z=S(+whG_8+JN-8^XDkhIEazCx5jYPXg^S=%ZhVCKl|09DepWfu3+7k!{GxbaGHmb**Lfl* z_V-;*Lj4_>Q}8$Rzrlt@r*nRX3*lMXw^7j<(b^YsKl(?`pV*UFN1^?_m~*fW@_FEYu&Gq8(ZfqLg_2PcUjl3frm(6 z89&8~YoXS6y=SI%_Bx*H>3LpNsP)|owZ139<~$F)9%_BB26vH9bvT&&n;NhjtO-+K zE%McRegm@B{Trdy@0*~`0Z)PE2{>wi6{ z_5bhBwO%*KeT4E7oQAoLb2aa86KVI`P4+sCa~tKx)@$_4_a^dZzBkKl3L{Xm*J+;H z!qPn=+Ip>gyB4;R-PUVp>ve0B+vMJ9cJBYtYrVcJSL^lNx%VJzy%x1z-wU-~-v_l` zD<7@b_v2s2(?0hBgCh0MH$OcmdkA|{^kLWD!L`To`H+5i6ng@E3~q*x z!|m`1sC`~X>Zy76B-DI-3Tpm6P5C_k&wa+~@oa7<{Fjgp=6CY&{vUh+{_nY7XY5*U zUw~ToyFjh`U7_mnB2<05L9P4U-ST=s&Fd7m+*GLgq~&Ve59IoCHQ&;6Gw6p)g?^Fi z517pNf4L!(Gej#l3{{Va)tmTFehE%yZXW3?J6R&>vrXpxzua7t^F&+su`>>O=Jvrq z$?28*5{y8}Ugzc9-say&v~?f7t^0kkw{%{~eckN+L|gY?g<9A9yY(C3)^DJtd(Hf0 zmw(mh8@Yqb{zmR#@~aztQ>4D!|C>EOcZk{ZbKl0^FgjE;J7nD-CfU|~XzTquZa=+? ztabc7sCE2(^y`L{T~YzhrWc0L*t<0(0HhEIRWau#EEd0buzW zlYFjVY3?$&-yrhx+?AG|-~VAp+Cy>~XI1XET$kDplK<-5HLeV64PCP~cb%@Eetp@PN(deYrnczI!AypZAKS+h?-Z*`FJWg9k*5 zg9k~kICuyu4jzVzgGb=k@F-LqJO&j9e}cN6<8D2OgBIt0L00_xl{oj)T;e}GK-@bC zb>DLeDjxm@6%T)h&(aR3NvC*t1}Yw&MIS;>T&y^TdGKehr(ziYbF{P8wev6s`LEpA z-+{RRL)7OY> zQqtW7cfcg5-%V@7HrSJ4lzqd^a4-5gP=6<*F4Vr`7N~v3tx)@ndQkg}`fwTP8$j(V z8p0Q7*V~}(M{kE}*G5pk>o$gcU=yg{Yn#F~uo=|v!Oh_Zum#lbv@M~2w`~Q-!8_nI z*g8*f>+ZZZd5T+i=C#e!IKN9|oZoFSfBz@%UX$C3cAt44)cMQ!@%IJp&wGG=_>KG^ ze_xFy>;a##@*d55*vjjW_qdh!h)8*ln(TER%Ztsc$3_0Wz!P~L z&CdMCzs1Za^PX~L$ln)uTKU?1hP2bOc_&8e?+bLwd(PEE{=UHTd7WJu^7jQ^$m`qOBmY3HPS^G0l z`?Hsz_Gi7I_GijR`?KEom+|z=>x0}l+Slqq{1>TzzWHgt^D6eFXn)r}z_rKnImY;X z4ZGsq>+oOXLDcU#56}OR6_4M9`dw!*^;KLM0u{eF9LD0(Q0fuq8J72!)n{1V+xWL9 z9klrV4(v>R|J$d%hh6)l_o3FS;cosPK-FgiRJ}ih+Q)qawT~MKb^rdcTka=NaqLs5 zdX0jr*Jm~!zsMVHXKdb=CQlHpoN-X~8gJJ@{3pKzXJTHI z^p%}SBIyfE_Bu{pp~+Fv_HEc1ACvQ@;-BOc=M}*SlTQ$^dip|^e8H0&*% zuk+@ZeY$A-wi!_SvYBrEzH#d}%hJs@KiTD9H99YEuG#11Eg-+T(fK0v<@vwa7v(K9 z`=Y#M*c(O{i)M$4|B`Lr2CW~K!^w<`6;S(_l~DV)RZ#o4Z{2=fjjZvr25S7QMSmUT zu0z)NDS>5|5&xm~ZyR7WxDjd}w+a8}@!yQRgLQEW)P4O{sQdbDP~)!@KaI=n$lBk1 z2erT30awBA;d;0eYJai|YJc|w)c$Ta)c)>AsQuXbd73sPT1}^tGoP%{v17Pd%D<486XKh1~c5ly@Ax?)xG0;+MRit-pTB`xU+Bg*eMO zm3IQpgD2r4_?wMa;y?LR^!%Q88oly?_PpZ^)P6a(Py93Qk38+a{>=N^t=BoI>p5@w zzw$03>$)yLT^BO@uYcsvKJlNtOXzidkbM5j`xlmR{>!@zJHe~i)ecu&Kgs6`JU!!j z#>NRmF4MDIPo?MnA9kdDC6{r^_l)lu>j#KEp=SkGhSZ}{&x)q6)bkqj>R-ryvGV^h zb>?w8SMUG7XT*e&xkXf?q8LJ%5N%}5mL)|hQW+F;&pk8uEca};DMVz+QnJl^?lG2- z-4Ge2WXlp+qEgzlDWxL(p0DeE_xpbSdOogmo$Y&)J=l?b#QL!J7UqB0jQ)EY<;zcN;MT7p;l<>W z0M8TN2$mu@hW*Irb~pewfltDw@M+i#$`8B)ehTk|$6#|PzcCT&{iC~}-al#qFA&}m z%5Q81mm=Q{*TL5C1K0-YKb+&|MEu5kX>a+9_d(g?`;#Mn;{(XM7Pd`pz`nlDMcQ#a z>Msu_>wKiW!p(j_`@dSpWRLlQouK@{&QN|}7uaAK>whReuqzymf7UHI;^%co*7I#W zU>x=633Yz{FnpVK?*-*w^@e&+st?rvz4}7=TaP41{KkIB+9!V$&LI3TsQ+*Ehjls6 z9sujZ$Kf{e9SC11zbByl$0wowzx5QeIeBTVJXylWD(SQWHHowWC_%IWGU2os-Y+OmtQ!uTR!ETq9PhN$TavYYcsKby%DGUyRivD9lfBNi4uW8lD{UrF7aTcn@dh7e}h~f8S5@buu_YXpOb%r>)@~GTbKMInjTiVujFj&!os|3U6jd_MUvHy*sHXYt<(w{)=5<0Ti8|0R5I$wkq^VWp&!OUYLVPcFGES~#qf zQR4AM`#kuUQKE%I`dI~EMZyb9t`aRA(hn>7t|okPNsMUWk`uy}eVrHR|7D#PR3YB$ zuqvDj3Ag8ss`(<%8@)6|>$K{=&d4!NoUbP7V;!$Zel<+yyMMlG`PqcdJqgDTuci3- z;kA9&!6Ycz>(udGZ|ORVk$rTZ{InZ=@xF*3Yg}E|$~(N8d5rw}7vC(|)^X6*arI2D z@4MCX%>RUI9d{e~UAfZ0*AQ9jI8p1k1gLdfBX|}+iG1+?Z};7ed}c{AUla1H>1pa~ zfjp+PneQH-#$lrG4xh&1oeHNPHy63?M3Z^{&leeoEkt`?vnA>Ed}=GWf%TH|*LtzF zmDk31AF|Fr$=|-yeJ|WhJi=**`+W}}%b$nTuf4A=GW-9&_LR^5zexFoMG$=lwTt%u zt$h=nPNLmsg=aILb%CScL$s6p)2_(MzZ!v$Co8ryFvQdMBfCzLu2Nx0e{VlQU-=1_jD^SVg+Zn!jUS$s#d^*iB|w`D;w`a~z}TWb0e(bn$^ zq1NZ6Q0=t{s=XFlx+NA*dc}_mFY~=+`enWq##MxwbV<`0YTbrgKwRcv%$9>RzxNq?OW#CNc>m0&yaR}$F~X2hRSCK;fhzn_}l_l zI_181;aa#Amceb-uUP*h?YP@fU4Hkdk`;h#au`Y%-{&yg29r_W}x^ySu zvID!2)sJ^0FGt=3wXWX_%i+gx2iym>uHO%}u0KFJt;-KW_5V+x`u`y)dvcg~yB2=x zJBF-&c!YL4yzr=GYd2{2fProk2d1U4pj0{}EaC>L)0>@iWwS zIe&pF_g5(UbQbEnoWDWU`**1Cznp`zbAPz?{nO3&JmvK({mXZe>mOM9x5)MXBieUi zEPjZ$tW zzOJ`1)b%2hu1U(B$hzL9uD%)6b>HE}Lr=VxDa|dPmMMwwP*Ka2yWkes0`@`Qiuh_5 z@m$f}DXj_b&UJ``-))m}FZI#5y9eriAhYjsU&{T+>UWU*+NL}J4?*p_C|vt4+BbQS ze6_#QKE)G%1MA!lFbRD}sQr~rQ1LoL?Vogk!!n^$|E=y#I;~TAPTl6+zSLLt^bsig+7D`8eH3cmd<<$n?oT?k_W-E& zejKV_41{W@CsO2R4NiG7MSj*(DbLX#E))+E=?{ZV<{Thph{?~1R^BsESk@ zNXa*SLCTBh6T%_U^pJj4DA~plwE5yCWZB6v$g<;O;dk#a|3mHnzKlK&{dh~y`X8$O zUxB(G6Nz_<_>-XQ-K$XcZ8Fq+Fa?&wsc;9J1~txJgPISfL(NAspys2QzvURQTo6`6&yicNGuoe^}WQJq|k-KY;%3(67HJ zXZ;T!+Q|AJYX7f<{MFC@+m9?o)_7TjUi*rRq4wdHK#iBBP~+t-sC<_}<+~gz-xW~# zz6~=-w-QD%?pDEea5dDv;u@%Z#kElTitC{E71u-UD{g?=S1g0tSKJ7-FS<#3%6$iF zUvM+jzTpgXrLyg}LU}N+jLha}6fI2Vz z2%cqJ?}Xad+XY(@z8h|5pJWfzKHpxb{k)H1TlD+jbi(&j57~hO$Q=kj2p@up^Fw}nHr|>!U^^U+E#5)RG5$_m050Ar(@H43Wwi8hMZ6~4j+dhZ)qW=PFzwJw? z{kBt3`)yxA?YDgmYY^`=)PCDHQ2TA)LfNtJU@ZI|YJcemSPsv?Z{UycM)W^H?YI35 zwcqv&)V|WM@De-=e}=z7?VJ4$e?UG5|ABwNO62n=tcCtOoJjaza5MZHYX9^fsC~K% zQ2T8cq4sJ2h1$=%1ho%%8EXIS3e-N7#~<0Bit@`2Mf)rHWfv-lw*Pb$)c#XNsQo9x z`EN1j|H#@GyBcaAtuoZUS{0~$wyIG3iLp@oe%0V6c#S`@Ph1^Y`^s@p`1sQ-i`f6B{w6R9O6LDR{yQvPXECx*LHz#3&83g*Lr|YJMeP5Z+``||^z8o= zu6>ABe(git?Qe~&eF#ze5N+T_^!LEC*g5ixs>1c(2enUdKk1@95BeWKZW3;5^+|Nv ziCh=Y{SmJ9ReKm8?%?l4eG{FIqRkJ`*1L)~VH@*5^^zTa2+H1fg|f%psCN%fFMoG8 zeh=snzbCvFJ`77?Zzz9Mlz-a?jwHM<>AQL!@%KZPpDoI-c@!q0e~jzkzd!!|c0B|9 zj}v}{a9G&WGtmEpn+`_LBb@JTnqTo0;hNV6LHQ4Zp|1C7sCo^7TF*ZN<##*_<##;i zUguEv`jVjLwP8@#J>2Rs!k_7vzcI@HykGvt3zG3SMvAoGD3h80{gHhgpGY}=e+uQq z!btjnKh@Hwx#`p0^Z_@0hMPW9qf2`GSoMf)=Ws!2no9uNaxb=HQ zG{0sd@e-X${^=I)Rnh#K$xwdF6f1}M-^yYBxAuI^;z_Ugap9T%8K$4Awz~!(AYF+3+trLr(`db*Pf0kH2 z?Eky>y_9hE*G0(c4~xlP_G1a*@@tmDa`+b90hdAfHOry=niX&_d>ihEE1|~KD)N&b zvl_~;Spzk$*1G+99r4sp*F%T+8=(4c8PvGi2sK_dL9J)sfm;7=CLfL0Ey$Nk-}P^! zz7Knt|6x~H4tqkv@td~$--B!6`>+gtVE3K*pLjhyANqF?uJH>Qk30Pz*?rsT-$l5_ zqj;itxBp|x?N_=-WSzQKwEF^CpYHSXohq&@w+W)PkXa0xXXJ-n6l|LgZRK$hR%5WW2B1gPgW8$tQ~jiLPh z+oAGp0+nx5DF441l>dJRR5^D-mD3!`e@}$+-|uqEZ2{${w^Tgx(Ym@7e&F4y9$Qzp zhVswbK>6qQK>5k{Lix$}!QsTeAIe{U0FJ?rZ3}hI+77-?{0E`@_V#cGatC-7az`lt zy%Y72f8H5+ANnrvXRiApsB`hIQ0L~|;10^`4t3t$18QB+6YAXdVW{)_UQm92Z>aP4 zK2ZK@UwDQ59)UXV?FWyce-z5keGJOK?hoZ}4}kKoABXbO2SWMDPeA$KPeS?8PeJ+D zgP{EG!BBqt(@_5P5GX(V87RNL>C}jyIQ&)lbwg7pas4q)QtI=mns0}R*s0+r^WFc{ z5saG(9`^r<$NFFKwf;{X30eP}%>19~vviY0^Z%4@|6;%N=Kn$S|I$oOPYsx!^*`bA z|1whL|7E6TAq{p`zWbLt)5@8ZI`L)ZJHjWp z@8Q2eJo$ICq5Qiyq3S)y&3`Vk%AW`2-_3{e?-oF{PZ3o6I8g0V4AnkisPapo+G(L% z&r-LZi=fT_R<9+gZ>P!+T%Nkr?Au$C@spN`w8L_fz0Qi%h#&a2$aSqwU1{l8r>=q( zk=IgQ-jX$A!w;V`*@29?J`Moc_<)?VMUmw5{`qzh0c6$d@yM6@KPCKFQ z?=Gl$VK>x#vB%2)ICZa;|8eR*!gc>d%_IAv?Ee8+4i7@v|4*Ro{~;**e;CUCe+o4p z9fA5U)lurHdEgjSKRQmh`p;*`x<4nN`q@c%41NyP&%S_~AHF2M=C4z*8v9jzPn~)4 zbn4fsnkP@Eo^jKEq*Z|Y|0k^y zdfnfOQ1@H%u7xpal}*q54^=6C{E}qiYk#^iteNJCzZ=$q-!iXV2OBX@)Q0+QWF6QH`FisI-}(ARWX;#{ zibuM-Q2TT@LCx1UL(SK>Ks`5D59+zW`cTge-b#ASzqcW4er^C&pN3HNNPwzGBdB^b zhN{QyZatbHYhSG?RQ;Pl?Ze#xwV!t2Y3I0))FtHDtI!P8Lw!4N3_;29|Y;901B#OI*=gP~CVK@yaIFbvAi z7!Kt}jDYe#o`>>BUXV<^Mnd^NqoDRblcDzKd{F*Q3e^6bA8LOt6>5Jj4QhX`|74H% z9?A`*dAtw64DO%yukH-VFUd*^BgZ(|X?bb#OM)WvOpeL?_a`kkE#j9DuJym-YyF>A z09pT=%=$mA(9(rP^GlR(|KgXVH@^g$UozI@acM7`p8bEq<(G_4lV36+?G1>~3L%ooY8un3|rQn~mo zjTam_dCQ;t<|J$EhNj&*4tDyXs)o!{qP}i~6EpHvN{Fn7m{>uia>n($No@67` zIoT$+KJP%yFPq(ZZL#*bqsZarBAKXK7!V{)A}zPA8%E zl|F~6=NC}*{L<2$vUt)feq8u;+SjH(o%SvH)eCSzfk_uCAb$}hVq}TK>25$^oSo81y?#(rANcHumUWD z71JZ@b!dK4rSyou6$913u7>LOm7&H(6{zu0mG~M5u~6fn8r1U-*Farwb*OW}xb(<5 zq8C}uLDYacC%hKwIf$B2en&0hRrfIeBlG{i^c#?yAlHFa;PtRFRCo=~jp^~kQ@;~W z6xU6^g?jZXy-8%h>1NUH7i2%GUixjOuP>s%RWvQEVumz{Gg`kP15DxG)=$DZI@wY$ey3fd@YoYk~k1f($60UZI z?d0LLwkStG3s{<>H8z=z2X7L zwUDD<^~AqPJ_C{e*Z+GGS^nQs>7Mvh;tzuI?*>EpcTYq4eM6x9!DrwZ?-@az501Bn43K zy@a6Ndl?ODz(QCHz6kXk$V>1RI0oJZ$3pqLFCe-=h9PWes-MPp*Pn-u2!ufDDTmU!0BB*mnC*9L>F@9Dt z@(BFPFqD5>0>^P57ec*HQVOf!?=OPWkQYOp7cYVGLzhDNp>IL?$;+Vp(dFcS2mas+ zsPoge;g^K3L@$4I6_h`^8pjzEqh(P3=td}ibQ6?6 z`VN#ox*6(xbqo2(zke55=dxR&{Nr*c|8yIa-})Yu-}*kB3b(@rT;B&!{_}@We*F%p z_dz~_I^W$1b>6-U>b!k7)H+}f)Ouns)Oq{IP=5SAsCB@8IEVZWK%E~SggS5k1nRu~ z5KJTdFw{Bor%>yRBQQX`qp&AD2DP3z4t37{8PvMu1bh{qggTf0oc>dXe)9#g-YfbN z>KyzO?2G&r)c)w#Q0tM?Q0t9vpw8#Ng|*;!Q2U(UL!E>F0J|WcfjXc65l%q<32OcE zGnD`T3)Ft-uTcA(XQ9?Pzd@~geurA`oP*ooA5i1C>RH$;dQVAycu2v8^DTC@8wj2_anyy z)b3-?^{gvI`sqf0+IC+;rN}mDn5Q^gTQSt2}<@l4Fd_5u9s-* zCFR?{xUuxMUV^q>YGQKJKr_>`{wG}Pr8@#zFWnhvj;!^PsP$4J)OzVIsPz*0;BT}H zJb-*=N$Wr>@~i2&+vG8&tpg7Rv|hR|&?X@N>>h=)Ub)aoRtd|}TZN1di z@@=Q|wtj%@JM#R$g?9*aBzy_}zIZ$P!ksL=yVe) zx3CDJ@1gd<-|lJcmgqbzqPOdcO6NZJrd{MO_JQ&j`$G9UkC3hk<@SSZ79}kh`*P$y zjwRoUr0-9-{PqD*>!rt`);|NGp0|Gjs-90m`T0*lt(OKtt(OKvt&^UHy3QeP`OiT4 zQ_s5fcn+$5L#>@h1d^^ol04D&ks_4iI(3a=`BCSE1_RcCcik^VG6R=K~tgn!!)S%z-v(c z|8&@f^}r0+7S4pZTW1AcCqLN<8091U4VVpQL+uB@3F|JN8<+#Lmdp*zBfj3}hO86j z2Nn>1nf%3-PH~_Ju7wUPgJHYR%>Tr%>?sK>bmNQD$-fk8U9t$yM_vpolr9M@rJOp1 zimzf%nNr z>n2!O)w4bDfh&s*7JnGnL43UjAl6*`QD7(Gb&$nf3wH(f60Ux_+xqDq$<|LH{paI= z)=4cE?-T#$d#eWn2Lf7G91I*Kz3Tf3)O8%P@WX*4$g20JQ1wP;opDU@SuY(694B1Y z2g&DT;4>KQoD7_Rec%`9b)BEP@g$!s`Z92e>(qJ)+CKJImhS7oS*}O-sTX zg{t3oQ1$p8s-8cVc}ixj1H^2?BF6G?5FkZBBpsgEkqCBl5Z-!bwj?9R>H(w9x z`%Cqyzt$zULd`F?Wkl8|4Kh4e&qCi24x{`8H+~~GJ@qiZ`gY!**LtN1)cU0<)HiP`f5FMH?sWU)=++T8>sceJy7e1 zd!g13_d%^6?uYVwAAnjnw1rwXw1ZkVJP5UJXb-h+=m52D=m_O+cY^ZEJ45-oU0^Hp z4?(RHx8wu0!LeH&nmtW8r->`XOt4 zJpwhZkV*HL;?o}<%ji$I#y6yY4$K$;qn&{nkHbFjN%ZR9Pq^_UpDTJQV^Bt9d_&~H z8AB{R^@ZK(Pm-gZXEL7Uervo#@_#O4s4GLtoi;=LPW@#Vvii?(>u=9zjIjRpdCthtQNAdAn^D=T_5|r$9@-qr7-89ksR^{8jc(nB9w?gw< zUo`opj4=^?5j4MbY=->SaTzZo%WoCsw~mJ!X}1Ybek=Ll|4h!9h}WZn&k3>dSa|jdImLrbG3Q8Bq8AzwZIhBE9^i*P;BTH=z8x+0f4a-S~6d zeCE3O%!BG5^E2c(7iTQUkl$RCv55BJ`@bUfD>j+$|7Mh!yhyZi7DAOJ`Tnm+`lTlG{ojmbCNCFlKN~&wXGO*u;`9CAjJIJDl+5>kGge#tHKOfj6HYtw z{a^Ha|2Jc^>DP<4pS=NUzq-t=-$u87n=IWs7EgM`=lj1ITTK6MMmhQM{a=y#GXILzRNJCr>? z2W8LyfU@U*LfP~4P)nBiO z++R8aBgpjA3Yo;GpH|Gg3MN6xUZ+xKjHQbg&5kJF{>7E0H#-8&j#M={ zHnW=P+5ab8>)&fKWk;%K#v#j&h_WMIC_7RE%8n=>J(pCI_|cv^nYECcgs-!DBs#T4 z>d*R~aGjG~597l(xcVDieIy?}7h4zoP28`WsE_*3%~1X47O4JJk8+|sw`SJ2@@~!4 zIb8zr|9daI0qHgV8$#Kg1Sq@H$j!GgR6TBovO`VW{F_4c$7XIhcR-bYXQu2>i_GSk zvO|fPZD`*M#dnEZR|}K9PRq`lUe^~ zK45ZN(d-a5?#qT7V9U|Q9P-pasPM6GwP5+Q+cBm_q zo$2P*ue)2n9+s}B#gks~W?%BF7w#icU)KMo@0aHB34K%WqPR5U%r z4)vF8b_m-2d>oc=e+NRXi=Kd57d;8JzI+O5T{MXLM0uXh9BlP^I&%o&y1!ye_zaxA zlKCI1zdQ$5I>R!D!nH67mcik6znK4#WuHbs*}3OoIeY=`fFq&o+$bnJmked+d{A~S z#jc0>AF6+(LYwEH`bRoc{|rFcw+txzhF!xi%FfKnl%JBFS>VPGy76-?JU27nO_%4U zLnd8F@$siZnWG6;d60Zw$}EJ@&P$mu!ai^;dev);8&C4NqH&ooyX_B=$7jA`>6!mw zcdkovv@tbb0PieLh%BTepO_$*Ksn7OptLiKJg_ve#LXxzyyhL>p)58E4BfR}nwnS&_LMCPB$w z=k3gu7Jrp!9ck;rQ^c2l{}q&f z|8=I;liy^Xh8rM$JO2H*qO}u@zlwhPJ@Nnd-0=*u{EZ(oJ$5el6V$om&rs)%zd)Tk z{tD%HoP|2~`;Bz+H-1N!pK=cBJns*va{h#s;d!WYy}w{I<@^nGe)tcJLw^D4`*jzg zo>TwVt=}bNodaHmH(}?lz#E|_D{@{K1$90d4RwxL0qUIcDyVbHGZP}~$Vyp}^SKx( zf9GnbbxdWbbF?Z@=W11<)~B&h>zis&=NQ*Oor_e5)hRy?>RiJMb$(O>>ip{3ssU_kW?z0dIm@$KDKe4t5LF zI<_8Mja(n<9O+i5bEMngLBborgWE zGnfYNfI3II6V`&wvm$?+jD7MslV3!k^jbZ&&o!Qae8F+CZAZRr${~zo9uOZXZ6a8_?d)bANwdi z_VJOdzAy<&_B#Et9<_AYqWPJGGk^Eb8juy4pN*>@xAG42+_B2-U;Kn*^Fv|O8tlVU zCJ)LQYF6Wci_@{Lp8i{Lts%S?q|)jrJsE`H;^n8Id&%jwu~3 znf?3`B7WSctmm_2PhODB{4!GHx<{GJ^Z!|qa~PkzBGDsq!>T2_Gc ziB7sm`obcJK10`q{m-=aNp!MA^j5#9(cH(Nn_mvsDSMd}Wpq?d&PY3K38H zyO8gejLs@V{+#r%u%jnA_dkF4CBilTje(kX$3o4! zvHnM|`pt%_@0%8Hj`FqZjBsAoe7io@|I{nSS&&siJz||Ak$N~Ld!6E}u*oH&&Ex3l zrwg-|5PB``7vfwTBiO#aDHKt!K+C07jYMy=@s@^N1 z>b=U+t+sg5D}G#fUDjIDugls%e)YoZMZ511{l=^^({Idr7kxr_lW2O#{I@x43-!|e zHnjJ$2)A>Rt+0gtR}M8_Zi9z7AA65R%tgaqvUfAMUXHIsZr2e7_Tx z!(CAG{cfoFeh<`qzZdR>A4ARe`$(_;u^(zaKLFK#4nocIpFo@ci9e?FaMm%dqqB$k zA6A7&U?+GKc7*8hPflbVhilk7F+&@|Rio)7JkZe)ZQ` zUuDT({W|LhxBSyk_4>xbzs>p{S@ru4s@}->uV)k=zxqtpkA&;GAo=`~^%IPCe#!b7 z_JL>7t9^fU<4HbO^jp^NT!-!xB>uUqf2gP0?+>W<{*!nr_dHa)`~_A1-%#}4~or>_&L>}{F-Z^o^Ps-UVc*?boW_IU&Bpzt(&f< zo354{|2jARz}b;`vQDd&Lp^7G3zUCR z4{AQIPyYY6|9V??2jm#1L3ZP8*^7oE<14{ruhTfY5$&e^SHiIqw<|t&qG@&$$ou~$ z^ZtMK9hR^|#JY z{j3XA|9*&aqCDNQyIOhOvbA4wAMyX2KYEZ}cC9CroqHH+{^;fA+Z$@Xqz}|Q($~%Z z5vcLe&n@RssPZ4n);v2fyMMOk*#X&uY2ORQkBeN_K$E@B6WLFiJXo}HpMt8#Agd?y zKl#NtPiGIc`#D4;{WB)>|DWvVOdcwl{YTGzP0D`3?(6XEVRm1Ko9uN)WIu25Ul7gy z6VL4bNa7_rqq5UYpDddF_d(hB6t{kUw|=RXF3sXeulRA{jO>8vGqSVDuU&BaB;q$YL z-1rNi>?d-aEk(tOkDV*d4im0&Aoi^^y97o%rP&K%AGjF3>a)m=C;42_lI*2!J44dF zmA%}(o@J)z{NM6fk^QzC4%r7;nY{{G;|x-dHQB2z{hDm;gD4y}oP@u=F5Aiqn)H=0{@Pvh%vNysFaL;V5Q{NG-AHeto(rqEWty8h5^RU1Feb1ZhQfqcJ!dj9Q8xS09j6x91kUqO9e{A;N1i=T#Gp7;C)wqkzx z7V5dc@8BxJzlY06{{w8cnRPPMzWk3+`|>|Qt!saVTG##pwXXdYYTh{uwXXdQYF+y~ z)VlT@)VlT$sQvywq1LtMq1Ls3L9O%thFZV<19i@D0qWf0BGfs+zfk82m!Q_Qm!a0R zSD?-nJi*AhLKM__Lo}>~z5>)a#Z^$}5f!1%FDgN;OJm@(WUnz2{U7>OH4xpx$$;4mJOBK4H)6d4nErHQKudY)}5z!Z_rbQ2#Hl1@)ZYbx_X( z)(%G2op;&$P}c`LBgZ&51aAszp1x6}|Hqr`b#4mQ4Myf^!m;N!D?amdz2Ge{2}) z-XlhxW+s{CNJ)^c_?#^HWD_55E5^ znjKO2XV{4@@H~77UVvTU8Q2YKz0e&l*ueXLa4GBwpXYg)hiNC-?Ow>g6TdgI>~|k1 zd)t?Ay)W_z{FnW!e$*$*^H}gvtJh<}C2x45qUi_F_Js!!PxJcYQ2xU}sQNwOrhgLZ zx}SpbKL$bhAA_OV>1nszA#S~%Azbx(7V7$*gSx(L6S-Mv(p7e?z7oHlNV*07U z*T}D4c$!Fkng2~cBRJjkGlFlRPYBNxO%IuGUzcot4UAeq|C$X;=zniQ^|v`t{b4TD zeVqq&U+2RMZ~@ePEpqRtgS^ry2^Pb(FbvD!Lc720|06Fa|57ObWf3fgi=q6NB~bp$ zQYioBEw~phgYvJILyeCWP~+omsPVCq^40%W*>&;!AJjNm12sO@LisoAp!}8fq)S;+ zShNAkUn_$;@7f4;-n9wpyz3pP@w6H0y{aux?_a$OHNLh&J;zv1zWqwK1wWvj2bR7k z($4RT_C49{P~Ve9=Dn&9gFBG5e*_tyJA)tD{oNVVI$Gm1;)m@C?heWi+7moT{<@yM zP}lRZh3^Xom`VBJm`6l=s z>2w|6LR|+k_4z*d6SA)32UmXv>Uw^3oT!}WoJhZblyg;11;}%NIr2l*U*w1W3M=JkK8ne?Iw$fxllTqc zm0`ldsyS8Q23RdeerT*{;})9VdJUA{TAg^!7kYEz;96KaNAq2+oEnz@wUU|dYKo+< zWwO_~E+;bI)fVl4j&(?{|2bX{9e4vQfj2_^&oLgZfOVn%=XeuTeQ$Q_qyIUcLavAW zzvno&BFitnEhpmlHh}VT8$!iTaN{?E?*4`Ooww&i{Lv=xB=MR;`KisI{Lwq0{Kq>< zCx5j$vd$k8q0SAi9~<#&cz(|I*Ey%M`K}fBNA~n?DErzPYCdZNHUHg1ei|?LLiN-8 zp!(_kP~+qQYv1-cZLNLV<#e(3eNd!*+ndb!e@;h}yNFg!C#Z5e^E_X)hxwoUVw{I^ zdXhfY=_-=Go5^0Mdrl9Ndx|#Cpl61**H5pA9!+~%2n z=o6hsbDlK)W1`J7{h{WO0dD;sck4IM(mi4Eq*wg7@SvQhOg|{+Y4WQV9xPgagy^5i z8Djcpa+1&|gr5~n4;d#zCEGj$ZU1x_EMXiEhnf#YzzX>N&qIA5_XW4TM?&3)QBd|F z8NI%T>$7~B|B+9S-Ve)RD%=6npzKvT)I1V^nnyCA=8;U&>po{e*_mvp`y90UnvF%A+I7UqnG8{nJ?8m}*kcKtBw0R5N#XZ?OG=`tkq`Z{G-naA{7O-N_F@ZPma_!8 zNqA|_GU~k0pmaB&;l0Oe1VaXq^K8=?BeCa8Y*-#*-C;%WSDfwCL#LfMV2Q18K%LzTbHP4}Lg z-}_K@V>?v79}rL1{njjviyb*1(Vp6`hEY$Fekatp*abB%cEibp?;&0X5A#3ysK0(p zxI_3p!s7_vkF57T4nV#4aS*CLpFq8@dEqIZ6527ysP7o-fd={l0{1_ft^q{uO$)=hw)akWa(aoKt^8xW@6fQ0?*^ z;kpmsBdfiCK)zghCg*3$(|hSZ!Yc45sQ1zdXI!4m`30_pzrr&3n~hu6|8~F6<@|2< z`&`Z+=yks#?-l%+BmYY86`Utr?-fM+tbcO;wt4!WoGWfUE?!hKs_gMJ(T^q0cxJU5o+Hm9%?_UF4TV3O{AASx*5to-9osYho}ejJVbrP zC*IoEBj@+G<$7#?sR7hH-VkbkDFJF9suB5U9&e0%g?ii$L(K0@;Be;irmzFo*$isl zzXNI?=uW8b=rxBrmrsOUh<6vSVp!|n>p!|n> zp`NR_59+xJzOQfR^AF@k{0V24-iK_LJDhsQI1lD_%9Z_XFJg~6nCx{r<#y!$%Kj3L z{q3yy*x!e8yTBwU+3R%8?PlqQi)Me7Z~x*R(wqH-W`7?xxmRv))3g33T=ut5uIz8$ z+((dQe?{5feo*%JQ7HRMKG@OzxkHf8EE$+Pfc$ED9?u<$Jf?J@%ENygl>0=k2mkcR z+^4DEh2p0~u4|CVUT1J_#D9ERB){h@zb4^la-So9qVue1b{nD}s(i8ANp`)7&M?vJ zw!&pUM!k3g>|&n+-{yvTKha$h8W?L&-)V@eAp z+djm9;V)S{_W#kVeq*8PJI><0tbFZyApK}U?qtf1bzTuEccRH&XHxE~CQla4A4E@o znvy$%`0>uP+^H}LO7=RhiL zdd{(Qb1k0qiXRtVkUQV>3vwOus~0X3?S4Y^;oM@=hjSO9PY9QYria*}Qpq;&K|3E= z3^ng9ftvT0LivGjLHUKtNT>d=9QoiX*8j+|!*4^~zm=9R^FR6%q+boo;TovHTXWw-UWr@|tO-|{(;d(sVub+&H)T=PlPcG~H``Q%IDYd$%J-PdV#Ff1u6{Er0N>Jl02FhMt4P~b) zlaKCW6{vn!6{;V^LfyY=d9u&myle7gpR4CxmnZuiCo;agCVQP4dDohJooMCMgetdI zp6meo|Ku0r)Xs}1eXLVQB>nX!dz~BdZZtVwG<$;{ds8>BKJnw7oAYjhNl>!axh1cj z#jh`#y&>G}&8_GYo!j!7n7)B%_NF0}JxOru*T}73V@r3t#gks~|}_5XX}7UcWj zUU)y0op=DsPPK(Ao%VU{;9B?~EQ1~FzHt6exohcv9ii@HC#d__8On}yff~mTLEYD` zQ1`tXlz$zu3qA9C@Ey%VMLqK#Azb-943$qW3-6uR7g_oBfyxgVyU1q_ZWv|w^QXbE>SU!;Y4bPKbs(jjxiP(qdi7z|y0?)tnz|N0^S_hAU zvLngvb1^=s=U-AJLqF8_eNss;yO9R}cRwk>IF#MUfch>-CY1fig8FVqHq>`Rf~1ol z%6P5u*5=&2EPj~LCIccT;9u;?oHABJ>}cKc!Koi??LnTCYn4c?^V-t{!h64y~&J|D_5rEO+}W! zC(7TO1~;OA4W6Z+k`LqX^}HF#O~Ny+eCB_VdKXI1IDEqmpY4WQx~NH9_Z-UA{h14O zf9FB{}ShzLh|&lNUn8FNLyqi`;w{ zL-oTYZvIQ5%6-f1-P?J~Y+NnRTTA<0C|)5_|F=!{IxF*5nY>oCa#usuV~t%u^FR5; zIP3B@kv`U0FOq(P$zG={Z==bZM6-A3xqt8El@mYS*^;*zCPB$w=iR)m7Qb9Hdq=q0 zyKU$bo%ix~n*M#!?A>-Kd-j1_zYpE|?XYwoSv=_#KQ6pGZ-W~4a)x_-1e={ zk*}Wf_ycOc?$12!*Zq}u9&Uh<_YwXUt^M>qg8Y;V#Frhqh+UE0`B!!ZUV<;u9+%O} z&Rl`6or$`Rc0S2_$y!%N=X=cFRDiNGS3&tH6`|Inm7vz6G4M40&egDhd@JYwfBS>I zshZyyImU_2kIPrTttL{>YfSb!arxErBld=H`m0y*>95!3*MLb-GXDY2uVv{Pi)L?> zZ~x-j(wn`3W^b-H`G))(P0#wDaM_#qeA%12`8OfU-iWd{H$&N*TcGR>`7jO|FmavR=ZUvS9-B9~*t)c8x8z?(<57a)@y)cV-_rdc# zpK`xjj|ZUoZCkfK?V#%UV7~maPWkQg)h|2bcca}e6n7N4?oK9qozD4POztLHxer0r zv#VVP^FR5;INkGmlRnnzA(FnQ$zJE-{9Y#a7R^qf=f3yJe~kD%|DWF%^8CNaJpZ5n zsKtLwG&@B+vs3+vm*@=0A8h)^MYB@_q3qBTQ0?+0RQ;Z^bb~CO^ok!B9+LmG>4)S$ zOMdmj&xq8Q`QP+I^Pe;Q(EJhT6T(TN=^^8NxMZ_a(CpLmaHTUU{{^@fj)Y|}+1i!) zA6fRs2g_j!l)dpo*|Su*1vw4Mo~1+CvjEijZU&V7%cOkur!1=n^FP#m3_|s{94LF0 z3uUkJpzeD<=?831T2KI=qJMXn=<$U=?ss}Ru-4w;gf0~j%m2h1LB%kT|(_pkS zJ^wY>2hK#Vde3mk`u#gl<6twCeb@qJPu?ZH+I=h3eJh8$Z`+{S`#rM%Ha&|(MyUY3!>wof#arWdNAbqT}S0w$%CVQQI z`TI>iAeucuk3Be;e}wq)&Y}EIU=oz|{$`#m>{_ZJ=jMFHneh>}S zFDgL!HCGjQq8=n(MYx{+$N1-*Fs9&h*YAMV?<*5ui1ty zjXXzLo%hPr@8h8Qy%(zA*MPTD-nCHuzb4dk{I#H-`mW&sW|C^&DjbsQsCS zP|sr~Ks{H-6zGq^A z`te-_t?j+L7NWg(*AnWzyH-&9KzBpEe}~?_BiaU8@AusU_5R?!Q14;h2RFg{q25b; z03L^Jq27mV2lYPWgK#x$4-Z1#>*ITk9Sb^9ub+@1-)rn#@ap8q_Znf1n`mFoh4J&c z77Rll<8&){nEJ;$-9^Sl50jbq3wjnr{5--L-@O!{@!hAOH%x+(y-wePM=aei(fmB+ z+rRix>CMlB=I8Y{c|gJArf2=Hen~$aSRg;|iGnAQ<>!g=^PYn8^9I4Q^n3EbZaiD? zG;)*h5Gy~?c}Aq(h0>dU^&E^34|VlPuHMo|9cF)bIQs2y1ohB(c^+!~yZ|+hM^a9d zC%Ishm6u!~Kkr)F?LR*+h4ivVeki+~3bpT_=H{CY<>v*U>{kYq9nW;j$%3-i*=~73 zsCwiS$e$}H$SsgRmsju-?R%j(U*!4dX93elgCNf(fLL zb;gRMA7`@HdAVS`$rD7g-{`r&uM|une!MfOU?NO{lD*EW1(PlQ6w&NA;by<5qEB?D z6}(~k*F>}5)1mD147YwW-TKY4bgx@H=@maN{AR&y)4y3Tm;CC5=ZMso^}p%o7tAyL z{DNZi3E>5z=^=K`k!)lW794Z$8zkNFf)mtJ?fRMNng1=H zlLeo<;SfLYi-IqaHGU!W_^RNPrT?lxexSl(y_FC<7gZXey?6gD^V%E8-;uxOweOMT z=luYS2tNb!Sg-vE^U-N4q29;%7k-QW64dv*FT*{o3$H+Z$J-O~ z#LuPtD5&qGN5hT8uK*L7Z?A$~U`43?%1TiCnlYis^Z{cRj9WS4sWQ zt-NQV?-Ik>@0HvZLT~dRtTF1HhM|Oz$D2lcSR><|M$&t8kj2CJ8MmYFhunnpdM~~y z^0UbNci5iiy94U|1^(k=?>#h!dfy=t>iq`ZXRz-Z^ZjCPFJ$s%o^2I+hWuijyF>Se zWRF{m*snGwd!2hj_i$a>za<Cttf+am8`M189iGKrkPr5~XXr8HGfR4h9wxt< zo?a%8DeWB^5Yjx=FVrWbd8)6%nWr8RxvqXDd!0u^^ibr-M0?(?y=-lIjekI9?^gkG}tST_sOUSmQplU~mWjD=%L$4R#51pW&jZ{ZU{ zt7k>RA$ECUXcF=Cd>FKLeHCgxoeZ@engTU{PKBC3r$No1uUR`!56wVUJBwEjj&38+o=DD{>SB-iugX#~<;r(z0)OU;DhV777 z!aMoz;3}y8vKs2S{54R|>#v2{zg`D*|JOr3&%Xg`Kf8?fs_tR_hjDNd<@YOnC$yFR zKd^MO$o<_S+VlMHLOsuq%=7%^p>4=I=ZEZ9zZZHRS?vzlx85H5z?H?ii+6-Rgjq{= zgg&AieODRMuXlxZT7TIUIixZ|{{gE0XWV$` z@iTr3{Y-wkZ;{1aXc^}JkVcnMa4@;jf9qNB0 zaZvvo@k0G?qz1eVUJK=~)P(s`kz?-1{H&PdB{!i9 zcYs>gcZ6Ek-<=rI_8aC6oshM@zXxhv-x)50_d@Lpbb;C@xDR{%_vC)4|B`gYUHdTI zpx!g-4)tAx2cW)7)B_HLJ>g*33+jGnZ@66b8EU`gL8$$jzLIf&2x>p2AJqFP{h{_P z2N19Ri!u-%M1C0eBIH3(`=gJ*?QpPU^h4lo{v_Klv0+BX^lwO{lC)PB*6Q2Rw=q4tZ$LEV>q3Hsp6Q1@tGf$iXUsC}weq5kvn z8q|M2CP4k?<8`R_g(gDnk4=L5ug7Gl|9ZRuE0Di$LjBic3ec1yxQ17$)q4u%Tq5cz+0WX9Di9zb= z8Qh`$rzI2WKQAGu_lvTi&Kt9#-eb*ymwEnNsQD68$fx5WW5bQv~(?)CVvQ|MQ{lM;F8Q(Jz4dKh1|w|9M%6fBmm$5%Or{#Zdc# zAHnf(37m)fQmFT|mcd$ZIn@7QN?>*56;S(%D@Ed41@%9cQmFmK)o?!cAH$}+`0)uG z2Dc1d*TjPh7I~G-kG?|m0^Sai+3mP zab?(G@Z!A+$HIlSPTH4P_TQKNl!w++2awzH{0E`__i_ko-Sjo=4G+VI;Ss3yQ}%4F zpN=M0^=kd}ZQ}RD6XP5ciRU|$J~Vfd{Mr0f z^+In1<*IOp>HbX6Ys5N-^AM#_cY>xJm+oR+mSzDUImex zd7C3IL>BvE*8=K3#2xT3<*I#PSPW2p96-mj}Il;7o|#{`(@k0-pOJ zxWpOY?FUO>e^?3!detv6{v&Ih_Ap!r2f@wo5vck3V5oK45V!*lg<7XQ3RRyTgNu-d zxzF)9)Ozg+sQh~p>Up1nnzs*!ny-(5dj6+*-g~HL&%jRbS;Eu0Yb4bFXA-chH2*p8 zC}jQD1@ixs(cb5g_5TyddTEUJ1!S$CMD4%62(_LY3-!O4aZu~um$3IlyzG4iS?e#c ze9?ICtAtwz8QOniUV~caO@R6z&g<~j`4hd9u+x87psoKVqFLai1p{EdQ;%U;#6-M@oL=%X^(zy z09oxZ-P&V@V?MI}vlE7D{{>L(vJk5M7D2V^51`6rKGgRIirsu(fcy;l4`Cth3*m3%&myS* z04;{9S06!N(Gu@+{M}7{Erl^~8Pxaf?-Ht@N&PWk|bR?Jc!-x!U`C zpsZhltTR9Le&W?S^Hc8zo?G>Q4OIPKYwn+U*CVSPtb=L?$oShRd)B=hy_;}Xe*g(* zv-fit>1_6X0SCaX=+$nvxOS4ygzG9uir^-sQL=E{`dZXUi}6{{?U5^e@Zt*{@MGJJ^|8DXBA=%=G*!}7K3%fOW=e_6PK8S4g7tH>mWV4rD zr1P)$Z`d9FWA^`gFTpi=|9UUO0k~hmzsgZOmv_~B4fj6OW3jsvkyJiO`CQJZbVnj9 z-MCY4DjqR7r}#PVENbziQI;a3Ac$JVfr$ z#=q*=Y5em*jc+xe#Dz}yp57HZnOR;ylCg2a}T%<_Jo^ZFR1p>8)|&+12sNB2sJ+Ug}V3j z5Y+hGkN8!d{Vg4=|DnotAXL437^=Mwf@zNoac&h9u;}6 z$4vG(k0%Y|xpWSKJLU6)>?xn8lAeSKP_oAvo;1Szy(-!~Uf~YOe@1$n$3vUPk2ENSCAfqUkYu836J&&w;yr_Bn7`Ph!3sCcT!lB$>P8y5cJUq_gk9S@YNw-&e z%Ka7BeZ1>#{w!Z!BVOgp1gLy_WnNjknTS8t-$_vIW-?T}c>}85yy@Ccfy&>v+;HB8 z%Fn6RZjzG{t$e*ne)8o~ev(MKl1=tFzN8eB{i4N_3KegfJs0bL!sGs5QV9Rt{}b^a zFq!**Ntq^xL~A$bDVMCI>DY7sFDV;x|IcLZ|0PW``{|;!8|5%!f;y50i>v30we6;X=3FK&$tQpxV!3xDI{<)qa*hwV$O>?PnQO`&kav zeoBZ}<-Wq=XZ;UVo~xkhMJZH!Sq;@*K87maPw=n#3hgHLGW%m|a6iKS$lAGO`@x?f zU(dW`T~gV;@p^aw{RSxejjsJB_yg{r&sF>TBIyU@XlHZMm*h{3vqdC-wwmm5zD(Li z{;2)oPC0LvJ>|SJX$MSzl6n6xX}9_NLA3U#aEIjYmEPJPwDz~p;e}|#k-w~+xM>zE(Bfd*IirhT>t;HYj91}^mS9j zf5l{vb2aIj`Hx73)*jJQPUVuLu#a`hCr82rDB0swNUmu9qeN?uxRal2=0&6D|G&xA zOkYW~_E;IJy;XtAhZv~zU2p!Xnw|8ruO9X!S2w*U`3Ay^3)c`yFXO-IYbDn-eXZo1 z&^Ha=D4HJ99_vW9_6V&#)`jaR_j*w6D;BDK)rV?d4WQarL#X!E2&$dL!6i=P4pvw0SsCsiJ)cjKIQtho3 zvf5#Ma#=fU4dvbj>KvsldbQhjQ0?%snPuk%?UN(yyr2UdNq%;O+84eXYG1Y!_U?VK zvitwZW&2_GLhX+||9;sxav#s5^0^YLo#@~KbqK+5S-{(~ar)YoL*15EB`@<7qz=?@j}0IL^_|AZIqJe)if|1r)W5&w^v z>~RJs4>5VDX!RC7_4d)^C$W!ph9y4+6QE?~0m)C8{ga~ATimVQK7~Hs8J_%{=|_lG zZ=Z&$m(RHAd)7_gNb{FqcGAnfdU$m5DASKl9z%F>;pauGmk|An$uF4x#pIXKHw}*! zO%Eymmn2)gg;sB0flHj%lE=dm_$n-g6Wsa-tzN$lRj(&P)$2)6^?EW?y?z6#UcU)1 zQm>}KKjB+&5$0$pLs(h26$~PIR9{Zr`aSBv<|5tC*kX3K})Ki`R zr9+)ZX28AF(*RUG4#JBt6YAV81a`WMb*?oF>YQsf)PDOMsCF_Js-4V(I{(On2WiI+)HzZ< z)OlAJ>inx9x$Io55cwqfBB=9*58x8gF(2x@p&07CVFA>6!-r7k4GW>pyB3jdwa3NC zI)C^G>il5|)VbYKsPnpIQ12@*hwX^J1nT@~1zd)HCDi%DDyZ{^Qn(lQ)llbvA19Zc zYkh*ObEr?@c-+@Oofoc!I*0lU>fB}>)cL`BsPmN#(i84RSPO1~!*Kr`ZiZh#ooj7| zI)~T-buPCR>O5~7)Vb7`P~VT;4t0LE1L|CJC)By-E~s;p-B9N*d!WwO_ClSneFb$6 zwh!ujZ9mlc+5xC@#DmuF97#T8?c?j@W3;nN`G-Z?*%6aH&Ns)S zeRkwuMb1%9C!cZKJ>(qax8&bl8FG&Dhr+df0dkJ=XY#+ecUgQc`Mm26IY+sWe9@I5 z=O}+A|Lw|;cLkezK8}DkRk7xm-CfJ zj&~wO^9Q4<7gX>?;a;<#qG;|gs%}BF?>gM;;~z#{3|I11LB15OESepRYFrTGyB_!3 zv4c@93aa|5BOlDKCYl|LYEw|d=YcC=P4w*xZV*imqdFDT^3}$@OTmqzxx=W21$BHk z;eIpW!>C6J>iSyDi)hdzzn(AFwSx`%<~N^*yS;zcz*lyTG%8d35^=spKJ81y`I_Rc z{_kd}{_hrZZ|rM=tbXuTsD2O`f49k={f^swx8tsU6cSDgUo#l#wD2{D1K^$LZTxrb zB%jM`>1*XH>;EBgyswSCU$J!GztLUq8tA|4iolf4+g{FF~|* zfWjS;KS+982S8f~3^sX)Z>Z_n|HpkL&-18H>ww36!;rNO5Va0?9Ii(H1k^e};plwp zDeQUw-!~k&d3c1SgZKYM((g69*zmKi`$*Tl%>M@Z|L2HbeIYxqVF}I=ARRMQ^>bV`LBzl zbE3%}XOeHS$x}p&?+vK<-?Zms{3pC<=Ph57mDAfI{->JkaT0xAlaoYmg$Txf?79E% z^ILhP_zF-}LYLW|;n6-z@Y^!|#cvhqR;jCEL6T+PrEuT;k00 z&4DFwE-Zz4mamNe$eK?%Q1hvLsQFYF?tleQ^Ql6p@-LDMKOjDp*L>tf=!>D|RSV!c z_#t|g<3dXp<3HSpycnv!d<506EP==2p&7h)O}NXD|972Uf~`Pty)zDq1+j#v6{h{6``V?y3vj*xO;acq6bwT}#5sd$&SLLxDs(dy;)z^(s^>h>V zdXCSb(*Ffi`Zq&8{}!vK+kIOtKezezP%fA9zZ5B#?IwGi9lo6=?-4DYT~P7vcIzqj z)YHAbgZPhez7p}j&t&fZ`3{(TP_%lAo_c!7cNF_r=dkZJlo^%Qrj zr{AJy{qOt9^xuhAPme>@!|&bn{otnWNAq{W?4*}{_3$sgpH2UZ?-b$1g-?oB4cga>yq1Dr~aEWu?_a`iY=U^$k;MP-U_3I*3{rU^4-u?|$ zZ~uX+x0j&m?PaKX`!Ce}k1J61^eXYIJg-?g82?ks%C#I+xkf_O%koh5vI0~&Yu^6> z;Y6iG#4d!s^0UU4PY}>T3<|1M0mQPfCQ<*BVgs z%^RTVZB3~8WG!g-|Df){*2cf;aUEpU>zkn7ANtw$sp_S4L?7+MrZh@XeX1{#{|!v` zIE_*orj(6OxKoefWKTW1CFN$A03~~z#woX&zmB4fPYQQPepBgfe1bMU-EMNTl;);q z{g3-f@~uUR#-}?{?nKu3Bx-zW30I?U1vNeq4)wELN^9ii;Wie3ywg@B-CpU-)#sf1 zE*Kkb@9I0adh=f{Yc=CP`eXdxsuSr@dENunZad?yeU5u!E#5cog1hR$f8*BuxT`&O zh3W^oLG=UOq2hhO4W|dP`h}iu_`RU&M{hU0KK2|BraYFS@vDDI-xQ5s4@st9=qK_# z{Y_^4Pbr%(4-|=aP|CxE9|Oz$4^4T*{10~h4{`kub^Sl;`hQHMyoaR>C!QGRaglhQ zFxlfgnevp$!$s>q&{OUsQWCI_b)HFi8YV!=9_QJVk!GJDTK|DN=^K^uoTYD6%2<28 z7g9!B`kt4}^NkUS_XU&r{=d?NJXW;+XB>9y|EIieb}x(8|GWa#zl^td82>FE-v6`w zoM3j+%f5PeQp!ZrPfB@%@Z!RgMdD%oZ~7@IZ<>BeN+SBE;kQK7L;9bolCA%NR&Ttp zfclXHb^e_URbPBi^(6(WUZvt+{X!a4KjFuHi4#akhb1rrmcpRr3+sRER6jCtUqpBz zsBtn2u7lZdGt7bN$8w?iv1xDzoDO%xcL+!Ibp|{K--W8z??Kgb`X}b4@29Lnj&^3H z%;ULZoY^AJJ;!8^GcRQ>&s{!(^*?sCojlo7{`n~mOn{O-PB^8&{H+qL-7DN7`9;!O zyNA~9=bK!dvcU9=|G2B&e`xJ~Vag(8wR=(Relb+L{|Ktx6AtyFBxNab^YAi@pa1`g zq?_;j;~pDc;kvJM-OZmpe<|_m`By{b&&Q;vqx*fMt3~#{QGJc`YY0c}do5J^{tT*p zuY+pO>s|jFpz?L28}25k^84KC`__~%tXwyz>?EHq|b13C& zvp+0aJH_4F*%9>d&NnGPnEt3}?d)5qc67{5-*;~Mj+?*l%}#pRR}Y^^`O)+zQhp}9 zxbROR>1CWT{mGPHOn)-v4EmiteC2GVRUK~Tm|E2X1)Nw03xt$#qlfnV$WB+|>?aQ#Jn9Pi=s#b||VHHiT-2jiA~g;ZSdGO}!bJ@Bdi* zeE&xz-CpUbH%(mkrmnmBvwre+^n-c+X7CBvoOCGPTR`Re9q@n0+m_g=U9^H~kMU6L zu{BhCY~$Lub;D`rhI1EGdu*So@wHQGhg6NP9aHZk-!A3fEt1|&CVQNFQahV`pJ?&i z3l(n{d)~x6>?x=FQ+rrBbrtd7&1Aj3i5s-yrk%h}lUm`|9DLsY6UZH1#pU ziwi$0l3vb5O#gW5Fw;MtIvjn|@DrlxA?@)g$<`jBwZ{=~iSumg)35|S154pZ%U9n2 zLsq*>fNFQoLAAS4Q0;CsRJ(f~YP=i+RS#Z(ss}H^MYxZJYR}`~I`|UlQGIyX(#5$x zRDBr_RbO6(YNxM3wbKbucnQ0iQ0EWt!?)lpsCCF}sC!6r@Tc|0Tx6|F=0V-($%BgDfxp0f zxB&YwTmcK*bQB`%K2Q-{kNXEu_kZTY?XVc?JYoUVdB=xP=N${7&N~)Cop&sTI`8-h z>bzqKR6Z<)dj4fl&%Ye%zEBC&^RIxqN3;^^UePMp7Q0fY`&Fx;ylB z_rf)>C+noOQ1`q(gWYgnCwI6Wt}S8x5BCtxMi{_u6O1CiKZj%R{{^gveluKyehXX; zw?f^2+6HxQ^Ci@|&335sp&d}?Iy+$>;@bsvpL{nw4);Lao7xL?zw9e`0q%oW;C`s{ z&;#%&@?f%EWIsdQ1N#N)e%MLt-%h2TvHs>)G4@yL!D)CFO1@g~ zTk3i1xBpE2-TIe5B-3x773rt`G}+^vOD$VBoEKvw3ooQHuF~I4(fC?BYSmw(^?_>ikc~2#^pQHnx|=8ZXtKd_YRTgywhZl(=x5B zd|Qd-W|lJkD?Hj?YgmZf#^Pyj@%W0`rL`yBQLF9}y&ag3K-> z0Z7(8k9$ntIqhC#-2)J{58lPx?@Q~Bta}Fc!v)0K73zO--Jso5FuPu94Q&V!=WKe_Au=ZE0y)USR#hsLY^P~*=4sBvo``b|Z= z{|BFfgW$*5KLYi?w82pSOB(`xMMKjbxBPuH?J@GBT?FGlY!8RQ8z6e#kA5O;1olx2 zo)ozk{glYP=;5NJ4|?z7egCJi>rp&1?HPNXXVVgp8!i|r)*eKDNcI&ymo^$XYSk#w z+luFh<@S@V=V22##`G_wjYWTF#ET;S82>FjFQtvM@Lx)M8TX^ui@NXf3e^4Y@lf|( zUWG@@2gLQr_fJ=dQW{ayoCG))VcqgQ0M+rVBiDBf7pZg-iFH8 zsZjHkM0gq53sp`@mQG(V>$iFf}cm=TkqEMn3K@^h>sUgyeTHEyMf; z(*m#}GWT7$ACf6@U*!Mae>rG+#(%<%p`XZsn)l{HJ;yYt=bH|d5AVS0=x4wh@Li~O z^B(C@J(`KEcJn?|JDLUcJhP$h!_0vypSe)=dLGohnLMcW;y~S($%kquVW|5x1yJpx zka#p7DneF!`2bnzN*nzq>L?MG>AtY26nl7CB0 z_BhMZmYcjrq+OMyts)$Ke_;jm6|IzP-(UF8z0~X&|IsUdK8DKAPt5L9g=_T>65iUh zb;!!6&!F;2vae`;+D6hDwQ7S%y=DBzeOuwCw9UAyyg#?{{z9^qH>A9`rERfrx20`` z6_K~&Z%Xl(qTLIE*zHQ&VRpOHcADL;w7uAciua`LhBG0u-4~L3_3*y5uV4&J&ei+r z>_@?Kc?Z%ClD;U~9VFbtX@@M_!)aezxQEk@;crUuk+g5z_#yFpn|2h=gy=0E*|jI! z?_dG#;5gJg{d=hX=Le|%=tro2>jeH({y#yL=g+vSe*J>1{iu`3n%|#->)@|&GdvA7 zKRyGsZukvq-S9iqy5SG}Yo2}<`5of<6Iu1@96S!sL)GsK=r#Uagz69fg6a?dhRfhT zQ0@AX)vwEG5q_;}SpVZ*0ZinS^2__9{OT_&i1e2g zMJsn$u60qgzq0AC6VX=^O%LfutN3H2r`|%sz2099Icil^(fUnj?XfzXLA)L~7uJBq z@CKL)YeMC7EvSC>MhmC5zaFx$sE+?8!c%>P$aUrJZHWx2ANBpQFcLOEul`m%wW^W7 zA$&c*kw4B&C$#?eX4s7W@)p<%HijMGt?*vhgz&2oep6(n`!=X_-wu`TW-tM}=5QQr z0Vlyb;8b`g{;T7^C9>`hwSrq7E+oo?2)By~w(!CYCSi;=d2~I)n$gC)3q`Kb%<2R$kG{e`_GTe(B-dG+!4wS0e2w0mBVdrS}c`=P%|e2{xg z{rv-6S=2qSfl&9r9)^0(K~VYo2vq(KhRWX|P~+iH!jCO_)c*vs?twi9bq{P9Y+3ZU z-0dD1WIpz!e>muy7Fqk?BcaCE1l(2b&mn7E z8U-)G(NO*V^HBZ$7^v~;1*m&wFTzhq_gJWLVjL_%ehI4FUxpfoUxB(uHXf>8yb4v1 zUW2Ot6QJ&sy$=5%oQY85_9UowKNeak2W3Zc`~5VA0S-iR}d;c zGjYFK6!PaFH%HEbm0>ol1aZGJA|ls64ZB~-56C)Ux_>71EXH|9q@K+%+2g$Hf6wHZ zqPHUB0ebA;_ve}YED`(JCVQMY{<$XSiMEe54{HArJJuPFzX*S^PS~Fh6QE>|Q{XQ& ze?_7d2!MwfSr_dVN#7om+5h*Kt&6@A z%YB%?&wtqb9rEute+MMv@1TgkLneEiuU&tK&EKBYsC{pSB2|C+x*n-}~6H7_`8dd7d^XZ`PIy-fV)McVZRk@54QXyYAZ zKkpy^-+t}G{o}uef6YrSLCqg7oBO~1tH_#PT!F_SGX5gcv1cDJBE4LC+57?$PKESH z80l0&Ox6}Ovxv-B3&-x<+dBpk+nxUKMx^j7FKZr;g%R`(aSlx+12+ISHUH9oY4 z8eiH#Jx5!paity9ICB@g1c{gD?~vY+boAl*#7O7v^v;%!P9pQ5dqhhIB)#{h-*5UZ zBKrG8(?jy3dwN$3uX}noH~_h)**_riTs=gyhlJNFy*IMb3Ay*#C;dTWM~<8S zm}vKXhe6%590m8~jY%I3*TCoD0Nh`||0&W5X$LQ+kHuZ_h~1rW>93%VEqckQ=YAPk z&y72FbjbN+?APpD&*i&n$KX7|(fL9i zvi5f!sQvcBoU-$QFnXOc6yQFA{pLcbbA}?QbA}J#TW~(qIYTkj{`~^{>73z1WSuiC zgpq`^2x{MYG1NZ&NANk;b4#H1+m}LpZ*>_wx}5!gsPDCvK&5*HRJvC}olmTSD`2Vn z9IKJ%Ab$*XKJf|E`NXGC=M!t7&L`GFoqK!+b?&ha>fB>J)IR(MsPmGIQ2X$k;05?O z)IRRefve8&H>IqodZa|TJU@Nk-1uzoJ;>BUGt%{l9|{1DN=vWne1`Sr<3+eBj8my3todKu#3nj zyN^*0ZpJ+_qwITCTvlY*8foVVQRpo)W;j(N>~%>9!@Q&dpS449N|6d z;TGguVME$y6S!<4>wnlC|F^-$xZh4V`hHzAV3wxuq*m@gs<<|-G!`sHtpesaEFYJ*=^dct<- zd%-Vp?+tgtKJY8}AUp{B!f)V1q+j3p>xcX^a({Rl4uBO1e;}*^ABNT8Ab2Bu1U7_& zp%42Za3LHD@4@|1I2k?$d%$6^FMJ#hgipZg)T<|AZiFwxE$|gM6^@5r!&jm1PrU}?kte_y()Bu=4=2JLo?{Yx3H@X^6utpQ1`acx0 zTWGS!S>&dFvB>?ik1|%6zvUTA%->SU_**98Z@I}Hr^NNQ!u)kASea3ZU6+DYqNM|J zpKEo-$GBIZenIYYeUh;TIo|nHG&{(BuC*EKaIabLnP~2i`&{cYHsG%NT#)-*8#6vf zz7*ahnjMU4T<}H4X54k33v!=pOU5?jgZW!UvxD5{+Me+xTmg5YZ(p!OG(F_r)~<}k z+|$y%Eok?$_GFZO?{6>E_t3wB-Qhl{@A~bB`kvnb*cKk7es)s5vhVwSol%AFmPI>< zGrlFh80UyceBYStalXwsno+jjgFE{@$7Iib&+&}!uup)J`3_*l59Y5*0NTEb!X1)- zLVEU37}xmDlJ;|cMjsvVOU6mU(|!uH{hd=8+E@8C<217NRYaX9pMk6K_Z$3!c`@NI z&;29gGV-b7a~Wp|uV%!b8UG;riq0uM+QnZP=dFHRkURC`qR4aoWwOWlJEN>!{3F`A z)+PMwJWJu~{P$nd6B%(O<0`VwwM3o&UNiTIKzW{LHsf14sB^7IsPi%0@fRJafZRM> zF%V7u#5++U@q6CwCUgHk(9h&Y zMV`NZ;9>mhTyp^Q6%CYZ=bHby4>CK(fAo5u!BEdX#O#JDT>LTq!)=9+1)d;XD(_)d z-j7SR@`lu#;ejVDyy1bTU`6Do@i(P-glOdmu^Sn9#_UE0o;ACXfl=6nik}N4z?l%) z&JX2YJ^XxNG>n0KN8ipV#dCQt1SmJ#=TrId-T%N?3-_hKI1Bfsz-#!MQv7n@6*qoJ zJg)}E!BxIcjh&p#jCfq?qzJTA_VTwq8ri%6*`83!Xdy`2|I`TT0 z0XM?{)P7(PYJW2m?tme<8)m^i#GegY5>5^rfSd~-;5nv2ohM9(I!|~9>O5=)R6Twd zsvf@wbv`$f=kP?lADD%#dLh=IKPNC7PAr}in9K9%TnpN{(mbehr97x}B?tdiBJu-a zWce3$epdi>epd)}epdv`7kvd4lKZ3=WEdVwGW}%%|fVsoJCOkH;bX# z(MM42XbIFl=2GIX7Qy--R)@<8@7DPxffeX={s!4+E)A@NC2$oig{!UIasH3L$`Kz2 zKEYk(C~hnKH1HYz)h^apyI3pP+6AOut_y6yuFd@QqMg@C)_L4UsPni@Q1$0?sPnil zpz>`qRK9J2>OZ&QKelLFU?;N9{NeoH^6g^aZ`?=D z|4X!dldOFE2kIP-_x9Q6`!{fz??CQ@k-@V1cm;da$E)UkEl>`3)yoK|dWnp`@^(r)jW>xi<~o zhP&z!WZ(4mU^8UZH;7$}U~{u;5xm27hlJNMcqfc>S_b2BFJIJ3w0;DV@2!Jvk@cKy zpq>wzbhit3L_ff}OSJU2xAb?AZ0U#C-5uxHNZQc%T-u{%y!-FGC&-x#Coy$HQ)V%$f z;Iqh@w~Ly$kA$nyCqT{H35WU1nBXYn=Hby6f4uX&NV>h!Gar7zb$`)yH-F_?P(Q{I zukz_7sC;@EDu4gGhdCbqn&-R`=T%)*}k{{;h(|NoiH|Nnv^v(FOkTpK&`am~DJ?D+p*@IBM#igunn4aSn5 z>2CVoanm=${Jm>-(#xLz{{?57{{7%=!sGvcBI#xS-}G~Xb4))sn2()h!v#?N#fMPyo`q2Jo<&gep2bl0 z;3KGc+!Eqf`7gC}F#bc;kL6JHqXeq|TLIPYt%NG)1MYX{N(o2hwi>Fwd<<1zK7pz) zpJK1@*Fc547AoA&+;G-eec2RTZ_l+MxRw05l)q6Ve>R!yaXt@zVe(ed;@J!p?-sYd zU{8J77TksZ80Sk7|JzOG{(o?%$-6|WFX*W+yMz0&k9GD2_rL@w+2ec_+-LUtMXN8k zTYWizKHfPP{MPh`M5`}fL)C}FZu*Y6>HEg~9W^`YWnVq~UGSLczYBg(cyZz5qSXh8 z{>R`CrvEYc3;L$v6Qb!M_2p;DR$rjimy>Xbb2@kmmcUd7UjdU6@6p8R)@?+UWc z&8`M@ZWfVw4X%QbnYzbUPPFHPcHUOZcOn~7Pb*~p-+TU1$T}B`&MZ66x(@bdzr7OF zIap<=bFV5;=P)s_i2cIr;UMg)!lAGld>mGX!=VRW!LA0ZL%cV@a=6!o0o-dr-8;Dv z&OxpXmA*RgIPy)TOXqHNktZY9gO^||+zsoy&(R=L{o~D<4Kvk0Hp(oRuKFG)^87cO z>~U_%Y;5__M6`3iTj5p0Z$db+MNMUA&vP5@dY;>%o~Ieq^PsnV;1-z?cJ6Wq{zg;( z?nKskOiQTqk5*9o|Gd}ZG^Oq*tJVxOT z$)6y-&10a=VHII2Sa|*KNF{0)%Z$Zst-iDgT5Dxuma%LiO z^RUQ(e9JFZVg;XnyoNVLDs~GoaS<0jPCXko2ja%7p5t zLQwr!7W^CgY|>FKA~!R~(vzF1eXoCUhqmuEop3bHyaP3!&47ycUHB>U`uCvrw`M|( zfA2$$f3x5c+-JM-&VlL==eqIFgGyH(jCP#NLMyj?k>?Ma>~RV+3&`gR5v>2QtL+qJ zerV-3Kl1}CxA`V}oZ`#{=I=w%#w+Z|--VgWtiM^3xybsP#ggf7J`#y%iOC*kX=d3z z?lRHFx#if!J0+Q)nB5A|#<`VHo1OHsuO42L`KjsGWPV0?apAQh z@iP9KetqUT)349`9DUR92GR78ac+}j8|R>nb6>!gMVm9Xq8~ATi&5)VWE;P>L5*Ku z!X0os)cCans-EnGswcak>d9`Xda?)Z!+kGY;_T1-3YNfquoND!{A1pO+;9G&%!6{Q>rg{lX~pz7gwQ0u+pQ1#(^sCxPX)Oh+M)OdQr z%JHYnUkGpH{GUbQ?K@ZUJl2^fq1NB0pz7zZQ2Pm|q4pQfkdM_O*#C#s;qSO#E&3z# z9J1brJqs(tKcU`-#hvx*h0ODCV)2E{i^La4JdpPCcjjMK-hXH6zP{Q^*}DI7<|V#s zw=eH_EL^mw51zXnu( z-vC+vhw8ZcTCV;^S6>^-KYGHwN%2u1>l#%bkV$`Rs6Os0Ux?fw)DU~kvmnpgD0DM= z#T(~_hm89zp(e<&MU9Qp-|FgdXT9GvbQ|HQoFVzwEOa~E2X)U`?z-o^0=B^4|9&Uw zPGrrWT87H>t>7Wv_lbv^KedLMKed5rjH_*-?$fq|x=(u-)cmGB)cmG{8-7Qq`48Xe zw)X})g(7U;aSzmdqchZe<6gKLyDqST#(${y7w(6jGQM?%>tHvi_Z7NBokKrB_?o}; zK-Tw`dP2<)dO^KM(i@(HeW2buco6EngT7GTGkpmDgWM15y@UQx^PK@u?;i|=djH^I zsP_*BLA`(Q2y6!j%bj!%ftqIwg_>tP3N;^i3~F963~FBSIMlr238;C+lTh=Dr=aE` z!=dI6BSPwDpAJ12Qor|%$oVPjf0znKLd~xd;1r17<~5^`HP09gHP3h+YMwDBR5ssv z0a^2v7op}aW1;3Lf zOEf#k`SzU9T-A3GhRzJTVsvkZ; z{Ji%cI%w%Q6w-V#AG`nNi-+;2`Op!l`QkTF={O1%&$m$X#$!{{#E2TPn+y<&bamYH<5V%2>nhx zF|f@4`OsPO|EKH!oa_I*>;Ho5|Ds5}`787<@x(ZPi^TJf$sXrY=(5TGiZ*XWPyM+P zip)~|xfZ&LzXT}R<3wbY%aZ>{(dMnVlfDXB>TjYX^L)`F{;o6G z<5bEbUC5P1o4;1UF5ZdBy20$O7j6Dp6>5H3&EjGFw|E%;v*fRa*-0<^>fu^hHBDbD zt2W`qg>MvzhxNbdZ_27;`kS)qqi-6nE1DiM?#D{D`75;YZvYFZ&kdo@uNpy}XT?F) zx0|8r;Vt-Ay=x3@{D+#CG=ZA0G{tU-(=6*YSORZ{rLei>6Yu{aFCv~6Q1j6{;5v9G z+zeYn%|lv2&6ne$=F6?2=F4rM&fVHVox8Oof67I)&$`RSx(}uyfWuS(=x0&gzD{p5tDq=jvka_hofO*7MvC^?b;q=Pt z0VADWSv}zZ*ayAh?d{r0K9~1kR$n*YA@W06{mnn)KkUQvNse>|WDVpwln;>bAI=)& z%8+^1BUyuy)ovl_8k#l4?1pA(o+Wq9v&O;4vUpD$4kNz*oo_vXtohcH=oc(z{CD-k zku~2M0X5%x8m>qG4AgwwIu*F^Xv z@+9KXylgVE-Zy;%UdH}S_y?Q3X zdoRleJ7Pc1#;w$>F!4n@X;}faK!dz?U42Ia1C3wQdRpzP^)LRpzG0ZR5b zSy|cUFD%-)rErJj=Spwm7PN6|y2k4OyYA-C-ft*Czlru&2(^AGg8j(%51`gD z^GTQ5RWVe%S^(8v{u_@LVyE$F5!86I7;3!v2x{MA3Dh{X)D35u8_sg5c2(krx5E12 z)mba8e_55amVCUFUn=q(t4;PeA7_1H@>|vn6Y**>4kV{J`D%|1Z(UJKM9qGW`zG z`v09!{rfIAeY@TC?J<9Q%}#pRR}b&c+GqOxSqBL(E_^^Fz4ULU|2pfC>A%i8ioR+1 zuxNTnzw?b`>;Iv>Kk_Y9|9=ebfZsv&x5uH%^LwcB{Q;`ne}pRc6NFQZcz;6H{NQJ( z_g{X2TIZjHTIZj_PV4($krxr(X{i4H3|t3)gPY;+Q2pK?Q2qZ|(yRLOr=^?qKUBRs z4^^KoK=soXq5A2+pz6op_+R2&&iV(Iz)P?c{_BoIkbQ+KSyyq_`w5W!g=<+&XO_t@ zwj0k|E}Q!lFcNlx<+J~9KUxu4{b-b{kA_-*UI*2WR)XqBD?^1>1uDE4sCDf1Q2lCE zsD8B?RKHr?jmHDkU-CU*TMug;tA4H~-v=H+eW(T1Ki&w{Kh}m?zt(}Ri03A#b!=Uz zb!A+J zc3D4)JMFKX>}h}Pv+sflP_oDAkloSz^%t!lRk%a)J4tW-D71dGv&r{ncQHNVKkn*B z@5@#{dVh9TWc8z>`q6Gs{b+ZnepKOT{@(-p$cR4KJ&~J-ds#Z-o!%np_nMvN+Yh3T z4foCNM>^x3heT_a(B|I??<(IP82~lk8c4cS&mTsvLw*fHR{ehjS?zK#@s^7inmxqg zADaCr?v=2E)^7gmZ-?Qo{_b&w1D}9O&y!H`Jq0!Y9}d+YkAUirpN4AJ&$#hE>xMfL zs+}c3rSCb5e^mB_Y|V>b$R3@odGYg->5s>VJm(80^ZnoKvU%}Xk@#N99!ESeu+0Cf z*)N;_S6u(&UH`AT{$F$bPY|guuV=qWJTcBhk$5JV>~SV%zhUy5qV?P8sW(%yz1YV( zZ)d*+6QE?y|FaX#-YZ(ajXUW}&Q7xQC17w=f z8Q8@;f$Utf3yRk7XF~PsA&ZCoe~X9xf6LDtvy)!-)x*=XrpC#G)eQ4!A2ddwn3pL-L2Q~lCvwD@E?N~bUv%|QnUWuxg z1%#*mwh*fSEy7*(^8;k{*YlD2|6g`7t#`!<8#(_mp{$nVp8W;x3KtU2*6htN(%G85 z1rC5;qF4OeTsz6<^0sI1aLWNA@66t9{u%#aAD&Bcq_Zb`FVCZVfQ0{5_C8mJtONFE zACOG@g{13H_Cd2dl&y7u+_erk4-XU1|IYuvLDsl+lyODl)VEOM)G;Xg@1Vw~=Oja%2C#;u5)vT>`4`#-qIoU;D2JXHT!0jhtj2-QDELG`QA zIc4?hI;eV7399@nL)DWiIqDy)<;3Kuf4n}YW{&!gsv_;Qn#p_zILBjhP0`}30o8xs zkfZ*D@t^Rbomx3{@gL*dDB{1i$sVUp&P^uQ6|LVxPrp|$rxEtCPW_x%m;fbvoCY}! z&AyRn{T}YtZ^faHcW%zP-SoGJ)^9b2>X&YH)7QjJUsLmUo7qV(`|9E5In7MpJm(I= ziwn09tzUxZTjtzp`j$DHW~kq4C7K>uJ!wsOsNS@JsxNJ!)`9JKE|q`FceH=lK4-Ay zONX3$h$qJBC=$-yCiC6joK8HS)?v7lADv}SessyX7bZZ-9_PNC`_12A(dG{dcSwFW z>23Z1ZT|3p$vtv<_`}-%^&(g%^wJdd>)w754m}` zzr`Q#3=m1TS9<#%*~2h4Jjm5Q;_A(Rx#P6gA;hnKZ75W|dlag^{rCRdF#Oy24^@Ak zfU3Vw!c+Kv3ab7Ncf%RshVwL3{e8v_?^&zAqjE-C{Y}Vuk^H)p|C~sAN15z#M&~?l z@{6LyHwG&H7wmai{}W!cGd5>D{$reRBK}`8+2g#N^NPviMXSH)DX&*^CSf1zOvrf+ zCP2v^=k=V4W?}N3Zdv z7+L#E3!uIe@FCQAu@Jrm7eS3bi{VemAK_2q%o1dcM@ymhjg~=;N6XCUlRoywT)t@D$tvFTkx(Ll0eJ_kjJy+8g}Y!4 zxEt1jdthC-7dC=l!NzbOybbP$cfbR%H9QF0!$a_H_%-YT55sQo2Jfe*r?Q17XI z3zJFDF*pkOJ2(gVID7^9d#HW7A7BOKAEEZ^{Ikl&`=6+9tI4mQp~n4RU;;duQ#Sr* z&nkP5=+~UGeY4Z#o8A{XgM2^Z?r-oJ_&e+l|A4*WS@&bdVUQ@@Wp{m8$vryseRa|QbZDB0s&%ZbR9Kcw8U zeqZ4Z$&bv1*6%~>_bZrOF*nNejQ_Z+-;d5!zkgkBC1mycqWb;HQ2l-tsD7Vt=%237 zy%G6TarNA)gjX}7n#sPR>WYtfLd{%HuI33fcbzA8^BetA=Ek$JJQ!UHx9XZ_~zWk#2@e6 zA`+iB52C+S>7*ZRBBF09qPOR>`wX|EAIJL{&0r+)H7CC`F13K_f9}BjJnPUqq3#W| zgtf41g-SBS0 z?F99`pnIUcC)AneC>PNs_g;IRF1h#No{OER^~L>A_sqJ&%cQfL+4sopZuUKLAAl7j zdgS&(Kc%>*X!qtM>-$8#;qsD%dByLQzlcgExb2#-+&d7-@@ON;whq)6T~ht_ieLF%$;g>iMf1Nm3xOtxn4LE>N~5` zNjKyJg0p z$eLHohU?%QsCmU)sCmUasCh*m)V#uhnpfmQ?dOJ}_HzrM*4u?p>+K?_{eusn_7CP0 zzv@vjvfBLusCND#R6Ab?)y@||^$&}o+WANL(>!De)VyRV>8=*R_>Zi5w;ZZomSBGq z{#QWVZ(9jfPglW~xR+w5_nTHD_aWSm;biy;)V;`0q3(&UfokV#q3$()26eA-9n`(X z^-%rB2B>~uBh>x4O|X#gK8Lzj`UTWI%*{~uOSeF^udUEmv@Lfh&!O*;ehGCyZaZuN zcR<~nL(jd&UAenSx9&AU-hbPZyBBxuPeb;rzslX`%8>o){kaER8FJtCVD2I0s`!W8 zzx+D)FmfGav3${y+;4ENLwJz)=)TQ83MUqSn|lm*y+;R`mwuo79V~&zVJZB<+BxGt z^0vYsbAQHO?e2uNyPqUmyMx@D{3Z94wS$wQ-JdLzPv`z>?c#Lq8SK>0ih4irH~9aU zI}h-vs_k!2LXT(|6e|kYP%#;>H>4!=7KwtQf|F!`NSeunW<{}g)9d6U0l|U@D2Sq9 z!(I^V4SR1`vGBdWHD@xDSg!x}JYVjOFKf56&#r5)z0XcPE=mpG|zlg-!ZZdj+!XYncfY?j^ zxaId-WLNp)mi8s#cC~}&s-1bbmuquFTuD3J)ehsK+9fjaI+PF|`%j0Gj<~CzLBe+_ z=>)m=ucR|fgFE4`evsgXlf12=Ystpf4f2Ds|Qqn*c~c=d%!+R_AJ?(@cR;eFF1#BOETa8m+XhX>aAyqeg7}n>J8dB z!Si{K-X(nqr~U(x_b)jBf8`6}eqhN#xR0jah^fxOC5PayeDsCNpX5CkA6jy_#qU>g z7>sxNNv0h#|66{NN(SJb<|K=jFQ4VBzhui7B;QAr980)$4M&w6Y3Us$*}@-f;g6AQ z;pP5W!*L}8?RlL4hpFWA1dGS~4|U($NiYp}!qNXvE*awb4|4qnL&cMOKWAu33gK-2 zH~(QJsc>_{u#(}fJ0!gkB_olwFDAaRXk5uC_#GS#e}rS;b~qM(1}6|t&lwNnq2zT9 zr$MrkTKCN?@$`J0bhDAQo;w#=>%3V|;c}qth`CU9#5|~VVLsG)sQ_xd zcOKkKI)zZ@L5twaxCf!We<_A<;XYeLp2PFBE}e_~F7ET-Yq-ycA0VF(lkPS+fLY1SPLxik9t|(cGJNy47 z*HS+0|BIB*)h4t5Uvdro-S+mN=hjeOrmeh%{7 zUUCQFG@prwQtx-d@x)(-|DlxcUGNaN9QX5ycQ^bNu7KKiSjqd?{Euw*e`Jln_d<<3 ztBHT0XHCg{`0F|1G~%trzms!+$$G1w2SoC}&SbCiV97%!uNN0|;JxrC{DzXpE&RhG z;U6*C>pWWWn8}Ze3)+)k{HfQCCC^yBK3VdF)$5Zc^Y{Nsp0@DMhzoRIGT{jSY{@1I z|9r`F7XEpYz0M0IFIxCbqS>9X_e52$o;&K14$osJVC;h(soe$cveOK}h;iPZB3$-rU3bn3y52~KuC*Lan z50Iswe+acM`3QHF|Hn}C-6v4>@~O3-&q}^2(fs^X$>$|n&we49`T0wce0*iH*ZI06 zyq^6=r2f7w`HuV@>|yQjeaUu9@8^;qEWIBklip7v>HTc7*ZIXwZ@Wl+ z{#xSUySA>*ZzAD-H`(j_QL@A0c}k(xC;rq=Txmzb_jKBo#=`)V>~-3gcCh#zMXMj& zDUZ&jonTkEp`D=?nWn)lW~{wT|2u zc`NdM$m);1hnl%8-1)H>o& zsCC3)Q0s_(Q0s=nq1FvaupTButs8tiPwl2Zvikb~WVN>=p!AU=ao2co6tdde(a0JH zjw$tUPx`T?$02`?45{zqOHa1?K0&11Pc)f*fYN~`pDbE`$DiPi>-V_Z_&OGTPd>*%-IG2Z zYW$r5bx(R4)II5^K#k`Up~mlYd)}#~Q|x(@N>8)rO)}Z*OfEg$o;O9bc6kQ$kWa$L z4QxES^i22%JPUSeI=eK3^oBN06}cyUTIo3!pZOnoY@=W9lmqL3(&^;MEX^Xk?)8Gq zBZ1QCq@#HR+W0gBYJ8fBdlv55Q1_jmOZ)>ov((=0{`9U;?K&6#d1m+ZwJa zz1qzuM82ld9uUIl-I)%Z&R!>? zq3)Z!1Aa-oJIRms@4|nd{I1f?$ejN#T}6I4|1XlC6()23zjP(#s(yz%{q7!xr{AqE zy%%!+-(=4Jm)>XbHjCE&3CB2if9V6reTWZ{*Ofkq+#4CjZ9*@62tEPVuIQd{tT3!MLOtLFP1)s z+^^|*%l`o91(Ek=p2xjs(m{-*eM_AF927VD0CV(hsfud{p|S zwV#hg^8Ja)Ugy)&&rJSOwC8*d_1rJ)y;=X0UMJ_P(rs4XUyH>5#$>PaZRvL=Zxe0Y z#h-frzVsKX_a94tuzLT|WUup6>CYDa7tzK)!co5KLfZ*9!1=W_zD()=CYqk~JNeN* z-yd%NcDVWTlqp_ZnZn6ma}#=%{n=G8=K>wlmd7!_sB_kF5E454axg z2{*#M@YlGuH&naW2Wq_Q3DsWqg{sf}pxR3>;{CC>ci92tbAJ!(f2jVlKU6=#9ew7& zvc7~{PWlJIRq$ZA2I5Y?IiyT>8QE#YmE;rs(#C~;j29Xw4u={alHf!5C-Z!FAK%Vn z^v7N2F&Gz2FFk_v)ozZ2YOhB@wb!Ge+UqfH{*Q%vuj8QJ_jsuHJE2VD-N|JqTK-Qe zOQC+YHx3l3pOa1YI)lmvo17xrbA~`Ycc`@o?Ej?K$w@66Mf|SLFp>DfP4+q?%0`+z zO0@QhKkapN*#yG(bjFsAfdMF)`~S+uTlfj0wO8D&y{6$mz&WMtbn~AmT6;~0YLBP7 z`8&l))t=9VYR|Kv+H($k0p>!rk36@Y z@{!dK3ZUBadAO@x7FvE-|3lSp5UPHQq1y9osCG_!Gke5bWZ5s~S-#FMn_nh7#zkcp z8kzrLPy8jX#{G8g89!{%#iG4Gq@6D)ThPGQJRbY8`Sdc<)jYefEIiL%4mHnSfxG6{ zE1~Ast6MUMOS*69Rl1#j6k$5#Gd!1T0UY$rgt1oLX|Bz_+ zvWq{4=Xd-YHP2hQK<@2tE?aEvX_08|kbB&3Ez^DN1Dx0Ep?&wc)a~!LL4EIeJ6sFz zfUmbuvCR_{-gy@Gr#beQ;YX;*#{Qy zL&?PZNF?6JCVQPv+<2c_ywv8;%04HYzDI?8SNcWSm&omrA>S2$RrU??0OxDb+7slv z)o;tT;l5k*ccQsNzFYmi><8TS-74fe*dNP&M&91^lW5@}-3?^kz}{Q>WRajesiZT6Hy^M`!D8eiTX_d(6=M01CHFWaH~Q1`xOh#jy~ z`N7!`@>rL-2t#?(}8ZdgWPbIPTYL_`;rfh%ZFIHhn62k z_$J(;joba8#`D8**Sb9kR^7dzMKARsYrgFdHO~)#n&*#z%EysV`8Wz{-ap!X-Z4<~ z{IPEO$3e{#$HPv}3FU*VK28*QuaivnIs?m3HhGX}^ELj|%i!{1Rxd-#hgiJ~HQDQ= zl&4zwVWQ2~groe1myb1j&*<_I<(fA}N~T|o5_#TelfBLu*?Ex1iZ;)WBisOIeEDe> zZh~m@d>Yg|ehO4MOoS?zbbH>Z7Eb;O->qqK`6Tn7Tz&@W^=Ud??&Hv2uDdvA> z`853dHk~D!KV+VtD%s|FNd8&>6JC0$A8J0%aLY3jS@UuhTn__K^ZazEd42}eJUX3`W}AQ3k~t#r#?~vm_R;4-?Jv%U(`h&7L$%WjU>Up+svTYgJ5in&!-4ddOQ6~% z`ULiX%gQe;*ZTaj@~cT-?P?)ZzArcTE6T4z)_YwE^6Mn3BP$~Q!wb0*fKcKKGtdBR7j@siQ zsP?%Ss-NCUdU}r~Q181GDxbGO<@0vJso&mV^|rkHPHS(=%I~rMa+gTETy8S=|CFyV z`5uw}!u;<(Zxz(@2~YpNxBPzMcXd{a#9w2w*SW8Jt;zR`*1z$me?L&Zf$%+@2g}#N z0F>-?9x7jN;WvoZzj3#IN`Iw39w~p+tq*AZ<1x70d7}JrxC(BBYv7Y^KZ4eOo`UK( zPs8=_8K{2qEL6XF4yxZg57lp8fa*6dl3$hMCa8Y#5>$C^hAPi3Q1$&XR6V}}RsOFM zUv}2lpzN%#L)ls1fU>jFt`A;@9{U#I_4lLRhSHbcDVLtSwftSU8a`7cz4$%R#tUfr z?gxaI9{gc>SP%XPN)P@Rcj>{OKeYYk(>2u~yt^dA&()+$7ob;%#kaf=g zYp8Sn-$0%7{}yT;_#M=F|7}p`^}mNY$NvM=IsYG_&iVfYb1h9MFT(S8ek=Ay?$@-B!fkUAB`JryS z!=T!2KR3O@q1tIug~smz70DHvcYGDcP)^$$`-|jnfXQCxh>9akK1Q_X90m2(ew| zB){1I&Ht2&H1j{DVlw`Hn9Co0a0b*k zG6iZpI1_3-I16e#I2&p_mU-k`9F9n&&zV#K>%6$!E~tc zZ3bKqXTpsz8`}CG+WH@Ae9N)-VE%_{2YFEKD<7(z6hO7R^PtAJLTKZg&Bw(R!3xb+ z#TDnf;b*(y=a~E4iurE5d2T#p=Hm+#p85EKiVJbq^C0P5QgIQCcP^>87^cBX@mIbU zxZxykYq+dpp=vu>m%Zg${@z<5{q4RAkIgr0q3jR$L)jl5AYYny z)*)*idJta1yzx*)*nY4cS@XySsCnjLxPowxK+QjoLd{E$LCqhJL(MZAq2`${~hW+kU!v$a0k@)=$^{(ckppg-`mH-)vz6uJ*hox;<+6v!*-^Q$hxqjVV*=EDB0E9dC(@OBuLd|fS9Y&d|K3Hk`_&Sm?pNyuWjFFd-LHl} zcAZ@-cdHEBbs%<~9+kV}FT0M|ciEnmd%!91z)H=lJuCOB)V#WP<$gSGd*ePL&+BQj z*V(s{H$~o0OIA9TF2v5%zw#K%|523#EdNJHCjUo@ggeS) zuXD7U|6@e#G{;sRPq;zN$BC96#NKp5<%zh<-UP8Lom6=;@@~xoMGFV9D-Eg~jJxbg z5WCWl$`s`7O+!Ts2eB)qRu02mb|r{iX?W#Gr?y8le~twHRW6Dre@hc~8Gp5lgs?88r#yTyYYPj5c8auV)Sn@$mJ3J`_FYoMOzOVFj z_?Gb_vob2bjvT;!B<*iHd>45J{`(Rhz1jODa&~1{uRa$_ubu@5GEU{dEy%gFW34l} zN5{Sc%7^;?rvU2vpYx!;`w8DCTvS;{_)bo+axVGo>J*FQd$!45XKv-3%CH`eJNn%` zg-5?Tzj8hdK*?U`g31dmUY%%qIPU1-7t7!DaA^DM3!wDzOU?bV%7qq=^*`>?$1ksx zK7K{zmB`Y^Md{;LLFwaH!*9?FNDuw-+R9So&z9a$c^&EP=DFVFg^O>{bLp?QRNiRq z{U*87-ftFpzgtY^{y(?9mx`v}msz@1mF1+{uc@N4ig*K@N|AUA8X(WDR{H3tHTM1k zoLbT9Tkid-hkD*i`c?=^|7yU!0CxvI02`s~Bu)5BZ)&!57ga9C{bBsY18-f>a4YY% zk7r5cQe^EnL%xT&ty25X9dEl`DnBkDL60NI7q;e2R4SeajPY;o>JHQ_sx*uKUv# zj`<&1`FeX#Verww`$xYQ3@*DxdE`<@0@u z_ko3zzruHG`nd8V^Z&T=Q_}0x^oeNo3i1EE@-y@QypsB5J@bWV{t!L-tIDs*m)0}T z)-m5eeUI@itfHR2gQ~Y}Q1$jbTndSA?e|Bh_0CUlxwF0UXSfRf0@uJ_tsa^Gt$u&2 z{DbH9^!zSbJB7Bs*a5ZP@KlBSLmX6ph=*$T?V#F8d+rI!=J_4qojkWA)cU6rTn{@# zt$(^et$z}r);~MJXJJ?P0^AvDJ+=$fdMpuYJ=Trq$ll{c*1D}bRDawR9twAZ>W@93 z`rYnO-%acR`%`XvLVd5Z7nI$6Z+IB)`#^oa)3Yl4UCq9*n}_{>-2YhIt7?Db1mxaO z_bvB<`#`yO_Z(1lAmP+L#eJ6?Ty+qfv-IF9?n|=oM|6MEn~jH5^+Qfye5go2KTNdx zhJ3eic$M~P(-$X+_$Q0z5Ak2nKn?7%8NuPQYFD21#dN)rm0P8CZ1^OoM~)SACxBhLgOlVQ|$D-dF7rA`h)f zwfOA+!_kzx~LDwo#xu(Cc)p)lPBY^b>Zny z>pAYzv-J}8H=Ad}^XOSs^YHKFoL%Loe!4nSMV>RwWUu3|I*0eyIV;>5S27fyaV4uN z69%AUuM?=6Zt>=cHjgUZNsTk*Z|@Cl{yZ0IzMN(5IaRq9j`<&Z@{S#ORr&a9{uDKT z7C_CP=RwV%q{DbMyQ&DeUsKSYKfoy#$@c>JGhWSc-RHXQ7SGzve4eLvb3Rmih}f?# zB%a2#i=f82i=pO`OQ7bR1#b9Dq1xYNZaNF0+Rf$m-O<%mS5!&QzOw2D%4K`wRU-Mi z+GMYDP1Us~-yqs^u7i5+_4Zz@|4FZtb7NI0@w+-ViNwFzWUq5eRf)-^qK)_XQ!iyz z)r9ZqR8*D20F>-?Dyyn2e6?ufJ?=K%*Wl0mU)5y(b)t>;^-$w^$jx7an?J|mHCj0N zD}1-6MODq_zo_a~((BW-SR}u!|IL4C)e`exT6HJ>eVc9*%^%XA?vQN#3);B73@&%> zuDT1Zg3I9=xWdYn`5#&1>q@vDu7VrkJy8AcUa0YPHPraJ25Nl059%E4TBvdQex9%T zf57s={0~*H4??w%hoHuj^-$x<2B>;wTuSUdn)QE`Cvl&dtp8z8_!!(5qVHON-bi@$ z=O?T`KUMXl_2;Lmu$$ALpBAkgpnY%iER-E6(!ZZ4zWVnI^jq0KUWBrTY=Y|VFF}n1 zo1xB=Y=N@ZybNXccm?Ww$*WNIo7bT1H?KpTFL?vX{_`f3{pT$x`_J1vSL4My$m@{b zh4;a&Pbr|kZp zL)jm`fU>)M3HA5Gzk+=U|25S4k8j|o#QPTN?`3}nb&hl!)Zc~q9pzKUNpzKV$L)n@3fI2s_C)7ESy`avA>-R1x&yUc;G2RsPsTnhIj*}Z{%q3k8>rXG=%9wYW$HoAHgoB}7=^TtzZ|5mI^IK7MAq+stUME;xZ1HXoP47^;lN#s9-}DY>ddEDI=U1O^{>=ZlOAon# zd%bq-xUl*nWa%BE^p1<6^o~oQ^bXQt-n_K>GGxtvqW0Amn)~I|S0L;D1W34Rs;@-u z*K}3&HRN-EbG69(EogxFU#t9)&UN-41DxwcD`#l)(2Y>@&`nVD)Xjwd+zEtkfotvx zgi7H3uoO!FFM}&6?{YYNX+?D<@zTi;WZhj|U1iU$uCBrV1;W7vdwa0|!@VHuZd-5H z<1c+A1f};hK)tU6weD_&dQKD6`!+-AON*fNrNwT(Z-tsKm$>;~3N^pp=05Ls>j!sL z-(mgW&gxZ^)Aq(?BIR(G$zEr9_1z|~674xFpz^oU-iP_0bUQisRIep|SLa@l_^VCk z{D1X*Ca)DuU&5dEbbs}F!uNF6RX+d&P%_{DRX=3m*Ndhv;coiU2K)y&4_7~F{*Q>J zFFguXK99Nid)&?6MvM1^g_FO+cWZjO`YH2&y82nt>(lg%X!Q>9f4=%T^MAhjCH(s~ zy&#%DL|@t@+4Lo7`qE~&+d^@4#RA-VT-TU(Nlu>OYW`|KFkVk4!vI4dGcgdTQco z!tW1Br+rO4jCb1Cw1a7|BmR2d4sJNf+ZsC6bgl{46GZM(vy;VV{)eM^Z^`ja*P5Mc z!sQQ1f0vp>SB8A=)2+sf+=uXxeC=A(-NNl!vm5EF-$L@)qh=4Dqxah#>iv*Of6tnp z$a=rMT>rhH-g6%}9R56K-G5Ns?%NtiJn7xzk)_v9fYRsFpuTTE1>OiJLgg-oEdg&sl_0q*q>!nMe)=LYZ>i<%xd(kd~s{e&h_o7`6b-&ydQ1{1O z33adBRkTCq|C;dr^fjXGPhX4ww>%fw?n%9#{-<@)4N&W-8*5tbOSAi(ZpK~n@h$MF zMJ4KYcJD&VxCdNFIYu>FLX$^!vM@^!nvcdj8$yU;FecYCK0R;kheu*Sc{P z)cWflsP)&qQ0uSNQ0uQXgntFz2j7Hi;k)pD{I&ji0BZfU4r=}NAk_NnA;RhJbFN3$ z`fCH!`s-n+_17a%>#s+l)?bf7t-l_JT7PYH%k>G;Nk)DW`BKt*3V*G?o`!b*A8I}M zEY$w|b8tL-9-abUfTzJ1;TdofoC;rpS|4wQS`Tl5v*61xAHKr#RKKqxUjtu*H^JAT z)=_W3a^yE*Eqn_uhHt}V@Exdi^}A5(v8|-{MbmpV?^6#SB12nOe*hmK+=o!>+mE2u z(;vfU;3rV)yHDW@$e%&&$A1ogX!@e&OVaxie`xE!ui#twe+{+%`vz`B{uX`?zk}MR z-v+f$|2@<`{SPpX_2!ST6Z{Ewg+IeW()k5y9lRZCfBsjf{rTUZ_UC_xvKRaTwLiZD zYJc9t-#;A+H!EW#+=!LJq?of7*U7@~<*$sXSd%!Q??oj70_JBLVJz+Pv7u+50 z4RuaqA9xV#2?xM^;Yn~mI287R!(neY7WRRs!2RK5cmR~0OrB?b#YVAn&FSj=i6B&1ho6PrrwP8JDq{#YxRPAVYe-pBPA5%Nll_Bf*aZ1<5 zZOHn4LhTv24_cO1dy4B0S-(%LO?PF;`u)_}(_9&{exFo3*_9#d_tTY*r3-nFGi#^V zdz@K2!`@?B?OFC7XV>}(zrAs)Ncd?cd!2LK_wc*#kx`rJrU!YCtlEGpL*8S$(zWM7 z-eYDhe>a%-$gVxtb%(sitlAt`hP+2^ZJsMb-Xp)Zz?C8Iah}q#bRqVaqS|?u|2efm z%YU(C@;_T7+#HiR2jJ#^o`}6>el2zk>hGf3^DW*5l8JYrNW6^L{%vWRFa}bxg@~Dufd(Le))iQ6Ied7xLPV({06IVi=Z@3ETUel|g>?PMg*-5U2 zvXflLKDg{7*CXqG(;MINQ* zlP2s1J9aeJE<%>wM3miRF_hipRw%m(>9BrYTDt=Iv!!>`-bQ-6d2Tm(;o>{=JnCb4 z?VVO1%j8ad+$Hi}%T4C|zgr(GM6&_fpjTruUlr>e@BPy7y9)o#sAs zUt9YSvhKIMAFhWFz?a}UD0{|(Q1@dJj(k5-yB@h;(}vnd$QSE>k$f#^fcQVE{ImXl z%*u6u^SFq=y?5M+tXrSJe=2;E@Nu4}YM(>yc-zw=`<~B;?0Y^dT0FUH{q{WJbf4i1 zQ1?B)NV)Cm*;M-yvi4oYN8x6;mG#CJ;z;z&b=eOFpI`yO9 zMbiJnWbXg1^_YxnUHD!Y{zdrsy19%OU7dC!;oF<+bvo3|F?ntXT05Fs7q+K$t_$0% zxh^r1FHS* z4pqK;K(+5Z$+z0YUdU?adqdURKDf(n(G#k@?TfqG{eDpO*$b*3d*iS6)CXDpW`Eu* z-g7`*a-I5Z-?{_qG!GsmnSOh)NV)VC>FyEJJ9VwaT9VL>^(I$JHW88F(wRE0ZbX?tutD9uldXn{V}ZzQXJN-?|G4e+}&#QlA&sT?DJ3 z($PJ?3a9fl3t%(j*ro7Jcp23Az7Q^VuB^Kpu7X#i$w>^3D8@toh@b+u7{;?BP@fmFLZfOP7xu%s+_xG-Xy1(}xH~o8&^?s|N-fs=m``rh1U+-F|^JMo!-S7JV z)cwBe+~+@tto%I$mGAXX^V$Ze`+XmVY7dV<-S7J-RJlF|7cPFh?n%<=PQEun-M9G! z)IGnrb1&~xbx#vc_wqvS<$b2^S!CVIE4EwwT;21y?@4-)b5$?ay#VJdeX(v6?z)#3 z#vQcerMk_?x*r%aUv8;;6#N0IGaHgwh{ABK@9=Kd$>6S>Ne?0`;Bl zr_i_fGr8M$rjYUci@L9H&sy@OXy5Bf);-l8 zYF9rXYd-xEZihcX&2v9P&1b(r&9mE~?#=!cs$KsE)sBCMYVUtQ)%y;p_U@_o*!RP6 zQ0*cfsvWh1nrGWX-T&MHO5f=S-+-N<^qtOd;o>g!JJ)*_>_R>h;LdO-sQaF~LbVV1 zCwO+LPb9qR15zK|>b zweSaugg?k+uXAvHUy~0NZ5}!V>iihtn2!#t_YtqBb9j9}7=V(Q|Lc=2o=;q$dogjh z^+SL7J^35}bwAz_Q0t2$q3*{!3hG?X(NO2JkAYgB9Ba=zuKr|u-U;=`+w)E^+3TEG zf08}#WYOlofl%MO6FzQWq#=GD)~e+T}M_qw3|d>HRsP=68b?G|4s+PDh|e{uZ+ zWR>3~Q00eAelM-R0{=AUGSTwA(DHq`WXreQKWn(M{yIya`QOrG{SW!Ru;Ci0d#A63 zY2;7gQl0DTZz5jL#WxuB+#B8J;?6j9bA72B{}wlXiN$07hy9$g`f|ecVcdYo74?mf9&(w zJ+Zbw*GxXOU$>}U`+K+6FNUk(Qp)A9MN3307sxu{w))%g*Z!T@f6<-wcfeI}Wxd+_ z-Sx{X++C7s@5@Ev-)*wjS>d+#m7?w6ts?%hq<0T=;JvUJu74{cl!|zt^`jJK!H8<+H5oUYC( zBF~v-?P7j@7@p47eZaH&|MH>c-2y0mBRb7+yti$yDM z{3*X%Lw69qr?WJ)1O}jFuX9`Ib_;)pXyu1H&si6`6aN9uvd}%|f0tk1kTD(;jPW}qtt!Z`WUh`iax{vhwG_4WIFY~|o-yd3Q{`ZI0w=&RK34U{EvwL zN=WOxS3|EMYn=zF$Jaye@ZMdWH$>k1O_ROOTcNj2en+(agFoTl4Si(cw~B;+&t$Lj ze&_>}KN79pKZIK65sv!*IP?YadODwmK7j!!+3S23`rP7uAzFXK-NuhEq1Jg{L9O$? zh8kbKfm-K%3$@Ps4r-mZ4QhP)-k$eE=vRB*PoW>}c|V!#b$$;0V$b_kwDz_gO5Y=V z+`z^^LchU3;P0?g(;uOBjKf14cZkeqo`yJEU$II<9@`k-fV;I9$oSd5p#$Ny&V!7T z9UD3|gvUu}<3eYsaiI(D=MXLdX2G4H?nCGPbK3pR4c#r>T|^r%5@8?8qZ`zC;e{G6 z^qlhQ4qcWIkh_ z4C|N8yw72j*S3a!4Tn>H9X&qL+IJG+)nAgK`il>$KlF#oog*6tz*X=FxCWALL~mz3 zbxgz2tXDR}lSohf}0uc2-@$=e!I8;03?ED(t|ykR8y(|e3Cf7bt&j@|oW?yRHeS7RE|D3`9z zSdnrYXR_BB-!Q@CG;x9EG5iUCO2ae@KT#xny2fm(+uT)cBu!`Z}BzlFF@Rk|ia`tdmp0iN5_$!PGy0F>-?G8?k&xdGAo zG46z)-Vn6#GaF`D_?ag2_x~EsweUfaemJY4fafWnIZ*k`h013hR6g^e@~Lp~&Up=m z#8bb8xECp1lVMyRr?_D*?){wEBK>KOXzdZ=KTqw2bkA>?Z}Dw?M>uPj77l+KS1y7Y zS1yJce{}C}_=j7*>>rbyW1LyeRn7%Yne%hQDUD;By59Q1;ty`^v$WmP50^Z**mLXp zTNm9rYw_1hi*BpGt@5@TZ@cBLhwi#y`NZX)FF)h%LsxWP@$=oU-M#b5dskGfIArCu zD=%1?yK>FS^Hxn&fj;y#7S?6BD2OY2(uy zmv6joX#=kdurlS-#pXtSKZ{Mwd6@ z-?;IO1K;}j%`I=Pee?UbHodjtt-ar_e*4mQK7OZq>jm$veXrpCfgc?9!HN$mKe*_F z<34Qv;X5DHeK`NaX&t>mp6gL_UQd^C7bAhVbN^O6H|GXn*|?EJjs z>14Mk*`HCApHmzRBo+9BGhC8hoOvG4;C~nY@A4Z?gf#lJN~djh!^KPx&p!Vc&g0p)m4BqF0&}T|pg$vr z783qBJdAb+dwlzQ;(hz{PxkHNN$9{o*47_8`_ib<9+G# zih_Y$-`MPoLVw}B#KFEx65JNn8~-WM^3DxpW&4Y0l!3x5tKLX~A3(Thut@%jEZwBc z{Jfw)J1Y=4kunmau^In$q)6n^nQQfAgnf6+|Bs$Kl; z^Jf(17Z(tKpVsx!(vIEdTficP8_BOX@q$Q^_)`3tGXq7wqM81}K$a^+pO<}VabBP( zJ(yn@NFJYl+QhLIBDNg+kzODgA+M;oFsF#{{uu!}Q818KL?=qh)KjcTTfa|sQ0Xgt zAS>A|4CT_}IX8@US)RS9;)3|X`0V)E@&5Q=d;nShDukI-cph$keDm-rj4!eVG1L45 z@mVI#!&UKe<3|u8KfajstOcFpNtjFv>cO)P=J%ZFd;FiCwj5Fc)=2dvxa060L zi8Lb8?#r(~n!d_AJ8wp^Kf5riFu%Z>T&o!85uTrRv;NQD-#5dG;Lrr?YpTzfY_@5~ z){dgho)&e9a!Eet|DWfRs!X;D&xL-fupmB%N=;Vnc|2#?e?9Fc{WtQFN^)vL8cL#V z#ahTjPr@iGo=i9Wv;Pm$_nqO^z+{hyp+rCJa{dpV^G_u>h=)#SGhX@8IWpw#LHgr-Lo_Lm$_oYx^ZYq2etO}s ze{oTvFDF0KpX1BP&S>SoA7Q#BPV}9gnV%IHTAZB|Oe@UKD$WcRwF>6(5^jXg(rJ~# zQ5HX^W!y_E3``Fc2J$i){E|oHb{2(Z<@~?ntZeUh5S1jb8P;M z8Fb^AEJ)88WzV-EwZ%u{^W;|PWM%k**|~xF`FVksP~q{uTVi@kK6yfsZ$d#JZ^YP` zP##Yg((4}MG7S0RR_TxP=P?Lp^^SQhUv7Q|>dZgBFzM(=^WGV4+rzNPfF3P$(_31e z8wh6la{bJ?g~{lc$FL-&$2Uf@{6<3>GHC2 z=b?0>f+pvN%PCUgF=a}YJm2!$vHi)da`xYOGI6G7&nPZL0nE=UD9kstGV)AcN~|vp zJM5cQoRO2AIVx{@ez@~plF*^syCYj7ZJGA(qTQL0c^azCzYEMWI!X6de{<_=IJwTt z%Fk7m4GaIXrCL2#5U%~8|8enz8|I8aQP7_gG;N{fHUFfPjI%~OA{;i_Q^^QF(!-{- z%8pu5wtq%meo-(xv!&sxJx1F_PX3JWteq55a5cY2{UdrB;nd%gqX`nsep>5aQU9zq zVU<6A+U;lKdlnPeY=-3^|6}Iy_4Mr1|M-MmJv}^H=R}_$(K`!*sPOh9eInAIg28zO zSML<(pWgp?RZI$@3KFBTh1d9cN=vz@pU$K}idrgiF#gg0C;!A$>piOV!3E{1)}1BL zzk>Oh`8gJMgmh+lQA`plLR(TI~7QRn{) zBMNc;%l$eviYDay_Yqy|_| zX9Zc^#*9FEPj8Ig7E}I~-wx)l5()ok{PreJi@tYw9bS+>Cs4>Nlbqu(&dZz`)t`D2 zep0JmR#==TEr-B*fb=zumywaeZCA1Dddo-ac`XA4ED+4j%gFa*_fR>Yn#^V(a+e_< zndf8Xp=ka2b8_5_z0-|+NtNz|&=&HS`Gh^33Oew@@l$@TOTTIUgm=t*d)#Itr@H72+Gt7Qk=r%EH zUs3;poMIFmN-nuzmW60-2aEBxfJv?z5MDQ&9Ze^!h9|R{%SMe&&Q(2FmSnaX6%Ch| zmKmItl^o2U6~J0#^`y~+8NVude79_~l36n4*}@Nh{j@2!7{xA}qV$gG(R8v{HWp@QU@6X; z7F(x9g9pq$QZcli%#4P2%O^HytLpc(sh3E3qKAeHGN1Hf%Q1_#9Vpb`EQ4A;npshc z3k8(NN(w&}8&4U+r?QeU8stS(Qt9XE(e(W@W)ucy z(5NFL;=nfVokkxiDlSkjNX{%!a(ZkEFJS)|n>8;dE1A_F_Q{qsNW$#I6Qj@3d*u2H zvN9qWJ)zBWh7#hs)MUMm9>D)6X+oQomp>;bki~jCIZ}q<6l4#GDW_m&X7~--xGTdJ zp*P`U?9zW4nIidW6Ry?zN!1n!Cw(L4{aV_2;;?W((o3YqG(m&g@`@&#mp$%~~Ei0(rgpKAiq8GIa zrsT|y5i=g;P0!3qb{jo*0SrLX!$rk0i!L_C*!*!?G{bsyroSNA(i&UO%Q4=reWEbQpQ+AlFU5b_v>$&~ zcDViQgdc)ChWN>RyiGl4WV2Dm2%5>%V;PlyG}%Z!XXMUG4r?IV=ZR_G zSr#I5Uic;P(>(j<_$|TQR2V}E*FHWPG8o7SNKc+u9L&zi4ziSFe>mM^zyca#|kLrv0kp+X5+) zRGaao#ot{(MS|JB?)>PB6&0f(6tT`qW8lii*q%M#mPcvKkA;3}B9-&OF)mB4OIJgORLs=Vb)gi^k(vr>k~tRsiy%^MP3=(^#gpZsG!!Ye@fXk^#Irn8m} z`qusRFUsL>;z#VH(r07!&k(@&k$#NUEuFJR3zd5 zSRd|U{!v_`HOZ#iAi6v8G`V;@H^Vl@fXg>_0NqMLad(L zXDiCIJUb#2DNfJuc08Z=%E`wbFnfkt)zF!9k~^OnH#lR-=;EU3HuUCY&bt9S)Nq~r z;e?K2kC+z>s2Ph(_m$zjP~ls!MtHtLXq;>5AX9F>tBoQ963 zQz#Z|`W>nM-0Ylr5=KNGn<(?ww8WvjlH7+yGmwH6-Xab!D$dZqm61`iZ7ZudFFUB< z!?ozj4cOMo=wL?lWg>5)K>UAj!F@w#&MT@N>V_T8VmODlNlcmMK3IvN#_M$w+e98t zB)KcC!8wT|^JloRuZ@j8_{hZ=^TQoTAxD}i@~_exe8j&FIUsQq&(aAK6?2<>jmm2A zYMbT3MJvaJ+oKj2N91RlDtcz5)v|_2j%$BLq;Zj2HPOjE3YSuaQUXR~n6&axq7NPf|(!Lw_JMdOd<(1u@K%QP<4 zXS9+z+!f#iksOET+0KbAdC-9bX;git1xaODilr%G z2)!ajeL%SzV_Sgipvyst4%2>3xEw~i%M)o};i^&sY%SUgr?3PGCZ5=nbH^E)IfeP$pKR#j}?jSg(* z6|)r4YS#u_jf-xMrDu2(Pj9iehG)9osri}3s+N|$EZKRZ$zinOAR28bxi}-6w1e}a zhiM4NkM#U#_(=Yv@mdT5;f0h(c0h09aCe_9aah_++FHvld1`7Pqd4|>g6Cul?{CSs zYbTCA(k+a%#1!okMC{~4{8=%^Zqkrl%$qpgeeO858P-VAFkyT6gy?g^`*AG+BL3n1 zJcb;)PFGpOn2l9N+#sM7m&6c1$J+7k*CkJVm-KoQBHY zZ8h0Un2z2%qZ^bH@=^oL(ODA%MeJlSh53eHQ46M_CcDMTZch6HTbbfpD&@bhafpG= zo`d@1K4)zBl;U4KuT!G*;%Fu1XJHRewj#?mPw!U#n314Ys{NQEmtNvc%>2*s+B6jPYj5JPa6QGOr}aSWe#sDeFzUiknn_Hk zuwLU$9M|&P;p}|H*6;(C&Zrjul*D1-mbQ+Gc~Z=KWe>srXI>ch1}D`-HmYoJ!vt?+ z6U$mfVgmK8bCJ;^&rX~eJq+oK9EJQ-|3Di^PMkQFp-QVOR$sZj zNTv>R&a>lp;e(!eY@rM#q}(~e>GN}>cZ$bX>>)-zX8>n)@fCRza#$?JkHjH2K7c@q z#T@kH5GZFTd?lWQYdmQ2CnhDa4Kv)=*E} zL2iHe|G1aOo`+QfZ`0MY{L_p48uyafA8FO@wLUFq_4w!tF1A^=Xx=R+*1{EXD#-X3 z@e?PF4+M32H(Uq}7s0tKzov zhu*|7E#pY~xb#*5WY6o?YQGkFq zW}jjWT_>D%g1I+MznIg^S=LEtroNFh{~;U^rRA$fL;@z;3D|5MZf0B2{ZTn~qZ}iX zNsRpisQekJ!ezh4O@GBdmS45Uca6sv{9h`+Xa-uB z)s>!vi(<>F!W|3Sj(vA|5*90*ex!HCp3`z?hY^8%SBEI_1!r*V!3HX(51p6qmN=!Q zo&7m{OyLvuM1Id}HEhHvO&S3sXHBC+#*9FI%QWfgx#zTf9x(&M!y7U&jhSa9v60kq zu&?v}p7cmpNX@prPxS9V(N#9mcW&=VD0X%1Kb`IUixDfP2R%KWJrMt#02@Bx2Vd%0 zlQ1?oCp&0|Up2B_>RFsHZaUv6X-_B;s3c*WRxF%q!=e%ng+A&1Jvvi=HzqctVFlyu zg!D=I9J6bw3)4y6F>XV`oUo|uxrZgf%Mo*))+**CovvmvUTCi2)MJh(d4^JU-o*KB z%Q;#rv6eU=JGy+;WS>T%?ZnnVct538g~v`{|6I6*>|o``j`E&Aog@5{_Hx=N&0xhv zL;cZ1=e&#hefwQnq$6AbHNA#$ zL!YaT9phHIV_DlV?rBfL!wR=Isywi;s2K`wvc5|J(=oWMC z`A_3jG^$UAuGah9?46-Z#vV!6c_nY+DJ|m+2fhd~COh^FB0*a0GLcCyJTpWGtk&ns z{boZj+m<5pqx~RnVs6WGVs@N*r-#qi_)c?eS3b^4*)D4|dHaqoT0X3F+uFMd`RYRU zSbJJnFYqSj|Ks!QP%@S^J^%@y!SF?g_}1lyCABy!i;&5#)z|cfsS({GQYhF&W0m)q z?Av(}Z(_{(*S`s>a_k+Pv^d4 zlFKl$)F(fCWI5!$OlHNF-Z`DU5vD0yz_T`^#H6PwZvQ`^DKYI3` z@*6fCB^RB?A&3ACRrUvO;-uJc=|S3lZjqF@=nI7HOneD2E>h@|0~s{eNG`{O4R`7O z>F8t8XqHdCcTB95oa};@q8ZQg+jnX;U;eB0=bQkiB{^1^7sRmMqN25!pFK0}y`uKY zaBh8xBlTLctQ4&r>udQp=bjyH{3Ip*2Q$(bS%Px30g5Fh<~7Ye(=nzyN0zqX@{vlo zw%9G?N$NzhCKdTkW4mZXfP<TBz?MTr;st7^Ot;*9jgqTnV#n_D8eotYd49cnTTck zn!%jpbxl9^i12$@{U&6mYfq?mt8oxTGw>JrOC0CtaG8Qj6%FvQ`2<-}{~vX40w-Bk z)`{M%>~5+rNL0e8z;pN&g6}74#O-ENR5UXqa*3+kDl=>8H9ImQvNF0dGNNOts%%6` z5Fbx?Yy!%#?;x@$(tv>Ah-`|$D2xk=jtj#>2W1!?x1aC-|GsnXIrl_lWOh;GdoQ}P zGUMK}pYMF<+duzNF1{^Q5e#eL1Y0m#ID1qUv=OV^b}}k#mDnv!#vZKA>jkw{}=rW{Zmo=p&K$_{ln(^$5H%wnJcGy z+|YTC7)j?H8B4w%C0{&fzW0m1xAg7R(!oOKWnI6ItQ*kC2$Bb=yst&^U-}F6uTlK< zVGH%`WATHP%CqwG(f((r6+s&WXYR=KX0RSH(?+>qZwjMeP`C@|r9l2Kccf|Fl&4&G zB8MB$qSXPyG82j*DYY)`(sp7P?(#89%yZJLW-*i&~g*II` z({3+hXo$nsk};vHfS$5MEs(c%Bla=Ja(C`K9B774mrHH}r0*Tw?Ao(`u}^-UfSfji)tQGBm|2S7jgQ^W26=oMba=W5@up3cux#R|Vp`(U4M9ZqriDpf~gaX~6l z|GM$Cg8^_nJRToqs-b+{=zENtMg5j<7qGy%6XHPzNdxS7>z$-HYgC0BC_g9V?@Wh3 zeEzxBDe+o>`xp4fJxg?+I9&!SXgCj2oyH%oysXGw7>&*T79wxMGjk=xI2r64MbwVD zyu8-$P_ob2A(~kQ{GC5Yl#_9$x&h!+?+qvulMU~v{AGOf_fo* z#-9lMFl9w}(19)@pjQb$$CK}iKvv1Pu?5`&6dMps ztR_knr#~+LzJxs z>oHmVpc)>@1m?GlM52&eqWkJ}2ac_sDf*UjGK*FF9#SF2Y^Qun5iedE@wex{wn9RT zxKsY9ch*}iwOFE^n`bXiGl?CwCsR8&($TlM`3;6*G;1k%%azMqLM$S9%X@DOMADrQ z{OjKLjb}*epFw@uDfiyKHqK_}aK6OhMBFeXe$j?_ZlotF@RzaXFV@UG^dAw2qx2>E zCY|m1^^U78G?G~a9>}4x_58AD{c@5ET5_n^Soz$H zJ5LKMD=S3gbi7iNcGTx*3qJ?7v%Xd|H}`5CW^ENcZUn^T($X55bv8MCc*+!}44JNu zIN<5_>OJY^*=P%`Te-}m>JRL37}t&~mp$lH{;`MR)~g%fa~S)m$Ui)Pfq#ZiXfaR# z4X}Zn;LW8dB!!>gJo)u9MG2=JH-6k<9p6d2TNrqv9od!occ{MvVQU^6`Vu5e5qT#>F7B6@%)Tc5d;fK zIwIA#`>FqPfLE$Ci`;h znwz}MYlQ^~rJ*jYi%kh0RnQsOL1K)=|G@Otj~D9!jXG@o?Ue)TbMbMs9x$}q^y17q zzr0Nm#_v%K>~4!FdTh3Rme;vd`ml9SqC@=vFj15Z+UIqu3oE9c*)>LSp~wAozI}KN z^-dSMY)xsU#x8vk5!ZH)cIy@l#a_p6Z(h(a%;wwNiQ9A;L1FI{nmC|X@qQz7egux) zdY*4Kt@*8XK|Rv#?tLoxv5GtEaU8(ASfpZC>UMJp^=vWlk5zO5gzVwAG$aJeA4mTl z{L5b03)9E!!WX!48t^e*oF4oH=fJIxSy9?c-4(VY>t~nE?{&bR+Q(CLgdkGf1*P3k z0?c%RK7#vO_t;E~rPMCR4dfutWDT}~V~wb;pn9>O**hp$A7cPTB}Vo>2KKy#?NW*pcuTU5hf$Eu)^24=`XFEEYf9+m`2F6 zg11&!&XB(lIKk0vLI0L%cNS$m`fHJRYE{Y={7?(?jV|PAyAVXm^^2$xly~B5xL(2e zclZLFqU!B3%Miw~;6B0UEhW3cI0)T#tG7djvrq;Cy)09g#SiY^sp*o@e?qJZE;rqv zCt<#Aw~iX_qqk>)8R0@|aES(2HE>e7s)P8jxkb)OG54@4GpO@)*Wcm6Ry_EO3x7KL zDEbogARc}@`lzupVi89>-t|_$x?QM2Wy>w*Mom_}aYk+ghy{9li(pCK>$65|?ZONi z_?KIY2);1Ie+g%V4xXLP1A`!(3OxJy?KD^|9Bnj7dy{JG zJbV*P`^(lzg`ra@gJJnI7io!TH@a}4UT*^rU6eazo}HF=+x^~qC~hd^PP9|MWA$~z zk+{3TW~MtebzXyJ7GXR38u;a`N`~xY9ERW=&zvq#t*tM4p^}OiQ@z9H7T2nsMjKx^ zfA8i!4!H5~{6(uvH}qtR!2|xt-Tzh_YhZ_P=C!l)Nx(xh_#~ufXBZfK0dD;B*3f<=z`fO29@)oK7!ZgDX!o zu-$>nq)Ji9M|kHnSEN-ihkcf^8-(iVa)kB#mu6nU4 zA_)Pa^B{2Qpj6zs3hs5bqfx5N9txfB*1uT+)4*2&edE*3nTS*YKTU6Y?0O28A-`(h z7k0Z@{2%bO#i>iGF z|JoJ+rYGpHAi=8Jkj-*K@7xca6zG*|X-o`V^lH0qT~Y}m1VAq4f+c}W6fN#^us&YB z`sH>*?RHo$pijMWDLJNU1)C=O?hj-Vr2QLC8V6r6%d}rGLn&? z-BPaw^ST9wR&@Hq!9m<4SZUE%UcN{>Yu-ZPYSDB8+}SdUswJ1gX~18(wLwHSl2}$` zXaxbmxmKzVj=A>a1^CRhN2oOWWZNSA1awoQg>ovn62~W9T$BsO8OTraT`7GDbxn;x z-euLnc9`LL_6~wJ6^cM;mv_OzIh4d?ba9Qs>I$)7cDsli*yUr^< zGB-qF>fAJ_mTB6-Dm%w9SBicmCPV5YiE| z=sURA*QQTn^L!G*3^mxlS%gVP2;mOgG_p5WAP?asL=uO$mb66uxEH@j*GYV%B^?Gs zquOVC<`hZ204~UIiHrol9nVFiWyTxe`>xngZXs^-HsYC@G8jr2cMPWnylY#6P)I4t z!#uu4?*kq>s{0Y;vT*TnQZB?_N@eihq9tmL@)!OWIG@3Ks@I5`=Vth(V1E=p39Yk6 z9yb*|a$SAAG!L0&p$VCc$}${(#KZ3Ke8GMRdBfvtS1I5#T|0j8E%bdSe!O^uu3V0h zvFp9(V6lpJW~;cg5H$(jF*Ln#Vy&|nGq4aKSp;cq7t9siZ<#4f@dv`-7 zMPmXsE9*U2-kX+`8i-5FeZiW$JsH$z@(dY8E9DFsZ2TOx^0LpkGb&SO2@?dbg($c;U@r|xH<$EAc1 z=U?A(3L$@2cFKG9b8-n6wz;UpN{QNSkN;L>gKI97tEDzDwn#vqEsA=9&g1Be;|b`@ zie#ON^N1Ei$kE_FQ#{j!oVX4- z%OyLi0r>Icnp!3px3<%0!y{KG7Si!^MQAh_D4t_GJtWTxEY5SYpkFREG%A)RH(}sw z($)xi*p`+9IRmASi;eS+j|%Qb8MiO84d91)>xe zjC$bS)@b=F2p;5}1CQ@kdA7B8n(I{B+lag{EAho-BoD#d#&9{EMyQA3J)3grEH#1kJL&efY3cfaPVmI16iV%CWHQtZ z=dD}@J*CllD3C_^cT z0H1`-hxL7aPzD;**ZX0Lbh=J4z-N_<&Zk1aCF zA@j$HofXRo3mO5RnbnclPS8-WpL?Lp`pyrebF^ob^ZZf#Xn4RkEH)r8M%YBsGT==F8G*1vhASA1+DLT_edEz6X-~wBCt zyyqahXvSNqipLZk#=H27ablSMGW%wjAz%YeGz>SR&geauA+lxx?&xdq7GFiMnzW7N z7vYKjteS}7qD+!LhT5IWnfcYx0%pMvm2CZ$49pYI*> zi#Z*~k9U9Q{ogTBsJxN^{&!Tqq`eUBrVJ`*53&?_r$+7G4Hw*}9^X;e62Ga@S;sf;}T&b@oAExZa8gM`E%EC4LaO}1uqNYK}usEO-P3Y1Az5@ah zbG4eSBA+m|3+h|Mo21;7%x-nobe4F}&yDz*Huh`$F8w7CB_;g|Qf+|$(guTj&PHcN zDms0CbWG#%OhxAnw=V&AF2Up)3)}V1#m)|lBp`#>yKgz67<6M>ztZO#ar@M*?w`^` zQ_qOL2JUgY`IYF)arEbL^rvwZEELl{ix;!e!KSeb>|A~Y@;YQKYe45yqe0tNrN0BG zVeP}Z>OCX+8EN|&(Q{(<`>g1hG3s4E@qXuU^NuCG)2Da9`~dZAtB2Xo#*5-Y5j;*^ zv){qR1YUZ}NWAodD7g|PcW3YtFnm#r#ly76X&PI`wYx2fSAoCy=T;QoA*c*^-HVX- zv?%WRXzc%r;w!_@*c+qx6)74Mcy_@u!9Lls3L{&`Ees zTLeydkRNAC3T6CK6uv&m)x>)K`pETsTa>&!N}d(2XU2UL>&qyE=W&m6r5T-&H|i=@ zuPwJDP4V*yxsM0DI9vF4o6ftTSMtwA@$>zqeoGW1p4s62_>m}nuUYD2 zn9K<|XPZ5SGd9OID&qOmGVAEE2qw-&(YJa-*_5jGeEr1_CiT3utsB3P^m$^BOIm>A znl=6S8$~(f0sG`{tI9>vQ$Ijfi#_IgW}X&asFoP?6J-Ar@VB&Qe-KWR?W$NRpddb? z&l=i(+C&k^$DpEg`eGNkG7aBF#MN~dENRG%@-iRHATbJp4a4+CjR;&JX+-!_9-I0! zf=X;c;g~HTb_3#fV;d-mLrS)k+P$3u+S_PXK?9H@*nq@)BUifAf$Epzfqw%WaqT%; z$DBPo@lA`ZKnTNR7^JR7Ks~`GaVs>o3WyGr7vvCeN~|BKj!gCeO-~RX(A- z8lUmUL=V65#v?yC{EdDbgu%s0`i*+xSI{- zk?!Uoog{KciE=L&db;t)(T_(@rFlW9F`0SENfFae)56|7@h zEZ{d0l*iBk!Fw|v$RW%~o`LcD@~Jty6EB!AsE}n>pc{L;N+CvizcRU3UnHZ(iO{{t zP1WizoW_AAM3hnzZXOA{%O zN8`!jN2XR5^xJ(%B?ij0`wl_%Z;9`;*w_hbGHg!jjDKea6YmW8o~8v;|NGBke2njz zTMCBvFO$jNFUVlKCL+TjBK4fW)Dse&fcM<0{8d+g!lw6HhmPrxi!a+L54nKM;zEO@ zFIN`wSlKi)bt=y}mV>jmpm*H&`` z@EQMaBk9~PM9IgZDZ4yczdrM()FV85}Bk;otp(;Y>W_X5#0)j~ardiY)velAxM$;r!0HS!Q@ zS%MpnXtdaGDn)jxwo`2&Lw6(3&~xMx;Mg{^xmm4M@yA@XUy#bAXNt}K%H?39nn@M9NIu9lg%EtleC#fM4GBhTJac5}2?d4W2LR3Bv*1>UQ6F^Zy= z%1C#kNaUHqcM^l|Bs-1G#Dr;7JPS4mUI7K)@+xa_zw@or-2ZgY)>w`df- z67_B0z4en#|L@fnYa^#G>*OUsT1wxwScpGyru zfcK3(v3;8gi7>{$#ScE?UmbbgekV$PJxbmlp0_}*k^Fch!u%b`Eau_+&rrM+_cQfE z6-SWIH*gsJHwB>aO-55WgQ6PAw~3<6;E*5)LHJCH$4?C;=2os@&*EpznG4Y)VzGY7 zoW-x1d4FZ(ygwHuzZNBLJ7C^Uo|9bQ3hXP=L9jWBb{LI;Ys1J4JtJ(Rf~1OX8mB=; za7`f8qA7)XA!_~AD1HxTV`u%_Q4IV)c*P+$*&n4Ci1e7lHler}$6k!(RX%*o%Rf{$ zf@O=D?74d`+MCF^xR&-1-{U%Qwn!c*iXI;hhE>u=3YgD@;H3nKuUY`zQ#hanYXc=U z(rRDCcy2g$^v1}gY+3l1B9H7>FF0dlP+8_ocqb`y?ykgp8D1;7Kb4;wPfx9tQl?@d zgZJLQM2uftD;K&|*qv0juf&_43@w?0QDCK86bsMUoyz%a*iGV5e8$@&;r3jFqz=jB zGH@G$4|GgF?1RtgD4rh%KF~4MQt*jZ(fKhiUk))}l3N?LI=m(-2QQ-1_um8gJ?Hh9 zk#PebG{z9xf0>zA@@E4#ck+n{x4R{jrB4Be$W$~TV1|2%9j9yJy}Od|;X zH5MxiSGlw93QS-k*TN+S>tN`hxDh3}w%&V=GL2N&z~roTIJOZAS!f-F@|&A^;($C2 z=(>d-Bm2Ov&4K@`=-489mX+<6XTV4KJ^)Lu}b(s9L)A=xd}&dO^_^ zncl6d`51(1)h_*xE4g9;M}_tIzkXW!YrHWE{&9IY0lO-k*RkMC3e?8^!$>%LP)l7Y^O;{!ymiyg=ay#sJ3GPar3Hwvy=MgQJ9IwdXR*%17*MiA z`>o=FKwDARj9u&~A+3EJ1L5 zaFjETC#$)o`p!;&2YxX)F7Ql{ER^%Hu9s@fa_%&7#=*7urNf&tX`(bysv=-=t z*Vk{+P6EAq;~q%5yl@X;{3KWf0_%8&;37w%qCoO3ieY@CT4-zu9>C$JT#?ejDH!-& z6cMycYe+nG3J4R}@4z&{h4nr-zXxhiI74#8(l+dYa+HbO`4qkledB18?4Z)B&y#wP zJf-oeKRajYuD!b?-ZYk>IX5JH^d&H5ZOC(6;OJ%lWHCrbF5Xtrq#Fxz+LM%MBalHC zS$ZXmLrNKOHiPl|!vN_&k1{uuMCkOTdFx=Dy!%vkngt9_hyN?F5r=C-eDP*s{9YTM zt*ib5+?JI#YN3=cn)twF_i6-36m%{q#4s@{81HpAW(X|r8XBswbnB&7$4q2i*|FgQ z4Q6^D+Rern|Hf1I33BO?kikGRvAVbI_7BI`W@J-P0f$6R@-&%FvOxDg%CY z6kW)xH8FX{sHIP7#N>luH2P;5f)ZGXH zjzly+4*R$J0`d_2?8klb@K2%`^2|X_?|()yVo{5%>5RZHPKG^t1Bff5DH&=ImIbpE zwV`Fmo~3=K5BIT?J7BqGJz^4wMvkpqXUpqT6o813+>nBnAXt!gy||^{#G&KOL_b?U z{_P?{3MB}c*P5j-U}9q2X?TyCqOf}v=g@b=p6cA6f~Y9@!ai;qQ!NXI`JQH zNOxsNNo<~EAK4D5cbowO+q$%7vSv?_o)G(yiQJ_W?1VqeGJ#n=Q34L2FK)eJ`esoW z^-UAG`>$`}xXL97zDP^B%1&3HEc8o*9a~{YF*`f8+eQJ6a=~n@sl-6rQ~1B`NIKDh z^Mx*)tu;H_udU3%BA5tjJ-Gk5V)%48!Zji6P?g7IXd+)+KbXQm6>%KJ$2G^=( zWetA-vIL z8-w?FCDG2(_X5w0rF5|n6PSdx$;;u)1ar3x0H8VCi))t9T$aNK=P_%F=|NsV|5Fx* zU_I!m%b-2{tyq$F?w*}YH&;SX)#~<3P7qhnP3*FU%$Sto%Y6jM>h@|jh+Aq768aID zX}j|m+Hu%;Qhj4%Mf`BVT{Mkm4IG8KJXY(4^5BY@rjMhZXRm^K-6lW<^Q}=opW4B3 zU&@R79a-R3yvI3>_CKeMrVlCmHs$RBnv6b*pBpCba|WxjXE5JM@RQ$vL?H9egCsr% zJ6M;@TI&8SvqT$bP>02m{hPWH|JWf;>ZtnHKOooA_4&^I*XIy;>?&69VbZTl2Vs}b zLKfu}eq6Cbc41Dl+9#J6C6WcL0yO3>+T{81^LpWwB~v|^Ky5QPmebvpq?}`W22O3G z*<+XtG!AwjfE;vX!R33UosIpM7b&=UUaHE6(LVaRti=E+2eCxBA8F-L$I1M_Vj@Ng z*zJ_a^xwi3Uf<3j&^p=nI*kn146~wipDM@x(c!VL(LTcUaJV*pC01vI`(HCvh0%}8 zM<)fl3+gs4{`@%ak8o3^q`+s&4g=4&(UDt=kwmJmbORzj7GDKuXz&y)t^}_zen1wu zQSS-(@%%tty=GsWiCCF27sNBq3n?*ydY&9^X5F+I+)vGBHx)ri3DUV<+?Io&H$6w+ zf_h~}QY~S$I7j#@AGwFuL2fnMfGp=MKt1y@m`+(plXI;OrIuur`rJp-_-w$;)2OWE zwb7f(%@ zT!r63FIoA<(d(n@#t-JUh7aD)L3SlpF&ePS?qFiH;q`ryM`xJGV|cYe(Z`(3%e$9H zY1;Q`R7KRParjpSoAG}bDNp#*D1oZ@0|&_yu1=1!2)POM;S@o`!Uq3Rfovry*@U)` zs~~6Bn?}l2peOzfUz&jYU7s5!P58Sg{%a#mfQ^T)>jP7`zXp&(1fuumZE3R*!@^l8 zS)h@|nlYFp(l{>tyF5Ln9GO$eo@h~EU>_|w6Dj+UKoTbCp3m{!XwT=*@7jc(0Hpb@ zMtSR7GhEzvhIt@=d`oKI>*!6eT})ZPz2Y47oMkwl4-^Yxtx= zXY8yRUd`;9L&VnbNdwG?*jnhk_PrU4{esp;R%XRjPYh z&o2JjlsloRN8&q;i{_fe2)6W6W1+ECUjdc7P@%Bb4z{?4WHYu=E2(-EF-c zl|aG>kZVQO@w)5M4U^eqw@j<`k>7aKOEeww3y=9AChskOujh{ zqr3qkn$hJG{c3(4x1(tEcAN$M6Q#bBKO5*6M$rb4g^KvRP=Ad-XXJV8MzAzV7Q^$n z2<%-07Owz@ui)QZVD$~;rwZ}TT~U12KVWT|s|-0{7C&K3lxL2{yHFp4=y5D~Rzb5N z^{;zKy59rG=3xHk0MsrkXX7`hiaXf9DRtQQz$IFdaXHW7QDlE^JwPHl#Vhei-AXfK zKz9`VqqOVm@sB<{x^)CJyfMVvKP_~JCVQUM4)QRJJD7gXoifAe`YE4p4ae@iMH;JN zyi;z;He_Tk7WJGRXlp=|{I^^Ln5|q3`(RKWSChZE>CrS@P&N&m4Mr28A=f2lGRD2~ zb0ayPtFRCLl9~7Kk37FH4hHG<^6>nIdgQB{H%+E#nne>W%o6_da6B2IFUK7UUwU`l zLVqr~szWR2FGTUD?R6`DuaIZN-^_UqpvXU#(Gu1X?T>vk?JM+VnvGs+_U8p7_vdny zY)1(K75FfuCUFCFak31vyLr*vXKXX;5i9|{W$n{fWC)VQ{`_RRtirFJ$?y?Csz%!C z&*a%=9?uv#kGrGf)+i~3^9bN9ydH2jEcqjc;pwfzMh@B)v1F9~q961`&ZCQjRv{Jg z)Pt{JQRNQ5*@aj@+vLwDa<``7FxaRvTQw8cV2VxI(_f<> ze8#^#a{WIOB_EEGw;r(m&JO^xn*Gf`OLDWHms_1~0Q7oL6GAoD^iDmn9c^Za?Rq!j z3#?khP5xjMzuVtr_#1tA*e3sZ6#t>!WK8&TGVN&mH%HF<-Aqak%oCiS0Pcp{IfHho zV!+KCF$LO_f+f8%(@sNVS+yJGop?lqb9+q`|ExbZ@K3KFHn&fhIb%+YyE~D4Y6>@3 zL7v<%&g<{YI{wYbb^N`ECh5Nvt|KLS19<4r{CVf%Oco!U56<_hH7q3`e3A2`Gn2y%&j){+uVB8bA>i*}$)%12Tif)#A z_5JIaG!4?HSF?zEPcvqiY2|cVV;8*xtlMOHHr~CclFUNONe%7%rKZDR_X- zALy^~-yM1WJ{Tpx5G61-Y~sWnBpTow%CP472iJ)9`dbEk!bC^0az((i7o{mca3 zpHzR)#wLtbG&;2E(fmBCvh+in(5`rXwIBRjM;_iwNSudDXbaD8IQAZA`aEzEX{~}^ zP5CnDq#yF8J3J$+Q6(S1gMp98&olI9Z8K?9`*uNSM+8rwdVSXflTlnE@*5vN-;pVF z1}QL&`gFd&0}C6X=-WNzgoLn6Q}x*3b?A$Drs4J-mi;{5)O$1PK5PNZlOSwsn3po} zia=#1>$Hf(WW=BDIaM$5`kLr{(C6vhdmC-{4zGkhcf;GiWPs;~7UXaUpJ$*D zXsz`(VHOFP>L9)^H4ktsuJ6#_Au|B#S%#NK=H-i!J7!92oIL2f*0$@6CLf7?z(lT+ zqSOKKvV}cd%zFQc|A5~8t&#Zhm!sqjQS!VHUml9E01g~Y_cehlp`q~TK9VgNS_Jw7 z$j}|01Rwi`VR-VBQ4HRmw8$4^TG9AtN6zbgQSugwz=M0>>gTl#x2maBt}!KXDL~PU znj3iZSNL;#PZYmp*xbOQe^lqjsl5q5S$+L~?H|k&Ss?IOA;iAh93j54HGGA9ZJ1EW z793Q;%TB1Av6I5*D0y7kl&5(AGifCn|D%!n`5O#g3;E9h`+0Tpm$QJ$O`*o?_^U@5 z%nPIVr$@?QekqD^$2-9NkH$wkl)?Og(YYJBrDyLxaF7p{r`q-NkGkrYp61q{T<`IW z_JZzn-YsKW@nFTnv+p+h@%EAX@e&3$%2wsmAyR+uq{XTYFTuy6GopCUUtj2xo;B?7{JhaYN*rLA$Xk7P5q4Ct{@;d8p3$>HtpP*fRK*+6-BsAM z_Zu*QMb;l#jo>~oA_t)okZ#HN;ov?9_=G^zc* zEko5k9o*zDuoV~&L@f^x*%VCIfc;Qtt|pPr9iOK9Ge_SK%4HJQJgB=58hE&GBs{!| zmk9NPS-LyKw=+jBipzcG0hE^V0BVGYf~J__@k$em8lQPBl$EKPd{t|H|; zxtZi(HPPn1Q>KO+pnpu7*SdP3z}K~pyp**o@v5x6gN#P2()9ZIEc&_O*r!}aA3i6c z8-0z9HJVg%@>TJ=a*ut@a*=%tV)MGkXXr*Jr%XsH)@z1)o1;BKqFLWWTjvF6Kpm$r zYFoR{k+y3ot*aF5D`fqAJ(c|c6qQlUyq;0rQm(WLFZq^^2dN~ox+Ytgbmn{-x70q>yy(|OnFTz&|Di-d z^pvUS-{*|7NDlVPH>o2kn(a+xsr0cA~UsbEoucI@qW3ZC)QHfMwVeT2j7j!Nc5j z@eE&0TLn~u#O^ifMs`DfX9*Eg{n>G3v{x#xFgv)ok8}Jd&NP7JD?3c@U`~Ccc_GTn zCFs~Q8OeW@_1)>r5gz}(^SD}J0D%;c+o=ae0Ac)Veh^X#wyB)dy_$@Y&EwKQiHzrvikG#1=ik% z_Mlv3BIo=grpy>^uOZz&+$6-BFT&xcxmS}F5i3WP(`55|dH0D%+Ol17dcwB>>)#>^ zocfFNo27d!VnzrO$>JtPdAUX4AzCOa|Z6jgZT>!ZSGbv@qx?BHr3e-kmR1h!F!0K zmP*j?uiQ@LSPqXczg8yYK|p^qOA2CIGPC@7qFad!!3AWzS(gm0X7t?7U)gn`sYAv2 ztA@a+7cSbku4zJ}>PcCuJR zP;T5AlElge$%XH&Dq(#-VfIbytJzZwT;ksrzuZ+)}*Nc@p5qP^>GNYST{mWBl*$}WxK z?DFnbD{IVzHuLy#(LD}m)|+1drw9kWEdo+og!JMk_V5}1wUK<;TchMs zv5C2|>%iV}Gs0?4y?(yYS=YQ#_RV}c7~7zg8M-xe?F}37hsQYTX#D*n&2sP59wqJ|?$M6c2e^e33tBvkxL_s+u2c@ARFXB6G2iu#G-nC$qsOCZ zL{E9P;HRTcjNY%kjuOr6I>M>=4bki36-xkt7_Dx@%Nb@Q2+IkIMRAmdXBCODss`WA>eN%4F;lihXpKnfvT=*C6lA)?DWtgDdw+{!Z0l;E?4?Mns3 zIyevY%bq5GJ|!7Zkb`rhSLt5ZXrnRH|54O|48E>XnSnevh?>BcLKEhl)s*JLoygsl z?&|;)nnvv=FQXsu-6P@y9fI%HaoQ$1-ALq`Q*(&p+H4|h`>B4tFG5SPXTkG1Mk?yn zHEJu$3!j4LijfCJtKWw*TaKs`OBb==Eg{|{11(;x&%stB4c2%Zk>k4ArFdxOdwaZt7ySV?eAna!30zb(7tFr+7)dg@(g6Qnor7z zi||-JllXTc2S;L)=VV~NrnR!MG%754X`=iEuSz@DecS#G9lVc+>5BGs56SuZ*u&I{ zBrc|12T?Lo;E#{2k8x>E1<{ZR>f0!KBL48>Ypnrc@17T9LR_#wnhb_BG=hn?@EH8^ z_#RlkWb#fz$gQXJ&$amYACKfmkxb;iD0$5_r5~q3GBe^lN#+KqKAK%C)6jr=S=G)R z_->HkOTdYupl1zh^@NsKMh=JjhB2$Kss2xVPC3^E^4wT>n>K4-qEw1X0K_`=u8F85 zGgMk@wg2&q=HfB^g%z^Wka8rN7Cmvk0p;9OCI?DDL(73hI2gJ8h_h1L6p$8 zl8lxzOU(5$jJYzzeGE1vvz3n=i@%kGx!uabSd2K@gM82ISp1ZffPaKp*MB#1T@j4@ zucG7&*A#A-43Bb^{Oi!AVFYwdc*3~T%#@d1qOU~ppZGiu;*tN=Fle6`i;wCO@%&F5 zB0s<+%K7@T+bd3Zf><`xrQ{viMycWgZlgBzxRBPjUFP4_pq-6uyoT1MN^G)C-Ii&p z09xgIH#N`GdnB+^%(iL`I$Wz-31j)+@pG5EH=!0cskZ8(-@~*lhlYaq1aT>BKOSn< zrXP>8YeU|OGG~2ghf?u4>UsC_BC^dk#Ka&lrM(g5V1!Fbs)j!!%CqpjUlXUyn#dVl zFH@vI|b%4#3B z#L&w{pMy)5)MhnRF=qtw0pIP0P}F^Vpxm$ncFV3@c0p6PdNjuA#o>14*Chma8Z(>n zWw%drYZCDi&mM=Loy;^LC*H0%nt2%i$|YUdL1=&6Dh0;v19_)i)9%T&2kRoHY)+%A zz{VW!Pk_z_f!x@swo|*}tX$R9Gb@MVru3?7xK-`ynSKD;<7a4nG=r@mMA8l@z+K1UO%EaR_n^K<^<&+{YNWiJ zFcE0JyxUDmQwt8LsZa6FA&kEINSL};Fo37Y&{2lv&bj_YPF;|Hw<|lIB876_q4B&> zS6Cw8Nk0l$06(O=Mc7>sOX_rUx?1<8=M`!Z|ZD;`}bdC!U3fl#~L6C3M> ze6}}!3=6E{ZV#aZ%wK}t)DC^5zl*EjHW6(<2|p7#=YKd1ziF2SC8kzKsE7~c2NOBx zk1lYRwPnKD))xGZRX*qZb29Mi#%jSc`cd?A!^F=mCtZY;*w8?hyyjAQky9>-eL}L{ z-_5)?@}wV-@p^KW`E+MKW`r)l(H!K28DXCOl5psv2EDvvu)0%JE3+;2n11>#%%=4I*! z>Mw$kyh!vH$G#E-#r^$u78kFiGGu`3U}`Wn3cra%mAd{RFI@5rezhtE{6~M%Q#TyF z6b+3f^p^P)DvW*wF8p(+%_be4f^hvx936df6t9F!$`p=z&HTH;1Q2K_KZMUmi2${0TfMoSse3X)sB9+`@RQYWH8bP~Sr!?^=O!Rn-p& zl1pn1$jfKfX5jkf((Xu{BX1oM1`4@2O>+4=2|ESiPl?jYXs3)S2%}Hr?V>;ln2qDV z#UY@bZmj@a7xJ0FFv3F@V((6Nn07{p`$xL4yVu-oS)^o1PVyBCt{kxldKvJ8PM=fm zRdMAla1^HN+m(xrR%aQ`erfV`lofk7S6)slI|%$h8+r;Lf@aEOZ#~Jc&Vmo=_thAL z`UuyY@hub$DPG_sbauu*&M)H{ru^J%hv!Eq$PY>@(fBp-bD$W8J}!*sKy}*=WLtd@ zJ|`iX>?!GUA&NIaRw98xbd3k7|m$|J2O)4@c2)Oa_Y3 z5U)H)?nQ;-0J+DhRigMDNx9V3dcdiAAZmv)f8EyJA2R8j%*)Uz7M|LTxx0=TiOJ-SRoWk)pkq$tj(7D55v zO?tN3IG>sqgmFF~>KLkkNC`LcgK%N7bZrrItrhPmk!xg!mcA{ayiad0+VoYdrCwQB zP7udd=6FxPf_xlwG609%ZS9x$P=xt+B-@10hsTbQcV)?2HZJ;-cI7zbVXC=u1` zmLAKrC+;73atQkyWIe5eE48PHa{Gy#^Y<8#2TIenbQFC+%6sz93j;MITnD%@lc6<{ zds&*!Bbe%RpceX#%9NMF=4j+pT9rn_DK?S2{r9pIv{!8Ayu>U+;?T z*3}y(8pw-ePL(Z??&b@*nYdp@#!D71X3(a8_&vlt%#Jjun-Bw}$b~W|Ay>F9pTFtJ zQ@3txRPM$1cqfSMfdSo$pC8NUQ$1_e1gDG&sf0m)V5H6!+3*?3l#(nbgP(5|2)a*&+3gzhBpBej@joj#={ zm~q`M7Bw(Y-dxpeXcGqgmX^`0^$Ui^^ zXQJTB2!Fzi^Qj}pNiO*6;HM^TPCmTA-{khek<4Hm6S=*VZX38o_Cs?6CqgH5#mwv8 ztD2W@x2?>=7NGw;_*J@d*%UGfIMfx8(qKvp$qr+P4=(Tnqi;ZxPJi(iQ>%#0=ar z?*`(8)fm;p{s;SYR}c^p5U9tXV@kQTgN^&4Y3 z>QinLJ5yREH(DEQibnTR`(#lg6ui-4sz-~tU z^O^PI_)Ru8^^;D{tSr&Ups|}`$w9l#LHGjcD&)NxidPq1N`6-S8h^@2c)KFy1@@c!ZpCr5e`{v{z4Oy{j*cvsjU(;K+4-S}%Fi?H zfjs4mgzPhi0p)0a@1Muj(@RBaFMRuF9=_S#dP)$jKvU3$zx+n(Z)#81K>ia8JBU8FRGul@Qt?ICW0DVs8sL4Ax3-! z>4S8NJ8oteq^4jvLgHu-@A*-=lMBn3p_7MHQ>xkUK||i#2@-#}{-IH=Uf5~1E)-5J ztZ(<5o4c@@>RKL% zZx4XDG|N_j2F)a@Jd_^beY@NW(fGtjJK2ATlCLo3dO!eNo%|}4Jx>Xm3jH6C!)Zx< zCh61!?Fu4zi-!}9iz^Vr^09vhmhi-vsu{E(UawUGo^cmL21!yr4xe} zJvid|@$Ajq0dmJ@%2ER;8rTJPda!O}932qjDo1B~6S>>d@fg_76!f}R|8M_#NU}vO z27QgR>&Xc;eb4VMW;y7$oL)sTIhyWgnt`BTA@d*?pR-JQ=DDJs?!bu*_%D?~WNL0G zeR4v^`QzdI9m?5{4$U;?Rw#>K{Xzu|){Xx7QMrqYb0hdQyEbNJ6mtghuQnqy;pR&3 zVbMqX-I+Im9MLZ!4U3Rrm>t^V9n?N~J<9we z63w%q+92x`g%0UdFVD7exrGuyTf*;{E3E*#od&{dY+StAT!r%E{F}GlSH5lJD`Pc&DNbGirh}lj`VbhBfL_Q*(fEW>FVLmr1sLsWVo+FTX z7BgLDI!spyb{~c=dDuw0BpOTpCQAMwq)WnseZS%skf>om1|D$L0o(Ai2_w+&;$;`d zZkX^RtE8vD6N#19kv){}p+=P|71Wk2N+Egj*CsE6RY3kr6#vaI@&vw64@$|C=(E^Y ze8xXD3eO;OMe@2RdG5c>It_RyA-~g0eZuRV#ug&fNPawu5j*B4nb7b&Gd}3(k)d8| zB6lf(>qEm|dhSYS=Z0(oP?)@V>@Uxf9tc>#O}zMI+T(h$m_C0%?hj=2(beTM_@>}? z7(g1JL)>Hal6-zZ5+l~}Yy6#g|AF}o0(&u<>q^Rqf{~vZwOhKb^bhgm-N0b#8%F&W z3z0tX(AvESlW~C*p!AdBhv5f9D&Sstg@A0TR^TAjbb@%&A+DW_SRHRv-c=-hNc6R; z@`6k$GvdIWl^iHk2N`*OyU}*eVS)d(xNJe?*>Behe)Ekc6o>30@FVlf)S%|w?4Q?x z@E#XYNmV`FX(#v)#3gWZOy7D~Gm`s16|taB)<4Jkh`17ejWYOLUH+u2;QyGv^y#!f z5*0MaCbh=c8!$>DIYk4rfT`o-3|D9EF)Z5rt;6L{3h2*ExF{{_E*n5Bbhle<&+$dc z|ov7YHl_RUImgY|iC6hG5H z;)q=j{&A4&{pBczjhZ4~%;9&;JU%^g9tht4Mo#6L%p=5po=qCn2x7JKe+ILIO`XIb zv%CLGCWl^lwZNwC*JO4dH}krx_-a?TKWl(>4a_2Tq5}T3K!O4*1If4}VY}n}oDUUW z?UQCczdmxG-o_+{2qp8Thg>-1+7awQ+S zHtXaoZ&I0$(v6v%YJUEqGaxzZu!qWo@JZfpp#QxA#K67@G?RmvKZ#=4j}D&g{~5(! z<8yohzIw6WRUg0#-VN~w?n(sl0cK7jZWrX=+|p_tZi(IA>D2`(XSs&*V6X%95#U{A zmbwyuU$!cs7vK=O30YOM(z&3yAlKWECyduHoT#M1E&}GjP^EbVUm45N) zM@=^-!EjEO*%bduXFiczvhB8NRU}4p%|@Tcdwj+}GZHVo zH=;@G3$G1c8lb5_L(nHvWLZoWDK{-{+|2C+dsxBU7MFuwc=Iq^1NsZGR#G~G@ZU-( zO&&~F?xm3{LSTjH@Fu1+M4$oOH8e1%(+g9s<@Uqc1r_R-p)R7w3Vh5v9o!T7&Hio; zMmQ2A6m{N?AAH8&JaWB3oIO2C8rNXG2kyili{dWV$F3vjGvsd_#MySeb-d9ee&3tn zhm4$Qv0iIbOe*w^qH18X3DQ>(zAcUCTt+*-{;(uB0FTQG-8zYEPnQjT;M23PP^@0) z7A_$I;`Rj)y1_|)w7FOR{YW{@^<&BZh>|ab>lspf_e)Omzaq|xZF3O>4(*Jp5;+eU zH$!2~*NyJT?&6U#gzFr#i;ozK5pxBn;o)YT9y)TJ{wYen8YQ3q|Is>0DzI>M{%aI} z$%k>!A734|I>*N12N+S-Z!4USe`4ghd{>mflpZOZvV7Aufg{>LL3R%+S!E@NuAD)D zuZ&{&2)Kj$b|X6pSq+j!X?B_tkW&ebDFo~s+ilD~_RKRIZ9|6j*H+%gJ0E?|oaxRB}d zRijnjz%}yUBgDz_pmBUGhCX}n8u{PG;)n2v1#-Isu)6i{y*HI|4$!S8BUXY89k{k< z>-8FCfr%2@yvlP$Z26Am28xLEy_ZtAs{bY3t=E^<@?H=uZR8@k{TBk6)8W69T}mYa40QRt2JKW+=PHk+ULAzCboTyP%Nq!N$!|sQ((p;8O-^f^Q#-VdJI? z`hH#3@pq4e69|u=6Crcs0dO*hou?zUiHDH&WUbTQ{zecp)PmD+uQEW?JlpWXmga=~ z82$o-6L^=AJz(s#TwypIF=ZfnPPx^-ub;O=RQ-eVJ9-cLi9?zi00m$lmXpN@p@Pezcj zC$A6J@!H@4PmcxSWet)x#gf}N$H0(Ge=HKWR|X4oUlfDKbjKNZ5c>JS1^VMC{(QPX z#E-{3yGcr3GkH;ydWH9!%6;AaK8M8Ypji?wBrolPtn&!}{wzI(8oJQ`*{t{HMy@v& z`>j#(GuLLleSOp-V2mkT42A&{r71!HkOSBT`Ze(MZhf)dlKVNle||fP!P6T6JdXLf z`^V4)Q1}B^z#}G4vP)K=jq`iM#L*9cxIcPdG-t{Cqc4rxhcc~&qCfSMKz7t( zrM3!}Ysk_ua5!`}wt$Db=zSpcRq|py6G0~2jS=M>owD5ZSq~dD0iT9US`CwHf@L)j z;#Um({n<$P`^_l%09Dt)eRgfmyEPXhiX2KgQP3kN9w$G865kia@AM(^6H)vDeh(oM zc=A6Rh-{gAqA~KGI5n0`jV0e3#t*-W`6eI3*ayPL44o#*6~L>}0FFUZc7`uTctj81 zxX?zZPHf6k&IC;>__t-gt;mIR0Z%%9Cs0phSN%uE;wO?EvQ)>?SUkn=;i_+q#dlb; z$;3Y!h@Y%n+JLZRl)h9r6HiyFsPreyzCLy2zE;PQwXx(W*J58GBKyNAd6QTP1bZOz z(1AVot~K86K^=Ve3gFwoy*IqlP)HhH^uTjAKys{%#dH2n-!&Gm4cqC&}T#GQ^?I|$Yz067oC}3XHW##--shr z&M4}>#TJv>K?W#_zw?ZuJea;j%DY?3+Iv)*TMcONcJn)}N-bZlK^MENh+X2xm6wY< zP*$(Xs)^)4Z$dVbSH$72uEkFVulT!btG8LHrS*J#p#RBZhwcVDyE$|JCRE3c9A zrNlhq>YY!6`%Tu~I@{<{X`X*+sSCxrj2gMxX>zSGUS@G6@9KG5sa)mnci0Z zMKiF=-r13srx6;DYf^&nsFVNlOc&fsv&F&~-sSwuXS51(E8$JEmDjIZ?QR~k*sgVc z8d9%mWX+K_Hv64!@1=OMl$R;xYbMwQ-_9YCSu2k!{4&}8?GwmAo=5T@NUmfgcfdrF z3D0T>RgTeV0~lRJV^4EPCosmHyaOu)PDCh_rVyVcx)0`Gxgas^QKsEPxO-V$(}#4s z^;e}1h@|`%fjlpp$zTG(M3%Pz7TavZ>%4UM*%8vVrN7Gi<~i%FR<$paJahg$ves65 zNPtjjn*Q%?wIoAzxrRY=68(m(S8unIZz9*tl^EH0bUX1UWMGJ#Q^)d0F9&>0_FuEG zi)gNB(Cu@%QOj5A-8}p&+0x0Wsg;HAYa_A`wAx&f#Yb0aHAptQ`D)$3!DRQh79^TM zzSn_tUPI`fPGMIR;(44AMlulSV36}%nL%W0(7-q3;S8W08EIwaomZd4pLrx)#=tZv zO&J4dHS=A_{aIuQQW&QAM2i@Qx`t0SfA_Y=<@~PJqroIYXR?H5g%T*JRP%QHxzZ(= zcHP9s^Aao{?wazgoSNU>#J-jVoSu;H_S^JS(CM8x@79SeEN?YBO*yOHM9T_3+?QWl zv^E2>FZt(9ck69doYFIN%A1f57vkV-k;&S}%79p`B$mP)9(DXJHR|S+P9j2y_%72j zBwd*kF!RmVcPpDnq$CSm{o54=JI0YBtTr+GmK^dmgx-YX1?!4!aGptmWq}AF^>(Ye z&2J}|-fN4348YPtW@3E3GB6i*ITea~xr?7;hE%u*8Lh6|2DT{SGpL z*D0d`=f=DYMT;UD^==6{oY{)-$+L>3^10F$5e^$D62-Cr)ep;Z-%YJ9mY3nF4u@r_ zsWTLNHaVSwW(s?TOiiO7MA17z2hL5em5%dbW6zW2 zqyHG4q-QmUzuHnPFu9ytryU+OH!BRG-BW$5Aga<2-1NAcZ~kC$8fTVG%rY?8Zhhxf z!0z+29h&d$R`>X3o<%M-YCXYtv#V=MB`~y{&hknJ#}4rVZO_uslBU>r$=oX7l2*_0B>adILzmzRO%D>f#!gS)w$%Q#mhdP=+9+Q<1N1d&OAFVC!e}9J2WA zbRSx3#eb_)4EI&fEGBCr+joz_E6{)o0A(qT)XYZn?3I^I;dJn9K>%Y1|DGzML*nsr zYSzk8ken$kzz<^WMa4Got4u`l=&|+!;2PS8-rgdyG2cxt=1w+tb)ajFdu1I?RxY~- ztS0tU>3H1i?SQ5+o~cIdrL${qNfD0N`1SAm}idQU0e$tRs=PS*=z|u(}t@1cBIOyzWNer5hy2$vWuvWQ;+YPkc zy>-$0AvT7lt$ryMhVM_*>RoYpG=$koYio;C4tlRDxyDkHJ8xStfD6RhMC>-)w0yC` z6o()mkT0W`PeZ0np8r4@6qwK_dX`r^mG(A#?ebgD0fO+MbSXE#1z|Kb?0TZBmj0cr zy=Ttv-7FUf_SOz!xJkbNmn~c>%*P1SZ7|PdHMa;Vv4Qi<@O_39ILGzqHE=N*k`+s) z{hIwciv63eH`DwvhF&hMFP&MPS~P`FM)2Y`bZ{`h>p?1(;$^(!hw{Y%yboM)eix)9 z9Ss{TFdiTp1lWO*rIv|5jrcTqIFl1?o2}41g8-0bpM(ao*D3mrK81RdQ?C_ztlnV? zc`nIfuLynw7v|0aLyK_Ovu9d63|Pb0CxDH38&p9O@q4-4 z8vAYJOu01%B*Y`PvH}YK?WbVWu?zicw?4H43w_c!EOUwop;kBdk=Vqt z%eC!VwVmH?wQ#|4W94?1HY@CR{Y?H$xs;o{nU5xg(nH?{Zy9D1B03RNuz)E` zp8C8cJ*GkW=hpgo%u^)=^Sg+#p+VW^NafO@+IFjU?=Ii{%w^(m*PX)e{LGnRIt{H# ze_*D5M^w)zKJg~IDw;R-WMv14gXg@srI8|cTQaL6pP7ct2qaIZv_m?jT=cr;vP3*z z=a6RgP`OYar?k{ch&5jOWXwg7Y}OAajIb=H8tnas(7^lTYd3 z4Gt@`c)(-=Vl}-+;4;|Y_gRP#R!#%l@HbkFqR-(67w=c*Ig&1eQhoY_IX%2cS!cck zqX*2QT;jLM@+(eRT1XeuB9}>N6*xpfNs&fjFDJFoqM%_un1%%Z(iKHQj0D?&#o zm^$xi@a-9srMwR0v^E@)xn^dvj^*XWsiGmd%=2tK2r^!<=aB*DE3yKzDvTEvMKen8 zOHJBE+;V=e(~_H`)9JUt)*#%^riY7JmFKb~@CIuUT)v&9{w9}gNy*#+f@p@7V6X6_ zQSw7ka-5-?n~>~Q@tfM5ny4IMxd@&2(C0_;@gor#SX;rr>>r=;?~Ia1M&Da3R;wa{ zX6jHcY|OW&RcIf_@{fv=e;*~sDEvJQ*;)zx<)O9g(-1Fya9TV%Wy+t7lDR1P!6^Bz z2wG2ynj6wl9%?>D72o7DG@?3EeYeCn@uS&tSBv3`8T${KcApR>H$};#qvT-`CQqlJ zJcmFzATtmk%tV}v(7H*ki7(oK#1|mrj#Hot7datj*Fkfl{W}F?D+Qh+ZVy{?pJvL- za|<(TS8x~dnB_x-wje)B+NG1PAorOhUXzN1PkhE7F8Uvuwd~?Y;uwEh z6n_g9+46ZT{`KMxGw%kX(UFht0&#der&+llxFKsdKQ~od+pgDpE3Z7kJav*ZQgQ!$ zrDndd>g3{|pCS)rC~gyEnDZ`)eDqC%`UK&eZsXq8HWo5sQ?_#}9kmLJD`KvXYj+O` zOB&}XrqsLegrC~AP7+LZ)>#cru+om*`tQ>u0w9@F11i&mw+uB#BcuC<}7n>Xjz9&TUtR}%O{QMFF zgOw`4f4cy>i-MLFW#=|XShkN)Dab;yDa$a~I{N5nzS*pTMnWU6 zp073Y8asp~7t}D-JYmywHt%2VlmIstmiH21vsV#0)pWI8e;sdNyZ-YesU)fkUEJj{ z8#<{B2mN0ZwwA2Vx#5{udZwEK(y5EhE(H`4t!bmuX|_>1cE7h>6RO3=<2~I( zK1_zCD%3%`)oSRBg;;eRba$sO#H%^Z1q9EQrDz_#H9A>ZT3Z#dnOWAea(g00mnRk| zG;7V;>r0$b{sq$@LD+B+`y^7oSuVPf7M&xGK!^28vp^jpi5DbVhoLU3%!BvU9pX1d z9JytL=~Q(Df(?*s;JZ_ecB_^}6S-3c_dwQRi8yK0!ykZvnakKap*v>Vof=Ggh4Y#0 z9=$$dPNPl4CuXf;6{F`LlWo|l_JrUntU(x7-4=-9t1^eL$1k^}9(!0iH-QB1>}O06SAaj?;skL zypX-S__kYt+#wgVVZf0Q)qP>tvt69~dQSzjmvWPpcg(k;j1rM2-`@rVf*O)!jN#xB zroNfxhGQQm>y1rpf*Uz69NH}{IEJ?YDf86hWFgCtOKHp<>5_%<`C5zd#0s zKuiZiHH^g2jCM?_zu`T4yQ|;y!PWPF4g7)Sz;P0^cUyDy`CR+uOS}`l%zNLsx7or? zoKAuKlkaDCn^Ki6_~dm9>5QR2uu=P`xg;}>OOt1nPGPixl?$W^QJ61m4)ZUjOI?uVNWZ3&#+*;!$6I%~t`Bz}m(ug-j$#zO zBv{9#25&9ie_(ncEFeT~s{6#6IR*s|6gX{q2WHcdxOpaZ4Q>WT^(P9OJw!xN^9K^<}Vc%@or? z0K^i_Y&`ui`LwnKqN5dRC4t(PE&Qt7qQ}h>%qYH%0&cjORGa22lUI_^N>#!v%;PXBB88Y4)y}9YJ7FNmjqk9uv z{)QHY`qpEp=|_&vEnc^~pNXMFWriD{ZcNtCW8Z2L*L&aQ>pe>o);SrTmT<8gePqzI@$is_JJ76QBrBjN~X`?icWl$V>Uan!~*Te?82K?YC zfZ=#6D30XDqWecpU5x?yhRC|L3rPY}iOL{`ud690t}ois@yz_~`rC5WJ4WOEcHMl= zkSJyr4CuEY!=8d@1d+Kl={(eJsoG14DfE%WN8KiP<3gsO5+nQI;~^!H_7sdU1k5^* ztlyJ^N3~h<>qE(Qp45Qof`o2%)3WpT%M&F4yl{+n^2Rt>U56xM2mLw^S08q7+4^pA z(ME7yx_xA(Cf5r?3uT%NXi-i%tUoD^Tea(I$if8lQra$^G1(-~)#&zE(&SZj1=DuK zM#n=OXGpf#E}ajnW^fF}z(ddgT)S>DFApbHnwmn}k((e6^_;tfmVgS&Z2InSrn?1IJ@sKM&*a-#syWDfp@a*^o5_B zqj-z$vI8Wx5aSRweI_dbGnlHP!&EXiWV0wL#79T4V{2!u>oUVQupchhw;gl z*Qdl0o+P;x3iv-jnnKxr{B0m7p|KgX{4RbL@vBG2k*m>zFAR>s0d9C<{5ArF3?RS@ zSS;D%wB}*?Q^u=WcjrVACulAkcY*l5;@*?6062jD0~m=&42)p2nwo=$_n^10ygYYn z_WTF<2pTLTD8McS=X>A0;(@$suZ4_5oAp9X45BgS0B>D_&Iu9Y(&dR3P^QRv}*r768D z@-P=!Nex@r_DKV0juQ{~4&4Xb3Lsk`lZPQ4?2g!fK$l`K3Ziu_>UN|P4DQ*m90F%$ zBeY5Rl)Z3DXj-~R3bd}Pf~hK8O8zBqM%4l`;1nd3JkJF&jATYKS78m$o`j!?+})`k ztlYGI_O*dZSwGr;M*SNWGLFATC!#YAwU(&`?P?T~ug9wfdDIfDkIB}g@4kS<4xnMv zdLO%0J#$4#mlj@B6}eV}-C$xnrTZVR~9R1e-cvNzzVBYssGpL0IRhU=gXo_?%M7}q&cgH}4@$cC7#FYq1N z;8*#IVUBEw$qJu0$|CNQ=|to28abbzi{Oi#bPk%&G)BfCI?NwK&!atYNUlR2UmTdp zK$@6mMe&dMV@Hev_@xiJgTXiV4LWuX{kdlRKQ(gvyHRpyl+1_YKg6hRi{e#(R2QQ7 z&S9fMtlxY2oO0+JZqJ;L@N7I6ioa4qFqfp{$6h*Tq5rw|@iSwT5zk8c*<5!+roGI0 zS#cM3;;x5*Lu}K58UMNK9%Q>r1`xpRf%&-xTK7-{?`g?`vDe(BGFrGpARf7I_n(H2 zBE_0f^h~sa_&oQhKxhBa4)&!;A{Rf^Fe#E8BC}=#Qyy$2ozVk0pEh+__yZs6SI%bU zfp_q-6@-*KVf>A`xpo}OVq-fi7O;DKk+#kDuE$TcC!yE*HKdpMssOJc82gAKEM1`o zp{yfXY9{Y>YyX9Eg)aE3YzQXFU9Ax%sAafLoAtw-a( zIuf73UG$|<0++=m@T!Yret+*5n&|X!gLH4aG3iCn`P?X8!$9G*cgox>KNH12?c>4M zo7@tivo8Fm5exjL=uXT7c>pKU1sXVX2jdwJHr$`J%<&QWa@f8a^TLSoVUMnM?SL!x z0S+>Q&B`Xi;gPLRPZ{EYpgt?5*}4Cp>b?X@va3Ar*7T?~dK^(*L*RtiF-C-gnmR^ln&XC7kAF`29Kt)-lNy=l$SA0eo3KxWaY_cHUljvlL45Yek(|a_?twy~Cei9x z@zxtn+Xc~7$FtkEV;vc#scQ!Zt1WF^soo#yUfZR6a# za*5t&r=w=q}L-EXy;)_qmMdepWpBoc67nZ@hw@;6@#w=(YaQedP;XaEkR!$!s zzjHD96@+fYa0x0yb-_3vXr#-sn>5`Z{R{B_fpg95Lb;H>Ov3|0l%gh;qNu-S zIHr)Rp;c)nylvovovL3+PbbBGFdU|fdZKyI9}edUf1@3KxDTO@tFLN)PR@~A{XRBw za&f3{W_p6+uhtOicV>N_N1@vuX#qbxkAil>BHGF#RubRND9U#peC@G7Xb9^BDVKiN zgB8*J1qu`~z`6rN^J&j#C$Rpu+VL$ysgnXN7uk8?PeOpZDmum`r*}FM)5o_1vw;~s zV9k5bJpX5yk7E!EKauz}{+FgdNVJn+o`9!zS4e6e*gGG`FB$s$#J2SLs$7f|vENA3 z=M1?P!|ZZl?2`X9O$DqQIBBU*_}Y>mRtWlT$zkPaPUtiojvisjW%j|O41O(z1Yz8;^Je6zx}h5ElN(|vHx{5!PMivPQrDFAx1meuGv zAmE;d6xqHJM_0SiuMjs?%sO*`O9d!M(0%oFl5@A{QtNjDS+lG4$o8w)Eu*xj0V}vxl5{LHyqoHWdZWOvE8k8Uptp zd&-t0nWfru1+{ouWN`b!?h)^53rv1--;$KAqSlTu{T3mS_h?aMcD~bTE(N(Af#vO~ z4tTzN7CU%jF1prH9ms$fOUSwTOObQ4c86WF-;vo;9p7wA*FK@*_Yy>Ek9j(ZAtE)e zA(IpXrk0H!nY!9OT#HH5)>MR4yD`RzqsdI1F)FMJ;Uk$R&?wLFvY81D0Y)`~L`fwM zKHw$-Gt>|2gDQG&7AgOliayWlChrV+3`X^hO~VG11TPZ1RKi`U2%A+i6e(rI(tg;Y zpDWfEi8CFB%%$vH>q|&TcX~VU9nj;S=C3xk5Q+nFzFOU3m;_@WYt=1l^g^8{;`=;L zE;6T>JYm|e;bh7aDr}u>Wm$JEgM5q}!%{vB=dPkU*E&HfA_Jw@feiLwq z_6<zT4%EoF}liwHCS zEIc=qD~<*w(sO2_jI<%&BzmTve5tv?c$CQ|2R}}uYKhge5i?{dBCLd^u4x8?N zRMgKO1TqTMJ&pK{_J)=&9*Cy=7LuyJBNcu#N|rOW5{?V~*9!U5yDtavxZ`Q7vj*4! z)8{4fl*X%Y#Ji(biRF22zi>a_qVwFt+jBKW+HNVK#l=d~Cg$Sv!*wysW^|$Aa$|@{ zOd@g~X1o(zO01({%8u@9nI7OsSIdl_0g8bL!)E8E)+zmK5&`Jk=cwoQc>(8sA@AoY zZ-@TCvsFK8AK0%3=g7EPZIBLr7p2}}x}JYGSJ=K8D&RxE{z86r_j)!_6oLid zVx%=C*0_VZJZHeC?BBhCz3F6D*QoCb*ZV23$KZ{tTX6glR@s;U85WIxiHFiC!qV$o zjoNB459kbo9sox*E`^C@KwId@P`DBC$|R!B;J0fX*vx*QzwfdiH6W9m*#Pte)HqtJ zKM(|mSzi}a*)x7h=4%5{r*(uTqx|0UWeX?g>#~e@M$@;TPn}(_nsM_uGBZEN&gyLf zO1P2W`r8{m0rIlGY;whDBKl;sANWNvBoDFKm{3lp4GuJOfT9w=QB6K^3zX6JT!-2s zVzP2ZSCaPQLF?zPDXOKowpP$S_2t@`Qasf?9mDm5`SBPCSMcmS2IwB5`RVyWn4lHY ztfOkuA5&u}z~|XNDCMVQ%KQ7YznF{orPLbeC~&54SDus}s49KveP?!IyBgz*xMJ;h z3LWmbsH%;`{aEo3E5kp+a{pQp9lDl0HoYH^khxK57RUV$fI-dhv31N4^`80|{nT>6 zx7iVZmbt!D)Ez?7@bwC;j@z#jTKr~Di|;eE_|*~V`){k4Me43-NI%c5u&%#Ou@zsf z?ZF|KaX1$>lJ9lC)eOiq#+~%0v+(v6xBd<1Fu*tlj7ae2=Ao|JlVSxk^r#WP;qdTE z6CuqAEZNx5g|?s`mu_>F9O=NW*nZ} zR&Q{1F8+y%zkON9;i5Aj?4mPZN;aEO!H-fnde9f7$IFg`RntYe2zI1a-Q+*ZMUNLP z!Chv&Ueb2FZqLOFxp+K{C!N;FUeLO+`jd;)v&2y@eu$ta)V^?qd9d%q7-596%B-UX zwLGgB<0Y&}W~SJ|Uo{}8Uswe^+%Naaz8yA@P%@m#Mf0KNW<3`zWNB_*l#5>IG&hrG zUPju^OPq_L0=w!T(!692-g&KMM+*ipFVsj=yTf@B{d9VzL;v-da8!Re7d;_sR0ng> zv)!m7PSK3(&$k`d{kiyuD*no4r4M|oN5HNeE_O#w(}M-t_!l7=&E>RhIZZ}E6Oen8 zx|Wa0adMgbNH2&kjQaBd1}i%H#K?r3+)@|rM>>Z0NywGA?s+hixt|e!Cgg<-%XJ&t z3*`y`P8gZN8g6xD3L6>HC;fdRuyjH|u4X`j%M+mngwppUq4q+|xLl$%ctzm~!jbRp8=qat3hgdX8_uxiARaMGcILrqm3+kfS@?E1PBRMULI%Xy0A?2H{ANCWPzn zh%Hof_1L=+`-*l2T!nf9O>umNu9D&xRNmY`8Ihf0gbZ;>_)57If3%nugC(s8UM)$moY*KZ|4#j^UM5qM`49zpkS%Q zJBQ(2g3v2My$T&0ZRmRSC9b9+{-GiF(RNC&xPUlIge`l#;o~TCIC!yqxr$)rnoJDf zF`??o0(ZJ~O@Ke3d$nr|kQj5s;lU*zgoC!9hHtnZMkY<{9A9KS3_aF6;Z~F%5BgKh zPof8~c-RNMvRA^>CW}~0h$`CxHX>BctlZZCW}EiOgEoGH`i`2`(K3A5EV0CXGr=x+ zq#mb)7Q?#x>l%#znoH z-$&AjOgq@4&^F+C;dHqObYG=r@i*4Zcu2(GG~-K@HD;3~$|JCc3mm*%cq1677~Y0w zEMTm77b@-F-^U29A%o~8_;o`=Gqcl^8rF7xzz!n%Ao_MGUmBW8n)q*^0%bPc$i1XzOq!Y_7-vGj|c19 z>m;ZCu)9v$tEJluR%FnLpk>fy`wTgmZTS*94-ol9`ye@q6pp3i*;7K8;n_NZ4jsbQgM&p~g(UAo+A~ zpCS3yz3d}+UM&9?cdoMZvmD$kBe%iw7C7aV3OV~^$H{-p)w>sK-HgmWi)?>DI5^!6 zM8eHy#dsV%Cu(c)4To-g`gMnHzCq)y74pC4-m_(1c4LG6GD*A`&wK8}q8;p6fYC5f zPNV1Ob%zcy!iccZ?#w*T{$Bsgo1Ss=^y9!Q&z^yvs zjq#zKT?e8xTm9n;b>0J}PP+Yb(Vl*TnYFHXZi3-THycEc0c#8WZ}m@E*y}i4fG0}* z!cM^j@kdF`r$sBK5LeVDP&WnWnG*S(c!5=L6qE$Wch4lYH{>GEW~h5{pL{=AqxT$h z#*9F0^0o`8JA#-W^ANj*=0Zu|^?*z1&XBkus>!mU_~|#VxfnC40Fw>?{gpzvTd4HE zI-YosP1ptPb8IJ+dJ)Q{^aII&@DDH@jSP<^%V&a@4SJ;22M{C8U|J;r^c4=%!Z>y& zoGpD{&=omv7I*D;Ss3jyUd6uXov71=Ci3H)5j!8Yt1ka+9+_nS;Dq?N_%Q@IKqaA^ zw!#oh-5|NPPlHoLfUq}5#i>=GH5?rjIUvzrOcOCX?!=0-okSm>gRjAbKRL9-6h=hC zDgk5!1jh5I9z;i>*#M>vh>t(W#Vw9a|r)&~4=2p)wCX4Y~p?33Kb#H+FQ-*j(>IzQ0+yUit$! zL0%fQtF34cjFeuGGm!{fYn?BR9zYAqn8+?}dbwHrkLvk3`!@Teld|G}YQP95J@F;+kku%8t zJt`Up0TXxo=%1s#JN(v^h;WO2w6zd63$WH^O%7Otsbity(1KDtpMf@F{ST7ugm00b zD^_(9rJ!-Gci`M|pC!P9**HFw=SO56EN(2J9QnbdeqpJ;3fx%?#-nnFeyWQ3ec`Xc zfq1Rz2+DYmX4`srF_;vzDau6HyPwm}-VF=VBCM-x_!pkpKX>Tn_<9vxqvD&5L~@gk zpF(rUFY$Pk^oBgztz)rZZ{pvkSZ)$6-Ke5#nUg}th}?`eKRvwwrqTuV*#-0E*VtSxUUKekAD=>hpn6i zY*hUAe!z6|&4D$)i6!G+B{rRjOVIDhOuEH?nx}ZcG%>%*=1v?Acj`?R^vJm>&nO!1 zEb8BmO&uK~3KG<@^B@TWg6uE}q;Ph2j?*`d1ZPk$`MbO`zrC7uOD~|8q1|v|dKcd? z4xMdvWz%On=wIEc<%i(f1}Ho>*ehq)$z5ZIi*nYL66>j~Ln~Rm1SCc*VuDa1z6Eae z#p=4~O$QgY7b?c-F6CEM1%~v>hKH$AJlAkUt}KYY2T&8{#Djwg+NyYuy9|1awIBqrR)+^^8N_-P8e`wa?;Nt0Waj&b|0RUUp7RAQ0&=FUy|y%>0B^$ z-FWU%_f)+em{g}{Y~5{o6w$czTC5Z+A-urp2`&}<0%+jO##KLj8n;gBX{yatX?wxZ z`$M!1x;|{q5KI4V5$Q{wB%0jVrp=9!=FJw`pR=Tl1Wc3FOxzPc3L(C}2xQ!-o7qH- z#9lkW$3yF9SCC?rG&?28ZBw5NN5|j9TO4?)@`uoqjI-m{k6DvmxID=0!62L5NN*eu zqw-!Xyw`!7R5TveJn$419qwD%g#Y&rTRDLAL1nX<2B3VIMCO|MI&d=VPZs)h^?hUq zgir$yz@rOWtIe-V<6nw~COIMTXGWdIUJvevqLNl8moW+qvW`VdtZ&{Q-7*81{yMc} z@$?o9E3l$cgM&pqw`QgXj)6&j`uC@WZwMB^xoC!~I1XP=KY?C_R~&rxe2f7aI5%Rd}Qy@{NX`=Nlx;i{8;kJ;p_e1tTZKQ4E;6MIz>=HLO=Jd zZJ2EU$dP23-qAmszHwk-ZEQVxefk+$7jMqEICI^h)K&JU@96Q5^$p(ej^3N^J$ys5 z>BEQo-z++Q)6-3J=Obm9$SVev%DDFfF)w}S8X#uv@$$Mn5xc*LkVX zL2u>#$B@tyA!^7RM+9TCbYyKzT+VYr;)H?%tsX$h3#*VL=xd_6AFhL0347N9R&fj0 zmo!B1EzY+oq`)*gfU%SvMp*2%hEA<@R0=uqfX5zkg=e4RPCj1}MoKk4t;wc=S&2q}4nq$w>I3YKz@mM+maKK}?`t&&AX zW3nHVs{>ETxc7kELuU(Z>7O820_U+v%m^dljtf@s1Kg;BofoYTOEA zvlqU~2nb4j-(kesPw$(e-)+KL|8G_FuR<5%*BH#0v+tl}oH#92xCUM${csa?p<|nX@P<2OFw2a>b9HE#BV-;zLt7U-YLFbRWSD;R| z#IUJn|L&{S@_lP{`)5DE?mW*(`Eh{#@Ry{6z4-qvBA-mw7ZK>!w=q>m{GUH}xW-P5 zO^*(a9na!X?36wh?WD#*>;Uo*{O=lk1HG&+3U{HzklA2dls$;AE+k^Myf}s4XW-iw zKe?q+@`dTQ2fp=^@K@VCg6pAxxHuzk#%nN3Iwd#mQ9ly;yO58K+cbEkc)Tig4)s6} zL=@_V;%Xb&(7JK(7)a3W`g%9Hk8bFeYMb57(+lg}&pgy!-|W8e#v8gBd$tXi0u;gu zV1^q?n%yK5wN+eQ-FbHR+~`=T``FmTME7vt*hKgARQJGqX>NLQXtsNB=;+wMPzgQI zc>+#)dfnP{5<7fEUm+`sMxdtCSG)rEItw56z@3J@f5*6KN=oZBd~Xy|)Sxka8$w#w zfBkksw7IrQ%pVX7p6Z-H;y^jKSkfYbfrH$3C^)p&5glQmBw0Crcao|HqA#g(E z4}V?)g3&maBp%=DCyK#l?k+4lnTcKeTv}#OhCOJS^}6yc{u+DMqhDWFt6$%)e#IxjU; zum-(i{#fhjtoJ5K{BpLA3Vkz9uC=OOpurl!tEn^io=B|!#Jd6B0N}px=e-9}7W2>= z$sa}VFi`7P^k4aCDSHT7-y)KDjIO-L5!TDaoURRj3UYf zamvmVv(<#!6lPVhip)+5G^+JVnCGP%^#b}QV>Qa#?L>1YAYeUe~R+>bUfIWulfTOzfQ$3y*zx?1Vp?L zRew@~6&vxtF}B0sNO4-fry^j>`O~-58^0ykEkAE(kFAMS)FFbK9=fgJb!?dIDS+6ho#){^Lv3@1wAw{3C>nlfl@!# z|91Sa?fLyB6$5hcKc?x;#py-Tr{jPqOc{5*8{8v-Ah!^}zKVZYssRpw8kv@SIKZ~} zqmY(7q@qt`(GnZKjs0ur?N8gj|F>2AITe5K{NDcpaAY6Bp}^S=Oj*zMfX03i(ywcO3 z^}4&ReU0Avd<7Ms{`n#my%0aa))JzVAnoF&mp*UbZ1O2tNE7h9g4vm7hd*ofj()+{ z;Gcw@R6`&Ac?#esMZ0$y!E;fVx-!f^WTn0K_Yu_7V;s_Lg?Z`U{sT^MId8dsmpX)<& zVM)UDZQQ@?_SXE_kOPX%#@ZU}!$f*_^PS?00XC_Hj?{H0jNFaqhU@j%)XeyRh1Tm6 zGy`n_=0ZGvy0IYS3RVmg^3%h`s_pjU9B2eYZ4m{5#ZQG^dBCxOk-xSEGzFX8L)La8 zQcSGf41RVml%ns82z{qD8G(A*>Yeh#q&9H14+PcsP&Y++D}2uZuF2O7AecweA@^f> z=AkMbF6x(Hr9r)L^w2VH&{zhAK-QpXSlV}OKiUQ8ve=JwoW;hH1NFf@o=Z3_r$Sve%5w^bVcUvr zY0BN=AM6|#Z~-6MYufrXCo8#8yBz+-yEHBRO8Eh&it4#%K^Y&UE9}PaqXCX5MPeKM z<~ofsPs2Bf4~iHJx;l=nW2yD@tpmE;_!r7UzKHVpbbPkm`5C`Y#cx*e-D&>$;^a@^ zvJ*K<$S-d}kRUwT8T`K)zuf4Oe=DUleUs50Tju#cs|fsbt1j8%EUGTN98x)z z(xtlH;3<3^nClQOfz1u`34aNB!C7dFiys8NZJ3v0z1oAN$Gy>zc+w3RTQ{M7;RYSY zxAWj{jmGw(JAAs{y5y*IhSsHjftm1jCID0As^Gl367AuvUbhz2Yw>qm+!|fjEeXae zVc+K5qgxK%1ncUNHo}8fp6{AOi=b)vb{uaYmomg)qf==onB>f-7G^9qm?k@+$w4D^7SUyk=-HiUwLEJ z4uM|gk9pmE$gdv+jzY#TBqpBax&pj~U^o-ys1Ms{dYmiLrO*$eWf?LEan(0L`dG-% zyVWB*h7F3E)6>Vx!B?dojVEh=6uNAkS;a|B6tA-@wQXFdKa{`T1l--?Ix?P1oS?f7 zLO{Hx{a2g7HTM?7oA48)D@P+f!p0}icyY;IG;|vGCSVQ50__K>L5lY6GmG-WkB(CG zFMojm?6yWv1y7mVLF%*m@{V&*_fHF3Yq6ucS1Gz*nx7**g5zMlPDUCZp|7IHMqI^p zp_HH16eE3g zDFMVL&j3uiWqS=jZEuzO71RfxankZf8D@9ZpAKJ$mT&uf^5Lj&L*V)mo51pOwmf?b zpJVSz*^eRdk5`m~!G`06;VIJMcVlje>Z^ykFI%;UvVmRO>n+kwq78z3*jg%$b7h6I{<&p(iVI%frf(EhGJmq*E~1rHa8i2 z$q}HQVnWu{QUl#UoQ!Td#`Qpb@2V8@Blb7PeHg%0jDK|fA>Uka>xavcE5UcrRt`i^ z)KH52HytyfFp-JblmE7b?ZS{&biPQ0^*kwrYI>YHMf-t6HW{d|!jl;CdMuvs@CAJ9 zXk0N-vl=@5n;ts+Ap;%$X@L&^xOy;BABj#)(7!Bc&l$R-0#qE)0F+-p$`!&?iB+U# z2vR0OrDuB%KdZTfCdl3hfj+*0_rm);E{#)yd=@2Zm9q7;v8u09|M$~&J=k0Ni2XDk zt~*u!NVJ^nJy*`Go&c}h9A?IhbJ2M40!UgrYFowcE6zKKb+87^JZs9MV}dS+++({H zE(wt@2L@**!!>B0&qYiADwG=$*#v(RZjPd9j?4Ur&(kmgV##<*UOp@mq!x(H4!Azm z9`=wP@*)JrB`w>EYRD}ET~XwBSq+p3AxSqi3(fs%ooKi*PU1W3htl4{wrp%yM9IjG z%~l8-Z^O7n(R2f^pR|_N&(#u@)J}l;2-&1gZ~%u&vPeh3qK(m2=7?) z9+dCw`pZdIK{m=m8_C5+saVFb31zI!z8=2SDz?qyd6l}N@KLXzdheV(&Tb6$O>c^Y z%zne|pR!804tvpmoG+(R(a+9+N)ZpvPkKM$oC@V-r;I@xluruzf8mCq<@tMy1BsCp z`)qQA0EpxDD5?8gnAClkRjE`;KjgY9`s1KoYbd7j3F4fqPx{P=PAnQ(8eHi`3 zr{fE4<+2Z{`0XlwOF>I$?8CcW&=EwZHHamcHebuik zQgx%ompmJ*wH0KN$I;yW19E!mp1_PaU1@o9r1Jni!fJ z>H*a9%+T!I2|i!!=YBV5y{L>W?WVw%t}QT2LI}%->->mbIw5^!mUi*czl_+6PT+>7~>B&jcoO850}B8F^Et__Xjr8@Rp+K8Oj{V=zFHB8Y!9aDzTztKfL<#J`OG z=9O|_OL6btJ+l}09(MFxw3DQp7gpKu@$>SYm*zjV%TUM&KU&%k z_zW}fSL3>lsMfHVQW*bZ950|in?0aGh{qTEH2*e^4^9uUC*K-Y^3$U(2cAk+)8fx@ zx?0&lxHbbx*WDME5;qz4SZ&&DD6d9VGV1)PU&^@Evj=h z&YhcK?$@mq9|Ug~4DGo)iD}#jGv_m!qNw?>!o@HJL@o+T4NuLysr8lVT5wX&FK)mz51jjk+~BJXy1m*v-Nh z%+Cj}7%2I8uAIbPuL1+Y0tbX_q#f9&;rZeDG>%tv736RlFp0l(4Veefgr!DV0~?|~ zKi&8aihU+O2nVaincsMnI&?FDngsSh|7N*8&#$epaW_5ca-0XdG|g^_y-nZOD~o=o zg?4_Yrm*edw3NRzKh9K>?3TvE_5_6@3yvrHuNg!aGYxh=5n6&g=_#$Sm`8N2IA5#X zu>{c2C76Za0Y^(398IZ&iSq=E{0S#}it}LH!#)*D-+cD4avm5I@+O4M{^vYNF zcTh||^v~|fd$!3zc8TvSP&-^tb@{vWKOHY=OV4jt@q&uS)AT&Sf5#)n=V>UVE9t7svMBuo5(Q5ULLn10>WwqM&SURLpubiXprnRwFl4lj|wQK_ovmaunC6)k7= z&f=};ehH3&1Q{$ny}0!Ba-*?|xhU&dB2)Y*l#}$=bOOK@jq!I|{g*GCm?6^JR)62q zd+?~fv2)Sc3*v5lP0iZRO27AC;Wk7I1HZR|DrnOkuKPJY@R_Gv>(?``B%))K`Y`U} z)A50}>i|wmcPnJ4Ov#5C>j1pNUbs8SRn3r?$Es_h=cm@qZ>#8~;ktp}(%o6>=DjL< z2d|sY{{#Lh@jfCO6JX55%Uvq}^yHkpSjQ9E#v5Omi~m-|UwZ`R2k&EH-&XKeUWD%k zZqgRx9l#}0_RltWY)cJ}2F)Ss_^*avR0EvF7b%G2FPr)QVru?>sG{$N^S?hA{cYC# z+q}4D{wZIF`8JO&G%KgAvGy$B>SGP>>>Qg-y-SMgz6|@|ksfDmvLs=?xVY|Dn)Udy zw(IfETzp$Dp8JP{FA(Q)vIf)Pid0ro{yDQx+$Ev9;_lTewB~~DslWeLjmI0G|M~!yX7v6nfzKwHA6{80AlDI?(aaw&&nm z6(Q(e@-rB>7CbuO&%HdPhrh3)d$V5uPgL|C|N81`vmUN&yB_{p#a~tNgFl1!y4dv) zf7qN8f1KJRUsBO$!g2YYioTjPE;v8_E*O_@nfd-|+xh;eis7>Ty2~>zX+Gh+&efK6 z@J@p_Xtx38``uaZYsbZ$Z`=<7uBJ24gE#bnBE^lZ#_0)W9diyk2T^Y#!9eN_L%ARM z2B06@5SK)&e<2?p>JKIog(yUh!*_YiRx`U#`}u6IEUgT$Y_8F!IDvEv#7z7#+Jins z^6EZ3L^Dn;e#64)^T_g5;<4NcCJ2gfL~NIs-d zpaJqXKVA3^&rVOxmFG)Cvt_wOor(QC7C$IEuj9Lc@9pL{y*n_?a(xZ|*72oomg;xP zc$Ckt#+U0Yk1wCYK5g)8Mcn%E-DP?;z||1GMu>J eLo$3t@b_*%e+96B$X~clJize7`jqL?pZ^Ptm|wjB literal 0 HcmV?d00001 diff --git a/tests/iPhone6__2_11.0.0_15A372/references/sandbox_profiles.txt b/tests/iPhone6__2_11.0.0_15A372/references/sandbox_profiles.txt new file mode 100644 index 0000000..99763bc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/sandbox_profiles.txt @@ -0,0 +1,171 @@ +AGXCompilerService +AdSheet +AirTraffic +AnnotationKit.MigratorService +BTServer +BlueTool +CFNetworkAgent +CPLDiagnose +CVMServer +CacheDeleteAppContainerCaches +CommCenter +DataActivation +EscrowSecurityAlert +IDSCredentialsAgent +IDSRemoteURLConnectionAgent +IMDPersistenceAgent +IMRemoteURLConnectionAgent +IMTranscoderAgent +ImageDecoder +MTLCompilerService +MailCompositionService +MobileBackup +MobileSlideShow +PasteBoard +Safari.History +SafariBookmarksSyncAgent +SafariCloudHistoryPushAgent +SafariSafeBrowsing +ScreenSharingServer +ScreenshotService +StreamingUnzipService +VideoSubscriberAccountDeveloperService +VideoSubscriberAccountPrivacyService +WebSheet +accessoryd +accountsd +adtrackingd +afcd +analyticsd +appaudiod +appconduitd +apsd +assertiond +assetsd +barcode_notification +barcode_parser +bulletindistributord +closured +cloudphotod +com.apple.AssetCacheLocatorService +com.apple.GSSCred +com.apple.WebKit.Databases +com.apple.WebKit.Networking +com.apple.WebKit.WebContent +com.apple.assistant.assistantd +com.apple.bird +com.apple.captiveagent +com.apple.cloudd +com.apple.datadetectors.AddToRecentsService +com.apple.homed +com.apple.nehelper +com.apple.nesessionmanager +com.apple.networkserviceproxy +com.apple.quicklook.QLThumbnailsService +com.apple.rtcreportingd +com.apple.sandboxd +com.apple.siri.ClientFlow.ClientScripter +com.apple.snhelper +com.apple.tccd +com.apple.tzlinkd +com.apple.wirelessproxd +contactsd +container +containermanagerd +coresymbolicationd +cplogd +ctkd +dataaccessd +datadetectors +debugserver +deleted +devicecheckd +distnoted +duetexpertd +eapolclient +fileproviderd +findmydeviced +fmfd +ftp-proxy-embedded +gamed +geocorrectiond +geod +gizmoappd +gputoolsd +healthcloudd +healthd +honeybeed +iWorkXPC +iapd +identityservicesd +installd +iomfb_bics +itunesstored +kbd +keyboard +limitadtrackingd +lockdownd +logd +lsuseractivityd +mDNSResponder +mediaanalysisd +mediaserverd +message-filter +mobile-house-arrest +mobile_storage_mounter +mobile_storage_proxy +mobileactivationd +mobileassetd +nanomapscd +navd +network-filter +nfcd +nlcd +nointernet +nsurlsessiond +nsurlstoraged +online-auth-agent +parsecd +passd +personad +pfd +photoanalysisd +pkd +playground-devtools +powerlogd +printd +progressd +ptpd +quicklook-preview +quicklook-thumbnail +quicklookd +racoon +replayd +reversetemplated +revisiond +routined +securityd +seld +sharingd +social-services +softwareupdated +streaming_zip_conduit +studentd +suggestd +syncdefaultsd +syslog_relay +test-common +testmanagerd +tonelibraryd +transitd +trustd +uiautomationd +userfs_helper +userfsd +videosubscriptionsd +vpn-plugins +watchlistd +wcd +webinspectord +wifiFirmwareLoader +trace diff --git a/tests/iPhone6__2_11.0.0_15A372/references/sb_ops b/tests/iPhone6__2_11.0.0_15A372/references/sb_ops new file mode 100644 index 0000000..b4a9acb --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/sb_ops @@ -0,0 +1,143 @@ +default +appleevent-send +authorization-right-obtain +boot-arg-set +device* +device-camera +device-microphone +distributed-notification-post +dynamic-code-generation +file* +file-chroot +file-ioctl +file-issue-extension +file-link +file-map-executable +file-mknod +file-mount +file-mount-update +file-read* +file-read-data +file-read-metadata +file-read-xattr +file-revoke +file-search +file-test-existence +file-unmount +file-write* +file-write-acl +file-write-create +file-write-data +file-write-finderinfo +file-write-flags +file-write-mode +file-write-owner +file-write-setugid +file-write-times +file-write-unlink +file-write-xattr +fs-rename +fs-snapshot* +fs-snapshot-create +fs-snapshot-delete +fs-snapshot-revert +generic-issue-extension +qtn-user +hid-control +iokit* +iokit-issue-extension +iokit-open +iokit-set-properties +iokit-get-properties +ipc* +ipc-posix* +ipc-posix-issue-extension +ipc-posix-sem* +ipc-posix-sem-create +ipc-posix-sem-open +ipc-posix-sem-post +ipc-posix-sem-unlink +ipc-posix-sem-wait +ipc-posix-shm* +ipc-posix-shm-read* +ipc-posix-shm-read-data +ipc-posix-shm-read-metadata +ipc-posix-shm-write* +ipc-posix-shm-write-create +ipc-posix-shm-write-data +ipc-posix-shm-write-unlink +ipc-sysv* +ipc-sysv-msg +ipc-sysv-sem +ipc-sysv-shm +job-creation +load-unsigned-code +lsopen +mach* +mach-cross-domain-lookup +mach-host* +mach-host-exception-port-set +mach-host-special-port-set +mach-issue-extension +mach-lookup +mach-per-user-lookup +mach-priv* +mach-priv-host-port +mach-priv-task-port +mach-register +mach-task-name +network* +network-inbound +network-bind +network-outbound +nvram* +nvram-delete +nvram-get +nvram-set +user-preference* +user-preference-read +managed-preference-read +user-preference-write +process* +process-codesigning-status* +process-codesigning-status-set +process-codesigning-status-get +process-exec* +process-exec-interpreter +process-fork +process-info* +process-info-codesignature +process-info-dirtycontrol +process-info-listpids +process-info-rusage +process-info-pidinfo +process-info-pidfdinfo +process-info-pidfileportinfo +process-info-setcontrol +pseudo-tty +signal +socket-ioctl +sysctl* +sysctl-read +sysctl-write +system* +system-acct +system-audit +system-chud +system-debug +system-fsctl +system-info +system-kext* +system-kext-load +system-kext-unload +system-kext-query +system-mac-label +system-nfssvc +system-package-check +system-privilege +system-reboot +system-sched +system-set-time +system-socket +system-suspend-resume +system-swap diff --git a/tests/test.py b/tests/test.py index 1849317..abe227c 100755 --- a/tests/test.py +++ b/tests/test.py @@ -278,6 +278,8 @@ def main(): container_name, "iPhone_4.0_64bit_10.3.3_14G60", 10, ios_version="10.3.3" ) + generic_test(container_name, "iPhone6__2_11.0.0_15A372", 11, ios_version="11.0.0") + remove_image(container_name)

4k(VM*g<7|!LA@V09qK)`8Bo8ED1dri=0L4` zg;3w0ErNPqt{Cclx)Qi@0q6g4`Zmu0DPQZ!OsMydW%+!-CP`6ikw`uM6~rHCNB#ucV)=Bup+buS>tad zTm)A^tqZH6)&=b3_ep3y{-4ZRE84tV2Q~j=`VFCtuKrV3k4(DHLYqy$NwnXS#8?*E z;`&48_twxhSB9k99@>e%aN7>i_O+P2OYLB?+GBf3d1x=~r1gIf?X5r0$Gky{o_oqTX+qgd= znQ?zo*F%KIcv5_y2A_ ze_B3#|2K4jeE9xv=#r)XH}toqzbKjX|A?gj*JOVG@20;b^8Ui*P=&DUo-nj|5eGFd zVsgds6(&~n|JC7Iu0O=Tw)Ex?>6g0U2Kaw5tDZ>y*MzUdU-O~9 zn+}EE7Vzop9vr&+pm$)xj&q{}cl(eb(I z{BF9nGcxhx@Bf5D=9ewTHDbTXfqLIJ*Xqaff2-e!f`E;up!vxz|C&XSaM&WWxHrnG#&zkUB+BJvsflu6iK<2(?U3fk6v@-U8N%#$&Gu{$@6`2_ z?hx(%M{+^guJCSTl?(Zy`><=Gs^)+|K$1|bN#+|{eE!$ zjzf*-AEDwW{Nq|}`8j+-GVKB5+LoRSpK|>m_fNlse|2TZ{rPX<)9~$&e+!>+^)T+S zt-puQ!hzd<51(`Okl!7i5C7rHko&KT;XmO++b)JLz(?U# z>jvc9t$C!C`L&4L z;QB%QT1szzko(itk#^>HW2BAi2k~nwz4<}T?@}Y3Xy=}@+KZHbQ>26I5Ap9Pz4=4# zXK#+&Vg9#>_}?12&Gm=)-!8rR$NcV$+()_xX5A&?-#Ky*{+efZyXlZgcdzW0PX0p+ zyF?x~|NA2ky8aKi{>b=0B)j>;xSdy&>h>vuMPKG-!d?Nc*cEpeUo6_t^ zCgoK1WJPk3FCjzxb6o#i^RMX%M)J%ah=lR4f(-Esxqe}h-#bSlPntgJ>Yp?{fB!Gi zi|dGA@w7;~XClv9y?cpvza6tb7wKpA-jV0c-cMwn_KCcJUmFka|C!uZe*B#^_J8vI zV{8A&K;(#LfN1-!cyh&{$cymB!a;IWU9v+BRQoe%Chkf9iG5wl56{Mr94Ki>a?%KsQtdEY~oFTWnnsmO6y0saU#mz;|H1osu3 ziu|m0Ejbif2mp1eK zAF3Ybq3We{70UjMTp*u-hx32rR?c6RZyqxF<9E?5@1MxO_~oL9)bBs(El!4vi_4J; z(O9`2sB+_=%9Va?LB;45a3741#@e|OR68T1Pl#4QRy$XQYG27G3#vw|S$f|8gI&m1 z^1gx^(W_tur$)3o>;V(;|BZAtEgkRw!E*&k(W|4e@d_DFwW1H>zqX)Gw6^6_C)zlw z>!};PCaU|%!a}A*4zZ9tW?>eaX4?A&EBjsyx z1EgKAk2Xb~R@Owc{2gFE zA*6k}Mjt_cj`~8bt6TI@(qBS`*t#Y@p)l-t(x zvPk`gh}3InlsJa#878uS4v)TqebB7o(GjH6{s~!k^R0f`FGrGYf61$otsNla_l@Xl zuq%8W_JCuo+&4w`g||fQ|03nS?Up-6Wd4qgzC*fwaDt^9Cz5WwNV<1L(!J-Vn_%ho z6}%svZ2l8PuI~d8|4AbLAG-dNUH>W3k0_^tGbK6=zbi_oiWWaWu48(%09oxi1FAid zxqc^FV%JqDTHH`%?NBV)+5zHM8l8jR+Jc$UkKsOuZ2q&%f3{@vm;PkI+~^|ww7$-R zUEq96$NmqszAuD5(95rjvpCw7{V}<8iBa`j>edsz{oZjo@>M0=|3_oLcUuW(&*%If z?k(p0AASkf;CC2)g1ij-TIBDMdyk9#PGf!4W53hb0QGx_PoaK)vJp0fpW(0H1q>S( zd*5T!IPK?U(QW8^mTnP=-?xf(y^!}Nwnz71PjGhpKc>z-&Zg@9qsSmBA&H7yD!NHhN~Q37 zf1a~@{l0&_U(b4;b=hmLwVr3Kz0W=(=ZiZ;^gB)VI=fOoHhH&LRMo@&-|~Hu`Xl-H z{lCaL1A@ldMX zLpYpz1X=GPhu0(sPdZy_^1nn{N54 z?A^-qf9lnJ`w41%oq)&TqSw`bCsUiIssDZv>A$PeVB_i@{6FRD{QWnm=TxVmo;&>x z^&ILCx12L>`G30Q{{`ho|4vmrdM@>>`GJ2@<0$`Z$-g4)K4-GmIiGsLt|KlDT0Ne$ zSiMzfM;z_Ip8Hod?IQ9gIMqb*S2x+~)JTgr`698X8usY9Z#B~{!JhB`r`3X~P%_{D zPpfVAmxy*gOgi;!m{$jVic>eOq3OM%ozvEXI)}X!svqjR?Q3B9E;BpnvFBX2QQDQ3 z|8mjnuW;>=IhRdT|B`-HT4PJM{^ojk-;Z{mE^Z>d#mBNM<^DIbbe{hsFGaoJ0R z8*BmP&yt|x=$3FNYz242)==Xh86HG#LwQ=i+d_?p>!8;6>!HR;JE;4Y0yR!|L^zOw;*esxHT=dE_8uf7rH{( z-{#ui4z(_9b^jNwTbjq#h3-(l=js8qKJe$z8wAx~gVQwL zA4+>LO>xhVwBg)uzW*=MPY;>Q_y5x#F?qOX^$dfm_fdDeW6yYhEG>=veE(l0{|J-$ z{eN1j$!VgEcl3;RUs@1*zW<-*hpA99-~Ug`F#Dir9a%|?_sF% zob9$R$8BG(<%^h|^s?vs|7rQAFGw3nc}=5*qK#*W{;9MlP5)Hd81#JqUo<^rypNV_ z;~m;~9}AZ|&!!c@a`+6afa9!R+5aPJ+&>33?w^Mm_v4|){RF6S{{mdkeSZ;_@Vm8% z?tPkstaE8)xNb$_Q=yV(Cj-RD=K?(M?MS6AI^pv_j91WGcZ?r6%aF zGd%YDw=%}@aPGr=sClsfYF;da`W@sV>@~g@BWs?#2{liaK>hFXQmEf$Era9u{nA@- zeI@=M>U&Eopne~>5*~e*^M6-UU-%Hy9Q=w$9vo-B~ zvp*@C|Bco6f%H~iOx~XMkt;*|^A6L;(;n$paUXY~kN13>w%hdhf70cjKViIIxUeVf zQ)KyPQT}-^lz-j_Pcd#Nhxzn*+V{xE7ad6Zg7WHn_NRS?JZ}Dhv}3j|98UYv#_vI; zvo0JGx&Ff@dz~X`vAFmvvC0a5NB1@PbLi)9RBk!@e^`J_d6fHY+IQ}CLFzwl^(RMv zNIOpXDb9}~$(87 z?s|N&b+-ysKg2=3|5DW#Yfm+(^|m@xy)~fP7w^+`UgT@w(>k2stLf7^T+4T$><=gmzl+(y}nU&Mfca@dX zNTmKm-{n^S6_Tm{N|E{#P3Aj*Zn;;v=+=vGT5!OnJ>k z%4=b=*GY2AYbi3%TKTTSF2QLnVwY^P*JuBw}(RZu0?`B^oYhP!{wC^U7dT%zF-~YMoyH(^qZJ5^uyA-FZ zucz7FCYt}b9m>DlVfFC+KdXoRzun&+W+%Pu>qhVN^)mgPzPl)|X|%UUz4(9A_x1HL zeP3UH^hwcvqUj<2=N`%Cf1vrF0dTo9(04B^hxfq>c)wjA{vTO><^d=_GYD!P42GIF z4^rMx&k)~GWX%J}czMY8uq%ri|Bq0=#_=#HfAT1le;JNm{^>C&|MWPlgd^ZK_ym;S zONH`#Y2?#9^+BC;_@U-Q0BU|*F<1M#pfAIx{bA6T<D>%%x$4?YJQ!ROuj#zS5A1gPtJ0jfPO z+W4I8n`rlMl5eVw&zD5T!DN%Y&da_jCQlWuo>!piebvSt{-5&r|3BYM@+UacMDkBJ zng9Ruy>9YM(dHF;=G7a%dDtg9vwgE*DwOPX=J@8C{XEg;73nrFiqWSyj&GsqOGKL& zQK)fW>b9@UZQp#$x4`VAmwnynV&5XuFZL~=yr$7NMH}}J{W9ND(=YR_M4uFWOEf*? zzO9gK^8(tuSOu3mYkcLf9Il2HaIHHpppDlGsPVcEYP`M;HD2F=8n5f2=FbMG`SUKk zi2J`0YTQ>+zsA`nYX|#(sQbDF>b|}QHBPrejnns`?lbXN;`#S@{~!5(_Z{1j6_0)7 zi|KbjeGh3TR6Mo|Djxe7>bq9E;f^)G95&z9aN=f^$%$pAVUg-}fD+pLOm)I^*Rl*)v|g@qGVrX?Ky;Q&xfhN3ZWVo`H$cKV7@OT)S9%4p81%^qV*0 z|KShZpMPnW?&mqE`*|MfeqW$o-v9S|{Hni-Uvb2**#8$tRQ1Q^V>Q@_ey$GHjv7$q z#zVE|BB*tuCe%7n%O9)fVyJPF099XYsCHc9m%py(uj5y|P}kqkFaPBgx!!sv^Z&p8 z`X)CNt^5X1>%(Q%UiSZ#7w?q`mC_O@D(w#q>A$Z$zIIZ7-T0vOaW_Z0iHG{_g}!x!;{(CAkv;x$h<_;QY6qm8NBj@LIOh@n!*Bq66usIz%(atz zx_G$%F}GhK`5yN_!F8(tMwlM|Z{?)=)7*5(^C6$#kF0qBX-B$0VENPioYPvmxQ=*R z{&hU#Ak!b)=Y^p5eOWM*^e{XFv*7`l1NWlOg?o@Aa3#!xM_@kO2MheM|CKNFd+c|@ zBT4^~_B;t^pnnR!0;#|HVEDA(Q~kb}Z0pY$+OPFzEYx@?;(8mxXXuXyJ@|h(7>@IM zs(Dz4p2KcG9SUM}A;BlwX(u`sPFi^K|c9~S;+d1&upmg z_{@R&j?Y}E@A%Av39uOIJ3bE7cYI2qzOxgB`d&&Y{1&+kc0`^J^&OuDP~Y)c2=yJG zMNr@I$xPRN{7wHZ+7a(8@h@jSCpb$*=JPU>z0Pv~TlBB|5b5;$3fZ$Rt@5vgsZg@l zDfh3oe7i*RLn?PR{UHu2sgRxdBWV8UZIj>euQxsZpLF@74a~a>7vA-6M3z4i<&P?% z{Lv<;@t|__zZ_d^o^JEMhnyVUYVApJ-WR!!BC~U7#|P-;7e0jAKW>Ne3m?J6=ngmE zPB&ky{2cOqjQ(l38*2Q0LVLA-?17rcpW1q{&%f8&vCsb*cCTU&ZGHLAPklkU{K9@H zKXm}A9bZD#a}cUMhoJn_VJJU!1giaCLAC#Dx7=@_)`_ETJB~rM>s#|%Kl;D3b@6-u zN$$_tk{?9+<42Rd&T;=wCZ80oz7tUG``NC8{XgZ!JHPmUCx3!-N+kcUCVQRV{HIO+ zT{ORip7HUA|19>2&Y%7>FcnJnI)C~9Hv6-p`7P4TZ~cQl#rfA?HK6j(iRQP?(;oSy z3vT;7q^o^Z0?HQ`ke&2m-DvedHPcrQ#0Nb1tr{Zb;r~rvGjNgVYX&YspA@YnnjW&g zCIo5+Vtxx+f0J(ar4E$;stfi0kQc65$M=6=A@}7{sPR#scJVvFKm%*vWr2pIYaECg zH;t%A_v>=_HN1lKldL~i!sX6Yfkapi8^a2CbwF{)*kWjYtqGK0YYHo2GblfL4U`|a z7Rrw{hw`H>p!{eO)O%Ddq28lv1@#_PYuX{dmkc#e+dz%ywov=U>!8Nd^-z8?=KpR8 zqy*%DZU}UC_3d4K2TSi5=!C3tZ-lx|Wc3!%AG1=)8 z=!;(S4${861O4D$D1WGQnCOT7$^XB8<6dO>jr#&I|1c2h`=IwjeLwU8DE~1CD*s?N z|ASC|VhHJH;83XV&OQY7-PwnszB~H})OTlxL49|2#4>T zRyNdkv2vi!hjXF6ixq(*k@H{!~6tsEV6z-Uj+60`M?|UU(W^{^zqKPzy#)Xg7cinynfzfuQMSq zo^d1pMLO%#3$kZ@nizNyrb5YHXHwuL%jbyZzf|s^l9#17zXi>2y<+mKfvKiv|4+L7 z)@#iB3m2vZrX$O5iSk=Bp#0YBP=1SYSij~3-at-{&a(PboY^An=70Z4*Y5!5LjM2H z)fc;Z%WvyR3HpoQ!~fF`&8JeR`C0}wU!NQAv2&6I*lFEd2<3Mc!Qtdv4E4LiH=*iV z0_As>LiwF#ZaHs3&Bx_X^{jxZXQi!o<$+apJ>`LQq`$ambzlwoM^PT+_Zw@KZoeC; zfco8tc#(?{+GZ>)Bh6q2YpiXlxTX$diq=7H2qP7@e1*KX9B-l zJ!b-c!0O1@F%JF={Dr-K2MHMmX9Iu3nNa2E_l~kFWnTOXmpc~%=U_QJ4=bQ2J?00Y z`L`-?C-!kr{;ew1Jg5enFRY$kBR%$hEi4-3iBG?X^z-;TSoDCWW_m4GhUVukh8o`q zq{~m&hT9pJm%xW9w+>uNdR-|0>xGrD9^3{mh4Mr7DM$080jxp3%b?~-L#X-K2+A*B z4$c3QZ+qF5=~p3Z9weq~9yFG0{S58-`qi-g!Y1kXU;4SJXzu~X{PDHv*QCpDU7OyT za#UY)sQOx1dQy5TWYyaes$OLLU9#-)$I0n!NLRZdD;`G2VPbb_k4GgP~7g6f}}?fP#~KD+)~?fSb&w(Ezq z=eG3Q(JLN-$akc7bL)Y$zk7Q1yjVRw-13nV|J}m=ANha%c5h_)?Yq)r-`nm3_5JO> zQ2x4~WOz4J{(GSIef{AkIKVCMUMN3)S61x%VFS}W=9lk>^2-lE`Q<@S-C98@loU@_|M^RA$$yKpZ7S_{%-`-zVZpE zePt@_Ncm|{`$`|wzS0l1uM9x#E7PI&l^Ia`${^Ifl6|2)7Y-?%_79pYKO0VenfAmx z+39)QrvxWQ~-?eBa8?6S<+cg^JUL^T9{q{Q=w$O|Cj!x<$GB)KdW*Fm5h?! z{46v-JKE$i>0?cg|0i93wkTbG_L=l&k>zJa`Pp$$e)c&iKdW-IKOB#JoM&SC1mxuC z3)YSl=S7kB7nz;*VUy4&MqhIElU;qRoIe;3Q)q|A^D9u}_*JNRlf%5!dr_~EUw(EP zlpmcA0?KA$soLvh-Eh zCpyd1--4-7ve#LWzS8VhiRKSUr++uhD@UK=tWIBV`Zc2YrL|Cgr^0RDI=6jqTfTS9 zPI}qbjlP?{!SwH@S5jWn=thzDa{h1n&FPy=zd8MV^hwbzqUj;)#8%0+F2O3gZ`+{! z%Lh>VqYt6{$95?H@e!=)7c7qTDyHT^gAiL9g0{x9YFvtSr2hfS;lDP1&!+!r z`Tmm3`2Aa?yt5{Ioqy6}aofM5{jbY8@^_-V^U#48U@7!u#QxW%3S5R92UozVP}fy0 zBi5dG_%8ghEk)CG{-^ako^-AI7iGlO`I=DawcvQx^^4&V@+V*?e^DE1eb;+tT4(EU zuBY?7x=`!87ixX42e0Qm@KUJty*}JWISt?#_BWToYOo=E2sWZzt>>2`Yu&#BYW=O0_xa0KVvjiJ`Z-x5(&8eeq6G zMskMceM^ykZ)LLANzQ1U5nHcGXTGF}O z8rpi@!Q_q^H=3UPKj~VpJ7s9S?woNGves)+>-Ei0>-8;A>$S?!dff&4IL{p!U6GTc zw^=(EJO3{(Tp_i!`YJIBG>LdjkyoRMwz zIijumq}#fmi$2APWISd1Jki$ue5iH3z-?cl+rE*O?@6)H?nG>AH_EDt!y* z|4`#(67Ax-f5uDJzR4Lcldk(N%0Enjx4wh_hwmf53N@~#Lfz-rpw|CsQ0xD6SP5r9 zt^cn>t^YHj{LmXverOhyADRs{F6ThKmpB(LcbtrQupAb{3Rq&}g7bf_TjM7Rjq}A&ekQh$SemgUL-F;}j8(4PGN}A-S^Dyfm9G5? zsQQrEN0iH+IJ`V#HR&oBQcgw28W`tPWUPe);M?fc-gT~>#RJx82A|WqUF{fotJj#$oHSPemJt(EQ;( z^zF(%&-e_M!$UTozs&f;%H1!S`Fubm--qzd-rJQ>2d|9luy}2J_&z3{TA`us=;dYhC*trX&B65&IvQGjIg$`4i^CzcM@* zJq-VbkHE9o4}*7@|!iG{AMjEe|m8+_IxrS=&|RMwSzG~eF=K=|4@FqE|j13 zLiyQxa3$qm3KbXBhw{@6p!QjpLG7~|LhZ8}LG80HhuUXd0Y4_+m2eMCgnDk;7Y zuA2;VU>m6CwQb=RcpcR9;OpT;*beGBZ3@(L+Z*64*d8v19fI;(or4{N@>@3sZw+dk zcM=)rolWNde}Xrge5+{t%v+$ozl2?>{{`*~4s>P6{|nq7e880<|1U5oIM|gT|1a>M%CT}G@!8Pe zNUks5c_{cO`UK};5&a`3d!0vv!-BE+jCB0+aM|OR9}hkTQ=w$9Ga~qedWLpX@r(;TYwZ~qd=C3N$Op~8KMw~|-hXl01oVoJUVvJ!UUbW! z2-TiRQ0;yRDvp~B700~{wSS-D*82*SAA1$5T~ndj^_q>x*Mrk+JWdbJ;r^U0nIY0I zubb?3W(MCdd5&oH%z|pyY`YHpKjpTO z6P@|NGMEY_dz}Trg=W7sQ6?bRDAatRDAb2RDAaZ zRD8Cd>$d$rRQ&ZNR6KPMYFr(H8dry*&OMJnjjylB-+19S!LMP#qHlsnN!RaUA^ZMg z!EZ^|z8^9#z7Kw9_v`!M52R~eh|8UyfdB-nM z@p3Fq{4MxvQ1RDq!N1&gorb!e-!1)*;Gf94t}{^Ag-rbQx9o`%{|=rdUDpRG=Ung~ z80VY|{tE}d3+UAk=UqF=r;9zARWf7a1R}>}R?Ad=_W!UC{VO@nsh(LQGj<;!`uNO? zTp7}iTA4L1y;kPMr0f1d;>Co_+Q?c5Aa->!FEP71nTi*cuIIs@Kri(xE~=Lq`ybK& ze#cgybj4W>NSEDZa5sLoAyk~z2rACH96n9@6;QwLxe|^RYzdyPG>i0+O;aSokI4Bj($+j&+mqB(eL*_#aI2I zekU~m>i@m&g^IWC%Z$a11Ce!3em{JT^ar5+e`^qI%=7HQuo-+1Zlc^Fa0cZKg^C{^ zg8KihhoPR^KLQmG4ugshABB3)Za7>?T=y7MocB0<5Bm|Y9qoDo{!0I+LjB)V8mxdm zxQ%-K@I37ZK>Z(GI#fKE0e7MgLOs9Fgv($E>b-$1sP_iKQ11<7!wTdaxDn>UEieN0 z-asBy9GegKBNxCp`nM1&t{e#!pFhcc)p^)c$RE+~qu>qjX{dO2G}Lg0`MR+CUPJ|8MB-jM~OHlFb zWY`(`WvKTZroeHO`wH9#Uxj+_Vk*>o4zEGIFEI@chSQBoSq!xwc@t_svIJ@$uoP-PvkYo~@D}WdemRWiI#)0cQ=FBVYce$tSBW() zW}KA6=izEN3X)Ddzc#ai`KEXt63?&8d>g&uc`<3(`pkFWQ20Tn_79br8#1+jcsFx1 z^_(r)C{j{KSaUpsr^DuHXWLTqa>58|k-|{wi8JtZ{AW>CE3rZ$-V3edZsTexy%csXO^B9Egja#EA@opLLTDFDx#%B##z-+ zb<&GUtBIBl8HY7O7m+@>G+wlH$w|?gp`P>f|7AVq)xvHDyco`gq}%&OwL`J@jh=m3 z`?NZtp2+b|-B5kgtZ`*yt8d>*{21j8D!E#+?c<>Bb>EOd?O@&BZ2A9pR~UAWLZ z)B;)iI8pn!B&dB{OL&SniE@blTZe8$KE9}JD4Fu=d)kEBBafTkHgr=+^DrfJT}bor zdZjat+lgFvipl)`FBF@H?M3^&W(V@?{nU!xBg9WdWd$Pm0pNH>ji`G zPWnmlX>Vkee;2aii9S$qbzjoAm-P$vM^?OXH}&l+yGOE>2dhk>oB`I(fuVb?{(+(U zV0F*H&;#g4ExKQ{_gp0FyYqwK5$@w)%QqzSpyeA98cKR8<%v1)Avg^_Y<7=?*st_xEy9d-M6sYU)fOonFAH4=R);o#KuiwD9^@CerTMHn*xz`7n;oT z|Im{rj}y6%PlZNP{&DIV1;@>QS~BAi|L>-cF+2P}vaX{D>bjpXyJuA{`SAa6d)afL z3A9J|@p-$C<0V_aLB`p{&Bo0MZ^M~T<-A6^>`IxR8{l%MGW0GihZ|u9++^d5{Xg^8&Qa0}FYe-AcaxHa@X<+WvB3~l~zL)Jd@1E_uJhooyA*p94m{1Ng}ipnq*nZ(Rp<~wHM@4%d4C?uR=sWb< zzeD!(--mv1W!P}v${$0=kq@vgLEGQ|gsk=I1k}3mGt_rEPeRrE3)K2_3hKL@ze2V9 zH>mHwoQ7KGes|mZhgKi!!&(J?y|B(5AiCq8RqJ0lkogYhzoB!;n#W?} zg%?8SVZovcAx~E9oC9)wRkGr;V%G<`zN%T(Tp2R{YGhT1aZv9)Xq^@12d~>(;%xp z8~_`l*SNUMwUd0hxKY;Sv{&;4GAib(w zpw2s_-&@=)>l!N;|BoE!T$|Ng{eT{#Z;_Sc%8+)q%xaCjuD2D`^&*omIqQ04U2hv# z-xlh+uXF9tW7i?8ot4ueD+TT??vQl@+yL9d0q8qouYM6v7vGrGiS#~PhdAur&RI9p z9?iR(pza4U=PtKo-HNPn2Pv;>Ru{Mz>fA-?I(N~z$?cS@^OZZYJc(DZ&+P_N(RYVB zU+Dp5*Awdeq!&!XZ{0~go!9h+?t6Q7j-mHEw9o0wdwj!TKd5tpyP@_=_dxw`b${|{ zpUQjc=6COM;n*PbGQIyv-`jkj}@&BeDo%OWoM`t~QJ}EjzG(BWo6-l;v z1kGPOi>!5W9J1E&=ivA6;Qyh{f5)S*i++OTXa5h?|1Uz_kBQiQjr}C3_3kC8^=&eg zKX@5d!YObYdRfO=)VbjXxEj7o`!!!Ty4O`n zy5{xl*ErWB-)48-Zh@M|??KJqt*{mP_o2@7wn05F{Q#a~UVjL6uD2a_B>f}!9_J)G zpw9VrLY?RBf?d&n45yO5n|5d&_yoBd>3iUv@Kd;wa`!@=C+>qfPy7sy;9T!>*cZDm zU`Oos!!z&z{0Dvsb>4Om>b&g`)Op)scr*GVQ0Hx5L7lgK4Rzl34b*wtQCJVVV^HU9 z-$I?YeFwFUeGe1h4^ZbzKf+3Q9DWObf>)wH0d?N?Gt_z8NvLzBU*I`-3jPd#g*rF; z4gQFH8vYG`hczhY57+?x890&jKjC`#7u5Ob-%#gtXQ9s9{((BD{TJ#y?;O-Q;CZO? zw+m3`P@Zt?e5y)V>rh;{Mp)}YRng9$szIGURfjr%BAx#&=J`Le&c!Z*I!CJsb*@$m z>YVLjsPn`GsB^#C@NIZWICf542U+LJb)n8Ly-??u^`OpYFNHd_u`?g~|MR$9y4mSzM;vHCY z5BjEIol7(ew+w6DzeZ%;zgDC_nw#u(T7;8KZYkRN1bXtd3il*mL#MUK`rjs;3{#6z4XP>*BpX(zU<3113hhg?rH6 z6sNmr{sG#4S9ULK!vE7Qt;2Uht@pj5*5kWqcVEvv;XbZ?U+7@p4_*rIhVx;6sCZOV zd^-SUkbW=udwcE+4@6d+Eh?_LAEu&zfa~CYf5L<8dIpCdB>e*Eu&AGBNO-8555~b`6Kx&p!qgcRUUicZ_ha^9lF*Qlb1>8q{_BtR4Pv zepvBFFdPUg-bj~BypbW&e?gP+|KZrVPDrGla5#&45@0NUB%E#ebKLy7ZvKdyKhMpd zFETz0!lS4s!6_7}XQatq=gII>CXW&=Ev=!Cjdaal$b9@T{DIxK55wC@*L)NYmV6Z6MZE*(?-1Fi?iB65 zK=!8}hxtwx`rRV>PejwlzMr)>{ApPGmA&BuZu|GS{qdQle;(eCtbY0es^5^==X@!9 z_GMp&50b8V3MuDE_z;Y9j)V`x0q|?|x_@7}c9KsQe-l2+b!tBek&lJHv;6pf*oXd= z9Orx={($sC}T)A=g4>eD!L5%ndCQmFo|4>fNZK+T)Ws7Lp; zA=G(MBdGql9IAh=fa;ekq56aPzS+-}%YQI7W29f<>P%=Xy6x)W4<-We)BzX>W%z8NY`z6JWQ zzZEK8?*hjW$99E!&Uzc%g8l7Kar+%`8*(>T4Y@m1{N96hC_e9r{4x4o@Mo_3PN?VN zy`i3)-vzf(UmvLF-F>0<1^u9&+ujZJ{Qe%OxW7Nt^Y;Nz@#?+s0_EKY^}Kf=+>ic# zs5tilsQ7viRJ=VHD!zUYDo!5)6(lW5@nq_S*kvXF&G< zCgcCJLzZunXz`!Q9aIvQ-r_%K@n4R~x!DoZv;QYu@n2rH;=lat0%XO1qT;_oxDNeD zc#8Q!Ir!hFvd1E?r2j@iJ&$-A9_RVQXtVKK*)4ZJm zHJ@LBn!m52*YAXEpdFSx(Me;qr;cQc{lyEmZPJmWcGjQj@*Tvg}wK_?F0Zt;}9-`B!GIfYp)9sc+PxRid5iL+sXOuQt22 z*=x*hZT4?db>6=&y8`=}5ZTWAMc)6*Ue7qvdJf6IF?)mM-e7p4C&Cy~(Wy zQr?#A%~swP>8(83>3(g6rHrrlq1NqfQ2qJ=R6l(Pb$_=*`Gt?5{KXEde^>TStAAJa z$E552iSi@6q1OLTU?toGwf=t!wf^sgTL1S!t^c1v`J>OF{+H?t+9^M|A%Uy zWZnbJxfuQ9*o)iC5^`#j?n8!L-z7P9ko$1|#J$CJbG&Z3kapF}QCyOVz0Rjw!TLF# z#2aA)_#J-jGT0J7(Gcppk&R$mKw2m)cb%pLcKrO2`XOb4E6rtO>i~587eN( zcgxq}S8vVnSiI1McFB)-MONH!8&uqII~j(87+TGIApZ7qWv-O8M7aIWAQqH|lam0O4 z@0AUNde7{BsQ1erfI6oe1he2^sQ2t1go+P_K*a|`q2hywU`NV*82$qvfqKts7*u@l zC{%nf94bC|3@Sc&9O@i#1XO(R1XO&G3KbuuLB$z9s5rt86@LVv;*oU8v?~KD{s}^z ze`Z3R&xN4koh+#HxiHlETsGACTn^Ov+@Q%G?@iPj$?C*i;5PPsN6v%&q{A` z3ADK6Ig_8y8E<;d|4CO|G9gEC$qP9zA}cNt6_-qe>(EbvrhnzQ;!7t!^ zu3!FS0kXcIxe!_YWD(SQznFAA_k9zdLcfH1`0iiMQmb!S4)2*%@mBu-`P6dk6u+#1 zieFZ``Bp()N4Z#yVk!O zb9P$)R*GEjCX>C+=A11i?-c2u_j0yTuHGZr3dhZVU$VVN@?ZJ~W{3Yrul8++x}J~B zZimVxALswHBi`AS^C|TvI3J7DyW3>1^GVJglRp*h+zLJ8c5lvp>=T{Oa`wSgDB0_L zp7Vv-?-%Xdigen$Vcr4sDbANU-+0T3)anzJxBB+>ph5iP|pc3g?bO7K2+S%0J}OK z{68}P|Cf6Oax!uwSPNbbYeJ>h^IVymh@Hlrc(9~#ZWG!yaQ;;y=S^3OcE2F!QB8BN zHGMM?{WYTLA@jFIZgUt1ldwNa`yuJAa$8z@t6aSgQN7a68;FD2}q!Se=G0y+&f%7B!9Qu?xgo&e2B?TkKCTR z?}cmO{q%q9vVo%YKeXQuKS2AMkbe-eepfsgxdC$AOP<6xC}#-r|Hgk0AuIlSIMO-@l8j=dv52 z;^RuF_;eFg+`1VmZruW>!1v%hu5T+;{QN#tT)z$K_aGlYJ>UHh>UsNisORk;LG1%} zKw{}k$Z`(Bts`aY=V%%4H+Gd_nA?7o2g z;C`t6!~v-1>|a9dOAf-9;325z(uWy8jTkpakoCKwub`fTe+}f&KK~PZ0r>>f{^Mt;`2Qr-dFU@t=bWdY_Bp>o z?R$QM+V7l(o8a$I=eB=9?W4}XUGPu%Df|n54*!PQubqY3ul)mc?)xv)?`Y1!@8NlP z0$zYR=k-K*&JU}=x-br22CKrWVKvwsR)_jsP7Qb~a(qN_)bHi#P&<16L(%Cd*aUKk!xWplPvlPInU?h>iDs2HN}tNtL~?q~g$;@mBw zx9h5s%YE)ozbIZD02MFZ3l;C&N4{FrI}mnWkUH@pk?YThgeYJ8rXUusZV7UkmZqFWE7 zyh)LXR^BA(tvuP4GOj06US0a(Wn}Gxra+B{SD^L-uR_KDQ(h>Rfz1)HvP%HNW14+IMV(+ILh!jr&cM&)6?}_DlOC2T0fTLCQH4`4YxChav~z0C)tw zuJf>KC;4>oSCOx|PVJYVonwDv`Hn_TaXq>p$J~71Le>8rRQtY%YR3;y?feloU3ffl zf_#nXkDp)x^I!7zvY%C+^~*`?mtQ1XzbO59@vo8Js5hDWEbc8n9r@j@AJWc0B4UpxSmRA+VIn^XHzVZKXds&UVTBHwf;zhfji}JJ{)s$@41F^d}uP$~QifiX3Sb4Q2 zoBbtbUq`apEB$z}H;;WH^|AlQz6ZS2^5Orj9Q;2VKst5}vzY&Ux5(B3X#2y<^R$n= zGVcnw7B;4y)@6yJ)dOwccop?&A9*#@{xKsj_PhC}P~Tr_M*FodxdzI=T$>l$pES?& zTr?eh3z$azNv?fMH$UyLxVkmJpVxjR8EXI125KMC7TWiJpyKW8;RwoU2Nl<+K8}5MGH*|yAH*|-Jw|hXv=SPX(6p!`Ei^Xg0 zpNz#7CDSzy?#a8`?&m#u_j4VZKmDP`-2h9!H*X-a=GT2t^9q@K56GVJ@Ic-m(lx&! z<8w&fU>N5N$$JnEfDfV9_#W!oNj_ctaNZ+%vH1;=hvf~o{InPLVLVBWa~{ikocpc$ z4k>>`-V?42srQxFH10HB(vUTNd^X+!d43yjfjq_$<1JmZ@doXDBM3{e&xAVvSmgdb zB8z_0I0-|Ik8G%Mkwf{q&$0h?jpV(89Pi}ijimepCtsxe0+adOUtS^CSJlJ*AG?Om zld>mn9hLVKOofuY&eM6LE#E7m#jPrLP{~;7EpCMtw?1R?vw7oU`eJBt>vMUETc6Jx zkF2;=RNOiNuA|>xfQnlwhxli5-bCc&=p?H@#d%4j-9^$97ryMKPjS;NUzK~A53f?M z#>Z5s@$nkeegE%!z|+aEIB5n{-1ItBd^Z!?^MBWVmRrtjx12dp<6~}~;^vaPd3lPP zi}M!HKYagJq{p3)o=rOa$oGHI^Znnv^`>7V+IjX`sPpOy zw|(o}_PuTS-Z4ArWzYA2^ER0N-MmW5b^iA?)H&Zb*y|keDAYNizRULn>EE)>cf0%{%q8ESn$3ALX8Liw8Kr;t0cj{XX@?*0a~o}Y$V&wqzn&;Nj0&(A=u(|Erb5YHr$&Cfj<=Uqwpa zy2x5bM6DxUsCA?s)Hq&N*l+Ry%;bUi1#941DuaP?QZ z`dB%7FSarItGHiR(H@PTtD(kE6R7dklzOUouE}p^^<9&%=X6Qf|M$D_=H%D>ZvnOL zBtfk^E!}ckLA9eb)H;;xmfr?yJhpY~xeluS>+`h^wa;&tuXQLTzcc-Nw&Vtp>uPVZ z*XfYo(d5pe)q5jUJ33iA@&A+;@7$E%mHY|L%_8}4F`4~;eixIwinb1+=l+B(!5YMr^uZC@X^eSIxoKeLlw z_I0EE^Y1Zz|NMI?uW59ENPF4;n|@&aeWo9nKNx*d^nTIwkacK~WLt-z-OmSMDff2> z)V^pa)V}B;sQu-`Q2U}sXipW-qxr+EU61AuCtdef>;NBwGneE4p~lMyxZFw0e*%`n zR9FFhcE9ld$XcKLQ0rU(R>E|+4Q4>Cb3v$eE)!~<3qh@OS#~}6f2i@14b9I%jgMTY z@fm?y-}0c=H`X=cqQd-we8nk+`J-L?k*@udmi|=!({8>|Za!r4jgdX^)R_FSq^mwi zInU-7!8qsH{Ab_*_#Aq*Yn*E*`E>E~`QzRGhsYE1U$p%Af7plXk{stu%%9|5KcxJZ z@+Z48WS{eL{uE@*M@YL~&40!0Ud`9@BBet+?|BV7jrVC#^KLrSyqn>+?{&9*GokwJ z4XA#bg`MW%Y@27r`E%^P&CM@kT%9eMCo-;zP4+rYeu>FtqSX_Hs<+g}3+Mlo8}H1| zf0O(P&H|DA3r+Sqi}Dwn{HAF03_bH~N&X7#6P;!GOJORM>~-GCUvBm*M4M-%+dNx| zKE+v;|F-GNMVn`V`?(kDe(r;s2cJQk2T*`eeQT1S@FhC`5t>NcLM6UiN;7P|uI*Lp?ug0QLOnGN|WA z4WXVNHG+Enc6mYUx!M)TdVX{z)bpc6Xy5;ZdJcFM)IRoVsOMl!p!Ts%;Y#FYP|uOB zfqIT~E!;zTb9ex@D2P3eOG4K3mX=Wa<5p15AzMSeKb8#j+@}rH{} zURrP3uYG^)f8+WT6e7nveGB?iPJ+`kKTo-|`iT7H5)<{~lB@xFF`AjVm9t`u6eOvFaUEGE}m~p|Hv-)`y2pexzWS={f%= zU2*86ly~96@PfyX6^Dw7Lm!8VLr1_Jl`)8#{~-l z1zJziCF5T*M6Nq%GVlKv#Gb>1M6M&NAWS)mGa%(h3bK)tqd5f;@~1etBKeDoA^JRB z7wdn%^-qdZAfmVSRT;~D9O;(#B-g3+@+qkGbQIJ&`ZVqB=^0%x20NYaLcUuvwx9_4 zF!^CocTeV1|HZq{k}m%@4$AL72jzF4hkD*J9?HK?aLa!Is@@l&*5!#%^-r??nNskQ z_0Qyj+15WVi?n}=$zJD`f>%wREpok63#L=Po}au1$IYK6*`A;Lmp;Sn*#Dzf`({G5 z_YJd~rE={$W1Lek*RGHKKkbTl<`tCEjs&Mzq#cgQUZ9l{tyf@LOI7k8gQpA>ytG(E)stuNR>yL7${?RQzE+jEkQ zu$1vv3FR+0!M!{m+e|*)zb(ibpYK79udVQT_&yv2w^{i-|3{X;{}5Kf?NI*yBPf5r z1Ipj;ggfCbD1ZMk`87UvL;3ShpvKQ0C_n!xH2;tNxcU1E_H!LQJ@|ikG5j3%fM3Aw z5Iyn9!GZ&@9DWHa;2|4#?Efim-^#-UM@T=wdI6EYDj=S=@gIw;j~0AWpm_CY!H;hJ z$DrEvt)+ig@B^~i_dQg*k%?cA%bvLUc)?Gk>$)K2oGds2B z)5X6Q{Kj?YK0)kH7yL~-)qlT3_4gmxsopbC{qiSN{eMBV4}0o6TksFEp8G)Le+$mJ z2fZZItrW z6m7mii(f7-jKx6-g|RrNHdI`53Do;dbr^IhuZtMBG(;M!m2+7Fo- z^OKDVJr;jl4i%4F0Tpjt3FS8vq5NfIn1Nrs3hF(KtD)YrZUPlwG==i#%_#r>&tI=C z?1migG%svbsP&?S$oxt&+3U0_Y)QZA{FQXpiPo}booG{-4Eg=P$^8Dm@H)%aO*DU| za{2wg^yaUi`KudDZeQ5J^!R_$<*zyx%3s}B*a=zwN|e9q4CSwGg7R0C!}`;;@D}9c z=&e?Niql1;-9^&dImK--F?zeJzr)pA{wlp0Z{5+~0DI65jklgq}~bkRjBilTd@DnfAl54*0p|6>)hQ?{^K6E-2PDKB?F-R$h~g)_d(5%fo?tbL)HI4 zq5SNS!a;@dvx5tV(Z6R)9u&E*AtrmBp@k2bJWRBDABJkjBi2s*KjpMz_|9=WcnEZrj>pyz#YieP--B({>n%!5Q$zI1_7%=;E(bj+LZ2ix`F2xBJ=9)fJ zwDms(wZ3P$?F+l@%eH(uW+%Pu>qhemBc{(QETFum(R`8i^8TOcM-~>Eeq`a(=#!#P zil&FG1EVC{x&rNfj)q$I$3U&eW1-gLBB=9|XP};=KMUm##?dbR_qXslYv1#Q<4M4fAKP`gj1mW#Vb(j-K$XkVyd+t z{|_}Dra_In=}_Zg2Gn?b9co>St>3c>->`LQR-xnC&35hPSo++;V%L5i)cT3sXhU&{ z>{;hZ3ZtZ}9?1GOzpxa>Ir9t4-~hM~z1p+DwUd0hcv0bEx1S;T-Yi_|Ue6NK^Zeh+ zSyuR#n+`b#SzfpTS@R6ij#Y&#E&r-Qor5SHwwOe`zPixUA{luNbia|9#J>l637?H<7OQNH;_6SGPdzSKou$ zuWp6fuf7lUUg|dTY2E%nGWzi+IDU0Ov)kl-Zcv$G>j;fl2Zk_xpYRy5F9!=ks-V zzs`sE>-}B_wZ2>rb!E$HKIzyGA7fqkEo?@(-$A|q z_C1`<_;3K~e$o$6-xvQ8>ign9K`-xn9)xWfAAW{pl^M-g>4}BG=bBd}^ z=MmMQ&My+6)}@JX7~x(74-js3sC8`(sPVNX)IFypsC!NqL)~+_1nQnsEvWIA^9g%j z&+GGeFDAch!_I_X2PPxeh5CPaJ*fBmE`@p@u)Z(0?!3|NLtXCcik#?N;cMvAIDMr^ z{ZBF3>ooK=@WsYy-09C7$)0gK)z=uNL&>}c=)2ndbro%#R=5L7uaVxyX=vkgGn23N zU1xg6f7~@rH}`3rZsBW*tZ`b@IDI|TIDG@uI88W=6Rmx>ARnG{lP`_%>UwVUbwCc6 z-=z2$@7np=_%z+s@Ob~v^mi&=#;3b1KluKyX#I%X_tH;vgQwu#@C>{M9){ha)(bu0 z%w^pFgL7d|IEwdS?jxVnZ}&p}6Z_uC>c9Iy^|yU-*L{)u;lJ!(^&>rTp8mcEEM5J5 zbKdsE#ZwQU?F$dYPUHH6Q1gdDQ0W`&`hN)OxgUm_e>?&;|9BKCpN6>c4t3M@8172f zFsSEy9P0UoLp@)*o8Bj&`u`DDK2P~ZTKSCfjkof7QY62gGTG}q?Hg_Kc#-^n#`m1U zBmOZkT>h+NTi5>QKGy6Q|IsVmFF-x#IJ0|E;o3YK65a%#4_VIxss9kFHGo@nzL+=*}1%zX6R|M$IO`iN-r znnI{~OA%DMi=oo}lKFet?4*}{a`ZLdtEPX=_XgpmMqd|6FXO-IC;29tev-y1GG8gI zfKgZpXIc5O|BpPM@XMj*FYm(Da5mKZWe(K*WiHhGIdIXxT~K02vu*8NzXywFZk1Q{0#LR$fW02-w|Xz$01jL80vX` zbM4T_wJQJJ_XqZUD1S)3JmEWP;h*pwgQt*>!!z(tco?3vcp3jK9>#yTs^o9qDaiYO zzJIY({r(3kou{GFeFmz2pM|R5vKuw~obS9F4kVv0_&gc0^E$DG6PFR65vv!Fc&cVp zfxHKpp?Rq4i{_z6VM2z+qr{AhGGgyDi3f474x7!YnNb5SgBNFL9-1UtyM;Dyy##9B zS_`|@v%DF}umaZ4(0Erbqqc=#M>6AGT@nBFO!hjLX2iz3`l9{M@iP4De~yERG zyMJNx&gL1h`DhEcAG?-N^VI91=A$=2%^zFgPxIB*$U1*WgE}|3JTEq{;r%(=U+0|4 z#=EwZkNVS_q59W$P~%y9sPV4@;i?vrkQKLu3|Peb(&qtWYoxX)O)jQ_~{@c%4a4WEN+;aI5t z>UpSf>6#%-nkQva;p=iyK7A>VBW1yJ`1BT)Ar3!&DBMQ}gsfMV>` zo?e1#ABQHB{#bb2$9XklA?}IJYZ;Ts_ax_ak$B%Q+3QTom`J{BUk!Ka&zrKR{=Ahj z8Ky(YUgzzMDdumXX!CW2JD_x$^fq6IHeY|og@tc zcbfCQX!$Jn{^ZLd_#Rvgm%BFIGU+ zyZ`p#R${02y9%n`_z0@s_!#OQ%xb9kKXLti>W23jRKKwXD%{Vp({sN!S?ywN#+T%$ z_N!ssL-=0@)h^aUwTlh#72G#scc+K(pKw%Pzrx+YeKYRKxNkw$y^pO>_dd2krRQs? z`^wv)<~cjyKEnM5u7*3I+RHAe_OctQz3hQ%FMFZd%Rb_%MLhe7U;E}h zz&0B8c^j{)9hIPTX+{|UgGK@^Nm`W$;c{a zNP22#dM%vVnRQ%u$ooWfGnsc-xk2lPE+t&`L-jLb?>Srs^`6A#Q2oypP~-HKQ2SOX zQ2SX8p!TyG;$QtyBdGqVG46UFA{FX=h^u6eUBz3m^ZO>59@}5K25KB{3bnt~3~C?h zTEfvdejV}!($O3S7~fmK5sc?8;hj9^^-$yf4N&_)t)RZ6*Ba_vJ`Hxm?nby4e>Xwx zBej9rM`{aupuZXFJ&JZv?@_denm=@anm^nE^zNOQ~hsek^bmTlf6!t%)2OG^}o2&|8|u<{qNnG-C#PD>~-$R>~8)>h}Qoq z+ySNcN^kuywEp)#lY3?MHa+Wq+|~c~$yEQ_H}igE^}nL}-+oa2?*mZ%FX7OS4#*se ze0a{F%z=bg*YjZJaO80LAjQZ0@sZ5InI7h+4`mJ^eP>D^7J05mO!hjDX2#}^Lqx)R z+`?-SeJt~F?9-fKqV?Ml{cwd#znyN+o8~+rTE8uK^&cbQHjV#0m-@*kq1xY5(8hn# z**SKuZtJH1`sFeBQ@{KyRKNTjRKGkH>U{lqsCnHBZaCxIa9@OKkK>`@n_$oF&-B@I zXJkg~xidx5={K46e`dDH5s~K#WQGV|`w%%WTppBc`w;)R=b9b+|LB#zJgD^Mn_Ypz zwdaAkwgKtC4_ohIlb1GCirwd4(8hn$=o%&oX9A0Xq% z_RMWC-r1h{HS7bwL9gf8;o3<)QL;00ms<`Hf4ejHl0N0r9@8`aTR8hN_q*=!vX57O ztMMdm4f*unc=A2=8cz<;@9R4qKR}&7{0KFk`~)?g9E3W*_!;W_;uom%i(jG6FAhPS zUmPYpjVr%FjWg3Hu|H2g{5$=z&ME$Y8b^*ojU&gP)`iER_VNFOm89v_tmZvpxRj?RDX35R6kXna8!;ppz2*ssCtkDRel%y)jxav zm-y8`*YaQLSO1(W(!RVVd!5?;IwoH#T0C{3;;rXbKfwM!;Uzlt{VDiQaxN3`f4RwC z=L-LoCZ~wj-=L?zY2d#K`xK{1CfBz24u_^w;}a5ngKa2GRNxh(68V+VpAuw&cc6>Kfx!wa+?%kp0*Rg(~r~h8Qqq)7Lr~iK3 z70!K7;q)^1-u}MG3a<}Tc*yh%{bWzS(9iz>?g|$Y&Om>E81D@94}g8(AoPm=LDx?5 ziITzohur*v*gxza#`7s(9zn189)(KJ5U6;ELZ$05sOQF>_#XEUN7nN|TBqt!Mo|)`*LjEB6ruiQ3w3l4j(_ZrYVVDjjd!2lLf%%&%+I&yp4k#^@ z-sXGI=6l5^zvO?}^ql|WuKC_8w37=LUiH6*tofd(`QGbrIr=x?G3qJd&<@}7PeN`H zebeG+{1-`gPfszW{JBu^zGwa2`~G>>uIBqI z$iFkC3q;cYzR6x^p?{Id6{5wv7%Ckf*z+^~6JDaT#J>XnNzPIc|I1AFI+gzACa(~! zze7*?edu3}eTuWnzY?ZH$zJCp|Ho#(TD1NSckAyyL7(P)>R)I2&qV9*)ce*0p-6Jsvhiv+F#fYwZHH!;U|-x?~v7x zeh*i}15o|w4{rJW2vu)>g6cO8LiHCvLzVY0Q1$6osD9!Q;nwmn{u9pm^56V_AlE=X z0&V>dJ0auF_;=K=_54EOJBGdHU&o>5U%1=8^$Eh&dmev5?bn_3YrpPq|0%c(#_l8h zBU=9HK7!^cXRud4be4Wa{m#GYXW%&)B0tWfS3h$By8TStrR4K|?j>to8K32`{-z34 zKT{QIo>C2JJ(>Wu9!-QlG2gieW)p7ptpC^l(BIU|x(+$fNy~)f} zYGuXx8{Da{UfEM$>txl2=}tp9OW zf0L4>{-!}zLuBgo4NXH zUA_5_>q|Z~Cw{g67Etx4B~(4R9`-_i1M$RpT4%Mg_*!SF9~y=`w0`JD!dLsh396rI z11rhrwou{U47Cr}4yvDO57kd~fZC_J1&+tABRs|XDYv@mxDBe_-tMNS6I43y$kM#5 zOIGJB)yq4xx|8o`O79YR?k*;KovvBkOztjPymv#T^B#K+#(%;~bb4g<#($D?uZaJi zCVQRxvU-`^TeN-(J>}jft3UR<|DV+t^8UZcy#Jr|fZ6vKt)Ifq`l$ifr8xt$9yR@g zqV-dQp!%V~Q2Fu@RQet^e~*}*^s-Nm4$T^3`k`6F2ro7Im`HjV|4lzU>v7W$&l-uo zSu|ZVJ*2&lkZk=FwEk%nTfI8nD2i5<*Nc^f#<1HPG|4`-VgQ{;CQ2kXVRDb1%D)%h>4_ui(GaEik z{RqIN%US=EKXIN=R?zY(l$DFS>ZABH4C7z*HV;|#FE+o6WEEs-UKGiC1-;@ggo?k& z+>5hbMpimrf=UN6^Sf7N&;04ttk-bYb3nqGnDsi0cP3`N0sFu=(JS4PTsz4pN+xH$ z<>ouIbiHl>SyOd`F{^;y*LkEzlim}8{Pu=-@0%m z>$rvVpPJt-g6eM9lZ`WjPp#GmJ{amE}e_^uM zS)28x$s0tAXB||$>#ZKK{wKUdXJgh@{3kh^MErkcve((1wZ-JEqV)&p=?}JL?ZiIC z*`D<^Oox)a&W@~a%zme6{Q>UQAM8S(=IqY;-t>D!>ksxqwfB8c`LG`g6HH)*nFI7y1pB(O!>0 zonQP8)sFvwdQamh)O#Ao+vgyZs5Y{@@>|e&sY= z4bQ-}@GMk&_!q81J_psWoQLXHF2FX_cTaY#oyI}cgLtTVQ3YyVQ#IQYcL#RW;8N-z z?VoeP#O!a~c?Yz5Umbh3j~dyr_D~b5JtX0-c62dRz5nsG*n5<Oj^1x=`=&*MoYG|5A7z`ucD(?dLM6c5pe|k9-Bxdze?kxOt5KQ2XHxp!UNX zLcRCc2V9PFY>$24Gc8;7_{QvZcJJ;c(eB-~fx36s z7HS{pW~lpj=OpCX();^fteG z9HvBvyZUrjZ~o(Uu)jM3{Teuubf~?If@(icLbcaQob@%f|FBqOlg+L^JSatbpqKrCg+M4eh?}>AxkggKj9@h;p{^ECpmc{{_{=tItAGglM6-b zztK~^McJ=npW?ifT@2HqWUupb_A6%ps%ZT;?$&?5hCa=CJ^O9bzad)xJrSyZp5&(Q zO*eg$&EH#QC%x>Gqf@h|n0{*ZbizxGP7_Hl>wnYF$bQH4GqOw3H;c{`O%Lhk9Ld&y zLo3%PRR3KDHSd}QH&EW?Q04zFRDV7jsz09t)t}FG%i%o>m+>EW_0RL+YPbNZe|{gT ze_jYzAuodJpBF>*&mX|u#8UzF-pCTDbA_c)=L*XRU-PRvB!)}?D;C6s%em0x7j|5LAd|Ie)_ zvH9To>~-0i$F0xaLU^i&8=%s)(cCv>Z$?&nzk*69GV`ykvS&WHHG3QGN)IHQ9ob*Q zcxOlUcGw5*M6Yyy;vZihiuIQ-4=h%PaU*qXN z$hs$S8tQx8XP~~feHQ9I#=r1q^yi?y-+dl#WLO0<^fG1@-@y9`ZCp{i6$G!?o zW4x^jyTNKu`;`e$`v~2DP91)9bPC_gxW)eXr@tKDm9sUE^%G zfX3Oo1NR_noE0_Bc83~gd%$D#7lcFq-ZRi2`S6_Hf%^!ruBVsD;qu;rfdP$E{Q`Xg z8mIcoopI`Zk>~1Xve$VaKn+FiFWUQ711#KufkA|OY6asz)HsPue2)YMBe#e?6nKR2 z(wv7y{0B=Q`bYJgj4MMdKhm6`B6>@2+%Cc!hTcPYJr4Kq9K+#R+|x<_?VcwBBaqM2 z&qM3qMnd&lqoDe|C(&Pv|EHkdzkV8S!~baF=iYzd8B52QfbKJN$L_!T49{Vw@pmlL z^E?mrd@n%lKaYb7=S8Ubz<8+nzyvoPKB)dN!%a`7n;t)QnqOpDeg^~DmfwNElF7>N z98vjWGUot+T+5FolOg#P4iw;D?+N6=aCyFDdr#m$_lUU{1{P0_xkLKp;=oJT>HRQh z`T8={c=`&|dgxWC@$)sP@$+@4@$(JK=ZS$y$jWC?`S2!GIZTEspSR#bXKLVWSOKTN zN;u7)kM%#Y#_j1)_CmbrEm+3l79!#mm#Yj%tF?Bs2nPv z--Rmo*-+&^2Wq^V3pLKYhrf$S=RBzTFdyCu7eIZt_jOJy#_Ba>T-_Ad7|^)9DeyJ+%BQcO@@ccVZwYKeR(@@T%5P-+ZI?asg6)AFxGSF_ z;p_^01LK`tft|1q+=E`_vD>wie4=D;U?1sM{e#H+1K*i{*8i{vvdgd8N0>2ZU$_?^dM+1LA z{s$P)JVWl{dPqN?@&)`8|C(2n6uRR-vgQdV8Rv2t=T1S*1OA4Z2mAvyKR69FZ#VC-^gXK6TBSie3_nTI^nBtDM;TgRPUEc<3UEek*_P>*xDG%*ew8LHN`u0%k z`VLU*`de~5ZT2y5=!mTK{jE^z`rF`Qcsta-Kqshuf;+I+e@{9?{g>oU+_evL7u0(u zU7)^;&=u;tMBQLtcsJ}1?}57C*&TkM`V6&Sb1&3>O;5?V-v_my(hKVSl-^MLmVJm< z|3&EwcOu`9dpUAHsQu9g;6~VAGWr2<3-Um?if|uEYTxKdsQsd+p!SQNhT1P04YgnN4AgzuF)$3Dg}O)k9Bd26LhVyM5A~mq7oh(0 zF%IfKA1^|^FEk!%e{2HOe?5Fq|Mkd#RmtB>sQ-HSq5kWU1@&K#Y}g0}px#r>fqFkF z2=!l&5Y+!qa-sfb5{CM}N*>hzQSzbwdr|=PK5GPOAFB}RKOsf%WVATvCF<$#xI_C- z%ga#zd3gou{i0W)&KqBYdXM#Wc$VjX1L}V*6QTakG70M5_M1@qXOm$R`7M|R--dcm zY6@IPy_*X4p42p`_oJpmy&v@s)ca90px%p`3H3fy3Dmu32d*VurPPZf(P&N?=|4z( zutNWfnT1~efhmW2f9hSBivQVA_oL^)sp#iI{h#JNsQ<;(9`{7=w_0wz9wSL;4 zb4gI^r*Ct9Af6=WJCS(4H`(j_kaHj>wtm8$_0x~CXZ>_A=O^sbp=7V~bIvd3?~))4 zdMHp7Kk4mn)@x8kE*&*uDN<$7A~lCrHH!E5^wQV2__)FL4R5m?nPe>YF&am{%Qmhky}JB3f3TB z(wyod@disE`kF!ILrOGBM1QepMjQU~h)FLlY+ z+dSzr>mje7b!qT&>^3tWs!zB(W?d%P!i8~{klrg`G4taqVGrh~DexKC0FHwVNne~N zHQ30~nHp>it07;F-aqFm(f*erIgEW1vu_%_#_XF0o8ewSJdo$SHh3NKyUeQ~a`Rvd zL4?z|KZ#URlc`D#d|wcdO8uV^8F5|`EzHe{J*>QqP9Lj_`59)4FRo)c}`XA1V@S54J)Hryp3a0?Py5kpU6_Te zb!Rrz|8fFQ-}%WwU(*u|hLDvG$T~1L7)I7}hz(}v2lL?gIr+f?;?=qj(jFthVq~?) zLTisjk{fA11zJ0N3EnjO<>0GUk6sb&zb`PZ)9hf$Yp^SP9V%bmfO?LJP|q<5>N(zo zYR{ALpHlu-a2j$iXKNG57D1qu1 z95)|Jk@cUQC{+6|gKC$vpxSRaRJ(o`s$6D6eSct%o6mERhoOHD&cb~j{Db_N5A`3Q z1yJ?seHboZ82kW#w~$|pU=mym^?f_J*YH#Xmtd!IfYh(0!DX%tX_w1`mDVno2aguV z`X$IZb7kivvXPzn9!d^%ZLUAN&!$`VENuQ}7`Elx~RpOYmoVo?n88aIaGSt7z>Nl5dBD zN061y-=NZmOuWAbkE7@Nf1<^I)Z#xT+2V)T{TcilyHzEB1y8{35ZUZcn*AxsW-q&V z=ilHzunRnG_WuUYz*Qyx2G7DixSzwn%27N~az1zg_a4+^v5VsgRS7Ad9rAR)d znCx{Lgc_QhDq1{^pyF*D(zwm~pYRf$t3u82pX6LE;=hT>Ugw%nQAT5I zUmNq+*6gI0eR8yYsGaHChi)Of)My9M>IFo9YpA2?Zw=jnzFG7((e#jd&`GkjQ)uIJ zXSmSm61o#sz`I~2>}vVS`X5>2b2qpe-VN8nd!X7!cc}5X2h{j{FVy(l6YAd6eNf|b zFXC5u_O^7e{)Z~pzEJh za;$uVp$PeMrZgmyu3VG7PB@fjazwOv@}c4_u;*g^Pk7w_3%!DW?*EDSFE*L`f1#I6 zenqr)gPwAEH8cr(?*D~egWUf!nfrgCiDo}Zw047?wVOAw!fy4guDd+z^*W|)3v$RRxL|B0lR@!#~(P^syop?A@9|4%eMq}`NDwsr%p z-OPpyo%cd>UVo&V*9}#BVWwCWOXRE zZ~O`T2K}c{_Mf@-Yv7N#e?CL)?~Bln$cfI{&<64+$@x+wf7Y4obvA_7lRs*IxKqv> zWluSO71{*Tp=93w3vDrfKZ@4=6z+i1ZPHu&gVz4Go4h0Rjp-Txaaa4>N%>y5uq(71 zS?y0$``ZK6{`Nw(Kf-Ac@A*EoAGt;JTZ=!<`A#I=LFuVK2VD0bTzB(l`S%m?D!&gx z<@e7}t+T-u8zdxYDI|>!vF{tu7Ztd}8=ufLR zCqie)r!%F0iKO$S$zJDF=x>wHh!)R3Q1PC&=Vbq%@DiP~Ay2N#=U);3=S=oG=R+6F zzb6-3dqht;#pNbopW;->jfd$_ve&7aTh06@h}Ir)CqGxsOhnKBe{*Y@zPf1bu?AFo zs|l44Nl@v#*!*2$cGAl}IqJ<#HoZ5u4&kLnYm20p@!$0Ia_gGDUhd`Sn?)}bO%G|0 zmr1tv2(3L{0asJ*S3jvaKRZC}3*Q2@FWV7&_dZzc{(o+4KkRm> z{jpI~W8=sjJdet!GgNuq2~}_Jf~vP&2uJDe3iX`bpq}$?sOP#TSM#r)x!oBB{L7mec0?D5v|_hZuRz2^l8qJ+$T&wRJ3~g7*xF+=BDp) zH+{p+U%J^zFZ<-^$lMX8ADR0k;iX1LiB>Nm`loZBGX2xJ&!TS@9W9z3QvPEkTfK!= zZ=Zt;ofmS)!V362tc2s-`UkCEzX(;Y$3xZY2~hRg2UV{#pz3udJVm|o!#`mboR51p zRQ(N*4wY+;rHB20sPYX#m2WOoJq|z6^El_6pRw+pAFLZm&U|yS)x|?)C=MdD=v%?{Z9n`Yy+t#HV&J8LAz;g}crp zb-!Bs;#1uAFcs=tYZ}x!*L0};_IIG#$qcA=G85|jqXh1x9Xn9xNTpEcT~Vm>ud>|O zx!5e^L+Hz)&Kur^3rWXpsPl$7Q0EPEq0SrLgF0`R2X)>xpLDA|EHBk zuYx)+{0QnC>SL&Lo7GU~2cJNluY4*!;eH0|!8LF&?w`Z8@C&GOt+i0+5MM%_%dLYt z&sz_5F0}#b`>`9L&d)YMoojvtb*{M?>fB@t)cMO+sPnaLQ0Hr3L!ECi z4b(Z}PV0B}=I*lgu{-xW+S!@XJtFOFugP9#U+#XBzZ30T@>{rya>I`Eo$qrGkY7hg z59GY+huk00>-{gW*@A<)Kf%H9xW#uU_h*amm)zehzF$S+J7lugIh@NrJMwQL=O{;V ze|OtG|E}7+8*@}7BIxC(Nb6EB)Sn2=mn zHJpHZ-Lh(;xx<7j$`ZpD;oboMFyU0RdblR?nP?5s>|jEZvZV0ExL=1IOlVnlNjMpK zXK5|b>|nx8WwpazxCGWk->$5VXnL5?v8-OWKJJ~$E)~rkCNwI$EPOfcR}nr;c%bZx zaLbvVhTTf945zquuwl>A7Bg|T_wO2pW9LXCUe>-uYPfM&`x2?)X1J^Wy9%oRyV~5F zgqtF(AG`*tA4JCAwX$cw!!2MRcmsMH|6M!DCrVm{TZd!) zKSWLo-(>z-|HB^i&ywSvHsQA6SU(R5|K@NzSBAvjK70%QmF^Bu=|;w1$1wXVmhM|! z{cTX`=f1kxp||fP-ho_?e!Mem4DSrt_+Fk*>j2ytr|*+J<8<$EFUa@*Oy>K4;lAcCU9@$8!W~fBPkLJi zKwAg&H+evKpy}EF$9*Z!^I%x(fI;EG$XW-8S_eD?m!p3eY8{|(biVZ{_PqZe9)jE= zI@Hp^`~M>851L&{^l{gHxa%JC|0(_d6U49b9s!l_BcbyBzjeTqgsXYYQ&97%r=jLk zqv0I-^=F{wRbyQL&$|AfgQ_QEp~8PYta;V=@C#whKgWgr~(U&L6bvbu&RggAA9cqha*;AdEu~?SDwk- z{|^_KeMGc*6?QhSD#R|$DGI-C`eM=MRWCu!n_h;>k5{15_p14O&FrL?eR6bS_zlxf z48KWusnJOy>1F&k{afM5rhh9u4Slod+oI_q?P#iGn^!@bS51ctotfcxU`J{5(VU>VeWY8F)amrI845}(RzHu8M*bD-u`bKz?E9(tAIJWChj zKl}`N0aSf?AF5wj2oJzrlX>r&a2F&0?>fB#S@WzVd}l)Qs-^DtCYC|jSGxAgp}S7E z@%lshL%mP55^CPF3hEx=N7%XRf(F$*jQ^xpEJdx1M58J>3@GiT@<$ zYZ3q3P3Hbz_#2aVidIk2Q%`q=_hX;p>l;xnZJW(C%x>GqrZlKG5xRM!-SU_JtSH^gy@fie>44&@Gu;!f`wvvTJq=ZF&p_4N zvrzT+U#R;Z=b-B8dE!@jUa)j9{^!NYH4ds=P-Zkd0gJ|QE!W~fBOnMuipp8%0ncO_Dh3Q%UH54IkTpJu8lPIh<>*^OjZcI_{cM|eBXW!AO%{Ke(?%rSLFwZfaL#=*Oo_I0_3d4~ z`Hy>bIpaV2@A$t}N7AA4ycMe5-iEvOIc|sbc;C1a?y3j>ja!{@S9`n@svo!usvqbA z6>nEJoNmbK7w&e$zXz&*ba%t+Vb5`I-k>~NFOlczZ8GD3UTnVH zS0vtkdG`~35{&sDnD>DB@9+8_;QAlv`hU>%KS-p!2j>kTo+RfXk$4_9+3P%#_o&H3 zMC(7$Q|?3a(y>o*hUGm5)1hRq^LXBHvriYT|G=H}jmUe#(l;V+v_0Qbc_S@-qa^cu zPm09*l*xSmU+F>~En5Hc40i1Q=e=ll&x+RnJO|akjJ0?e|1BQg|FirYXLi!dJ~=ue zZ@lRzR6h~HeW6pFR|qR$5v+tSS-!CT$4>R*W!&cz-YZb!%qUX5I{*yNZYPKX&z<64_J!rFjlahmyTcG_TD3EfcNXE8GF4<;6P zuIU;7aaX&4&)WUGy!ps#_oCYU0;qQXK2*CW9O^|y-Xi1{(Zv=&|Nj+9H{bckJtext zbzkbbn?HO0O5)Y?FNeyX6{M$w`+cMH<@UZ&1C8^m2uJPvBdGTMF;x3r4b`4Mas7V^ zm9L+<;jV!yzt63{ugm+w%5`ntSLD-~(l15Qxz1#-vp#Qw$zO>U&qkl+%v9J=mu>JM+GQ=}@xQ*_F53?DvS)PI0$( zwikVxvoG&Q)9)9poqY?{j=po#_r06G1Lp4svy)!-$n9TQo@@o;F+9B?guUGbzZ=L+wknjJP%=drt>zTi6MQeu&m+${bZ|x9TJG|WF zEAp>2J^TN-s~x7~Yy54H-w;{tP*gi?1l0~3L$yP~q264Re-$#{|FQV_{*OqygVIxP zn!4`ITzB(l{p5A%`}6$G;lr>6=}^A6gv$5p;s1`et*}$OXbsgK)1cbpjZp3JCfB}= z8%|p{oSUKAW4nBfuO0K-=WBfJkbejHcBb?ek@R*n+3Vbzf1Am7h!)T7Q1N!M=gld> zo^tA(-_6SDP7(iinap>9^ShedO|G|1n$s)4zv+96)*kynwYR=*`tEnr*U$VtV0O~WJ~=ute}L%+<_{vg)aZjE>E&F+ z^bh3^HvL2SL(n&iJ}jCZ(jFg`Z0!+RdmIWEI*;c+1}oq&SP6$)zViMbvf5obRJ(fu zs@;u%YIh@{+TAFq@$yNidhirfJ$M?<$9*(ZdwvG4hGR&N>cg{^F3$C#>dRQD`tm$f zJADDFosNSl_bX;-|7k-0_|8^Ivk^;bnc6 zznpLH{V=b9wk~)z-;;7R`STk5X({7B)cvM6U~Akb5}wuA(9>lX2HN<1O6B z;r=!}gWVLU^M|Q03r>SthfIgMhx88qwBDG3taZsusQWx6Q1LtPS6B+?VjqP|V40ha zS;)E%R1QDE{avX0KeORRI0x!HVlLEq$9quc9rK{hJLW^3cPxN9?|2{Tykj9$J}iQI z{>4zw{{hr}p$e$yUjlWHXerdaqGhlRc9l@~tCmCE>s|rd;r=1)2v@?};VO7H>!gpM z?sxi* zW&_l@%|@v6p-oWdI$yya#J3shKKT}S0B(i4H?OR@`Q1{6WK;0+%0qQ>4k5Ko? zeuBDBb`a`5+0Rh-$$o*l2lgw}{jfvUza7s1-TIr~#FXEt2S?y>DEWNZANhY-zx`+a zQR`ohNv7XEF49l^X|mTjksn(({3WKu&pMgUxJrNL*Z5jLVcFmL|IiL^@cb+C-r(u{ zbJSD4hkJ(bcFZ~}+4?Mi(T>Gj(Opyx`J;dN3VI_B!w2y$XpI~$Z?1S5mv1O&QJ`_TrQ9js>qVaP29v!`tAbehwie^2R5Jc6 zJlfxla2E1S7Ee2iCtTjPpdIN>Sa!1*Y|nfI+J1I>v+GdM5n1o|-vV_HK(g+6+-myU z3T{W%JpfVr;GN9Q^tGL*rF%sPU%{)VS3b{hD&#|AUXhesBf$ z4?z7dtv}TN(gwhA`M`pQEPo#?7({-w^)UX!c5pDP1JUz-^uq;1u}_%$h{(O@M@8;M z4-qYWFnBZX`#*+Vw>iTLhS~ExUXYI5Xzp;aen0XyNv&^8}VgBu2Q`6!LuPX9~#29kU{mEgvEI{Zc`Z`Fp9L7*<2(z6@+>&Kj9|PPrME_?|lR6IVM6q-z2DfcoQb0pA2imx1ie1+oVVJXbQ60 z%~Ys%G!5!`rbFF_c?YU|Wq3+j|LA8rn#H0C8IkMWz zyU41yvyqjrbD;8lE>!z@4=VrXVW;{&-};3`1q-a+zF)A)`h|re`M1bqud}$|1Cv*Y zw5y7OWrU;eFD!xK@}-jP`wRcMSDGE;KYHcQ3aI@2(Ck(!T&sVO@IES7jjVk77%HD6 zhs!@H_>6QWEc;ZX-ZK8AAR7kp{qt}j>zt08a1pMTB< z(e4F7>^2u{GP}(MUzy$Jf^FEnGG}YS7B~eW+kGLqCr7szd<~Oe?i+ePo&6|yqU4)` zoun^;b_WS}Pr)t=cTd4?3wKY!clh(q*;}yBjUN)vw*~v*6o}s9kzG5&{T`Ol4h}%g z(|>^Ke}07OkA8ycw+`Y@<^MBOdH#aC>esKx+K)Pftoi+6xElTj*TN%E^W)#4)(w9^ zts9O)ts9QvU-R_i$ZrzQpUA3LC*T427gYT|iC*K+DX9MNZ>aw8AGjEvhHBSmtbUy> z@I7G(aIgh-B_L& zsbTtyMD*1~(?j~vnvo>wske}DFOJkgPFQw{X#FO%_LvMO6R#J}fVJTqSO@0Ax={IC z52~NN)WWGBxe_^Cep%#l!c%>P$XCcc*a{g^KN>_*U_5MyUj40jcv<5}Blu!z<4CHT zPH6q_Rj@hz<<+n?Yy#WEYvAp$DdE>5{AS2X_q9;zz78tg&0#urE#Nb-C7b}ShXHs4 z{*&?F3R(AuTEj148dN`hBb*3tf~ucw;0)xpQ2B8)441cy+(J0D38y{u!Va(|#GQL; z9V545r+aFUduq2uZb#NVHL*&0r^p?+Uq*P4dop)MI>YgE?u^`pyY6>E?wNIobVb%Z zGf02XEz%uX{lVRo`;J-nNVal^-1F)Y>1p|XuW0wYAorN=i}XT&p7K_a~4wE{%X^;7F)` ze-u=I|0L9S^%T@Sv!~&Qq!=`Q}~_iQxV??xOxjTL|?$MNsK4CS2v$OHldwGVbTgUx~bq z+yePkSOdNWt3%vx@Oa*cOvLUt@&mF?m=u{pJxg-l6sc#EP4+r(Mcy`fiWscMcz_=J zsgV-1pC)2I-DI!xPGpA3C8F(P&4k*2#Ex}_6Dh}EiW7~L!gMIv>y$-inZI%|7*9O7 z+j`(#_!sG%4HH>6%z;`j%!N&n--9jSJgD`@e5n1%1s31?ktG)2qR2vvZ;{E2|B(+Y zz9pjVpH)B)>BK(nw$jSTQg|LNgNf0~$ST6Svvj%0drvDOADVy0f8?H}E9GwO69yAK zA4NXKegNr$tb0~RJ|P^fdtieqJm06VD*O!hp}4Ps!{O(Im*#vC*{v}K$ zAJ)Mak=H{%lzuea2t%ctB41lO+#2~RqIJ<`$*haEh@@|;$?X3}V(X%>#kluMw@3Dv zzg>|X=I z0eAxbg#KvhkD}>e@J90Epq`^LSn@M+8nV(?#&iFQ`$Ffp$RSt(55r1$#L~<7kF0sc z@8tW5l0PCx@vr#{w0XfXsCmJ0(=+}PKkNSp>t*8qOQc<&6d6BHi8kIr_VZ3h{)uQG z?sVh={xvT-12um*YwrI>&LeAnaSk4U$oTUVV$VLHr!cNCHot&`Q?)Q2#yeFDt3dw$ zSD1ia^PXz1on-$1S9noj>^UIz)eCF!zfjF{YC!eRHL+8?Nl@v!7%Kitpwfpu@p}uC z&A+#>HvT;HV~}*zDXi;;2eGSHcq#G)`ay`ke&J<=qj?wPd9EnD+}y7yyb?S0myqZS{s{Jy&I8svm!O+=foK)cV{6!QLGVKcZLw!>cQ zitEh2d0|WJZ}7Ab35W3?uAg;%VQcgnH*erSt2<`3l5F)0+IW!$H9p)3HNM;g^&D-W z#+9~E}3~=qxWA|X;L&&MK2Z?sycQDj_ zU&-rdJzO{x{pMLi3Lmk2e^fI0K19Snbajq)^p>I-PpqM zrhne3=YIiNcH^L)|3%jxJLWkP3Ny{0Ph`H6VbppFnR@Rp44~hRzbv>4X2UL|NA4}0 zoWdY>qbM(k94gF3eij+>JmJDTi-++a?wwUsm=FJi1@IJ%z%#HA9)>Tu;TJjLDGyQUpt0#l7-SvAe0ooHGSqqG zTZKB0oKpBUTn4Av|BI)JR$j1a4*sUYLdf}K%5L_pXYgIM@8C?r(fL9Nvi5f!sQva? zugA^@qUd$bP=@U?4uTmmcI=U9&X4)O}9 z^NA0k&L>tvolmTSI-mFm>fGaFsB@3iQ0E?>K<&eS3Uyxc8Pq=f8h8?Z4z-W}1w04W zLhZ+Y33V>A4(c3YJ=DJZ2B>}cjZpjYo1pgPzk=GA-wd@czXfVvek;_z{5Gh4`LCh& z<+nra%kO~Nm;VN8Uw$W4x$T15m){MwFTV%s{ADlH`O7}2^OyZl=P%zvoxgksb^h`_ z)OpAOsD1n&pw1K~Yne7Z39o!i&hx7U4)vxOe}KkdJ8F#AF0;81uTPJ8vQdk%29!@=|dpVcFZm>S=1uuj89^K`zKfD57 zpd7A*`mS0E)P0c#u#$Kh!Ut)0jo?JeqcQ0Tl8#j5W!PN>*AVa3P~Vwr0>4DQ1~#I7 zHie7lvHpi$@P93Ag8OxZqwm)>M@~WC0yc&%;WhAjsP`CefX$Ix!5d*~*dC@q{m1u4 zsQ>uh1ob{+8+a%BwuG|aq#xS%>TZDr$Q_~X)7%PmpXN3= z7Wdns?$dOFx=(Wl)IFijQ1^Q7gt~8Z7t}qWE^r6=))fXwM>jZ{aPEd}(cc3%;NBg6 z1$)4+;k|Gt>R#ldu$c4@f%;zEPkr~z|Y{b z@Jsj{48XB)H+&xI{?rRF4S5_)B3&=S*>F63o#&VU$DsGYfiMH=epn_<<+=TED(+cu zCd`Ht(Ffq2$T@H%3_{(*3h^9AqPaz3>eWHQhjuS44_--l`LG@=fNKdS0ux~&oQr)C z)V;7`_z~_e5nc%Qmyu@^&nvLmg4c>(g@fVrBK3olie4{LKlnz`+IHxiaKlRk^~ka3S}}W*056^v^4rW9gqOne@LWVmHrZuQT6G z{{oTwXYUs+F@GNvEi`|NB;#+fh`$d^_Bs`=za{3cW7*Q8O6)q7EfXyrko#QAi&o%X zmHGv_&-G!^D&#b0rD%4L`&=Itt;W4>*~g-}L+*2ZQuHbAy3Yl<&-Gc+=g4QGYechy z2~EnrC|ZlV?sGxzbA4H~9(iZ!I??PP_qjF}ZGcPQSLoZ7Z4ylnxwo~ss0sJ9bZ-mV zy{xT8vG4tDgZdu&*RTuR4)tBX9Z=u%`v$gwJE@-?Rj=&(e!Gim^4+pTXHU_$#Fymk z6^U=3$zJE%qWwj&{T|%e@A*#l?Drff`X2jqD4Fj77X4`cY8FG=cTu)K--?bPYhOjwdGhaYIsX2D$Cwur4)fe&MQ4!@ z&pAu;02&Ob%5c5zy?bFDM@*Ljx0 z)%owgq$l2UuIN0n&b36H|6VY6PjMBVXFB6s9Mrj1JkK9*X@zyWC4Ex&%U)1^OFj12f#F_e7X^8zv92|1U`*@H4o!I?mE}I z8LFJxL6v8FsPgOJ=I1TQItT0sYr|Wi&M|L;3jcPfa_IzB&UZk~BRfOYn>(S-OYed@ z5A8y@Dz~ms`#{~G%8%~^+Ij6gR!@5tcQ01|-J|$H@|*krBKh6ZWbXeL_cHlGk>~GS zd_VqmuGt5M%lk^UbIt$U`A@Mw4 zJQhxY=q(=Esh*C5Wz>ro;e0qA>O5)!cGYM5iZhUP-XrS#C==@3$Paa%l4a=#6lYsH z0>wGFtA4^@bx*K3gsk%bQRfc1gxjw?TpY1>m?x5-`J#PCz5w2cy~(7f5P3B$f@@(h z)PCSgQ2U!N!%grNxCOondl3I?uodCF4*MX#0lV@X6QRx%CPAGiya{z4HW{iOzXer~ z--bG$o5FK=JyVOPA*)`94Q9VnJROdo^G@*$o=4|e(9V@+LY*s>K%FZ&_^;_H{XeSC zJix{({{PolMvS=jWwM2_6(f=gS+iwHQ7T$Ydn%D^)kK6lcb0o+=FW1*JacCzgd{?x zC=x}Ir9@HMEJc$_xfLh0VhxDs^ znE%5X@Ll3-xoFjb)%a`w4YJO>cENja6$%KEPe&C~hnHaKXof zSG!nm?cyWJ)-E9Ra>Ig8(7R#LM$z``Bx^tJQ>gv8O;Gh`Gt_?EXHf5L3)Fl29IF4^ zO8EHFZ3}iFYd`J_sQtJvVTaP~a<~0B$hh{^g0FEOzi6ju`*D)B|FsLMAN~faAKvZ0 zk3GoRkJ}5?-|lnY*SE;pU;7SfUu{3szT5Xu_2U3ke|iwApZx)<{`?44&ksS>uftIF z?I-v=dOt($w;h4AOMhALJLz3Vx%>*_;BQd-X>zaP`D4LR^z_~#?djNpy{he8G8jgZz?ftO-Z}08gg7dhKU-XY??@hAa z+Xbk7IL_^}&iC(vi`)ab8^-ve_3;w=s*jh={mO!JxT{`zpz0+u;mZ5aXMM1|uLAC> zpOAQBeHCGh6YHx4hr_GzS3R!m>PbFbSjAV>7wz|;t(V7HxN5#;zG#1NHB^16j=s{b z0c8hxq4H4^DxbArd}(c8LnysEPEKJmy?kj$(fSd{d++4yjI8Ip0qXgX$#)lD zH~fb?H;R`3u9p9sBwPL=dN=!eqPM>AR^KgfH$*o5?xx>Evgu1N#_8+34YKa<>t*_V zeZArO!oI#fkoA9GKfkRM>#y!4tpi%iAgsgnyPP-f8I7pdagu@ZC-R;+#80@;B0C?)~xIMSapfE$-Ouqoj}BevfZ7 zOoEcV&b_`d7Va6*>~_UFs_1_Co81o0ZXav%INyWj&-@>E?aMyolimKX?-69#?V{}V z@o*jfNl@nF9^>3a;hUF2~~Khb$YB;U#M#~yylb${A*w{Yd!Q$Hq z`YQi-EFX;jQ1#C+X5VKfZxt<_El}xx?$#IdsW01n zUlBge`9dW8mnQT5zi)@hUx`*<@Tb1)^zA`E-r42*8YV%>UgsO%Zqwf*T7ALY>dRjI z6PoZtzu);+Le{=mY)W)Lt1=wMdizyS`(Ra| z_Pwe??Zd>uQq~Kr!I9`)4M)T3@IF`rj)Pu!3B8)IKIzti<#4YJ7vNq8>bsM=FpOLe zDu4CiVdMtnOZ#pOk*6Xzf@Lrs?u6I4&(SzV{bTc#CMoJ4o2C>8Ro|P5Jb!bOz0S2M zE$n@?5^dkFCA>`ht%xVSG(mdyJgsrp^R$6_p0-fWgTJildzRPuldz|`rJ+k&= zIza7zbc9+TPlVd1=mfPMd;_e)^L2(^*d@hX|3}vPaaX8y<(r_^mAgUhqudO&Uvdl7 ze#fm)>&)Gu_CtEWjilETYMuEu7{mMN1+`w?8)`kg57fGTU)Tu$eo*VW{h`*EZ->or z9{}sXfl&JbgP`^q29says|-nruK(VFyY?l9Lao0KgId2H4zuA1sC}tBq1KT{!j1SNZ&i778wxVfU)F^YFo(Pa6X z9RtmdnPT!wDO1g#^?%%D$4pC+9Wy;;2D0oJQFhEsC_Cn5C_9FD=uc;*yo%f|l5FWG zI2t!1++~`2|q(E+6?*Ka~R2Px+zx zu~c{-{WS7X&XbXnZu!Yb(Yn{axIM z^56>G^WAjAQ2k+noBl$md=06HqJpC=RSiSO1GqJ#s9%YpBpuAMYi#48`Svq1>6q5 zgc`rLL)DWVQ1#?1sCu#!s-AoecjLYbu5k9Gd;?d(-Eb}3Ywr)c2YKkCZ&UWcQSdwR zq4c4Rulu3K*YDv5cmQsJ2hme~`vIyR{0LPK4?)fM4nx(4pP=gL&rsv(5vcL>7c0kK zQ+_AD@r!;FNq0zr3J@h`{fi5?s~2(?sFkC-;431&wMV%UmkzG7f3vn{1sq~Q^{Wu4u_TT z*ZYfg^(3Dzyvkq2AFU@4{i^;({%C!OgDUT8Q009!RC!k?obpuzDnDMR_g@q0eb<7_ z|NZq{|2nRJUDv-JRCxS}w}H~5J~lL}J|L6-c>guHt9&7HV}BF$WoJR2x2eB5{z|u* z8y_<6*ZNx_$CtJ+%D<)Sk2~}I1b=JdQ8`22Ut510xEty_XSwS;=hd)1;r{nMN!KIG ze(K%62J7YAIopBG8J#a6ST`>mAuDB1%uDBn{u6O{-t{4kthm3==A0G6p zpMA*xs9*iw!y@~q%>UsWI3CKrN`f;W{$|%ahAcbdaVR_E2`D?`Nq^Mdc?wzf%F|Hx z%QH}R$^1_2m(TL2 z;NEljZ2#-7J7m9nj(@HzL-xzx@XvE)$bR{J{{mNr?3eo#kHrhw_xAgPmj4WYs^vdT zGWkyz(aSK|>jd2V2SxUyGyU1pi)4uwALRT^$e)9|?lpz%Z|C~+k!u&{iKYkH-wyi= zaM%7eWdC`gzYtmb&yf9d$6th80U5Hd9r2eS?<*=6Egs0e_M84vxEe0TziaU#(flFz zlrHfv#l2_oTcWu`_RW|1hlZm2<`8@FZU0WnIo4U>Uxj|0^NxuAN|V|5_rFVjs&y~i zu{%~vAA50)|2>!lC3~H<{&f~^r)c(~;vH4=f&9&0gk~?UH~Ay~$L7!YkGt%}4Sv~+ z8~vXk%U%>^FMbMTFK&Xe7Zs28jXy&_#08)V{!9_lA85 z<0ISsUyoX!tY!Qx^Vj zH~eWg{24d=SvUMSk$Urw|6kIHbIyyTbHQYIF`ZXeTQfr%koz!~7*DO+3Bpv4e z=HDQ-zWFyuy$1h;NJG*5A>)3$WV2tPm49PcOnq(wwSUzVYCo$PRDEj>RS&Nvyy{&G zXyZSWUD685UP(Z2h0`{*HCzSTz_qZQy(iB9Aul7H_E7fdb#Mc`9&UjhpzM&2Q1)^n zl)c;u%3i(!YTvCh)V^C6-cLDC*VG&BJ#|gJ33t_dX!cDvsQP&`RQ-(FgWXeaO_g2J zJ+%++dX64Y&(+i1Z%gfstmo+k^?b-$|Cc^?P~X&kxGO$LJOfhu!x(2k>g{ki9E88p z9q8&wK3zCCb%^`kA@Uum!z?`GKODsKNse)br;gw`^d2Db-a>5Wd6oh5hKSrg#Bshrb>V@U6R+gtY|%iekb|0T;A|6Tua$g;N{gtE6Df*bLF z7|Pyy1j^nT4`pv9L7mrr6zU$7$Dqz@KMs}t6Hw_t2@j(G6zRwwdm4E)@-uKVoB+Rs z`W*+I6MZh#V|Lo}P5m-Oy~uU9aCW|-82?SQzY?hVODP=6dw&yZ9yc(<;J(#`r&n{?^*w{CiNrUV_DH! zk>^-vve$V(^#hYX5-q(Cq0(P(?}7Dy;)``YPTfTKIA?=M_>CreoljCfHF=Y0;|Knf zB(REH6nXbcbos7)P2O)EV5T5zw~eB|6S_0=Ko#lLHrXU`$hAI^g9P6TmKL3 z{KyYb{r`_}J3Iu{-yVi4&!3>m_h+bbKLS>Sf$@J^`}6a3wV%Co04EK0I%^G`^>RG4K{x zKJEYZqZN_Wk5+R1W1;4sm7)64tDySPDp2uNg^Di@Y93n+s$abts$Z=R)vwlY)A2&} zm)r+z^I^?n)z8)De&7eG4|SmW$GTAcV?C((Ykk;}bQ(a-V;e%vV;e!uW8e!D4ys>nZR^Dy(uR?bSf^uJ=QOp$M3H*i$z-q7IqinDXg`WO?XQdUX@6bQ zZiGotve&sOt(%1#CR#tLct;i8B7f^gq4lHPP41D_)BG9#aaTWjTblaOUTM9N)sKqm zNBcnaqkW?}y6I15oLWg|h$0LG{NELiNWFLAC3L-E<#u;~fvx&XS<=_o$`+SlZ+? z*~L$#J)S1J_zB7M$4`np=Tjzg|8H818-Ai2{slMu zBsctIk^1st+H}&1bEb%-^ODJ4XKLCslc$T;Z{ttBnUR)^e!TN?+Dw=PCA0sZ_NwV8 zi`H-BPX1=4y=M8Fl{U|wZ*JOb%irsgdA>O!>CQFT>%8ISZ=PuV{(STjodszbrsor_ z-%o++*Zr0b>;IMx>;LvX(@jtQ(ytK-rUlGDn3hF+%_5ni)gOp|C@tIkLuvW=Cq!~Y z^M~~Nd6KQ)hgR-ksD8fy%HCfHW&amiy(&s`EFVQ_5!_X;MAge;;!}TH0@eSP;;#Dn zCbIhLMacaAU)o~G@BgJOf&Bho+EROO?EfQc99RZ54lIWo;M-8+zzV2w;2o%OU?tSJ z^e)u6v@-9aq0)Caq34X{XfLGfEu^TpvJ9>P~+CWP~*`h zsB!Bu)VOs8YTWXqN5`#J?(f0Hq(}SD@=*O_1*rb9B2@oa394U>O^?>E%24&_DyZ_W z0##3{rmKIfo*tL3{;^tm?R51YSBtdM>Lzm!aJtvz+M=ab6RQ8Nm9GAT@t^o&ojU0a z2_NUw6$xL@WUo^{y@AOMMeFzQr{8Oo-W2_K=bH3*m;@zzoyO@+OuwmU{T}YtZ#Ba| z(P^IE#{91pt>0<^)i1Sl^ViDFUxI~eZF=&TevL@G^tR^TF8w;PaWcL-pncsQS_wY982y=TiB1$kh5_*YvyXz1)<3E9t~J-9+NK z*<|khO}~Zb(>x4!-bZ)o^FDf}_kc-Ive&sSy_bc%TQvJY@s29$BY(3WpxF=oOzxk4 zyZN*JkGt%L0lbGRR|cjJLYDm?%6=FOWj_povLA?t_dFtfC~~{VFiStt87`9VWck~D zWOu^&$Vk`!F4y0}mpe>*9Yy-;*G5CtyL+JO+kfZh#t`1df2jIhHsDe2-ZDeJp*v)!(G_r+HsxMURT)_c4>b&g1D%nEbS8={*UR{!{k6 z%>Rim)_Ep^w){6S!A|I ze)<02{O6|6G5@*g3-C{fydj!Dq<^0;*~VRHjv!KSsY^eGWf*N0Q+;Ypcd@%oqsweqS^&|{6z7;@?ZwsNy zTl=TGh===B;y-~!eE+`{M&Q#r$Ag~6lM>`dkpKJr+&7W8qqhiujW3IlwZ60j>YjkN zpvH@(a3)*^HU2Dzzaqa)IE^zakTo8?1GR3n5^6kp7oNj?71a5u)llcB-h(=CvbIumbWCsP(!x@}lGYuhh47yszJ&#{J)668s}QI{v5SMb8l(OOLLb z9p}C2ywC~cUW~hc!iV8surE9b2f|bEPWU$*3QxmF;ThN&Qa|bU&!xBK9z@pv(=XEg zSpOGke-}*lIv3N+Xn*SWai<^oSNilLm(wqyp9Cd)oh#{{4246=i1z!6cT`bK2DE-3 zTEAbxeqU6-Uj?e)uL{-g6A%4UwT!yRM;F(~xSIHC zd#al}yR?SV!%nE3;mwepP*d*ov$aI>SKDN-QzrvU1-Y(h^U!)0Z~cr0#Jd=~MAY|= z4b8n#MpNYPagUcj<#i1_g4`IcflZ+1f#{LH78%Wu+eMmZv>^RN=US2Uk_#dJEtOCD z(N-e<2_pXXeD*y<8~i75KBFy+A-#6IFO5s>q57Zea6iL5^m?f820Fkx=yk+j{Zu0I zWWslX`kwIysP7p&L(cza+=QOKmCin~C=psQZF$g}P6u zJI_(h(=(%oJx|Y!+i=f7Pt^RP7u0uVz2Qaj*~j$zXY@7w{u%vXMNj{X0r<~Ye7k7h z%}Lh%L<8ZwtCAKj4n^PVT+?U#$6e#$9Z=)$P*{fkFsOVDhsyT|sPXzvsPTFv)cWXM zums)>RnDWJ?9kD06}$(kJnxl1&oc(9-0vfQdjIz$>vi-{vdjAjM zuIG3d>b*UJyUK06)z8N>lB|9{nlZ`h=VK!8|8bMO&J!6=nmkFQzC4vNfq0IR&eL#q z=`)h;`^Nv=pEW(!|MAyzKM(buCYs(0ikEP#|HEx1lQUi-KPvwht^B7*w(^IR>-3DN z7T@%YX|N*lOv24rJVUf{g6O@P@v`Z?n(>P1y_&(js(g3&T1GO=fx2fkNWLM@F*}3r z8SQ;VziXV6LAl!auJSGCnV<27>CMlWXYtL?NVRkqWcb{4A@Tb&QY?PI{4IXz>D*Kr zET;aYLyhAZP~UR}U>{mF)^KOy2%Ip-ihfqpLetKnh%N0wcY4>!Ot zlwDB(WmhbOvMUOq>=N3cFw@aYr+oe$J2X8{HA1oq$)uYA8YWGW^ z+WA{h?R+UzJ6{IXKP-o8=Wi2EcE}1SyW}16UERa@kF0w4E>yi-g?S5b?ebr@{}QzKi@2>O0Z(Q0@F9sP7s-hWf5?1Jrko8=?A*PoVmN zPoch#+XPF9Z!^?)rJq54hq(pn`_j*$+SgV%yL4N|4xU5zk$wU7ecYF@J=_lU-5maW z*Z5V&PV%kq8X@Q3zRuW%yVj>6>($?6>~>|ydi9=+y{-)T-gRHbx5!r$9`gO=cNzPU z>m!ThOTW)JfO~!7gPf!LA>$yNviOILA92??I*48RQ^p~<3Lb`Q;m_928UK;Dl^n_V z4Slt{U##8zD%si{`FIvR-mI<5Gs!RW4^#2t@1E71C8b^KdWM?!t0`^0=!W#z56eWWrSppwIeG#Xu$8 z)y^RLR|R4r_x=Sc!{M+h{%QwRTs_IB3*!RS0@3~g+V_B0Te#|hCfoz2c31=cMg8$Y zwVRqy^|%({mA~3h`Kkle9_m8nuO4i+sD7X!`q!Y}08XLblFax2fyVf&+~NcF{l8=@ zH)#C?>GK>-1I^G=`+>;K1J~lOd_mk>1X|)gh;}3Pby@{lAX+DWD!GX7hBt_vjMKHRxpw0w22e07v;`GVxTQ=lt)>kB&vZm{?|OErhlVk z)0g|v!kYr!Ej`Zv!@lJ6W(&vo4|U($t#CN*=+XXr1bVstJzf9Xpu)+$ozpwe2R$4A z&A(ruFWg<&FVNq0hs1Y#U;wiA#l-JR?g$Kof5SoW92^YG;1GBe4kMh>846>dj~MsC(hm&)*5vzm0_I@9%|VHWa31#kgSWlrRSjL zd(Xq{1FYc3|zJHkv590o!h&+Y#G%tM#`4H|?;di)CgGZ33!|UF$bxPjH z%)ra;dw`WU}ADB;jxBY+g*#DP4^ACR@1+xEdGW-95Gz+&_v~?%+%I#m7Ve#)_ z-CgoR^79`viEmUPV z*%a7p@@Hal1@enO<+>&CrIqW}z~@%3TTSNo{{ml_{+D91?n_1w{q2EWrvFu7hv|Q1 zve(%e_}cV$iMF1F-Zi?1_#3Euh{seyKgL-V=mHddF?CnEP^OD0*^NOFK%K2yVt@nQfS@!uaQ1g;s zao79*4Qjmm9jaXZu=;Z}a5A9r`Omgu9NV;(*d!1^*=<{yOQvOaCRu9%7KHY;1%c0xb>UiA-_m3MpLkk&8U!2Su66*;UT6eWKJmC~9(fJ&VdTchYL86_*TT~@*vt(F z>+M9r2hvl$>4>cMo`|ga)(OfUxdC_e2c3~s-?|{HAGk5-;hyxa!JCkeAw$Z$Td;?f z_st^j{T7qi2MBgIxrb=&9e?zD2K$-*Z6f-;O!hjxgMCcyCtCgJ3)P>aM?L8u989=) zXF%|Fm;@zzoq@qY7H+U;?H+gQUx&amz{^>EO{^@bt$K(D4 z)P3hq68>7xQ>yQFe|j8Ly?zG&70z?P32+sB7OsWQyY(1aeVa(Srwd;QP9h$)4`}sl zGE_Z#5l*6BOffwh$FZZP1*ZmO4^0ccio5F3bf|hW!`x>EUqO}~{W4TLKqg$W^s&p5 zgRkMP`Ur{V_24WRHMtc!F@t$dC5#qQ6i6c5pW`=l_GN z$PefLMe?)KWX}Hw-{rlk-QiBVTP=Os-J0Ngkn{g0bN)ZL&cf{$t^T7&KlnlLL*!@4EJzWO@21G!z~E6abPvs2``8Rv12kL+^Yzj56yT)7?O za}WOgs1JKdU-f$*RQ>)Is@{G_{+fIC2lYLG#)1FN105io#`%L#me|{6m_wOcqoj-y{O+F!7I>(^WJ#Np<{Ga$@ zoj-%8t-Svd34hXLuX8H+x5=kP>v!>|+|L9rSh=4Ip0#p6XR_D%CwSiUFNoIvp~w4O zzpxCwMCW2KCR6eME1I2jiTr4v@3Nb}D{lTgnF?1fQ+o0jIsczo9&-Lavr?vqeZYz$ z@iG55|H_%M=3hB84*!J6RigPr`hlvFt^a~n&#FQ7gI7b1tJR^+|DpOdFVy&16Yhky zpvt{ARDG>u@iPBM)_7bGZh-aS7T5rP^=l2G>O~`{{w^M>zFY%Uo{gdEOB2FfE^V55 zE%|KjVg3)*UYbL-6Wp<9T4W}mw}SXv!d0*pTnllh-L%fsx{TIo#dpak_NDa;?dUJm zPqc^XAFhKR<9|KryZiWd9-|}fI*&oWV0LLI;#a-70jj=shN`b!pz7<5ZvMMMJ=aZ8 z&)W^^`EJfsf7c`P7R&#wnSCgqvZC%H<2Z~l-@u$8H${dD%yfY+oFie7yx&JS7sOb+At-j)J^>sM@ ziOz`3d(8h%(dz3+sQP%9o4>o={Ef13qfJl#(ytL2lXAI3i+GEOvqNPT@svej2;_4ERQXPZs?RS%)pP2b ztw+3sto4hjmaplV(=xS=@p9%&BjZ1e$6xXq+~4A!@wO$ei1z%DdY+t_T*%iv9{aQL zbQbYyoSmH+9cN#M8fWL=uJLs))cE=aj4z#+nTo&0-}zAc)eE5Zt9?-W)hST>)qbe` zYU!61r)6eYeGO)&TmCa7Q(prj`3suN{lA&f`9qe-xSX9Cws3iwAq$rynQ*xx;qpxO zI{9w6ut+^C$SgGfg`(ZdE}n~y@AwyKoVWJ^xwpSKv()NSiD>SSd)(j5)P3!V&i(>u z-+eB2+xrrz?>*mw@57~VKU@aY4=jheXX9=7F!sUuRX)Uf+Wg;hId3-K)GdGx|O1I^6YL>-$jO!F~Ys9qflt-@&ej`VRIZsPAAuhWZ|L z16&C=!d>tasPAb%h59~r6XmP^YBRFzozI}Yd);E?{(0s;OPXMpzb-@33U(2*HHJ2?1H+Fl@$6w#gitCCGWd3CJU{$b&M%RFM?evwSLUq!S4M znRya9(fLcX`ULrI^;G6*+-n#AEt)&zyVWz9XK~ketB~(t&t;xRE{pslnjYl)(hHeo zxa(eK$oH!kGcO_UEBaS7J;?W~S28cd)vz4%^sdF8ENK3a?^k28D&XF;xV&iYknd$H zX0>teYlf@?#%8tRp3_*Ta#kGran4mD`c+K!I&oQ5v!eDZ?u-l7q|dleJ?m&bi>X|>|Kkl+W>t|_x)*!1Pvg}V$_Gcp~`!gP% zq<xp)9_CqAL^G| zTfA+u+M*x99a_KL4yr$IkGtmW*TI~3lK;mp?SQQDwj$3^nd| zanrjIYMk%t#(xvkIMEHpIyYzawDPz`S1zE(Z*~1DVN)_`dPX3&gy05 z(%WRO(Gul0K5H`JJCsh$dI=6? zKkEfJ3QofRL5M$g-HYZwe$f<>a6<~DuYL5XQ2UG1;G@)==}`4_2F!#rq3YqwFqZfE z3hYjMc@?T&Vo$IhFe~e|EX~hnWz8dg)vMW1`F`Ep=VZNstmm2w^<2n=n=gIV5$0zt zz+KM=iN~MigE5XjD+LaRY542?q`G>NPZy?VWw_-6d9FZKfyEch%0gB?GNJN;Onli{ zdC1B~$o0>G%1^GVhd=K#-{OgJ!lJ!L#k;$3Vb&~%M~Vb z|4-IRlUIwh7sh`#y;V@@qfh&OFY5!s$2n_6!ml;i>#WOq-{cQOYv1_OzCX;`hX|I&Wr&*ia@_^PpHp3Op=UJb@Rd5Sj3%9!M2wMBu z2Gwr9fE(bKQ0-V58pdY^ls%6l(VIq!pd z|KAc`>#W~Ft+VcjT4((pYMqsO-D){@>_PPP`%ynY*~>p>$xc3;bqKD3U*^az{zY%9cO1&@JAt0;s6UZ) z&i^l{bN(lx&iS8$ng{+3b>9Cp)Or0gQ0Ms1LY?zJ2X)T>AEc#?Xfc(i}l0DXSvH@hKnyGSF;N1_uilK*7W zi;pyR-J7`X7T)SvGtyT*YYtTpuO(lNJRim z*6EskE8*jun?%BQGui9hoPCSQw~E#e;7>Vq&+d&r=l`>Nz$7S{^Z(hsOux5i{Q&OP z5A?x5(dnB#*!=s6HeUCK8jo*x^EbfF-#`mD$n@kd{Th)wvWJ-e9ofT(uUTZMNPb!W zH~$gY!_9w0_GtVQB6o`B59tT)%D$U?X&oGv8_PI03T9Dn@h?{d?}5eCgL|R+kugyH z!F^Eu!TnJE!2?kJ!C1J$c_@1vTm>J5YvIFIE{y-?&-p)i7wL_6>p>E-?1M+4`nSj6 z2KYGK0-u03|A#jJhw9&+w&!5{hpGn?pz7DNQ1#?FsCxH2RR1;+TK{I_@#O4D*&44V zXHR$aUv%}SnEOlF)7)@V-Ehc^$1|kQcswI}ChkfP63?sIFT)t;)$CW`aQGVj%2%?h zC;4>YtnAtDdxyxcXU~m>FPsAh@m$C}?;F|kqVW}qy9);BO$#1lkTKl|Ug`z&Nz|Idz|XAeQ0yU&5z z56Fe;pYz~M-1DK%k|&t`a}`bIr9kAIg4W0n0i(MTa%ws z`NKD1B3uNO&&6&&mmv2?ehaQ9{8FfM9Lu22pD%}l@qZgOBHk5H=Rn?pI(NPj>b&{8 zQ0MGdSvy>v{k5&vyeHba#Txvz-m-w-dz(mmTbJ#z@#cM~^@k6j)*n73UmADTBWoP` z2)@d=@o{!^{a^#K#*vLs;C3>GijX#^9#-+_rTq1ICl!OFNFhF2(`pP;_C`WaTk z{Rq^3X}`cGxc>@k;{F@dcYMFYI>>)O?e`poTHiPZwZ3s2YQ5zI)OyUHQ0p;&L9L6N zgj)AF1?#}S;ToRfG}OM)8K`}yvry|N=U_w9`v+>B=RDkt{sq_s_cGX*{9c5IasL;# z!2J@`eIS?NId}!?dvs4I`W<{ZsPFA#;2KySYCWj}jF4`{P;{NC60+_siG{jvq%zdK zB3D6u&sYWOK9QV7r+S=Xr*svU~1 z>p<3Z>V)dzuXPbsBTx}R?OnPNSjYQImH`(i46XHpc8;jhB z)+E%_{2Bkz@3_2KsJSac?nAp)@mhZbxeu*nr~~djm$wQfxbBeq&{~JuxH9BEw6>vk zt_-;kt$pY^SBBh&cD>@Ucp>Xd9YZ%-{yT>fE&rV)lm8n;^g5gDb-K9uzfokJrfaAh zdOeG85-mQ+dehCJTX5HU6J%ZK)=&@R+Qr>P(}S!l^$gvHyVjK;>q@;seUQr{y+zZ5 ztSj{m^}}83N|1G>{-FWL`-*NCO%JlJG$=F>u7*SK?^--qG=IqY(H$Y(f2RA^AnTdK zLL-s;7Yz@MaP=Vj@OR4H!of=S6yFsZh5OjzyG3({m6D1_hwjDwnc{mybBC2C7mo?u zk2~xCqPaur)dQh%xF;8n70q3;zxcsW_l2s5w=RUQSN1U8hddQe(SJM=`v3BNL;P>>Zf3L`l+Yk9^_}J$C_tykB)r@^eoi(KhHsZ z|MNW5cR$hlgkK1S(T{Z|g7i*b2}<@l zGeR>hTv#+a9Cz&SSLAPYIJEusWGH+5HFKX8nr(W_|8bW+{(4CE_?*yOWZC1Q?D03C z?D2W`{i+I~bvO_t9OLRga;gSm>>En*Xs7<;#5LxM=k8EEsElThDdoPs%&)8A0#b{eYO&cMZx@K%4% zLCtsmfh(M{(0RBDUVv-iMJq?fe=FaALzhV}-g8N`dJ1iRaRq9=;mL`%hjLKuAqJ}6 zmxrn+6}Ttp3DU0!myvEIsQFJU+yE;>&3~?fn*UURn*UUV+hH8s39CWP$F7E&k5z}7 zkJTU@t@n75HE*j4)gEiXHn28Sd#nT1?&?B)H&G9EX(y<mBW2W z_Wg+NPdZT4I;S1-$kH|6$5ja z_t|)&^IIx6&TF-Lhxy(R;?=s_9Z>VXp*foW4bK?{*FffZ%>PD+_Fgpa)BJ5D`kLq6 z#X6kkb$7e#aiicR?Bvn-YhHK{)O?Qn^lZMw`kRfj(Q)+toT>Q7IuGPLMES%yV@1*# zXR_CMDCa?*U+1iFr(bzk`t&Q~a~^?7P_oxa%6ZhnO%-h%RlK8$9+$s8H?;BdNvQGi zDRX~1=NZ#u{AWG+%9RN@&*HD~Q`GqR9Mt&vJkCr5Vn+#EmerL5=;k$lZF+3U>DSzxkXv~+w>>899oG5;sNSSK|nNccD> zO(cA}$zCTTCtz|=wEiA{$|W-=7yWoAJ0}Y!LCIbxl#^rnxuW&=xLbdphd<+gPQ?7f zqV@L$Q2qHrH-Ck0{u~QeWP0+KevL>;POtp4>~xB;$$Ti|M__V*rC|GEaM ze_adJzpjHiNBcfhKm7setNcH-d@%k)mFq`P_2Xlx{$vAGf3gv(oavXU*Br$BKgUzO z(c{ejVLaRnuYuUR)}FVZulD@8wdZX)Tdh5B%VFJ|_WXrt?*ZEPHrt`rf&OdXUlCsI zdnfHy>mOf3t%vM_YVY4b^#i-1&XeqcTCdp)weGPG>U_z!Q0q6}L9O5HhdN*KJ=FTo z0jTw#gHY=~Kaj5aiyx8KBOik6;9;nBo}chnzw$G()?fbn?*A9wtG@UD71l-Xx18wr z{=XyZ`+wd0bA)t{a<8Y>{f|MdKOBczcR2y|`{94W1oZ!cI{$GJ{z14?P`{V`H`F=O z(@?()a|W(NJ_~1S{tvaz@DJ2{`#jWo!3C)Gf--cb%#;JIR;)>F#ED##U})@v$4t=Ck7TCa(PTCb^`8(m+z3i%VlRe@SxstUDU z69=_kQw?gJ>1wETrs`1VMruH&ycEP_9)H#uOsP%bEtKjYoXRr;tP>qMR4N_Yd*I$md}b-XT6>sB{Ht%r4mT4%cn?tcEmP^e;9xk#TGa~m+^Jo7b{f^5= z=HBJXkoB0m6|eOtkoB0+xv|(&J(u5;d#~#bS&tc$d!H*q)?@C^eZZ9=>oH?<$GI|O zJ?25hWAVa@eR!USb3GLg(=Ifx*Zh3EyI+hSlybsOmu{ZwLJsnTw z`f-nSp3Z%abmE+6MADgHGWY)EKARi0J8)-wdtUmCZ!hFdgh^1c*O`<%*~0lnvpW>; zsG=$IH@gFx-7(eVX}QzQpYb1e*&#Ey*XzoanYk|`%kB_mcf0~+cf1N^cMuQb=4-jL zkTw2^+E<%x?yu+0LDu~V5WV@ibCKIc-pHL#J`h_jU!0vABHT#w1DSW{=H^(s zxw(1x??ewKH}tUn4;w({-8SDYz+d*rLMXeZ5bAjysCjo0R5}r;=Pib^mr9`QrBXNF zZ$gcii`@J#h8ka&xaqxR?cnX)rPdCX<*wpAl@%=)c@J-!>~&V;zGLz#(b8E7mA`lG zc^LnRH`ZC5`#$00ocBb+uQ8eP|GDc-eqS_u34iL-2e}*2k9XGReh8DGWWN8){n+$3 zh-NS0ZuZhf{1cr|a<`iQr=r^3!xhfH+&yp=+zZ#jZ|%J@{v$7= zetZXIH|>WT;P+5=(*Y>E=^&Kd^aI=ue}uA|4w0_v-(gFi@gJ%je}<}`N1*JaU!d%y zU!ltVH^QsF{ti`N|A4BmN1^J^F{pZb9BSTs0&3p-C)B+6FP>BN^CYt7y{CAeeD|OG zx4qZXxo2=!Jr?^fKAU@vbXDJ>)#ru6$9}-W6ycihcRLCn2hr>$v>v=1>dXi5U#^zPdi&pLVa zNJr0C7wY+tiNAhcJhGmzf$QH8>Ny*^diayhHF=FmN96)Zr)gdj$oKzwny<#?wi#y`(BYnOrXMFCIcLTD{Yl|IAy5x0+tKcnp8ppfk-DrAUCDWhW zBoco&liB~zi;kZae(vsmx84H=uw#0{EO;CFkiFXrS@(VQhPpSa57d2N zeWC1ap4;s4{^-kYza96;TR};{yr%C{(h)?&mMr< zUmXjzzd8=ezJCyEfA%5x9efxbgpWYodo~{a3X|Yb_$WLJAA_2=JPt3xC!p>-dlKs2 zu&1EzJ9`@HzO!dwO*jGSzO!ec?mK%9>b|q*VGB4B>b|oVp!T6B!A@{8)O}|!Lfv;Z z1@?q5LEU#Y6{_5(LEU#Y9csUM22}aYgqknC3^iYR1!}(ZD%5-_8LIqWgSr=O7F7Aq zhPoH+b*TI0=0M#aHy7$&xi_eXjQ@Gj{ptCl?N2Yj{}kyW+dZi%v_H+0{800#)V%+> zFU{_EO2=K}aR%I05>UIddoO~NzxwA)(%DmzC3kC2^8chbl$VniwM!xQ73AjSu^%qG z6vocR&d-N!U>J@iUBXqGj{UX}J9Kjr;QIsAeQZC-r@eu&;L zQ1jbgq2|-S!7t(OQ1iP#;7;VDQ2X)6;MvIWyc5KC0)J@pzdzwY{QrWQ|DA+~kx#*6 z@NcMn`qNPR^k<;<>CeJ)%s0=$SojZ&gXiHy;<*4d4=#h+pT7vTKmRY({`@7V^@7V# z`}0?z_UAqP{%LPm4(dEa415K-Je&BVcnl8eR*v&e8&Ey`&|49JYeb!UQ-8 zwuVz-8~6%r3$;$u4r;xpJxqbu!63XI=E4qeA?yfsz9JDWf}Nn&EpC8Xx9AMDZqWs5 zz2Ziw^@^@g>lHUatygq|d*IDb>ms*6tykO%YryWX4(tK7uF(@}z2r8Su)KGEFE|Dc z&6l0gKfh1D?2*3t1K7VTE9xiG@AfyD@Bi|ncE$ja`TM~9LGJ!0Wd1%le~2qX=I?hX zUhB6Z^Y>x-_u}4j`SAP^t~+G@erNtjSBA{r@5;a1l_B%@QTd}?88UyrNAXy^kmtBB ze~dlHeff{sbBxQs-=5=v{D;slD;g`JKh9*Y^Pu}254q3raQ-81e30iDpP%H)kmq<* z@mhM2=XgAy-wozDp2&aFb%#91Q~6K3GUPd)$)DiLkmq*x57gFO1G&bsyO;Q1>GK3YDMV z;BxeThswtvQ1=fVg}V3gn7xk^`N!=&p2+_b_nOpmaa+k>`G4~qx}WYO?`KcRDarPJ zAn);P{%H$$HvbH)i2RS@Uwlrq`#dH0UtE@d-t;cyUqo)Qq)fDR0x{P4H@{q1?dXz7 z{FhDU{@;9$$+(82_rmZW`Z3{`=r7`&@*?^bO!hhz!&6LtX(6n;=U9Y+d z%6_i`_5P|tz1KLX_g@Wa9qnqUb+qbG=UZw(-S6s!s^>MK*5PVF-S1i(s-D+@s=sxi z-fumq`dy!Vt6nrfRy}VBRc?)N*SbYKRDHV!ch&pGQ03VKsvMi*ulm#sS?#7d&lTgj zHhg_p?KUCYBCK(+rDWP|E0On-AkyC3hFingrES9Pd5^U{ZAJQ@c468vdhJEz>sIsxT}Rr6iKg3xRa%KgJja{ED}!_lfBN3ZaiHro^2&Jg>NDMsz=?>-&1n4 zWb_&Tc@Dn!58rCf(<9v7%Bx5CHqxE3xTk3K2%^^~+{^U(gnOG_pKyQl{EPdA`@$TE zZ1=Xxy+&j}_;wfv2jZ^ZTZXs~4i7T-!Qm11Jj236?0N2x%<~Kt$=@)Oz0Pp=c}9rT zzdOUD(Tj6Nis;>Cve&sgJj&$JqOEh{Pyc^U_yP3eoiX8iVG@+=b?yt_Z~702w$6z= z`5PA=Yxx@&PO|(x5`NI~_mE`r_pnI1kC^Or#=H4T5~&yK7e0z!qVrgIg6Taj+WOTK zQ0t&iS~|@CEgk0n_FkVcJ^4$&M&!Bhv*!O?cp~vNi##t{xk3CVgFGR8 zGAyPadkrpwv!MF-*>Ht3H~czW1?RxE@C|!!jQ_+lvUFZJg?!#yI$tE83q-rW)CYBc zDKhzH{72S!k&1j6IgRJ2VDt#Zu%b~D}NtD z<$D9vxV91Me&0`^>cgi{_xo;wdas+|?9$J|TZyM8`Q8F`-{$8~_x$3{y}aAPU!bRZ zc_H`mei`15tb2LI@})b%U*TS#_#o%1z7Fq%Qx<<6-i5pF<%Q*1F8U_C8(H@QL&nQJ z;ct=E&+Vn2?J3zO+1dl-9^UW5-&;G_FWNo4koSKed=P)Vf5`j(A^f8&i#-=57aoHB z;9;oe{0Zv){tWegk3hZOU!d%VUx`1y^tbRaWPPXmJJff&f4~leX3fji={e8TzdzXDa?Jp~^7ez+V|y@-LTN9Cc$*$PniKUajZ zcPhc}VJwurQyI=Ky{e#EfhYND@>vB|gH@sKdya#uAM&r_xw@b_`YI1ddDJNIy0X}R zam|8SoZr$u2c%!CQ&1bmz`FR~i#x=@H5$?xpR1lARjOT-l zE7ue>=bTxb(^#b5G%?xhG%aXma&s}cB6ctS=wDmV#`If==(jZ4>$ECJFu9Fr<4|j; z^JC~S967hG@QI*7@-7ZZ1zKXim=$Y&zd{dk?A<`*|W-H+E9 z>ReA3sPox3Ld{RQT6#AX^sw}9F6d_I-E6YgxuxJ%ORtA$<6n2E@7>Wa*S)A$K~H!Y z-UeeMy$bphU+<#cBIok^6!f+5tp6hqDe5P8Yj2SG)9nQV(AWKVka^O;f4lK1LP{xBF*C6fpl|{Jm2ooslMcox7xmta!9< zGrC|D`(C@@1EjBh_#UW!{a$k)Q*b}B`s@4PVTeq)vC?NBX>7qb+|~a>;(55>K^Wsa zT<{Pa4#(rKe*O_xPx9%)q=H9zZk>~a=(GNB;aUHOn`tLc!1aYs6+CI~PZhk#b8ahn zy5L#DtKWKt_qeBIf@FJ-(Aw*BQ0?=1sP;V(s@=T+)vhN&we!ia3=*%#|ALoDXAt=i z`#Mt#rs01Df5>yqD3}gooEZf#<6gdWrfB^xME{k7WMsX+SE1e?GWmV2U=IGnomryg zd$#5Kb;*`*xgRZ@Ti~+7Txq!BK@)NfR}scyQs z(+{N=1l{l%Zuo$OWBiBhoXmnO^qSFcK;-O#5OQl|NIE$MxyZVYTKv9bVL=}J8|K4v zFbvCJ0Xz!X?;~HY78Vj-<%!&Q{r_X`J>Vlf%KPzG()oP12KLrq2;jh(5JJg7&4>7*;}@@n^$wAMCn(Vc9{VMs!N&=NYFr1ROBZfxU5vuVbZ046pNih&pifdmNr zs3H8n-)CmtnfKk*>TI0MLJ^UV|*CD<3FxUGB4!=+Gy`R6a z-mhkg@*j}jskLkLdcT&b=f#=i%8LYjKc&vTH-OueBk%V zo3Hq$;E}(&T;^5TxvqK-B7cPOLx1$0!{0ru^hZdcKl&c?i~fiy^+NZ+u8(@5?<1u? z<_E|}JOp>t=hO@Q1S##l{sXD_{~;CsKcv(%{R}Df z6+cHxz0iLlr9S8vNU0zCB~t32{vT56pMHgu`lMeYy#wiQkW&BjTcp%K{SGPhPrny9 z{_*gC3mpG&xJ%@K|HBmU`J?(rQH|uK@YNN<+v3EAEeM@Y+ivJ zQQ*V$SC?;DNwD6_w=xyDBZVK@2`dl4^G&D+Dg6B&xRS*0)7BouRPrH(f7-T{6Y=~Z zM^jAYIa2tiJ$U6Ic>d=oj}-o6C#^gbzv(}Q6n<$BTlq8mre7LT_@zC3<&pUP)gzB! zD)k_RU)rCqoQ(8?NFR;&Pe1x7rt%&s{OGo?JOo1)94Dmk zSNqEq#y=W5^0<}1()p0$TzovAOF5+QS9{{hlkxn5qfcTg&yj8pj&`s3cwRi3W-8B- z!e8ywmDBP3l*>3ePa-!q@?yw|kDJ1}+ktdHQal%bIpi0+I;0{8MhZFa#7YtC z>G-wDl|5+Z0c*RNqMa%EjdOoxdPUJycn-R1FY|-0+P|_7X@Hc!Q)_3foGs;wOohH- zz59-w%l9JZMJjaD`SSaMl^J=D^B>PiM_q{c4uAY(W@Q$?Nxv|qoHvV9eI-+YH{Jt&?^t;c z@}Io+&Xuc>21xlkwf3%+cT4{FFctXWIokQi%6swtw6*uGd{ExMpQ*s>YNV74eL(l` z8r{EZrQCIrkMEg(+vPW`Trcl$Sh)%HopSk&OwnJQ|MLDrD>uvg53SsS_kVTyhndRz zTUI)}?P~pke*74p3q6Zep)VulJl}zo z^ZXU0q~re?>35OdiInqx7s~$t<-fW@KJRNQU&n9qc}Ovj|FUv7#{Gb`Z!pEUzbU^{ zYu{S=w*0=Esq7!TNB-}u{6O-5mnrgpPkyJ?{&nRZ`TYZ?GVk9^D3Y{P7=1$>;qiQu28}MN0hgGo@1?z8ul!2d`?dT|t^H=@x6u+!ekfD)?_u&A_x}Py{QYpI9q&H!h}G>|zeYJCS5^#CI+89&7ZCrk*)^@E<$nQy}FXlOh_sG9{bw=_} zF-87q`3*W?b+7!MVTygYZ}nWXHvqWpM@s(pETrT!&qhkV^Bkn)Lz%C0?Y!0VQI7i- zDV|@zdgV7#?Bfep1GIbc+U#luX@Hc!Q)}7PoU|J-m3@ro$UnDQm;4K>^OAo-e&hbX z)r%y5ohkO=;%Wu$v7ZH`>}L@v`&mNDewLB4pUl^}cJXQz<+yK=;(3kr%5S6{r>r$r z590Zg)|QxJKOJBy>k%p5FLS-1-b+_6k@CXdA)l;E$%prXS6+yec;!V%iGLXPSA7uW zOa9omcE;M`+RN6SzxMjI->mLFGIsd`-f_>B_q^kjcXqw=`&a$bmEJpUdB+v+SiJJ5 z@2tJ+@Vnmhu2;Y7b?^V!`=5XH)YU(}`s@!p;hGb#`OOEu{(%Qxd;K+Uyyo%OzT(>F zUt7HP#%nLWZtA*AuTS4FdBX`e{OygU8=raOBX9ip4R_sm!;OEuv3%1-H=la*NjJak z=5OEp+7CbSBj5Y*KYS$n(VIW|>W_ZsV^g=DaqGix{rxT9x%IYN-+SvNx1Rj*ou4@M z6Oa7FzkU4mpXmSOqd)oCPu}>+{hvDhQ-AlV=YM+tr=Rob$9#J0r|E zaOM{}zO?1bKl{>MUpn&TZFd}hNB$1~j;&w$*E?>%>Jy@vGp6B-+1*m9{a7|eDlt4-u%s9e(R2JUGuF+eETimzU=NF z-u;&EKL2|+f3Nbd&$;J`_gr(&o9=nxJeWm(SO^N0pc=mR{u1wJvgKkrQ>hdJ{@Y#4lybA>gXwCJ$#oy7=IepY?mZj% zZT4D_Z6L#PIyjgOD)oH1l%7L(Yw65vtz2l-gYHVEzTnj4^&VUKg>o_It_FonJ-^gk z3F>$>zGvHx#QPog_*uu+UW@*gONC|6>p8aa>-ASvf;vu#)D!Qn0yDCBk8GRI^Zq>Y z-b__+5ED_)%oeah)aS`6>3W>!KgR3yA9-rpe~_0r4u5t|clLMAbdGkGI_Emeo&HJQ zR;-~vL;hX<^m45p6#cRMY&BC|PWJeR5_*Mg$NO_Eyo*6DpQ&L{2GyKQuL1a9AfL@< z`d5>ByR+p|J(Dj5Rm9Mb<}>T4DdQ6(`6|`?Ql^e&TAa(Lvzb!28hFs1%`IeV3&_iL zv2OeG)pDbP4ERLnBV5P2eaTp3z7c#=$>$r8`2CseLQwN-3z=$=(?4u``8|zNP@Aro zt3i6#^xmm4$>GBBNvJQd1xmF>wNOL;%zS`NR1ZouY@+TgTM>{($CIzKe&!EyX$=ha z((^7-NmtH$IHtJLS?$bsE_G%)>zx69^RFt>EGE2!XBoUL;Z3!(CJSOg-UppI`L&Fv zELZFtMvii41NF%Yy3kAP#|k`Iss+TIVipnV{wsVl zwtm7pUz$&6^3`0mT#+RgDRD9KIDDz-8DEDEgf86iop*&iu2h~!h5WeGp)%!-R>KDq{Ou;YYXCv<)g*@Am zQ~p`maxUm=!&9YvA;f!=)nG2D2Bj>JUwXJup3M}T zN9jr-U#oNbJ^|%se2tp?rA!rn+md7D`FU((rwgQWMx}j0so@*q=lzj-an_s)*5he3nTEzpH-3EK_oS-+UUnOjX)GPT-)T!;Z5j`{|KZcFxG5>(5V0k-|6 zMxmf{{5{@}h4m25$!S0+m#JrRK|RRgh`=ee94^C64-F6Bnm;Y4m+tK_4@G9h$uIaS zZSh$?TPQbjpy^7v;xdR%kf7G!*Dv9Q(K$;NCUpB*jDmDT1ulsInNcSgcOcg`GJvG*pjdqLV9TV}LzJZW$4 zH$7iN=yfSqE^^8S)t}+CdVhm_o1XV4gGVjQ`Jh(M6zW1Pgu`qiO2%ao539U(r=lbH zkPbU1(jBg%d}h8>uGRC|aN%-2+I3MV&#P0r+Yq=s-|c%try(Erd)iirZ1RcHU-o@2 zmY4m*r|VII-*Y&?mVlP)_zx$Kf3o+;Q_oC1*gMH1pJUrMbZ4aw5?(%}C(M4T*Ox1Q zcS1*I?$k3mG5yF@N!s6%pZIlm2p8_t1puTLPGk?>+x^G)$pP6tob{f{8wO-M^9S}< zy__uwVo% zBox_>(?Pwrmd^zP0r-hRO)cunJZ|_cCxJiK42-{Ji}(CU!4Ov*bDg&(HhJr#gJZ77 z;EBfx9H;+}z_AtlIvx1^x_+$Ci`Dee#KC(5v{-2aEUZ!Tf2rhbIHMZ7O=5fP%-4NE zeJ)Om^2Y`bVb#?$pnV#7R41Qa{F_QHhxNLrzTE=~%~lpbbEIpPAjn~J72M{$ol?*K zu%3RfW&@3&?oS3~&~C{IKTq-vjpH2aPv>Uej8)pxo$Nc1DG)mhT~uxeafiS8f0X~v zlF>tLVD_Xs&wGlrx42$=@z%O)3q?ULr1~omr_7bB#cqfna8Sz8ipTQl!M_%t2|ckx zQ(U#>Qr1wj(+wan5*e+|2v$VA-bA-G8u?ru+^vIwIL?$qw>j{a{vIdq2@&-n{!S%l z?6?&lUMU|4syJoRg-oNAU9j}i$;iJivdgNC5~&!lyjb8Qv` zSWwTGX3H7KJqQPoCQCp>nho(No_Ee6JAau%p?m=E2Bh6TQJ#SQlRhsw3l)fv-FYS+ z&2V~ynb}Nsu~C_UWUkQ21*4$uIH0FR`WMPQto$yIbD-YMY3|Mz@Yd%sI`z!nb269s5A_mTz0PibyVse0!bx6dErCt_7-T+A2A0N>PM6B{{G49G zGgdU-K`v`FTO*aRnjHRx^B7XT3r9jwxz2)Qh(JXpyxQ&v;(m_>UO zLz*O1G%$@&(FP7Ut~~BR;?@1OeGS`O8Z1*u7(cw{Ck8i%uv0aX?wGUnhjQ$vp4rXm{L>gBg;0Gdajl z>-ic;WZ)1?*<3!T*5p`#FrWm{pqYj^T(PHeX$TEUh9o6@K5gsI%+FVYc`Ry!5uXzq z_ayd6tx@4FNM|doj?MOC0P@FJZn=<4gZqPgGOPnth@5!Jw!?80GnL$|>F6_K?ernX zD+kgX4jaJ#`*@%&mdXbTK@R+O+Q3lNKzV=zr+PN4Mi6_>4oiXU$nVIdn=q5In6`)WN~6%>c1C4kzFytbc)E{bGhbt1=b@KI?ln@j6O54ivYKywOI zFtc##gJ?j>uhMug!da|iCEZPv;>gs^0iw?jqi@R30y4F9-`KR`i_A30`LWk_m`!Ih zm3p`uqvx{oTFWP@-I**mvkVIV#MVzHmsjiO1iZr!jYFIB&DNZJv$Zhac9a{l{e%7} z*&{n=5cJ-H-7?!)|15Sm9)^YSjPP5qV>Y4+;V4VUH46qCl8dd8!2^o?rsycoU{e3;1<^Cewh?3}4#oTYh1wt*_C zH)^vPtWe8~N7r-f?DgeBPzJ`X0$H1d^=!al$%27WJRHl_2Bc}ZZY4464oYCc3q>I7 zZl3C#QlS~y)iYbdo7Iq*XkQVE3O`V^?XORu+QUpBM7hcZwj56brBwnhOgAc^C6$a~ zJMy*4rm~QeP>>)VbLfL;eaX>_%CmaD<#ekC7dIe}(sPBPF@2mZo-a|vRR|l3tzT|@ zVUSE!G5iv~*9?@&CVJgV?7(Ub5C}E!S(89qWeD5zmk4__iSx0V!AuNbeUlQ{gEM~- zOUYCubg5I%aC1wDjqzY=7sg>W~jX{vdye_&Vl9tK?iBJbJC$8KBRx{ zMfs+aE;bHJkL!sb-+At0|B%B+_Li1=Eu*XRkv?hL55)muj~cCo9A}||KDu99z+s*8 zMovn4)}=p((M1vJabN6EqFVXwj?3vVH>tr}>3n_8*k+L5a?VS4y+}>5b0Y_y0B1}c zyzIQJP?2{!?Px`&?u8ept0Q=ZnJBls$d(6+6S^)~Z$p`iH=Ga6tTauC2B^Q`d@k3r z^+I$KQAXC&QW4Zixz4kpJ_CXtM5@^rvGc&_buFI^&LXVWOfKquAikrE(ANn!p?FU` z5;>LyPm6T}h>>2A69V}kgzpZiCsUm-W)2!bh|H62n?+_yVj^R}=?!(EeT=J6hCEF;Xr!Jxg9;TSM6xj<^=VYvdgc69BPP`Kd{hY>EY#iP_9Cf!5<@P^0Ji%E9lAo zdMCv#1+e_J{3SuWXm6#F96RHwv-$cAXf#@(NU6E^3}lM=!ZLphn`V;~f6XNOFeE-7 zv>oV&6kZAr)f%(>n;jWl5>-~Cl&>@U5SgxGAgYxe^;tU@GZJRP|2>tP`WBXJZ|l=} zhrkRMFq&lljBc2ffsE&HlCi==D8%QitEZ40DbMTDuW(EEJmpFV^VJ4o&JhtswyLk^ z^kdF>T5=R^(ZYmaj`eFa7ru&jxu17!g%my4tXl98X`>RUkv zE_{e8mpQmp!eiCgiKuT(p0nSaMYf{t`cN0yKunu@h`b`_lKdQSx{`-Hf&3)vQT^p} zj^%WDA@!GnI^;kl@B+D^c4HWjA)#t-3%4hLrq>7xo z7O`F204qXnR}e1oqV6&2j8yWhP~NIey6pqyY=hGh>ar;3wbemr1w%Bfp>$(5kGkv2 z)|dtv@gbdW^PB$La-l##F;X7ofT`q=){`X%Cl|2RLM{2gKrq{I%@e%mO8!jPZ!IUb zO=@6FCi|%+Fmm$VOwJK@qYlc&QpsJq-EpoN@JKd~l7~;&c9cFY%wXOt{hsuC0P^1O zJ@ucdz4?_zG_nJxO`HDlh-`k`}DxolYR1YRB4BObg@GM|ro*KP5+ z_a_I{O8W>7=6%k%^1YD%$twu=db;0g6jg%UAcB_^N-S9w$pq$`c99n3`Q(%}hV+do zWYhitHIPnDjR94Wy8`!B%!^TAxFrWOIqc?eH%0lV*t|JF!7$|$m1p#8J)o#=W^w#< zE2)U*osZn9q}3cJcQ`AbV_j<6`4J(3Sk&Z;ASvXK_V-iLk#Q}$RDV9HlCF=ovsd%4 z^!zt?{vi)0nB~q{7;DmU&+i<=U$ZdDq%r5RnBOTw&k|H9eaOk@FyZtwFzG$V^BW#Y zlwkw7xYe(Di2|6#&JjE)b_V!?8XGY5gb^rgDExo$5-;~a#XqaN8)}##|8g(!2LA5c ztMbrLlt#oK@)FnZ`Bs6Ku~zfE1Ngn^$$#=LckN-hz++oImzk?&i1*Uak3`lz`O`|I zdCS4M%QB?ALyI*vA$yR_9z*%$zFk3`27c2x@WJbXl{VG~$;3DgSiXZQ!Pvv?CR`Gc zipSSCG_%`hTI{i~UR@Q9sT6fS1>aP1QRDNL_8$Hem^%09mSY2Ty5pawBVJf*Z#3R$=(~%66=WUDVYauoZs@wY-r5qdt{0Wemg^V>ZFCsra zUGuUpB6g)s%f4S0IxU=O!Mq(yzX5CJoNN*-Q-1`@zZWK=Soz!$CSzJGVDmI?hFVd7 z2*+)Jqd80*`GJGXKuEFo4jezP%6EOb?LK~==O6a`mu<9TkWo3td>fQRBim?t8zNxRUw!A>HZPY3b8pI4ElxqUP7uh3stpnql?(J_>JRp${;!>GM-_qb?ZouHGR*A4xe%IE zk?Pa8`pc0?Y}L`v?Xbv2mrsytP-JLXAVA7GbCUJ{41ofTIS=R>0luO@Mg z0=47LfYPT#Cfq&1+5@)=4OZF3@?Mi2VH5STca$esqt=(PM&}p{_x+{^Mf%|^ykj;T z4i(@+4LM8u83M0L2(Q-oHireS^mlQ?o+C69ZsmS+yFfcPaCYa2*4=sYhh<* z=W!8oadJT}F^w|+j4wW2|I`+bUGI^kd(B38Yyfy^3CCI%=@h>6_?xacLhUKa>>R)7 zB`)MyFpLakcwq1hG=*yZD?FOa_=&%Z(RZNd-s0l8Yc(#5wtTGv7lMX28&d5Q11(D|*G_z8caabK%s{k@#gRI6b^0u}#5=cJX!-!ECb* z^p0%=G?>Xba&y{UY;)|MoA8w_>Qm4a)pJ9424d1RNvFM1D!DtvGcfo{ZjhulayjHoYpJi$4Hp>N!T<#_ zQI~jkx-a%3sib57x=vQY@kAq^lF4;zF>svJ{7fj{@{_~k+O$!fy-*44S!fhzOSJoT zs^IyVO13D!e;Vei{t(ED-ok97XbYSA#%bS5rxEu!j;*iElFYo)BFU;%_M_)F^;e0G z(zT0W1QB4NQvQ%i?sM}^*Rl4CH4<@l07}jTPk?a)^!>psmaFOIP9?aT&dh-xv&E#J z9Jf=dzmTtlpxK4?Hys~2FOP};JP^QI5@wa9It1$>i57~Vy#*PUl~=0X`pFRvi;|Vv zwPSwxH|(C*sQBqlZXib5Nl8$F3Q$N=oMDQ5X0x-M4Qs35Lz3|3h6eIJZX!yPYW`lR zi-rRjs?riJd_I{W(OC)^cbA@9$IiH)#;uhy^n{UB0$DiVa3JcZ7tV!s`SYisje|!~ zu~M!D={e&h=nU|DoF^&#P7a%y-0~7{NMpe*kB{hf9l6>a=ZwIbzl2M+OAMVmUCLBykc+!=6H{jrlI@rGz>-&sexwOC4w>IXewsR=?GZc( zLNjR5zvOrZ#%0V-QZ#_G`2?k??xSSl+)zc(s)ik`L2Kd6RvA;380EH=QDLgYZYhsI=XG}Y|K<7L+-SV_ioQ4W?R}+#h0cq*es}KCOCuskZldyj z>Lq^Q0_u-m;=ft}>R}y;2PrDg$j{sRpY2r$S|d1pMusPY@rdcu$^~;$Xa$2>cQJY? zCjXZ+Qdh6@Q?8pz;si8kwTZBdgd*?<$_GlcooI#oTon)bP}FRj9BV1*6Pk+AQ--Jo@>b1=eayDx1?zSPnxVa;19kwU?=9VI z>ob3`O@5w=??uPd^=J#E@3tKST`P7~k^1RpM5U>+$2D^Lb(dc#yjnKGDp~LkNBb`S zGC8?tK>V*Y2}YmeRC3rXzmPE7F3;QO*~O~B6MtFiqoe%_tMOhX^;jue^4zA4;{-c- z4T!rD-;g4#<=&71yJDw4)oo)D(!lnMc7&_1Y(JD8!H6a~$Ajb!n0y+II;$Ae8h+g{`C#$^2Ht8ir^H?ok#2|%ZBLOv3C@#pyoVCb!vaO(Fujzh0&O8%ppPt zIUX>8;M>%i68uDBJlGj5i(zRr2l34G6fB?y%0=)2(U*AlAbdva4EQ^@lgKCi4D+!=(XNQyWB7g=hMH6P`2}l1 zz8`fAjZR1d$wAfImyzW>op9)xe#b7+(A!Gw%aO)xQPdEUb*P_gFML(Q!W@R^J9m#x zjEoLo2isc0jZ1tmEAIzsIjwQ|5aeCpHW!);&^}}shXf2xlp}CIO~eFoG-|;d?II9n5T|+q zlNPfpSN;kVZio+@HGHGq+O<;-N|{nQ&3}}QcNL2h)CWAGu>;_A75DX4w!8Ht#Oinlca^&B@ zVvJ?R59b4)uE%)(qgW3mP0p6xu8;(-BU^E5m?-5+rTq?{yU%cEnW zS)n_h{H4scwUHt6W@GT^$$nTF9?1Yk=Cnj2o!mwD)xIhmTdTeFE#+Xwv*tadLJG6( zb}dDmcxlAnj{n*u2{GbM`6HR&V=A!`@W$)Lqh)y>dSW9_vW>BHaiRZOB_zb4O8M5&4}klxT9kJ zGRFMHn7POON5tVMe2KP6XFGm9=t)tzTSvT5n&QDZ`Lc~l8PNuoqXnLbdUJMME%cjQ zyfA*zop}!OJM-Eqe{#_7r?JV&Ng{GOUMZ7yl;>v--;L_oGu^LG?x_G~Z5g%QxDY1> zc1@#NYm>u=yLD#Dkm>4(4IWOfIw$Qo^A(|WGY7d<-Hx4(eidxK=tl2#w>=cMPT3ef zhp~?m`N#KP%s;~=v=}IW2G~GO@a9q|BwRnS{p6O5WaT=o+WzAVtGZ6wwRF=H)sTVI zLr{JfjFCX7fYq@hl=Z8gt2qbFL8mNJj&$c9_q`myHb>0A$>OPU26(2HpNDXmb;b4} zUA~lCy>4hb+Hw4hl_Cfhl5|8078;@da}2L!X%;yH+i%3=lA2=eK-jIO+U&W*XvaM_ zda`$(zmTafhW!DIDMTjlVUVO9&U?zqaX506u=L<|Sp-(@FG^_#c?w`0)ZB(5S=K z-yAuxJ{KQH;{ijvO()K*^~;+TVf-@1!1lE8yeCBKXMQ!7OarzKis(>&02nCp#_H#B zssJmdo>3ShyU^nl@t#3roFwEvFoQZQ4 z7(rnd(nV}gK)jKU>>pXj7M}CPqA|Z!O;C??o_!xmevIPIcpS&pyI7=RRsu7*T=lFm z<{zuj1rV}>+rp3#%)cG&JL_NO!W@_`W*5G|_ERq(?ZxS=pV&UI@X-*Zz0`&AdIWw3 zY;LPf{?sm>q9X*6VhNOXUJ+or5wsCIzttS;fiah|%ds8V$TL|5+rYL)R98^F0BH0K zior)4Kv9ViJr82zpJbdHrMTm=lU;_h&5k2huS9W4OLUx^6WyRGu4))Rr&2&Rcu^xv zMg*|J*Vy6jn%vn>moZ`*Aw`KkU8d-3>j6gWtBC(y>o0;%LXar`*Ucq;pW&a*8=oJ(*wb zlM?}AfjZwJSd#O4zZP5DFoSyi%c(^KpYG+qTxuZ9ONd>HKt6nVwo3`6=Q9V>q+Z0L zgqRC%p$uzgUT6anghwJR2PW z20=I#c=q$xUa(r&+NhHDCfV{ld=qv36UIq}p;IV>Vg7wfv_v!$on8!r3h>a9oGBx0 zbhK1y)IUgZLpr&m68ar0UpH)ti}I|dubNZNYtYOhY)3-{e%Y@iLuN1*LvW1y_Kx;W z@7d*qO6o_Sf-0*UpUzhE75w1%os)Mv){TSbmy9l5(~}_vkMT$L{5RTIy>_?`9X`qt z(&Avo;6N%LN{lNM@T+&hf_YeM=iI#3i&|7B)JKq-62gA&Nv^>M3$f+I7MD)wp@WIcCNtTP%oKU zCC}l+@Rfb9B`GmBLgI8f@fvJ?qJf1fTqczig?xmwPm}$$3TC(WQ+9(;JvBloJ#6ii z6>uMna!%ZxS;X0v7o-#1`i8ShMG;BJBAN$*6M#~&`zm&>vmO`zf>l=_o8^RFupT-|(<{}`nCQCb z)k+pFp#%{EARBYRkU%<$7UwwzAE#V!u##7HJIoiOPn~=rIX4G3NCLPp|3D0$U}AWT zEFfl3UWK%}&_WXAi{jI}=NQqtJ5z=4x|)}mTtd~NIL~Ra$O_)w`H5+^s_doR{c)~^ zyU^ZBH08j4Qp@r~OGw$BlOQ~`Wh5g(TToBO#&tFft?2ZJjf1#Ju+pNjy!?=QrX4`x zXi?V*aArr5RatVWbsFQZENl>wjU<*485%)AY+oy?501HJ=f&`ut&gix&y%T(>nBDx z<;%#YBv<12q=1Wjv3|znC*3v4eE?;3iI}|0sDn*65DTVML*&46H9ZVkpC@~GlBQA4iSHCSA=15P^?_>XqaCbTPvLOA?I`D-zY*G@ zZlb+u{g3Szrd{*jVT2b|XN-Qg{@K<{YHa?75GEZVgsX7V zh@MV8DIOfQ`-`QrFXQ5pQV z-w?H0`3wIG?9UiHmDh+e&yDa+vH4N>NobvE^0=Ysk#KeK(gZj2+Zp0buo;kxk*yLewO9$I$e~inaEm z)0|CgH@IJD$)+iU2JngXm+NrS39scbZguN^^khB_3J)uQBD!#ri7Wd#P03x3kcn;b z&187^%p>%x=}FJhyT*Zm%Giz&&EnAQc?}K$yFB=agVAyG~8@J2FMcKb0ak zxfj9q01HFk(Fe)oo0Mr+@9o?T>i~JRe;iaxfxQ?I4_dCUo@%nM+^AnU4thy|da!Ql z+Xe2smSwaDTiX!2ZoWBP!)?WOgT%Seyp`b_jhC3M7Xi768}V zkTuzlAS9Mwj;(VoN5U$Y%^>onrR8GhwOwaA-icbfwm?j-vQB>4!dzbQdv0ugE=}Nt z>N4Ve*>1<>{TamCC_&N(gJatV*30wMLEn(dSrISabNuVQhhR>wL1I4A&Fkh9{W379 z&gaMvwYn`g!>X`n5QtNanfT4tXR;w+2)qyw=47UZ$SDl{A^0~Wi^F_aM~we7Q7AcLt=d>u>1|u&!@;W0-5D7ajR{z-z`HrWGc3u~6qlCs0+`!5 zY1U_Q4{1d!eeaov#Re(o_K95_h^x0PRY~ zA_Ge9B8g5zIqh%GZQWO^s`E1@H+JNnYCdCnTuS(`|J6GVA`#o&%*d^EPQbkw|Ja)w!?iUi`&5*5 z&%0q`y!~nztaBvFP#u4a0P~0zM99(Dd8Y784RYcDa+U+8S5523k!z|vv3{$1@)daG zs)5Dn_~CwNG#DtJecRjOo)uV}Cx<}49LTGvSn6^U2EHb3ji84WsW~QRp!9J(KX3V{ z*!d{^c15aN7=7G3G3^qInssmLbqp9kXg!?s}ph`q~ZBu zct{&Ahr@{LVR+7lTsm{50Kc7fev5{#kI@N^_>@Aal8Q`*vN3wRg*+Sz2nM>xiN*F} z`x4zK)HDj?odk8tYfM9z1eFH zIv;vTr>h~x@L6WbT2)Dg*glkXB;-8il>Kk{~K9@n6H)aFt8K%1{ao(JDpUdbvV(YUh-h1qvMn8dVoc3eyWsGL8a-7e@ zSA_>WI-ZBX7-17h%YZi#WCX$vH(bGB)I_Rd=o^Pd30opw-o!& z%%vf~s%zGc_k`$@C!kz!z6ue`9PWAWyx-zCK3%_PYZv_u&;Oj~e{dtaXvSN~ipLZk z#%uVCabkG=W%NxeL%=+oXc%rrIiuHMhRBj>xT8 z#N*-v^&(uUt0!-z>;?=t9~VZ~HT-bQwD_W?LCCN~j84>{OPlx(2uSqNs;7#4LT?Gw zw}>}MxhXQcT%A^<#Cv|W;@hX~*Z5o7^C3#|8yQ@+0sc!>7(3@obXHtNr`~VrQ1N(r zy?M>;OTe82Fu4X`YtFtX6ksF)8N~AS6F$YDGYje`eXbF=Pr23oKD=n^GViD09v6x~ z@_v}`?n!vxO=Q7B@w#X6V%9p?Fm{0%%gvD2;nuP|bUry6w9RE21vm|>HjJy@W!^tX z-IsZ6_P}%6AaKfq+&EK` zDdLx+*4OQXCgAyrw(xwn=fBnS|2huOi2Equ%P52MI7bO-MknNnItA!e_ zMn&Q9#V&HP559|tt7{Kf(vUNw6MQg;i%}447^XMMh`?r&N`ybI)x5K2js&HK<8MJe%{&sh6#=hBxP!U*X7AYIv$ z+$}nzk>0UMxsZ%R1>X$uG=r2LTAHP5R%}-hs$J6l%4|l-oH&5k`DNBUj13eBWAu^2 z`J=Qx0`weiIcE0(%P=|L`pdyVWz3{y>kmeoj(rNyo|>x|T><&cBF<(_d4#jsOecxl zQKH<-fgVo$cC_QrQ{lZJ)R@pf&{P?t+YVq(ur%m_p*kF+w^|AKq^cMkD`EjZi=aH3 z4v4+i{ec`p_vAA4*OgBVo0)jcNLmS5O0v2!w^I~igy$0}allkkPa;@Fb7jfF*p zuF^{wLl(Ke#do}aS8vhiHR-}9kpd=Ly9P z9{sFCA+~7BRsIL?`Q+GuGGPq7*W>r*ZQt+lzc(>XTUK8J0Z}aGU)4|Ks>qyACVKjB z>75)?zplqsVxUZG?-NviRpJ7Jjjf<2!sdj|_!mSlaiPigG|U+K-+u}HV|>r#u2}c} z(BuDlOgdZB5gCplQqK+y-6zqB^`4xPzXG+OFzNO3F~@XBCJve*w>W?_aG^m`FDJ*k z0om|o>QJ7uEeU6DO~W#$d(LuRx3!3;eVRPaN6N+gccabg^~-&|Exc#hPO=LSEY~=G zl+C7KqbiEwEqNuT8xTN-$Ovt5kp26{6)AeNrCpHZeok&Z>H~Z}JqqSc@)Y{5M1f3xt)Xzl=Gc@?L;A95% zgiDyA_?5>syyu7VVfyKZZ)?5^{p)fW&O}ijG!a?V^aVKElv`fIK3u5 z_gB0G;@32j#6R{Dh}Cnd_gOvePqrQRdp!Sb3?&eY({ulfJCuVpj|OpxUc+9R(Y#ah zO!0V&w|a>i6@h=99?yM>i*Vn@QwLNk@p-tnaS`s+{r+OxdANbWq5Rh#+dMGVlaW{Y zSTl^{I1CPpKHe3@!d~np7Qn(bEyXrda#ZtJW=gK}67OiWz&`IKuoktHPRWTIk$s7M z3j|{fW|cD;(HA8_=}A~~1q5jrKQ+iXz*cD`fMyp*!Er&~xMx;Mg`eJDbgA@yBqsk(R=wXZnkcgX!c>H!mOe z=_-leEM38SutPp7!jCN>UoJ9klP|={3LpAOhdjG#)Q-_$z-zvtyY(>|KSe$7 z?I^dopA#anhPG`Agu`~^PzV*VWMaHLC>dU;(C-yl^tg~P$*GyO%*yKK(I4d*& z0p8d4#O7@%Btjp5jxRo4KW@95h)ETgIHLsk{Zw}`B~!NErmg7`DZp13q7F*kAzvlqXl_gox3A{Oi2 zdN2M|kNZb$$Ngo`zt!{Ky}`JxJjY)o1lASlAlMv5JB-Fa*f26fT?^Z&Aj#sFiqoJ( za77^0ew_>D;;8kbUgCosjT!Ync?sbE<|7WV$-Wh0Akt$N+r-7i*!E&9ujIqqoco7H zwP4v`CbREeiTYAW8`sio;)`t~))vWGilWDdgJG7mky@Cqgy3ZW5?^Hjba8rv8jKB; zln9G`6aCq|ZOc~AUfDAChkkC^A1_*CWKdapPdGa%vhNNhmLt5De{TxEGSSyNJrFV# zV-dV}(=KBC{^`+lEepGo?82eMtRqA7dtnrqsr8G6=TIRt9}T-nJc>_OrR};s%fqD( z{^^l*8(%)qF+JN|K6|~yNUP-o9aAn`KHd}>-{#zxL(JzVr&~dX$3$jhAS(L)iICrO zT#s!VH}C-+459sl$hiD}Z92LA&v?)!LV!xqHusXkJrSG)oRgTxTUc>=xXUYBm2Ov&0V3%X~j)p7um=T{%7_&dDM=^J>J~55$&5hN`7&k9v)3 zl3vqqvhTDC^N<4m$Yjjh7+{9k>_D(T9%TmLvbtbko9oc93WycDQ{^M{de zmZ6sBBqB;W6d0I7Riqo!J=@vsXCdr3kHU^bRyBCBZg=sR+g<+@=tH|?TNrVj_prnp zUqIs-Eoq^g1fQ-~OS|pwc^Q%s;kF{g?ct~w(TX}rsB&+HKpL^j*-N*C54AkWVxx*+ z-`LySR60hV|F_5Ys?_fiQ6Tp%ieY>{o6gS(9>C_O zT#?ejUKsc-i3nPT)gqoc1%y8AcVL=e!+LLgzXwWCI74#8&^By=a+FkZK3w0LzOl4P zv{PZxS4lZYp2GOlUmDhBr>`9lZyLkUoYf+H^Z_ts707dJ;OGf=XE8`eGO?gUleRCo z)1IV61%V7|xTROZIE0iDN7Ed?KOP|cUC6U}K!i?rj~EAI|JvQrVW!bJ)%}|jS{$w_ z;){0(DAu^35Y5C)qQ9HAMhGnD7;34owD3|^ z$GpfqQ!wEIHDLP>y$3-+Rg#Fv~G4c@n>}@W2_#H0+d1f=G_Zu&PSkxkG+9&H5JHu?fCd3ud zl(aMmi!QSewV`Ino~3@P4|lPX-C)THwZ$Y5jci*v&L;NsQUD@Ca!m>vf?!PQb>f!( z37d{56a8%6__yN-DdZz$UU`VVjDscGUAg)Lu``XJ6UHab)C%yULD-4#M2(%NYM2l# znGBR0x##fh`}H*0*N&lAaLzkyP?Pxa@>Kj52{yJ&_L% zpdoI(V)|xK81+r5qRZg^s#&py&p`j3czWm;+?L=j2_IQ(5H0KxnzVJqpt!w6MQatC>pjLv)d($S z_dq{9-kc7%24&b7dyiKV?JRsR>v?=21Qucfld#tJa#%CLX+vmE$YzA| zm@&n4R$h$$rz{M?deBmhL3@}gEJ-_e$4;h}96(Uj?857J5LeJm?4Syn(IeR>8VHb8 ztLID*x6m9U?nk7DZTDZ?j>E*0YG@lP;)g|h(Bz9ba1_erF&m^un<1vF-i~sPy$Z_J zidZTbZ;tx;&<>9CGCIEAmIZFbd+bwh{e7A*x+`Vfs+>7MmEI@u-JH7K8m!8k!F_j+NM`Mq_RKrJvh zmet)2NIuK| zdvUEi%2=5nSWLu70lOU%neJQI!mGD~2((VNJ)n`{v}RTm-KUgezq5Gkr?ii-EgV}N zHz$-c!o4pUs>0~U<)V|cnFZxGE&lx2?~kxUrKG@R%8q3{n@ZbGEqdZ9eWmRX@v-EY?C1 zl;j|t>%?u@X!VBs=z%CV%1EjM=q>gUe#%GA;XNR?iWRIZ>nuP$^EQ}HnUyB{S~-*& zl2OWY9!cY~0zFQxvXa+gU+dnh(6s+r7dG2Y;&fmgq{5CgRj~0o*q{mNsIdn!<88Ss z!d`iDAIyb9?>9?btg(|V@D;QYm2Yf0&fCz8&(T3ES!b>F&b%1YlBH5jqTFDy{AX#BXcUZCmIwOvyT>>i7WeXfh0`O z9iQWiP@l`6UpNar0Z8+bit^SlX1F--H1k0I`0UWW*%}sWD`vjln?rY0_$5kc^`AL% zC^350*f$sFwD2MJ-tiApBjflTy4CtUgYI)9RK)yTmHeOxgs1^T`e+J=0LgXO$e&X# z7bQxbfgj~1PTc9%JH%v0-k3asEm3iAaBrA1c8*BvfE0Xzl}shpFa64zcJjPX3=Knp zH7fWiAD%x^`y9$^)UanH$j(fWjlj%2a!#3{Wg@-j1_}k zOe5%p^n?DUQ7dDWOI)#i`PUMG$V+>FI}OI2jbPF8nr?=euXtaS+P$vZ+u|Q6yVpG2 zWexnmi=2rq0`8rtv3tsYM*dRxw=sU{(Uw8$c*Hc(*lubIO6%Q^Ze)E zzwq!6LT*jB?WLI58a`>z8C$D{72dAdLTnA6G^`mBTMPY~N-nGqml#wG7&hdGVo>`} zfxqQDlIJze0HQo)vdgNR0seHa-JzjJ;`_CW=Cr{GCikxVSbi>;1eH6Mp|IC`wWp6)A0`(=vB)ALxFiXj|6CrYBtql))@>cP{_G*8#dtro}*B#^Fi z7|n!YYazalJ%SUhwxCW&MIfOExNAk=xM@>3VKSPi{GgSj59*BL zhmEV18bciWEa_KS-#4eiD9?b1W^{R9{nW{J(~Eq)U@hpMCgrXCS+9;(6m4u}p&&l5 zRY}(?+V01i2TK!wJiZ^tfxUCU;u+xZN&H&^R-eKBRB^m>p_kb2ZmX_9|VAi!+p{;&@Q<#Au`FD^PX zO%0Sy9(#k)L}%a+p3p%qdPY6 zPnWkE+h_EcF($^{O(ic4*Ufz(Pwo}x^(zg>pS6YK*F2h}UlWHTC3;PG=$QF)|8Hqy z6qyTUb`*IeBqS|Y=j14%&k1avJ8M8zNSt^rkO^Wf+2i9*F9EnV8yP_+h_$4!g^B|d z)hZPs(XpZy?qgTZHp&QgYA142?sSYBjR$;-hscb{&$2Ws zNnhMR{2_%;Vs@(tO`x7X6#aAKS%Ra2Y)!r6)W*sUkB_T&l;1e_i)aBwg_lu;;&$eY z`R|K7()ca&ea!9vX40zhn7j;}3n+4GG9bu8G4cPKoV8xFLu+0q|N-W*Sk`xWd=Op|)VOx@YsYTxMKIYf2r#Kojml}OJVzf<{x=4WBFqM}19J(_#Zs(`*_6{;!jU)2u&4R89xZ`TR(xeYgTst4~LQ0xWEZqR(@b6B5EQysF0puR~kJGkH7j zu_H!UAL-U;`M3K`=HIerAzV^ z`wp*!KDXUlKW7Zjx6H`yaDDEBLZCd|n1xv+)>IYoeW`hXV{uTRzeA)0)U&kCkDHg5 zAa{)9R&ny6^O{}=7){<2`+!t36Qb0nuKi?K#Ug!BoJ^xj4e0fZS z1#n<{x~~Xa2@Qoq_mOOg&?3+uK!$GdB>32)t?=aSUIM&5X_32RSYFqc+K%f+&%cTy z@Yp$U-^Vopx2oPyuF)%TDL~P+8yk4^x4C2cpqIF+)!4wJe^QN&L%R~+sJ{N+8XNOO zW)V275MtlWwh>>M60Sl%*Gi~lGB&H=WhRuIu^O(=cJjEeDo64DuTqQG^{uw^`6&jk zh5ToO`MhuPm;G3ivqFsr_^VDC%xk^G%iGFeuJIB$)f^6(y@1M z+Q=KrQw{vwt*-P-FR<_@*SkHUy`cM?bIO=noVDWM*=zNDytnOqyq>`i{qjchVJsRL zjiUj`mOF<8!i+II2nHnsxKo3fYeEc{d5L8gzR)NAb*s(uF0F%p60&cdd>k%tK^Zv7Ex#LfdPau6y3*DYy39GnL+zM_(;;wpKE z@S&a3Zrd*d{1D=lf6t1VCbZu-d8oRlgPWWMrU2uCD9ZyxHU-nwWIq%)SCdHRmQPdq zGfUq$%Vm69J*c}6>-BJb+x2jmhY0n9QMx;hZwEUMij<=&b6>!!$SNikat{+gBIwLK zDV;v`OlWfx7d1=ipl`+6up1BYFJIMaVL(=bwQ;K41F$V=^{<1t{Ee4q;n0R@9bl*d zdkV&xO70E!QNIn^IMC;8xQyg;@sDz0s2Q@^BO1*6!^L}a4%)XwV>TM(O@o)V!Ot(?*) zsTkxm_cly>1Yh0yCfYhDKm*EHg;B-WeYUk-3u#?N!M;u4=jvJRR*;A?GVkugx_wy> z;M99M>}rMZ`~ z$xJ$PB#c{Xo~nD%H+c~N9=rdcL_u_vsc2)Tz~M#Cdb{^#ro6+z?CdJ)8xU>p)wtrd zzR*8uBYl#X-?w+VZv@_=pi)7-+jm_4J4Pq$cGxr6EAE{1V6fR(#rPzylC_W2#^L#M zfwZd|Sf}v0P8&LaWxOiXr1-Ki2XhDF89o)(id78~yPglU?1uc#E<{XqN5`JgUTJia zw}XrOIQze2Umi$4Q{eRude?jEUWn0&0qEExH;eCyxb@f z4c0CV78#IdW{89tfJg?ghT~Y`NTrgq>+kC@bGUU;3cfb@4k|fCa<4?LVn9NZc?J=| zB|`0x5@Ptt9dpGwgw&vKy+D6Ne!$vW(;k$Iq>|P@qF49Pv>K<|TbqO!^F=uP6qj=X z5wUVqa+>J6DP@M;_(K0`?Q@#W z#Etn2v)b&bqT>UPPME9C27x4(H4a`z9JNq_esAS=BFD0Lg!gMjt~`j*-@GLSF)ews z{5;XEM1~*$8E@8JhL+QMZtJgXn^0GWit|?vfl(KiOkCG6Dyt3G&x_<#AZv!}mx6%uEym6n zRo7`V?J?t<*8dFxJ-_?Mj>SznOviXurW3iIBE`ta$x zwJl%vPS1a{=f7klzRcB1udB~i_Z0MM)@>P#92MHN=35Hh;3Z%qVOg{*y#(T#HY*rS z+y@y5#oMFcC~}Q#y*s?^NZVd55ccI@gMu4d7fZiF=pUa7!?u#{^c+=|$7J9@x%<-<=$`>Et&xPY6`FitJ(JXT7X zx|sAE8XiSG^5>cO{EwG$;bve$^U)U~Tn7iGJvJ6If>UzTJKO)Yx4~tuM$a@P^s@fzQg~ur$pGWwhC<*!oMlp zX4I|*I#EZOhR`?Pd5H{xof3l$2((2A9+sjw%UIJ_q=zcfqpClb_CV zqY(w=knEHS6}g1pv>~8ZP(k2hBdpX|Wkjg{s*c28GkBbd7kRiN@ml_l%OlA(L24KT(8 zVyN1CORZmJKkA%gxu%notQ}~7(5zU2+F9>VVglzA?zV@*Uu#k$U=e+Js?9wJ)G5wI z&f7LUbq;FIODZ`Xp7YKWMmlgm$oV2Wb(4ZSVhw^$_BIx*#G&IzS)^XWUkbfi135&G zabS@c-a=S#&@8xlz~qn1k;0-n#}N9b?#WE<=RKMAg=)E8#|`MS;CyC+IS_Ml#q)W* z?5?^DQV8KfXO?ge5nbM4U4^^PjVuFI2|gQJIFLrHgL$Z5meu9YyX8g{+`&0h&(s!Y zDyU4izXfF=gAbHcrsZhra!}Ub2**lCluEiq4w(o8P4G~(3Jqw->Gg47KP*GcvU-%R}R~WfjwEAS^nX^Ql zSh|P>?*QUWGSK2uFbrFbFj(Vu@j@wKLbuuJn|Oo#&(NRz>ET1GHYH9QuH!}q}QC35d1gxqSE-lMX2eY-6` zipxZ<_x#oSm4564$;^oJB$@M|`e=5on1(#m%S!EBh3^IlJ|CPYGCJ0JhM%*|A$I}(Va-OTq4btIk>67Y}EaD7NyxFQ(&Pdxvw`*q#!(mcw2BYh7r)! zg(r+V&71O~Ao`J)_>RltARhToTCMg}M`DWt5%+)U814t?K|WVsc3#E`PY}z7x|D89 zwo$4$hSR75Juam66?^mVRIHwvXuO8#Mc`(eGhchC@R}d}47aOgj#0R#iU*d8b>v6=lwzmJLe5?I`D* z%j39hHZLXyF;m*D$Oj`_Qc^km=~14A-;JC&W#&ZAXj|ze1tLc$19AWtXA~w)wDI|REKQLwftA%dY>B3q`&|ys-=%C;LltvGARptq zZ5R60Jf0vYY?Ixx%@+k|xUT*J{dD4R+x&YZ1b7%ToAPBlPs7s^@eT()#*lvnmwH24MHMOUYM}7RXERSk173AoIeznC91hc%ZQdt4FD6iia^I4b!;5x;? zdnR(ZbfAblO*lPUvF^BSSiI>WM1CU5J5)d5CRQV(6Fx5j?H(=F{DIyvyQry8arPmM zz8bhNbvdmUp1KSjd6@4k+rG%D)AH{^rr;=2DEDm{&kJRRB?6vwqkzTM59w|ZcBjRX z`eMT_NSs-x`AVhR#2_g`W2E#*j@_Kp0X-lnl00P2GNQ&TbhKvSlAdw#{CM;tDRDvz`8u7~VfT#8 zrrDf|ZR!<$Dazy1)o4fO3vJTu@J33V5_Qt*;&e0OC7uVO+(`D}$GXGwFMy;B-(|jc-!vUEYGXop7a1Ez|^al9%fYj5X{e9nhX~+z49TL)E8n#~&yoBVtV{Jh}@DR0vviZE`B2wPxV@1l-a zyF!}fkR=VrzZ!788Nr5n{>H2;#+P%<@oOrGSR|h*r5m&Pi=lK}hM(Y4-nO9hmF@OZ zA6hWWqn`thtOz9swdIwna=Y~;&~_8C^Q}d{Kzu8|c^UeK`iodkUMKpCZ9j?y#r=9E zii;;h88Vh@^VMLi6n+!Ol^RW+sm zV%z+pw0L`BLZejaA7k`g@9g)(vI11u!-O zI>?pBwAg>Lp42+sAMVrGAkB7*$75A?|LMhG8G*cWY06cVen601SgJ{0J~TZD*Ef6Z zj>I`~;D|6#xQkO?E`I^nPMY{rqVzJ_DWeL)=o9yLQJ@6O#{Qpe5m2F)OGDR%`%GXM z;h+n#cPBecJ0ryXBVAZqF3y$>QZghb`HC@{k5~k)H2Fb?&nfrH*!*U3r2B$}%u>Ew zoq)4nc=Y8OBR%`1}~c#>Zo0w2<7C}R-nBW!irw@@^sc!7`5 z*%A9VH;=8D@^hyi?jNBbKPXZ8bpn?1X5tu1KFnFEI-u z2e*Uxh{;ie95*Vdxwn1}#ILDjn>f*GtA@DyyL!CeXh+BKGEjtuc>6|jFDew9$UP1% z<0Z}_DHpn0H#t?e1yvjH>iO^Ud;}LN zVkGys-}t>6;=8@X5m!R@AssU>K1AFL^I7J5l^);AJRgA`d>Dw(JzZVF!_biYtBRC@ z)Rt59Y%lQ?y%2}J#B=qZQ(j_})x|w{HW}_}9svBZ*u)IfL^w_%rKu7_^b)eLgTw8Rr*)p%d8$9- z;Ri4M%XM}mnj3y6_IYyqAfqQLhV>0-baT|u4_q(eBxnji0;Z>a8Y5@!4k-k6$bK<# z77Q5bh`Ju+1d~#o1FT54@iOlNiF2cHiBbcq3Y^&xlSIyJ0)+bA2|v9jK;*${rn)>@ z4~j7MMR+q`C^~iSu794I$)%hsm7I&8yA}mU#C{=q@;=2*U|v4fZeDmf_!~X{#qoW6 z@1_gkEF;q;_}G5|mOrN}eh2YC>X@Gf2f<%iV%NkssEOC3#^HTbrCm3+9nY%gzsB<~ ziI1lxezi!In6^dyirBdmN2ajRe5s3Ra8K83_&Yuj_$^E93N?VA>v7yKapI22?iANd^2=|8~>?1UM|B#lmI`NuA6ee;&lL3mBxePP{8VgKQilSdT8#P}vd9o#7?ALkpo8-%Wb9n4b^L3*vD; zAnItTfCvdU@`G?;F?4M|=vpJ*QADnm9UA&}0Qp^dd)!=K#Zt;E3*ZECY-ElXH!`@7 zgH8tEkZa|F4!{$$bIIl^QAgs(q8&$$NgD~!?D-{d+BKMp=NgcQa1b#&@;M!B)pS?< z7To?q=&SL%Of@C>#Ou+gU`uMaUk!3T3O}X}z(xmgNo0U&>4o)kqn*Hng`ZwOLh|E{ zwjZ(Y)m)jygZH!_v9CFuxq#H`Udh+wyCD*(eklM_zg%*20dQ$tWiGxmv9lASSDQol`QmqmhmoUy| zdg|gRJ+J|FCDk2DWRE4A5Cv$H{u_{cwz)4Ua^SbTk5JmRQ-&Hn?-lsE`(u0(I|vJ3 zbK_k9yRER$sAKrJpW7UMWDrf34?tijOe0^6D}@ORSSsZ_f|-q0@{lQp(#!qoVzI0e zYiiv~sO*jDh1rI(j|%OccwIq=zT$E@y-7pAgEV;cOuZgfFZ!~5cEi#685i&%B2W3C z;0)UTx$sa+O2ELyBGLp%WBVb5P}puyM6@}lFZ&8RDEzZ+FSZB5Y{J*uY^6YX!+1^i zBI#XaGK91FT23a;m$vbeg^Ovn>2G}w@g8PN8U#AT04Z{z%t^?l&+YC$^~~OLW@a*% z;CG@Bi|v69orCZ5Bl=Xwn$^cHqe9AO&>z?;f)sZ4ymlc?4l1XkLy285%L__8dbJx8 zIE`M^|AKYvZ{^zLv~Q~sd#`9bD?@3c0eomzFd%Y}q_~6@eE5+XOtXhRr2{bIG*@d2 zI*`d-kT+oebzf^P71&^|!C%d*R2}X!4$MVl6srIo@dynI*_SKn6#m;7Si) ztowOs+kTP@zHjR%CvHyedV#;mdCff;L_bo=<&bV`Iz`q)b4@!!4d{>_*CqF9T&~@= zVixAG`scx~(w)m(A>)HXodhWjrZnvr7(=`nz$bXWge0B*;{QldnUW_))-CVdfLyYS z)mkcs`=j<2J~L2GGT3m#PDAjT8 zeH)wdllJ#b?xK-Fz7%4~X1mSi^##&Z$a~!tr!1P3`&p56J*Vw@s)|OIQX~9F8vb-I z@dULh5PkdqWA9DiB&*81;ZxnSG-b4=SwxLWAt3>!>f!(j7-M%=uhZ-FGBbeER997Z z7v0rWbXCnvgUcko@x$QvA&RI$1MV=1OCoM@k1HDWBgQo*4yX}B@;dcGPK~3ALMQw)@yH{4AFJflDJ+SCL@lu+z?Dm?dw&TKHY<^BoU|2z7E0W z3W6>18=)6#l@t(Fe7<`R<_CTy$amBTXxLCK8(8O?@++|4Tz4swX#eui`aAol5;!`t zTsV$&P|nT|MYQ}p)E?MV&Pdokvl&p1_V@07oSYfUPtM&7IatmWQl z%grIE!BRGN4K^|2D@Y&YQ-bYghCyx$h9hK-*6^MmEq4mSGKTo%Ce<|8Z0!rCBSWQ*!9f;$gzN1-r8?BXP_<23Pp?KUcXm-)q$^Mcf z=YpwuPu zzU1>g&9F3MwbGuUiw+)f|2Xz$!3GMpPq*a;P&8r}xLSjCBjf0R8P{@jw%3_>zCRv= z+o6I^_uBv4Js!MpQAwJ7kOLHF*vNkB!YEP=;~@eA@rC zC0|qmjR@3$Q9^W7Vrwr?K8i7;Y4S!gw4aeBuT$|FUlc*iKzYQDi{n{nIUbQ><3>wm z^7;W9`kVIn0&1U}9%cTDOmjcDHpn_fp+i2^$+N9*x#?b@wuIj?M_L+oJ4J-onBDtK zb0CUb))&i)X;x;r2>!eu{C`^iiMYK*SZIM;1}}-PYp2_Q`OzkHWhoY5Db`lnd363- zN7I$W4RH{OmXPaC&@u@aTLk}BTsg^Q652?ML?av5pJLSi(lp@r5Vl9Fy&w7kNzk-)lY`bQ{kFb)S{!V08%57^XUqg)?RVt`0S(Kve$$yx<3|0a8 zh>HKX8G8a>sNeC~6ZQXMUGZuELMu9h%oX07mG_F@44fLglaSx(7MJmQx3PtYY9v3W z;)oq{zD%fjo*5T)^p>Gst241Lg4ailfBwGfMLS!<2|!`;=3IZdm-L2!1zhLN!+wv` znT-E@YvS87dUbsH3?3EUHbY2*bclPby(Djpu*8UUe7n0cAKEaVLBw8+=DLzHB5mZS zM(yUqmHr`)yc-lu`-V}!#X{r{9I|#T!elIw1C)M3_hI$LL z`H-NUkXRjWw7e@r{*dHrQp*cMrOb#U_N=^tLUj<5=U0lAz&R}9e=ROsP{2-yNLLaxn=TD^Ul>5^gwuyi>M^0J>6+1crxM=1atJ?I#g51`R|KZP$%r4V|_$| z690iR_#9vUq~o~%F@NbxXn`auXs}J%8e^@&D2eP84a_2!IzA5F>a0D6C7XYLborAa z{O3L#l=kW_3qUG#bpUL~@kO)CDG13bI?TX6I0*TO_)!6;YX3k>dVHJmZd4v7UBdhV zhV(e#=|i$^AX$yT=M^gcQg@3Zc0KNojkn&rR2(*Hn)qT4Up4diQpCKpl@l_L zDD`t}(x^rdtDToeW(S)(i9u#p|8GnVz39;bo4QZR>^^7abzJe)j&FUYfa^Lii`a<@ z`qKgl3ak(&~|Ut ze&m11U?;v03 zfPNz9tWCjF&K0xEIu(w_4DtTVf$CQHt2#V7%Foz54~yeh{Iu z0hBA*y?JjeyB8NBxJde4^PcJ4_eK%aM|#xq8P_gmdD&dztKKB`NDcf^&`i|cU}z-+ z*8)?44HDjNJYl?s;Y8LCb`g>9==p>BGSiRd34((P!b-!WB|SMIvaY^7+}Ky)@}L#x zwpzqbooI%!r(ye%hv%<<6l?y);U9InF$snd?=; zGcjh{E$4Gcj21MjzJ~Ysw11@~UHX8cN$gE0hAuVmRNx`#lPR(+CX1Al7AJ1#bb>vs z&~8i1!7sd{8La{Tg;*;-A3^*tdz2S$Ymg~LUec&(-|Vr2;LQSV9r1UDywG5j|GmW4^kIb0RfYU&+G=M}mZ+&O7nNr~Mr*;SJ{OCCV$F0C+c?i7!;~ zD&b?{2>uNDTN`P%g|{BB>cYR*hVDZ~&NN!c7qcc6`fNsPV8aR0ClJ2PkLNsuc3k~o zubcqfE)#U?B(a?tGW3B@cf&$4w^U86glTKzU#LKL}2e3M>kp`&InAE{=o$c%T_{w#DLGjVSBO8qeE5-*R8RM|m)%M+&F# zz3GJD5pAF#y9bx7WhIEN93p^kRB`wS1RM9AMs^atYS=uidO|-i^ZIVfd3{cKAn|Y7 zXkN`j3K{dc5Kl=nDH|+H$C}m7EEH?fyjyeZt#bF;`=G_}PaE6%=ybnhcuqY}i7T@& zAk0BPj(#!g0Ua*E{&{979lYsgz-%~_>jT}ilf=IcU*ABREFOf1Lhs$tdtx!V;x%Ak*h7PpiC!W8^`FI9U!hw#VYoXEz=rzZ;96%qC(m^26MJ5r;DwVFp=Q|o7+i~e2z4j!_N*`m6~r(DAv znIVUe)4T;4^DbEu%mloi{8zOXThTkY1UGmswjEU*5iqL*Aa3Qh z9XOlE+s4S)<5R)6r9T=yEqt$##0$uhS}xxtmrXw_UA+dOae&Ehf{?f?m0*$xg2*O~ zusSbUKaB^!hkhMDkz%=;o?=h90{MIti|>^2weaH=+)gJZ%X3#lH4AeH@&AVQF1N%X zjO&}Y%t9U-9Af{$>S)V%UZvz3=-foYa+Rj#M2?B(UoT z_FG11lr9&&bg8_T105N`i2WxVWrj~aFw_I`z`SEC`8N)xbCtPbt(2|6p29Z}Nnc$N z;rC#uc31knyVyWb-Ko5b-8XrIPWdJgG{vDgLr8?X<=bFTTv^K71GpNsIU>}ifD+4< zY{g2Tk_JxA*l?GgMdbiJjqxR$M(eyVG>#^L<<_}*eg*aLX}`PGKJ@;YOb3Olt@){= z=R1Uj61^vbOxN0~p(sCLhUza={59?o_AZn2G0I_lR>eQca`NGQKUf!r_=a`hUdRPk zHL_bIP8z=8NiF$;wwU)*<$WhQ|KpSMM!C?Vv}WDps$R$ivA8jrp@p!q-8FxB`tzO=z0Yo`qXCiRh#8_2x?SG6g>a zKH~KvZ|}zVmz$kl^Ev!Q5Bero52W|R3nxPFKdbmZy4VW)2gt7*7aO*izv6TK;W^gn z3ZN+Kh)LQ?`?_ScPq%)y|+Z+cw*>)qsIdCG6hMSrjm=;$Doi*e=HKWH%0*T zeig?ZGuY0cgV4`60_a~<{A)gdNFTR3c9WF6hVr6%g)GlEE%y!1_W>kk2hZXWkUX^0 z0_PU~{b7CzH8h~VVc>mFOLzm=cPj7ICkEcGK57&=#uP4w!r&66Q-lB^8>kKRYq-+~ z@CCdj_jC08`Lc@RPHzw}iTMTRkKqfT@CU7cM@))rmq4I`{kx^Je%zX)P4}zMllLqh_){?uCk@>V0LrXSImv>yY6=l#fSnk(d<2T&`X)GDMo%N;|sotXV@&BaI}n{rMR^vI6K z&JU5q532aPU5xy^ihr2DqZkP~`3-}SWphpxTb>g;V_tX6dqy;V_;JkF`z*%Z5I&~q zG*K>%yBZDP7&K+MIWVGI^ynKG-U!u6O}WdNplJgCEt_8xav&|?$*S84)DvN-|4}S{ z5!oTjb&SR0-TWPe`g|<@0?Rg;_-76All3jFL0HmCUn(~fM^~yz=^vYQy{_fD=3?Gd z%zN&MSXYS1{z-Xn7b}6t8i+i!Va=Umjc0qL4t_fY@T=k6YhI}-CN(d*;XZ3%IVNK9 z0e7XZip8gzt@Qp_ylhtbH_bnI2MEdr6`fv!hQ}!CYwjBCNsfzuxES=)$-@hMHk3Z; zM4t}XEVvp(XXej76an=&;s`Bg6m{QdnaS-S0~E#I0;4E5rZ185!Kr2KJ+h_wA~bj_ zspWDupUUN-i(S-&UE;?Ljc1mjtYV+Tc-%cSp6JTFZJf`>z{iZkWDkdAfx{c_r{HX8 zWg3}fq{5!oDNi4V_6CQ>9Syne_lh>arCOe^?L$iS)SQWq#~ykv$fs`3K$d|FRq(qj zmgqn#wtihJw~v-n2rOSt=}7rfVi0ll7X09TUHLovi&ZMkQ@8Y1p;(tuBUd|3u62x; zejJHB5z#mTepg@wBXH-Xx14%aAMCQ1m!;(%gvKLGdLcYoP5rR1irY)6%)%Jn{?x5~ zx(aeD;Z3QW(m&@b)f8s2m|y)fNWFTHHAmW*tFKmTx8TWGN~V;`n_w4wJAg!HAd&oXGct1 zl>V|G9OSI$%elHta@WEFvess6NPv(nnf|XWmnB2>P#%NkBI z(aVWHAp=9?oC3hFZUugI)o&kJK{Qu17_9S9F`vp7swwzavZdkf?un7}Dv0a@tu{e2 zdR8`{hh(#w$`uSAbXEU;M4}m_YO9dW>kzs#KJJP_JcT{NNCtu(404_rVi4IpH1I`v z*as{}Mp~Kq>TSdLGlhi97?=)9GlT(@OQ|a4{wy*EDGXD5qD72DyM}j_{_%?9{?v-D zM}tX*&SVLl6-uxmn@id8Cwlk6wCj969+Y7DaMzSyL%#X#`Rr?4(CNZdwO*m8f}Y-v zg#b=$VSK*0T9Uo$Oms-257*_Bqt<3X)+P1-^i&HKR_xY$Xs0tFJzR)`!$rFCpB)0m z0+IlQ**x0ux3^d@yR-`tO2l`WmLWc5cEHRxRanW+A(4^*IQNqY20O-o$-<8{8egD#lJZC-R!QM zD=#Mz28;1lkq=8;SXeO!3SVDECh!7fG`P7jFGI$Xh+?7IiyY2uMefP{no6Y-z4IhE zY#>7t%K}tCjLUh~Jvllw4o`JBEK5y2L$P-=IXt?T_hr|r<0}~&!RzBo=b4oHQxh{x zVb74Me)I#S-VHu*pl7N#$%BnOcMWwstcK}X&EZd$H5KR@PfXJekD8kahS08QeX9_v z-iy!Q{>*27B-4XE%O?667;L4m{1>3^gZ-;C-&@J8@y#HM>?`JLLh<@1r^b45q2+YO zCswiT5HHa7EDeq66dSJ@m;_$(h~?9al_7MEemKKR-J6F8k)pS-I#PgMLJ)QYp`}Q( z^b@u}n%yt1Kv1I1tRNy19t}Y3FNdIv%&NDI4z~`A%cmzxZ-}6=UAP8B_%1^dEVJu~^^nH3CvUq<_9a?Hl|0cT`?yC?2CTk+wca6a-&_ECX%5ogO znT^h~H#BYv`-5i-f*8yA@6HT5Bpn~}&00AMvNOFS@Pn9oRi*;^Die`BdaOMHyoUCn zwl+#?%y(U*iQ(dk9_Uo@T7koGc7O1I)x@64A5SoQJD?tnr@NTHr60|ckh9^wT|(Jd zWY|3R(QsmEW~#?Lgl!ht6BIM{of@ClR>~D@=<(?RXIGqreli@T>Dcgda{1?@*Aw5f zs{-QGx4QD5>C-ueUej9yA0=mNKXL%sUA}V-w4j(nKoa4hc*Jt#!-l0=$d>AYOT)ri zrLbkN(b><%OTrA2O|L;lo4Vz=S{1dwFs-TUms! zU1}aWKrlX(E+q!%A&jPmUGM0e<$t^K?;CJ?H{b%pUS38FH|ZDXGLJ)r`4~aE4dv;| zB}Ty|7O|fhzR$1%dkBwO5eJiDSphQLuUW4StY1%|Z z2L}VZ8l+-AUB)|pC|_)#`=AvID_|w*Xjm-c;sK^XkR23RYMJ=ch)|dm|E}^f1J>~M4p1YW z205@q{5>>OgH>_$TB!C^On$hKSJ|vKsO@-i0}w&Q_+y-hl%^QHirR zCi4kWY$bZ8CWhE+UqGk^P_~!kL`cC1rYw2tQ~XE`xAzpJ(QE zq{x-B%qqiYrXe!|$qz&>QaKS^rV%O-+UKtU0_tqaYbWbk{ZE{|y$nc&^fxWk6^P4NZwbHnvKn0mv% zn|X}m`8c`Y6t*we9O0O`c6&%1frX2_r>x=)HY>Dvpk#t#d3}t)Ww6NK{SYBc%mCf+ zH(FHc9(-}|{%DXRsWK?lmv)%l!-JG{276)jfLRRn@>kc;8+KY=NCVRnmo8})G(2JtLFJy3ay*un)sm`koW?;xMLS+ zg^TPEv+CeE(f*Y}u{8(o6K;oEbDjEz#s^0FrVijNo!J0VpFzrIUTjqqZ4ATk7IWY2}_C#6jSQ6aEDF}BLw2_K$yGIiScNZ4_Vh8 zNS&P(n%p&&7|6nPY7LhZSqONrEJ2qioYT%-Wn5%=ubD2_bBi{mNmsVxscNFQN)`aK zByVe9?c^baV_j@=B>0{%&HXwFcKYBL1B3NuLH|~ObbEy??}XKx7F^)K3??%K!e35H z_Nl}eAjfq9vm=w`NQVd>=O-_OLG7-&e;ve3v|IWIATurGmh_#jYajBn;MSC96n%&Y zaE+^i%M-J}0&-E?%s~YBm214C+kl!hn}lN#Mv*R67btd;#m#jT)HJv=%E&-slpDk0(e-jr@Kh}3Te=WzoLrztJu*~uba0ZesxsVTK^{#fEzxM)G7)K~v zh+?WpIIc6kv+XHC8EeK>LH26Elck4ne=FqEG>zoXu3|?_?L-2+LRD-m&1Oo!Wy(b( zr1_N0hOE)2|70iqV6yAA#k_DWHXiRx3HdM?mMUEU>z2=>GZtdiY4F{vbzxr3c1|OB zwt%A4ak(1q9h;gIv6%tuZaF=XqRSBrq)Yiy{w=+nQR5vEhCBM@wWw+6o3S*(=vVKR}}X=o2* z9hQlcMjiSA4CvdBwG+Ohzp|Q#X|LRTx~d(U6>}QRAwDr{WpWrj|LCf~R<$M!S9%J< zu-u|x3||d#_d-0R z_J)L#@7^W5PQ$U97vhpeE;!jCW4i5SM5B@yvUYp_@^TP&$OUZ}aAZUcez5EQD)xP$ zrUkS65?$GM4OXCx5|Jn0UjYJw8j@s;;ouRbzU1eIV;{qX;v5zs7 d+AWO)7v3VI z%-!1skVBA5>6kmxB@5&8hxlS(Hr|g5AVWeRrh}mxMq+qIJ0`8a;W_&Jpnl0kSJ(eF z;twnvj+3Ch+f-1W&vn0iiFa}@bKV!PEtPQ+`%~ck$@Me4LUWa6_~cd7{*0kNuu=Pa z2$H_-e)6nd`OEay;5SSXV)#|vWyEio;YCc+1noB*Iqwm0+sDx&AQzD)sA#^h0n9(+ zgE}qX@PGP~#+-NH>%d)(>!aI`WBz^&wxUw6iNJBJ$Wx2wA1=KR77!!nwEM)A*#>D2 z6f~`88D`Uvxz9#rEBTZT0w9(sh3gSXt^$&P9@>M(-5O@oap1E@ zQ)tx3#4xrsgFdoM*8{^S0B5~G>wfr39P?ZQ301q5l&&!*bbX(fNX^i7A z*emCyL3ce2Eng1c32!Q4N6lNMo{4^(xNpT$9s&ogOG0Y%q0wIO>h`A)Zd3Dls24PA z_3_0LBg&;Ctx(JaF(H`_$~*K9Poe>QXh(1??aV=l6K#pqz$)%{-m0 z6r*toin;k5`DZx}IOAlfzQ6u%F_h5j4FcXAp5-~+VB<7e!pT-+`w{;h5YDu4FIZf; z##&DDB9sMJVaG8g`u9wT8Jw7Kv`!F!7We9?14VJ}!9k$VLV>-(D6K<7ap0uG=#-HH@Pa%0i`qo#&N1Ajwe zU0#7C0jWe~5Y6FgiizusZYdd>zlFaoXT4)|yx(dtpIu~%nFRy-Ey%FDAsRtsZk==< z>Na2PrI{)85vE7g67I(7P(jU%tV55RltkK7T#O-L*7FGaJq7rvZI;~nP_iwM8xUQP z@Xf)r?EKyGBndz-Y~$sWF;3R5LlUurew{~GA9ioy`T=m!Mr6NK>&Q&aTQ3YP^rgw5 z7Uh)9`jg@~RjWY_0ZfEn^4p~|CY$8GYTX`7n!Kt(LBAcb(Qya|?=3;G0G`44bPX9C z{zExx>+&FGOr>QMdQraIhm-yT5D4=x;i~r^;_EGgTghvK6c|1frYQZ9 z8qM1kL*8DgW!k0u)Vsf(SA59}k$I=N{XIR@uLMMa!h()ysUlgi00McadHbDy-aFO}4 zMJO^VRmxnPVd?nb!MvoL6 z#ueee#diJgi+{?0d8RrM1j)727luJW$bE0-gMnLPBataF(-N`%;k^wrP@7~_W-ND^^qSLd=2A#gt; zqZFh=tZ9TxBWe17<3`c0lt!Oz)y0%{S85AjCj9_@HRAIBG9sdLyu*9S|)RVa!YJ-e3M`e6sQBZgGSsOD=^X_dj5o z#e3oa8kVe3J-ttpwCA8bXWu9Gu%&K&R-|AqGT|GxuVynzl57nE{zO0X$d9IeL)H%nUTypzpcMbyE;Ep6L9L9&Sx*67y67chT(+CSaW&+V_2_Xg#?Eb8Yr zf@4kV!B^YX8a#ExuPWqo&L`n;9n`_okCh4IR@?H>N{1ZT5R>(lt|J@#D&Nq|kqt3f z;qyjW#QSABs{K7J=kq!RUu17}qxtk;WDKIi{4w-AS`&xl0@U%DhM6>^iTP6%f1x{e z#3+DYdZRlSd~@Hb$IhX@!i@iAEyus2yepMA7#;snjOq#%pL9pHq~cdL8x>;xUd!i{ zLvMM0Xn#ca#w(!s>-C7{l9YVgEdv(&Utu4=G>$UjSxG;eOzr=dsTQ%$8_igpm6 z=Nc{0S%0*ReQ6?*h+k(eDUuu_1ha-IH#XwWXe;Map)L!5;6we&?$A8&4qmoGkPSGZ2QFmc8xFmw%Oihd~-Dkz0RLeewnY*@EU@#k0`=?2>lMq224xdgmhj0`53fpYN<6S@^ z-5y<*4YZ`~c^J1e+@6=X+;2=6dD!r9hI$y}ICck{)Gz7A75cQauG&A=lAgg`^cLm8 zWw8Xh8pJU_*7JoXIyIai)ss&0Y6?1^lf-KnB%Jn6p_Ap+D*k6K9ej()EfICrh2Jz{ zfuFCg#5|A(u+s-n!=~Gq&N#Rc{Fx7JAK@>Xt*bFFRFn@pe09(cZpALbL1r+QokKW0 zUhDl`hIk;T&q{uFZoNK=^3E`sN1lXG!SFa`zcS5$z6jyosvENZl26{2*x~R;;rbnT zZ^S54@%QlG%e`jQQHxD%?H8ilmaGI^X$%A_Yog0*YK23m^X`Ce`q=XuRxQWa2eW!4 zy3Xt4<3cN%HMTXO?=?=P^!(hc7_Mj_Q=jAV>rvhG}Zo`mhD(WMrrC9y}kK{wzjGd z%Zf(gY`fEt2|pH{X*s*L-qF)Aa%gQeLzhF*T^au5-xl*!%=@>E=*+Rixe-?I*O2E&MD|u z{67bXJa+?2n`fh(OJBxe0U<(BlS)y20*9pJT4nN$75XY65H9sfk$W_5UHuvOoU-!iL2(Q0dLa67=`aF+Zvpv!Res~@^ z?YKp>mPNEAK|6yezvblHcRQB`w~mu?>5W0KBAUNIfFcT5|G?0E+I1WR@UPyAZxKoz zzR(iMjw=2nE^sHscN69GPDf&T?;6BxU`7vU^X@kN{|57M^aAliiBG*hHse8}oe=Yc zcxpGgq~?x|^Ktxvq0eWwq|YbCJfw*IUX(sJxz_^BelCo4@}EYjfHearEe#UBHspsD zg1%mISUH+QG7UeD9>bE$>iu&BT0c{9#3T#i!fc7f5A%1F)qH9!j+|^1V&L=d`k(fH zZH0f{mzDQ1<=t^~@R|bOkTvItXN=+pgxraIgHXIi#TPM)wtgHq41|-ESUY8j$wn4o z6;GzXV(Xl_5ZZWeHIsgGWYU&zw!v_|XmYYeC;dGY|2BaU(MN{%E_b=66OLA2!>1wN ztZ;3v{I8kn-Z^LfZ?w}G|97?N1u!6M%^E#`2)IXai)`J9Pgj!|mm4=#)H>4$mx`bu z&hXWJD7R(Pb3->uU!GC*7^w@%XEk4qXdv~9R~3^IMo_KLYGAXj?B|@_-AQ!oWvH%2>daj`_ z&u&Ry&WL#ll9&zdna9NcjbT&q;@LFfkO&PC_aA%8mLr*^*t3XQJT01V`@-%q-c=n; ze!6X5%H~mPO_+WgA(8K>QDk<$#VD78+>VIl9Z((ce2Hf4;DxdHGkmIpJ0M_*dv4;< z+;f}l4vVw@Caa~|zu%Is{k`%&!XQ!`tkW)lh}67*Oj2~1S}<~C%4)mu%p*-JsW?*Y zdVmw5$xNIcDy#_MBbjHQQJ&$mW+ik8Fp3exODc5mA#NgKh6X^rTg5-pjFjK2;@{+R zlXr$Z2EF=*#-RfW2QL!6RLEQ@4V_iZy;2IqqITFKpG%kL7-!mbnTzPTR_2kAZgHPu zJD}ko<*zDrxZ>bCpU&d|wcdi>6CVo-k_HaCyWM%59x&<*XiB z#N@GY2ob&H6hqCxXx?W4DR+cg*|Lv{u`TSS=oOVO`;uh`|3h_0FOGSZ5Cljxap z^7&eY{@DB1Qq~Km!Tz~|SxSF!gHxh(#=rbf&fv-)2cVF~X7QKi|HJz&+a8F>bN}g@ zV_F#L@IXAb!IGF_n>&9IoM``{ueWcT40mXX_M72;PQ=fjL}V0-d#c_$>GKkKO1)(m;_WZwJn7HhFWk>p z=sfqZ_FVRmwp&W*>te2E6LYbD7cVB+j4qU3sP-`ulUzA>(BBCrCDza|qDK#EnGxVf zR}1u?K@$S&nCJm8R3j>kEFiRn z_6&s?5uc30>kM|g)_~3I2ip5C1W-d{lBEhlPe6>LrTQ7iIn3I+pvs2+Q?gzac%7Ev znvC)rua_+xUau1Z?O+X1NA+Eo*;uAq$Ru)XI7)?aa zM*EIk6kYP*n~eqKVp``wvj!+C{u}vlk9AN+J96!63y;a%lCC7}d%f1qT~ky`acwQ9 zeag$VF{N0l2XqY2PfiSbh;RkV&fN&z!)Shbz2GKjuW8m$HEfTmV<^DpIp`>2r)0_p z@2P(=5Al~$CD2jCnZ8B^q_iWi^r81}li7WF4`28dYr9j(a1X@uT1ngkjK{Uo{o$7T zUy9M83*lokumch@Hz>{GxPK5asOdhof)%3NQy-&WUU2v}3js)(%WG*pAS4Z6$wBM5 z?@dCB-x<*2Hyc{~=W){ao7Jo0>c)7V?$5`tZT}fzE52LUfI~2FI1sOf=XJEzOps~7 zo%Ci)=id~4{5PCKhJFlyh%n3 zE!wf(__ROL@*egBCXw?#zR^AGnC{EX?z@z_7a?WhU6$dO8RePx-!=SAWfyJ3NFTURwz4iWsisMceT+r?_G3}#br-xPiCvri1hJnM`E#(G}jd_nK?}sN84#%AV zVI7$PQ?l8N3IUW{=s{i(g_nhc71PCIap;j6Ws^^f#h)lrf*TFIUfvR3*TlSR%o~oz zla5Mcj|p$A{Ny<0EM7e3eTzX)D19M@1;M^UFam^{m03XzN_mz6<9T2tGgGYLR{;^! zkF5ea570f=w#EiRLWV12@flZgvl5GEn@Mh77K^{gm)wk+bs1>6E?&%o2<)W)oz|r( z@QwRPv1r})I{Vo}e#k6iYN=88wkb9G|mM_S0a)RtgkBKe}2Im75 zRy6eSkO?=urHbO`ea-7Bx!@L(o$KOy{#%L^Hn>uR*;-YXDr!rU3G;#Pa6u#rA} z(!Y5CnoeAh^IE4X8RgQ8^-_ru2atAyE$@VHzBWlri|?Foi%!2Kx4!`3Qo6Qgn`=|wniiSnXZuS7f_Y0I(VbC|lsZr>ds zm=nT)RBH#~qk{$zzSSRMEu#Nkxn(3qx%NhKbFB_llA#zU(KYv~-fA9kakw}cyxLCq z_Lv8~h`Xo*^o_3qKZaP16SNRcME__xy*O8fOVx&b>yivcI0 zo`j~@GeJ{Hu?q^uGEY|z!S{3>My!bG4{HjY<~^m|CMh3cFa_4-hkgS(3Ri8-_v^v4 zKfpH|G#o8L7r#&d<%JSTJp_#inxeVp8Uy%iN)%)}S(HO3T*APX90yKZ)AheKl6r7skn;oz&f$J4Ry$T&0 ztm=B@d16x^f9R0=XgeZT%)-wSZp%Tu;XNp`!p_|-KGJB_7f zW&&GEDawzEHHI$JK?9_5{D<_cGjTydw?c9n9Cpu?_6pJV z9E@}Z;k3;2$<^bS<0LWDyrx~3;q?ak`{2K~Y&#qwfUG?m&G1vC+R!-OZgH zNmnR#in1Dpdj@R)BqOXm9Cvp3zweR-vLrnXaq;pRBU0-re<{ABIPFKE`?&0#55={! zSSwJyCO#~&pp1IZKPj};nx-?Ii7WkeYu;9{VBZjIQ0>3LJbO_ofHf#G`98fHjY$y_ zNQUmk$CYPqTJUkxRv#co&EK?!Ttu!6fwJVO%ctGV8Ejj%3FBCr%S$}jPA9Ko!*Eb2 zSRJM6GX8+=NDLtBg+%#zt>6rJZHr>I+W1IzWucA}OL$#e7VIX=>3d1iXH`j`UkqvC za^c0(aNHbPfxz0fqVYofcRCYOKKOL3!fHr2%cAShizZ^s@C3=HgZp&Jw;p9TgXekj zUoq#Jm2u8GFK3b4V4)69xtJqoA09aQkLhx9u8^c>_FiQBLxh9HBq9>7Uh1JcSWXm5 z-Ua7hc+oS@zvKcPZ>=-&Vt<|u>#`mj9H2>PVm$A;57QRdlL$t`L^;*eu4kTqK0S;W zHrhWkk8-@*FMjs3F4+#|THlKr=<_=8<_W7mTA%Fb-Hg4rH;gcmhz`F{@Rsaf8Tb#S zs*7?5JPXww`wwkbhG=0(U}AYB!S;yVE>vd{q$8a#uV}tqIH_P`kjZzbW}*jBBuj*= zsX@pz+y?~VEuN?O3SnxgQ00wF8soje7UWDj@kPEU#M#b+(_r9M?eRwc&@J0K;!(Ex z;bS%4Lrk4$`v>A1+6^|XwfXrWhAY~v<2{C0TNr<%eM)wt<1h z;rRTRPV5$%c5nLr2#8A8y2J%uO_mMCpTXue4?QLoVA26Zf8{0IM^xHh?Fr3e6?#G2 zj~#?kFGIPAd?4%){&A+G5%5^DyyQ&Q8Icwr;2LRwX@vlgSNJh4jA3WU*fJOkh9c+9 z+`8kQ6-Ij&Q?V1h7In6viNr8h#IA=Os-J&0flRW0eVN#}1TX|SKqaA^wn86N-5|Mk zOub`_0AXJaiczbC*6`_|+yg@6#WFEw$F;yXJ4lT2x%is6@R#?^GldZ&VND^(2nbBT ze{=mO#=6IP`=>{Or%pSMLpy`8T`8w{-3VU%H=a9msUxSls(0*IgX`+T>}mm5P_{fJ zfp$S!W+7yOmRZaM*haruyhEYD)NuWPaTF`|;HLAQ-LzpVgxs5g5@QIKj-(Lu5|LVL zbx&kQ)bL*BXYkFjCt}C19spYoIcwi>TM}rpI z()PfJ$OX9)A;-1G^|Je7&IPCV1p{`zT!!{PLmn?*Wx|x5<4HptP*w?|YWby<_(4YY zSq}& zaep8E5!%}yY)$b9x3Q1vS+`jPYpoUJfHg67Y^XT2pcKz%L>sa82jO@d7VVb zXZZYzB^G)QyMu9omGEVF<2{7by;Dt@l=E-^QfXKVi{G>7~W zPejQ;kw?9?CmQTk{96;vO{k>{Rs0#uNuhm2Ef+p4uc1SHen%%*OZ=7=wS5jMgl{>o1mW4Sz-`eYVc-Sk|T|Zr5D*8{f0B_ z$Npp*C%XkN>scE_w0^IN$3F6^H+jlv%f^P;lK@u9DHB!I>&`>N6Lf|2Va2@&8|D2? z55jbF=7=@F3Y77u;+esCQ;_e;O8UsZ$Wz>5nwVc@bG_5hERBHuuIOc%h&ZCPRm(06~d=k?OMs|Q;5U}BxVpQ__x5UKAm3? zxoK~9Up8lq?jm+odBl(|R)R29isu@R$YNIHJqR^nPCQ&OLEjgAuxdi(vU{OQK8T-= zdRO_iB$b5+xe-vW>J2b;Suy8z&-levm-KV3UqjB3FykLFz6yxDq{*%7oxMxi*>sZM zP{V*Xz7U7u5R4H`N8`>?JZuldbbZA*1vqp_I$5R+*jS zLpiFv1j2$z^7)d8p9Od(%{l?#M&+dYA_4DAl-37N#4a0G1^3#sp1dS7ax*vwbV>BP z%kNd=1C#2chF1Jdk0LtmyuMb7mJn9pv;>z50RmKUX5(o9J{`AC>S?M?thA#b^gf8T zLD&1u8Di<*6>|HMo2&>@6b2Drt7)BDat7WEeWW60_*IK?R4ml1eYtj@H2$4<-zXQv`|6-CvDd);yZDqAC(i;3bh7qDN~~YLEq=uW!t|FZCG*DX zP^>_UN(l~-db(tm2Zn)Re)_M*g>P^W;6QwWSnRpe(>>6taP!H3KI37cBGn%39?_|u z^lYrvA?#^@Kf&_4Eje!8C}ZOi==n~H9R!J<-3t9E!?*?deK5VmU}j=OOARgBWoSui ze+-V+nRpJoifsuE;qyX#8|5m;rZ{kCb0EHvioz|8V-o#C5C5p-)S(v5O@MJVLUt?@ z4YOZk3!tvqR%OKu;uesE+Sj4j9$wPq;lwk~k38jgx_9mQLU->4@9nzewjCFQo8EDL z@S8=4pM6pI!D!zF7e~r;O(k|tP8mI;&r@-d(@uKla5KX*neYSTN$dD?bp;aa!ag0| z2SbdEO;Jfuj4cjK<5JH(^3(BNN!uQNJ-sk7J)wzp1eVidI)v&3L<`|MGmt~)mYP;_ z)|J4R)-seP7&8tLZ$rbqQZO-|Dd!8hYPi#`?TKlvdq+l-=(>+<5Ck>Yd3NxE!R^nw zP>$-p6BsUVPzf>2(9SI{iILQntS=v5Mth(3Shx zZY1=CiyAV=F@iB!IyV}7>0k}<=(Y?nBRn59VXfWC@IG9X1j|PU}n3wV1UFY3<85SAA#~F|y>LA*u zH^Qw*n>G*MW`bbY09D=)m?J?Kb6H8FH$c)vNboi76C9fX7qEOS{$uWVGRRpkm*W>e zZ7A7E(sQ^T%H1$)cD-Z6>x2Zhh2nNXrvR*M7e!wni-j&y=D5*JtE(c)5W zHondrJPQm6E`BoJy`}VCPzVTTXBqB%7RDP$ttCzAd!fWqPU+hv8pr2Ue6>gx8I93m zDhr3mYR$x#bafiK)U1?3K0TJQgG3u2Wn>irEziNxue&l?v)dlgP6Mk{#zUh^qmh^?(ct`n&Ywton)@#w=RHzA29>`TF z3BlDqWJ62h;4vXVljW5pxsN1dONG^BZ85u&y!iZNc{O?Ag%>30d$tcI1tB=yM{7-Qy78H6L5Jz zuNy~BVuz2&D+Hsc1giP+ir3)Xmd?)vfjbR*|K4HKl$6#ud|TY5s7_=0H7;q}PEV4#xgY4SwO;wibD@*!X2-QGbQQxu6^#ktYsi`G=FAL#+Xl@8^fZ)Ec=e-qP7Bi3<$&WO6 z7>MaZI}+*%>1I+wK!O~oAMYzIa7b=d}@`2CmyHxy5{2k@AKC9v%^*OD_;oio1b+q(r`?2y4Denu> zc|}KfEdE*^%sQ7-%|Dy{Q#Na#B3@n>t@n891QM(OX zcD97eB{A>Zn0Lzm0e+P0`&BarSp~8M-wDw9ix+|oJt}`c7JrKCQTeP`{M=?9m1D7Z zpYKumR0H29w1h8$^aAz1eIoJh*A=I?0gTa$5b*B%E*`?a`p3=i5V0Q-v(3n1PDmW6 zW+agId}G0>$Rg=P&(K7Mht`0N=wqp_j^~eHB|g8Y?ZYDG_=$~zTsb2-5I?qHT256G zWZt6=9 zCvp&D2RAY?F&epN!X8e~+gvq+*R~0Plk|sKH@?<>IRU=Z;f~S-np&@uAt;DPjvz?_ z(5=kZYUU)5*hl#blLn|crc(d|CoeLi6U$I#eV2pv6@H+s1#g9#jw2l6Yy}IHdRYJ4 z{!q*F`#Z`*$ieqV>CN%UMWUx;Mg*qxyIwEcBLhL!;lRF(e_5&u4uBGwhI}}PZSe`0 zmV8Ua|GpV5vHsiGzlPo(X*vHND(@T0`{dEh{}|%P{u)7nvmG&I1Fi=&_8ZMWfwTQV zJ~y8u1|JT$gvY(gyGMB+{gNqnHsSSZyP7#ApUgjg*JRfM`*G^t~a`(3e&G zGcF|lMaA!F1_>L7SRimF{u^xT(9V(DE`=B@_%BjgwSTiEygs44_bBhrqwtC@f3xYX zi~Bly=XDAqKK*89Ve~D1HIvfrL2A_#X!Ph{!n+LQozEv?tXM zwaC*R{5(H9F}JY&IuE5Go`I4+&X{t^d?;TDhUK;xBBsPp8_(n(9fEH|DLLmF{S5T2U8^sHMH9Wm(0F&>6p{fV8KmUbY;t~gpl{r| zaUa(ZqCLR2L|{?YfJUaU?WuzD__SZ$YX3_NmqrD`QN_W>h8_c5+lQn**wF~eL&>+! z$L`+KdyDg8+{2ug6Euj-t$A8O95&<_N8N3SO>K{6pF}_)>-F-c3mI~Iu2oG%LQd{5wX__n?YZc}4t{aV;T>F}m}3JWE_4kUCd z7+0em%|;PdrRxLnV~gf0l`K3)(J%B6>d~!x2t)$ti=^F>-)wVw7qGEmuOX$Li2767 zgm6mS^sV2&?Dod|*|-O!Yt>Q-`e8kSl00jLT1o$g1`B!vr)OqUwx-z~WcBR(XhH10{c&}GpdX+Mj~ydTsD?|3fZv>bC~*(lE??1yg4 zv!!|O7W-h|Z~+hSp}wZ2U30jS5496vU%XD!GOmanaHObSdlnSYY=I}J$R*mze%(RnuhO|U13EK98Pub{scPTw8!t*p###MUr6+3 zNwn9QSiiJg2y$QJ(WdN6yd(Po24(@~C&GJV@O#U)Hv|C!V3aQ}u^apmoQ(Hwo2I(| z9wYo3+QFy&D=qiQ2bA{?_iqFl5{QAj=qtFBlp@nC;ZBD!e2b`gDl!sMnL7XenCD#t30S)PdxEwS= z`q-J6@v%pC3>y?NXFwlM1YZ^D8a-=!6q;-;E#stS6tBI-!ah8wJyh_#hH!UtE68{* zeuDmU5CX<)+VoiCxaQBIe-(CuH07vzJK6XM8c)yLhlWn$-3YY7K+qnL8l-67w=^ez z1kh26_T?{>0K1LeQ%*0_Ye;=oURd)D)PvsK)*AGv{#4TbUz(pIJ%Zt2xlBeHAEB=z z$A(|UGiT4YTaj^gKy~Dr0pGBwM_4oWw*d8u72F3wi5&-b@?(>Jb8s~C^eF5sXeSi0 zvl^qPuP!A4vB@(aCf$O4hCl6SmHI=}2cL1d<&T=E-C2L!oe(wOwtw>BsBc~1df=PD z^3%3FM+}?ez?8BFAPKrxya$5~#|gtzq`~gSyb{q@in1?THI1^4UOSLmM2$qN4DMlT zsc4)-(|+)tev?3Y1`Y%BjB)8Sn9+R6(IS2WJg49kVf}J5u-BZb!xj_KP~h8;c2xbE z=O*3eCgUgx0m>;x1h3|+7zX@gbkiQ5JK}r4N;)xM|0dk~5txepkN$YbH|Ko(AvzKh zf&tpf&J`3jlp_C4!%PTFWMMYszinZQ7}AQ)7YVnXv)oWkk5^Yxf8a+p$&{C2NsRlt zCzkNA1$_6Qmor|oI&}E=gV5pMGNHrok#@ea8` z>I<>i0ox<(VGn7Lr*UDN*LPbH4f$xGE6V*{uz@#1+@x!oh30;>Ml{?Qm*YDbfYQFg zwyf^UiI9;4o6Iq6ymjLiLDL0%ez|?bK>66Vj0=Idfl@$^gZu=A3iwAp=i@fa)XD z(w*HH9Gl)0*{0)$*+1_pE*^Ga{5W5(jCeo$3RGV4VEm-_6V563zU&KQ&<5`(or#zD zU})%ns6F{STe}1?RtB1e|oYp@~z~LY`t957lbS2W1={{8G_-nykMwA2VdXJQ?x% z2tViE@g-9tJwmdT&;(8deQGwv+cBOkoo@{Q6GmV&e2v7LxBVotukM}SXpfi%4#aE6 zwgdfoCgkfOj1!;sZ@0Xc{hjjuMtN_D-pe94EM#mgNGefg?4vspB@zszzuLCe=IIO7 z<;>T271eyrl!f$!VhU3VG8P~&(b2wN6A@y(Tg4G8Fi;JDT*d#U*%b}?V(3nZ8Ng|N z6GH)Bn;k&9z8v5csk#y4OP-D8LJ^r{n#d(1`?6ZAGfbN1@!22wO85L35GD))5|Zn2 z|L|DWVJ7_TsN;+VS`sT_smk*W?Uw0$L&_mO0|8yS}udtH4~1Kpm7 zIB=<;#~5-jA-%iqY`&~LRoU)u+ZXl)>^ zS+7+*-_rTEt4uznDN|%dY^XgteSre;Sdhy?_(uM|DShn=SJKdVeS92(YTeAJXj%*} zquFrdZ$I6%TMqghj4K>RE=?v99HhQe;^;&$IY0c5(&uyF?;yup_$V5m?$+aBrYqss zhsMWtO?Ho_dizHDru$L|wLH-`Iei)X7yWs#o10BkU`xFzVoMjY%#z@SWy5oRL@ph= zeKjrZuaodUhIq67wfqmx!&T zYMy-Sq{EXnyoRimpCNt&cqaA$rHZ)xm>6Is+={6mG`_KynR5oO!C*ozQ%Z?FKUDGt zQjvXTyA8up3n&E9H@xRpO<{j0%dk~9{^?At`Sgf>>xF!Ctt_v$u294kc#;2gnYh^?(9p!&Uu$T*2SP#a?tFpw4!Ut9Gd=-2U6Rdk+fFwl_ ze^l{;Hek!(c&^32^#10P*{D?d%_@!@CjrX?e&=n?Se`Ga_$P(sIU#&)lO@vY8rTPM z4SFFCLBQKG{J1@_*rW?$d4=I+t@{3`3nl=@HZf$zah8%GQzz-u(T2P?hf=od@W2jkFB!d z<7Z@^kIsH<9Z(2_A1CcQe1-x1WAR*jRO_&rQW*cCA1^|I)>5EB@W&VZG=Cez2VV}c zA>Zm&3YJHmhRp*64N)eJ%b9=C^ zxs*%y6iRhVD8-LFs2>^vv6=djF<)L(%|di6N>swRhDZyrN@s*OAAUSngE%?6_*Nvu z7F4X)ndsATbnGDTjB!7k)-zj*=b{_|u-Cw!>Hxl5Wzse=l@O_8>R-=L)xDt^PV9*U_&i&ed`5{1xVYtrr6)c#AO9=dOj8vEus82Nfc+6rKGg+(hX~F`|40ZFVUg=xoJ4YqDl{+qs4xkD1)ma_b5cT;<;@d0wnM5xPtg1_Y`WSWoB?#0cVGs1*EVtqLRd*Zr zmq(q5^I)B(IV{n)>GvA5Xm{G#%I?$@wj&&u@{i7rGtwl7rQ=}-1cg@?98a`gGZ9_P zGT8NmYYFnCN2J1{9?`YDM4_;M9zjFrp%#J#95rb$Ox5b3syAQFEzL>+u049mm#eLc zN&)swI=>fj$ji*xBiKv5US2&1&pQ)kpZ{$}M4QyJU{xbh-?1}m)<6Is(D2%FabdCM zg~k!+j(Lvnt*oT9Sx;5yRZu;6gJSZbefG9Qz&80IyTo=DQ9JyR>hd@0f7)N(lAd3q zysYwuqx3w)e|rPQ=BY0tF1%93XIzrJqT<7dPNhgT@ZT_Z|~>8`RXS{iKY0(`J7|G%)ZR3#gnn z{lj$=;RBm_-fIJV#*>hDj8dP$dwkkI-VzUBwDekq?39uFVG}$6@32waoiJ9@CFV4B zZv46k-rTI>H@J8MyQSAQ!<&z&_eEtXcr_g-lZp;8<#$WEy@=s^SWMb`SwDdRL z8uNaxynBBQ>x22&ux~}oD!9TY5jUw$e+O`hy!$s-cfD` z`E{RweemmsGdEe7Fdv^^_v;KkzN#fYUK{hSj(OAnJH;39VllzNsJkMCmAwBfwTZbT zL|5Fs8bb@d(>(=PF7{Wcxg$zPo1?^wjaAI%pvU7;HW~l#$Oe{P2*vir;#W5d zP;g@`j$GQB1a2|wqgt-d{mT2M^8W6`(2JJ$$K$07jreN)9j)Q&4^;e{%?JYG6M%Nu z1K~`e2LZpix1vs%sKI?$R_!YihtFG%fGAmcbmZl=f^J{xctDZ z_jg;a_ve%clkGR17`R0FgrhoF8}Q&R6K~LN1FZK4n$6e3#hh>44^CW7UqKJvFmMz} zSL)Tp5oR6p4RlUMy^#NQKvY9bPJ4`_%PaoJVf&99_phSr{KM7oXM2L0?LTPtz2Zp58KYRETexJ zgo+aCqOk+|R`rb(7T}J_p@h<~CSKUY$k)W?b3{3fjq2Ma=Xz}@_*HW)&wBMWXvohr z$>Y$Wb)wBc;TyY651v^9VK!{s@VQ9gp|($Kp$TOW@0XI40sH=Ri3F+os->cOA-o zDdT<;zLZ7NPk^y!DOXJ5%kzM~dDO>pJk%pnmb3@o%kaG%-z)H4#J7m=jrg(;_Qihq zJJ=3fUI<{23|o6~rxn0CSIom!h70F>NQO5%zt{Wo4-pm+`3qMV577OvKJRqV&v4IW zmnIRU6%Mu#-JElF<=o_%&rRxIvwJIi0E63=JY>zu6Z;004gW{OJ^ ze90>2q{5Hjzn6rh80G_Fl3$1Tpu$L?fOSP&$X0?jo_2QiX+9hR&?L=(E=}%35{iZ7 z{Bm}os?M%nnyeypaFS{xq{G=4JV9u@g+daE2g|E?i2n-~oL!ClZSjy8Kse|Xy3}@; z6uL9Z!JcW?SDpoBljj)F&Pv$;wdd-{cvDuXn?Jb;hZgQ!(jDQCV$+N3h0MVa&cK*C%UH*N+rO9(JD?B+DFEJZ4gJWtTTrt2( zBxb=1Apoo3OmZHet^q*`tFrF)F_Nre=cR+58yb)*Orfq32Dvi|$t*(aBIt0^*5=v; z6&d~&s9w;$>8d#!Tq0RQUh|;4p!G|WM4wUx=mn@2YQ)L&02WOl#%2&H_GlVGO=cR@ zkt}9GvsTwGMaBAZK1tLyP^qq!=E}IAy7g`~lj zLj}eJQ%>%Kzc%N}fZRz9DEf*gYipIlr4B`GfQ{1z=_e>mK?mUl<3i+mP7=8jNwL|= zc?jUUFWj6{-)u%vdjj-J7*Vk*u)4OeT3)xB01|ZWc&ZRps>nT@W1>Bb8(C@CCt?T} z_CwqX2>Iv+4BL1Jx;+BI6!+WCVlRS@AuX10k!$RR93{9n5Gh6FuGrlo@XvTY;iC^6R{7}g*>?qGY^65NVWD1r1}?4jB!A{_6)`bR;|u7X@TT2R?U-K1paYyJYH* zLUXj>ck2gxIsj2*1^&kY6&cS71XrYG&NK?Nfc^#S0V%KS3Ij<8#od!ByEk;O1vDf= zX&iFo&=a1N**szcFIXyv-aw;CI*e_PqH*CY5+&%c0X`c823h0trAfTZBQ1tLW^=}edr~j0CZEeQ#?<2L`pO0cm?0Nzkl9zZ1)pspKcrDM zvIcf_;YTc6LcbRNFjTp?z|?&tI6|6=)oPu;xx&^9bQ1 zk3@ZMuv6CXD(punCf;O{U?YmShBAi#rDWeKToR#f*jVSBy<9(+*lYiG8pm3ow2c#z zjN-&RLs_hY4#`xCs04@QWrv+Z=Nd7D=Mv0tNxv{xF6-d1P#ZL8DXx3|nWNYrZURhNmhn*hJ6{OUILGwSe%9G_spPyRu(51p z6Q#exeoD!}sc4=+`M*)lt)?5qV$FevUtP_voo8yC$J7mQZ^0FQtJwovsc0LKk3O{)5xK=5&#nbFzdzR9uK$-aq^%VxVL zCT0gF$7d#HGmtlR4~;?IG|@dh2vC5$@{)kI>OL(7G!1hRZf0t_dwOQd;l+Zv8$vJK zUmcA)lzqL{DDa|etS>V?K6#lLPyIZnc?+5KTIlVb?rxaTF|{D_xhPDIsfDS_rqIaI zjpEn1!e$spvB*YRrgz#oXM@t=^kcAswPXoW8aNh51!lkf{aXn976QM8z;7Y&TL}CX z0>6d81`v37;lp?SVm5Z?&vv)n`OtX#osV3%>CQ*mV>dn6zUkn9wYMGoS$pi@&)e0( zJI++E?6{}@a4gn!_)vTM!M_++Hy_xf?z#>CK7{ud;_vI*x(;`A^Zls@RqT0R|3sU* zOX_VNIQ#_EySM!b2VaTuSH;v_9SUW4b{%H9`%wSh_QxMQ)PDNG@3o(D@b~?mHh|_{<%jXrKN1 zFJ?c2XED5M!#pw9Pbrz_Lzqv)T)$@Ly7^!ZV?JcZ{1iRrA7FeOFUNgf`)L^WsRzH0 zu|INM2JQEtpKkR1={ulrJ~jG`V_6UGKWpE7kg&I7`Z?hL3-tAV!156K%3~~q%}o>P zW<7={U<{`_V|e1hs|@_s0Kbm*u1h|Te_3}A>i!IMzYZ84KfD51aouHoeOPTe_yocV zW0mzau!3&;RKn^ayyILr7UBZoHivl}!1zvysb_aA)i1_aFJ##i$`bE(|M!viwWI$1 z?P~k=ZR!$uGEE)}JY86ZaM>U8=7SH6shf#A9NYeOb=Thl*DrtRz+u4da0lja2xBFl zVhjhb2OczA_aC%(9K7Mkk=Jr<2>1Kjx-RL63H%Rte5mViH`=o8u%C;u2FHr44*?e* zMBPK!moatVAHIok{}+BAc<~da?rnea_Rruq*Z07c>SX@@Bz|*^PDk09&FZda;d?5+ zcW|G+sO#{V?>X|GGp{=9rbAeV`>-aQW9Z%W_MP6(EcY?A$?<=XYfSjae%J7Eap4w} z%B&)_rXu_oqqu_v6{;*@isR$*W#{?4?g|7M$mmxC^!`8zkYfxh;jd>8uTT>W?5&ENfO z_eaql#&R8K;Y&H5Hqab(@SLs-{<1BmrvGev*V=2I)wMPhJMD`%#JfK9yjc8!wws0@ zzFX0ClY6iS^}9jmJ|%OzulTQ|7iK>Y5~Ad0SOo1DZYkkuBH7$_y>qD_Wiv$fBEjS=H2(u?&tq|?5pR*)cd~vvloAr zZSc&zA28v*x__(MP8!BB-tTpN=#1F5YwrKXZBIJV)^YXXDK|f<<0N(R8IM)heBx(E zrqAe9*Ib3Z&NxY3^CtZJWWeVBMAzZdV(Reyr*s{DJpLse`PJ5^Zig+>slPg1ZD)TE zqc7MOoqDMK$vB?}v3>(s$9}A5AJ(<^&R>-?cVeAy;+{G3DRobHU&Idn5OX=SRUIbH z1)d*#Zl7MKLuaX*{*~|WjPE)?|G9_w`@#P{^4bG!%HJnwSK4pJgZu*c^Pu5Dc;2%O z*mm7~dz-rG7VMkv&TTz6yM^m~`oUq$u_5aA|gSx^(G&bH?1e^>+cgj)NZRUWK{}{dE8b5Z~~y z>QXnwHXoRr!`#^~c?sQiK$n`$lY7MSS;X`E0Ix30v4%O4ZeM@p)^jy)aN5Bk^m_pF zBn{kU_AUFm9&^+4I`!cHLYbGenAg#a;gg{;oDmwsInEd^T4xNo6EKF`Lt}VqXbfAO zF`T;27HVvORkM5Ad?V8h_`=kt6o|edljJYXp!ubb@ttnPsQ$ec%cn+s2%j^|0nIt_2575@8)8c!U82;=6x`by;Myi*7j7lh zbh)B*LAh;N6zy$)*DP8m##WIn!_xV^Kj-`XCX-0=?tJH<7ehGGm13St*&(E=D z97L`^?z4)?OATfNADvZ9zG|=s9hS|%(NPmm50k?g+{2i1|DlEcaN!E3^o8)f9=o^= zx&3y96@CX9itd;zoq(>}bsBP0W!^;Rs7#1){HYi)v>yFIqSw|Fff~)qdMr2F{zaz-=2m>koi4JZG+laXs9M zVRvo{>@06BNV84}?DV$kUEl%iqzA2K*yOFX>y}<+U9{I%hPh$(aW?F>{7vFVr$eato}zli&k0hC>U(O(l-LVD3+aj<0*=S7)W9`_bFVdTGB997^*- zrBhB1mEJI6^t3UVGZtR#t&&Agq@=ghtfcNUO(9c#-cG8jf{3#2+IO8Et=x1jy{L+jF@E`K5 zaIQyAo4RoEj71at(^h-F`m-xNLsmac9e=tt|J5|BXa@I{Y1TFVIkhwRFBbnc-FNWb z+%)U__1LN_m*3qZzIyITW4{-Pf8QEz?d|+$e7x9 zuHt_YaAyTVrE`XbN*4lmmfzaklWuJ;1@2VFUgKE~Z3B!0x#>GvUM>i~k9@g~>pg|j z!q`4R+3wb`z-rsZku0m*^%i}am~Iu<0^jnCU0r)dS@RU;(IRm2E?d~6IEc!!;aQ#bc}1-8t3&XHMn@*hQ? zu2_`cpAhK7UaQ;XIOjNkHzOF(jg6;t1k(~Iw-4t zt1lcdysr92TW|eU&z(O0V>Z{bL$Nn_R{Mil&DdGpvydm~hgizFK5|mHgBZ?z)U$1{ zzPKW^2>-UAe_T<|&X=z+5+bVn5?L+0LKmj^CDH z;Tq_tSe57X@>cQFV(!HkvWpVt&nfQwF?6Ti=O~xx0}RY#woUXJZAw10ygUq>JS$R8 z{pV@7eUI7=My}#swyb+E|8H9lOvC>wf;Usn!~4%R^YHOm=pJV-c)+uS>oq7c#}IbBOx8(Yx&13O2#>lGV))&o}XJ?wvUi_hxlV{_FX+pLpy! z0YA*5PBC+)`JdkAEXLf0-3DyCZ^6hf>5KYik6C{@ie}0B!?k5ySg!(0{FX_3`)E&d zPW`%rer=&&OTlR={VGNdm~!x?{7JW5E#>Nn;k)Jhn)ApVM?UxRm+Y!c$`%nU5Wv=ER`VcJ@?d@~nTq z58#6wB!+Ux#A=)o;0|(OY+M;(A@Y!q#Ia^T*`>Snr^3 z(f_*k=Zy%DDYL@UurZc)3=S7e23tztLl+X*8KS#<1>SMJH8r>{1^9%BiQ#@ksot!_1pU<3ww=10aR-cCNpUE@eE=SJrT(Bp5Mwa9U@xML9%CMQ_ zD;A9p8G9ovx_d4C;k_eBTC=$%5aI zXYKHx&DyDlIbJ`Zr=`={*~m|}Y$v~VWZ28JEtxD?y_0K0pQXsHwcvuxI`B>CL|N8! z!kv_p{%M0x+I-0E`p@<}KpO?LQ9v8{*jMmQOQPIz<>&@rGaksT{$uOLAf@{|p{wu? zvOb~v9o$!2w@(kkvzn8yJMUe(J>%l*jOQfeY9HM)cBd3Pzp>AMxhTk=^V0=~*++UR*kUhD+1? zT^t>H9)zBge6ojJdS*qw1)lq%=Td`bX5@WfG}V9RINJIRU4qQX1>krcxLymNqpN&_ zjjoy{8vD}eM>esu9O7}KDKmz$W9iR0`ZL(frT%;|w&y>ohd;TauEP`4bv3s1%8s(w zQ(RBudG(W?*dtuS8xfUj_`WB0GyWC!!VU|&v;#TO#Cttkg`a7j*9{Fnmi!Fg;HQGIU68I`=eA> zFrY`wk{@lyo^~kqwDr08hc)BRgC^q(|8cpsZoSqCCuW3MKMac}y!mx=p8yZZs(Z_g zj@-2L$&7FiIP1J4!jHgbEf-u7+XI|ElgZ^KWmv>%d$H(6=JdzX1GkE1h3i+2^ z=l4~;Abjk(YWq>0==eW?gOy(PLhc~qYxvA+x0pJjjdc~YF}C=G!Urj5o?YWbrcNmQ zhI@alH-`RRvu?_Ce259i4D8R-Z5lm_@3;F7Pb?FAuS~IwEn~x-#5w8%-?&3GlTIAO z?^}n>`kRRrW#IQ$rCEEMkl)6JBgT2#`PMqlUI+$|Ayd<~lx|P!nVyoa4O2|a?Qw8> zi+0t<-@qkh+34wJ3?8Cv9e7%8C5pG~$g9f;*VKKDbut^bF9ujcxi2I8>WSU*q@l zmKw0d4UHPl3?G4}lFu9XuY9)5_)87hR*a;t*!*WbvD%u7R^l3`)YkY~RqiRujV2ab zx_VGJ*O${>LwxlqbnHZU#(J|b%sPmDO+4-^?)Bq^;rqA_Qa4_2?R0ZBjBK%nqld;8 z4rQ#`S-Wq{v~~u#w%?_NJwxi|o}qEvYR?HTV_RN*K{yZkpW>DarG*RJ>$<^VmABbeb&oV@O*2dLY$_T+W%ADg<}ZQ+yG{oVj| zqYt0F?(PBV`oDehy4B-TU$A$8r#2TxwNZGgJ94YHF?%o}%~Y6Yv(J+Z2H zEj!2T${FFvq4;CU2g~`qRouSO6Yel;u$hqsc#ZcMeduVd=@+jZ;_r=T%$? zet7;;$Hvi`^aA|PP9MB7q42+)=Qyv$Z5PTf6%UOm?A+=L|JZr=e84J_pU_rg$NL|| z#vv!b*!>Og*%#oYwm)6oyuRMIv%@#K@RZZ+wq(2H%yHmWWB@n2FvEGbU^ad}bD--2 z+um7wg|)dny)0JoE;%xtWu*<3*7Tc+!Bqg;@Os?{6K9<=*)Bf~J`Uvy-%OJaw!-ZP zb42}}Nxef?*lp~f4f#H=m06qT(T3prE3D}Tu2l-$%*dVegP2Eg8~vBR_66W=!%p<) z<%I*ROV2vj!&=;yi|c%K7aN=QGo|RsLE(+)ChR_Ai(OP`ty>AsUeRMF{xkOEdfs=S zPdhjI!Z$cLK9Bxyt8m|oX1uTWg|Bhn@8|s$_WO22H{RFy!n54>`*=UceIJ0Xysz+u z%iQ-L@&0P}z2AO6*%vN#-|vkVcPD3?7P8rXcZp5g=R(%zO7hIGBMttd zzs56-lTDizZ*&wco0nUT>vue*fj#1i#f`0Dv6o^QFB=frsI=K=Hlbe>y!PCUqd z?l;e82>wM@QFJ=vKg7bP_U`NgzplwvbFvLeUf`OV=mh$eTljtjG^byR&9(b{2G%9O zlB`|MbH(TmU10O?|9A{9t;yR4FAbSc_}C$*eR_}8y!MaY=BM`{ zi-&kyYrUam`R7_iT3=KCv}{hvY;qOCUCXV)_z%6!+2j`OS#@!^iZ;~$9QgDQvC;2y zpL?0Lq_)JG|H^$$FBEvPS5Nfh?ujq9THA@2bTCKd+iE>m_WT?8A|cweK22^lV-y`{ z#Z0bncBr*$961c0z~Y;~OdN>ovGBF}eF<$01aGSYukI=v-s^ef-V)<^DbJe!OJL%c zY_iJGMb@~*b*EeN+kN9AlXzBc1;Up?6Dyuxa)#hfw_=hf8<^w5S3Xl)jum?z-(sM) z|I=x^ahBb7{ybuYPJ6`sY16+L|6o36#0A~wxv!-!*}}8+_<$}RlMEj5qA?S#V(iFG z7XIe{@=SI7H(C$5a@Id;85pyz`MS@e?wKdS z={<)xwuF*!Dz%oZoMq#*GGPo1PS=*3K0jK@oKJzrv z!mqSia((1Q@$MD)+v}NipNVBZkrDQu|M-(C&u&eP0obo_g(1P_+UF1 z__#TX&zU%97nB>>SJ?JX<}H15=auFg!S_PVxkhk0KjEEu&b+GwR^q(76j*{2r0gN+ zby`B5#QDp)jJ@q>{)WiWON3Jh9LW(Ij#a4kPN7cIsi7EaHkMG zmKo<=^xvKD?ZO3q{{zn?gC&a_w2tTrEo(l*DpIZ&{`@lKP&ZBq9rgyUzOVAN_O^nC=IFzJP2P@+!)NLFt)bQ< z*kZkOy?tg_@+Il{ro1*QJdx+Uv|}&B&5UId?bhVoe^D5lDY^cdJnNG1$m5?gZ@ppJ z2?_LHlUI46$vaDUwkhugU-*lX6$!jI>+kX6ZQiWy>X+e(Hrf2a$Sss>$gXS65A;kY zrWTG?VIM3A#o9W(%)beRx0A!7x%S4p@#3y3+JM}Yn=M$5NpFe86`YZ$f6HxUKncTdnx5zS=92E_-2G6c6E7c6EVbQ za{MH7yND?lz}E!@BVF4#S+;#x^WEXV%Pl+|c#@f4A_qq?VD&#``*&)cVSFL$%DwHY z-W}BYC2NxzJYO)VZthX8g#&O>^NR~NQjMD%>tQtonU zx-fSIe>Zhl6AgZ>I#FZ+b$&;kb<}x}cE~$zeeZ`SXy^7cQ>T?Wiq}fEcG-T<@nd_v z{PyvMKcQ^a2k{oxm2*B;8$tQs;|m+9ck9X8cst#ceT1?Hy5lVuoQSULN=?}ZDa-nE zj{LU=u$e{MD1Cl!Alkk?*wnk9da-D{`1AitU2+4|moHIw40H2Z>NIq3rzW& zDSxi!0rPW!G2cr^(r(PAAUC6DZ=`OL+p{A|kq!zn)??7B-#*_o78 z-b|;;1J~e_J^=jtr<*#3)Ny6QvbW;Jqv`WmUGaD=zyIXd#&7(4@%Z)p*74iHZzzfX zr|Ef*{j22uYy5WbJIXKgzWrWh+~55?dm+Vhz2DFC^Zp)>f03UHvx)1s`JJ~n9(f6~8uq6Tx*ezc=|E)$c^>16u<- z5Bk!{6B2!$+vGkt?+6ZS<-*~PT*>6j$Y5|&{!DypV8FEp*rnjb8R!(-3Vm1uivGpZdU&65I>=R+oJPJ$nxW56>DQ4tW!TMQBelRdLflF; z*amMNy)E^53-S69JNGkQhuBZ5950QRd>qzy*7W65jO%G6N9G&O__b}cV{&!ibl``= zi80&gX+8Lc73=A=Vyn?9Q6XP?mpYy^Go>&+Dd{+(6embNydS-cRbh@v#w=L?atuH%m zy+FL|`5~d0cx?|k`7YdfNpKGVcmHBfAI=V(&m`ddl7n-t51e`5Hnk7ugC<64^YTT& zHux?l=cdAn1#-am3h47EZ)tRTMQb!}_2KKYdAi(bXAiua1+PGhLgjzxzr^HtWk#y@ z#~*8|ze($~YZCnj;&S*8+4v75;Mx9XPaM6?K6^rbzcE!0m9iQS`6Z|8n)PCh&7LFi;wi!lIjQ^qm43)Ai*=2wVDD`0 zM3-?@~^D zwfkehcX_L02tJqi*lFVprwy&=HUsBGc~h;tH@TSP>#R!3pV}^2gZ%k;`BQd&vzrIB z5xDvIwI+Xxysnp7|249$-p*Ir+zb2o{HcM?{y^p-1N!zzy0W>!Z3}sP0C~LsHufUx z?1oFv$6n8htcKq$@(w#(9FV7)gKHfeZ@@UMeeiqU0n>$+QX>( z8hDq3KY~-(8#hu3pa3c%zqX-PvCbxo6-Yhvs5F z7&!u|NWb7wWzHj@VnqI@GR>f4%zcI>;tm(z2FW=nct8VSfIoCM-yEuI|5hunk5vTGboED!9CwOO| z+|4ZHjpAwR(4{UtE-`KA8hRX{ZOx-N&)S}~kZHllSn9OR8`9h{IC0D~BeNVlGzW=M zaYn-Nxtcl`LF-|Pj~^YzTE@rV>#+&=)XpW20#3EF@&CX_d#<84k(ZgCh)XbXMlVf{ zpG(4_jPkAZeCc0qqrbkmRBa^ah>o1Zocdto+7rRA7+8j%1KjdqiF}$FDer}qB*RnE zyFZ>|lkrT_Wm9`$A3xWR-q!zorg*(Y#;Z1V&~*|aIVxuljG5~kr)g)9&K0GT})o%n)1J% z7jCC)=hi{kg_&lpcx!<@7qZP0M0Wh;Is||2Ode*U;XTRXB^ig^jUgqKQaqh zRqWbC8-^#+AT#p4-u6=KsWSAebcELM&lxH^+8619cWQ}|8+#Xf!iSAZPH*X}@Waif zd?2DVqqnJ-M;-Bq;w;+hk=ickf0oZ%_hBakQ#kwc_KXc!O>c6_yd zljOd4@a{zZ3; zUtgimCT0dq#h5PO-pJ66_>@1iN)Ozm^LUUmYl#cuFYP0q^0H*B4;za*+N*lGXoP+D zdwk?Je5>E`f1+{Eqm2zo_D%6XbUp!}k4OP$@+W|EjGT&Od`|fUaJo~#iGTR7&)+|% zfb;iH0O$89;QZwiz-dVV=ao+YXCrW4P8#>;KLMO@3OLVv0yryDz*+kV;Cu-<9ZCIK z`3d0MlmgCep8(FR6mUNK3E)gm0cXwtaK6bNlT@~<;tkrfd>wODHnZ!yO$4@)GfvE^ zoV^Hrc4jbgKJDyB?=2;sBYQbaeaSjE&XBloSnVd;jP6<7YM(g%W^#_^&Ps>_S+sBB z{j@Lpv6lT^4c3;DMIEfK=XzSZuJ&;TbY;oHCqv5$&bCH%P4g}@<>&ZVAFxVlwI)5; z(`x!K&sVw%{g{Zq$H6~3EmT^YmR}Q(ldKKV^^zX=ZZ^V*W?m;0Wt?0tTF ziO$H;`n1X~?|pu6Np*SO^SgSV*8#up`E3I{U+6q~iDRqWpol2&D58jeS_dlGx;)w(ch<)Mz^Px8e4PipnExZv3MQr zA0RHkKGrpRM&+8luc~XGLqVL6`iGW=O6_=#a!a&+kr}DrIp@cgc6lw%v9d;y%e1%? zTjRAwcfHUuinE`}+3Sm~qIoyU%)1QJpGowmpPxL(-V4#T(eaZT@RRE^!ks=l_h0@P z$-|0U;)i;|EjjQCw0che;Bm#@WqS~_+&X-~b;NkZVB|wKd-B*TzI-(2APi=|c*2@d zg-z=tN~(C}UmUSGEV9(b~hY<=2DT0^-Q*QLV7|h^LaJIy1uXJ}|@^e{%74Wa!I+ zKN~AF)Da?X}o5WBLf_ zY35949~~P%p7Tl`)!roFcf*H@>u60^c^2NJ zabB%D(5?-9N9WkQ_M`X3YdUM`2KstEeO|!+PR6YM zZg=$3`uK56byk_Z2I{VZ^vNW06%EZB&S77$*P1@f#Qkmg6atSXvnR=kS50=}RU_&y z?)WMDa7St$N-hy^h3_>FbDVjobw>BxpmW^*5I;UNmH07nn1l3*yt7yr@z`iR^66n; z=>zE1u5&%DGufk%PfmhA@0GEyj<1{R_hgv3v5{Lo#*Fqf&!$5E{rD6Uo%y5kfypW# z$jH~aEx9&{vFKct$Nyn%qnH$;oW#DSCHM7Nr?2yzzBZg|_tlry+tki16#u(s<7a}cSK`>%9sE;1JAiBw}Tp#Jua?9CUD-&@=7 zypVA{S|eHR&__Ik@4oBd=|-1FddRholh+ep?8WZODU43@#M*1L7fol1kB4opaeTe_HmaZCcO9u51`Idb-xeHHKFLzu$aLh(DY8Tm+9(HZlG@86MZTYYorM z(O(K(m9Mif>AaX)bEXOT{=Sg|>RIh$Q=aZA;PP?wS1#pTdhBy#;VQ#dF5d?u=Ssg1 zq{C9${mR|5^T1r%rzNzrpLX_Xe)Vf7E0UGePCwfh`=O^Q3wfVxL-<&8_C&Nk=Jzzs zjehIfcRWqZ=10VI-M9|xVs>1IeFAP=M`g5cK=+F4=RG7<9n!+wY>#t&H2`*xs~6x zVdjCO(edzSC*_rs@)~@906lpZ^R$I?Z4MFZ+0T66haA7f)lp8_S5#K|k^4_)X-;NG z?gNKLVp9L0UGdZbLn}Mi3Ry^f!Mk7Z=7n1O+JeT; zySwxbTgA2s2bV_Y40i1C!S_m@t)*?*cz1DTFSg09=h4xJc8w2f?ddgS>w)|3enEUK zc={HQ+N%a;&suEs$vme|?(-XY9`ISCBr7tEjh?Z%lW`CDCSbEqFg82$dcN|Aww=m1 zK*(q7) zS^XR75zmY;SEZjM@}1 zUQV*UrRDB73zAJWgh>4s@2=KI~Ojhc_bU zbC^G7jRKyQt#b-(ADHUcQp_FM%N?1C{y=tQ9P>bSrS#Gz@W0>JIM+Y2PU|cWB11Og z+ZXR6C)CvQ+4Dzx4u`3p<`1%Xpxl%J_14xQ#@2S@LdeTaiFxRX6TJ;C;=@eGw(OxV z+8=x`x!&=c6i>`4jBgA!%T^QavMbLoHgeL~l^;;P7@l)={2!+|G7KGmNP7^_*$0&e z|f%{JzwXv64-$*z0|Ms7Mm8>#(A<b;`p$PUt(f+g^q^nhjM6!zP zJv?n(@230(@;!60>%937qK{grU-%T?%8L5RS{tsjTBG-{c5;ptTgMtl(cyT@QvRQd z#aq5h{`%8ravtu8P;4vvhQ`uw#oF{QpXV_9F+?}rs|<5EHdK9J%yzzOkJ+22;Ma1_ z-$G<*;{K6JV+W39|42GACiQu1%EkFI=jfzfAF}P6yBIrnjxMKcuRXZHiOu!PzYRuK z%a%&8ar*g*Dc4BcxQ{RL1^T9#qx5fLF3)EZ+I8)X z=OpltU$5+MZ@&qA=v~OUzNH6De*eI2{f)7akJmW3Hp5*XP3Ftw_LMg-`&(oB1?zgr zhPjHZyK~_MwVz8)EqWKfq&Kfld)X6XRlk>P{TJp#vd#Z}L&yH{@Ks4;^^>GF`tg2> zIhWkV*G(G}?6E?>ccg3YVV_QX^hEHt_W!nF6kXWG+R=N^PWGZ?@jL8S`I|2gd6zsu zodGV{zm^zvIeb{gkNf7fpW5e!+>9L4xgi^$i|?qhPBZ7EehU2D`4UIon;gQA(XXph z(C!w+R}=bHb)vo{%}LGkijOOSSzEX1@VsBrwBBv$w zHF*x4%>O)c9{nWFW#+W_gtO}sX*o0rej*~Rm!odfu=lDZ0_%ji}Jgg*k{_nw~EnIF+=-xXNMJsN7onr2G}|u zHXipi%Qn&T*LcRbL9r+}mJa=w*2wz@D{#hC0N%`t`3`H4>sA| zoL{DK*hbj~{6N{G2as7!vNw_Ojo6IqfqyA=wh(t{qRt^;MERbR+Ifa{G#~EPKeVnj zwEj$LTKi;|9lu54dhI4miegnO2|(- zoi$Fr>0XUo5HIPwL!Y95`ldu1-;~fkwr0L#Tu?SXT>R%+69<;O_=9kC_I7AbgDbP# zIPm{T1}D%UQ7#&u{ePF6v!NxYrF-1(bW0z&c$}4hhx=`A(J#4wuFWXEcV+i820vT> zN_Lm`+e?-e`S}U(8z@F)>j*oC!^DQ_?fLXzLR$E=Tz{l0wzF4DKjdn5HN<7E46g4%QT+ci0R z{+gUUe@)Jwzb2hIK|b?()+;(GZ`Qtub7jj;p)b35*2p(Q?R|^ck@t1aH~898;6B#D zUGm4KWnUi*J-0ghJL~oRp8n^EYj1?cyuCu_`Pkok-gl0zKVL&f9z=({_s}p~CtNGM@pmPo_3iHt2SyPwIni3rWn1do02=pa@Uf($@5HWD zEPvE+I~KR!oUNu7Rl1B63yr*P#nkzXF}EZzHl+5NjV&&RJZ1 z=V_?jkIm=;@vd-CPaPG)hzCGeK z_S_f1&%_mc#H&VlOXD-K(WXPEdhyU$VyT=TMj6F{ujhO=(TFv-UFw5$w9d;Dtb?M} zbldKc%$FWj+-DKjqM>+8{aJ1P`Mw`CcJpU5DHG)!n_AWB^n|}odrn+sO=4Un|6;AL zah6QQiQ_8D^=SC&sq=JRO%3M&n6X-OK0MC)XPfgq;uzm1n2N2zdEs5la|`uN%~`Cw zr0UU=o0Mc(iHO6Fgx_RJpeX^a6eFXffUuT6Kx;2Fl;eM6%A+dcc8`*zRDnzel)&vb6WEOM3#z7kqX z&eDUG*wz*>ExwO(73~P$Jwvc@)vvFHzVpgu&(B?WXZQ~PR{~G@kJap6h#%tL85rlk zGJkc}F!+^m;~RLKR}x%Y$613l^sNP3O5e+K;f8>ls;~Oq^zE7lwD|+dL`5IV-+eRZ z_UPHsv%v?Rl)nF!BPU$DKshQ_AavLwRx6vk8eO;kEzeG^n{?J#;peGq)-Rafi99=> z_7d*}CyEWTk>|*;mUiT1BXBqbVqF{aHnFVuJU{W{zO1a^J*v`PA>cGpzY8&GwnThhi_$ z7CNQyV2+nFJ)$K#tI^Nc7{0zp-&7e>c&Z~49vQ(L;=O&gxqPpz$XyN{M)$;v6|6Hl^#bIX^_ckj_2t+^ROSBiB1^KF(Q5iqGcWZ0-FLXIuupVC|e)Ok2aq8{v#h z|1}qc1IwCU;JZ)e+)K%neE93D;OOUDaJdh$&d>NJw%f_LsNL&`VXNKs72ci7L!aTa z+4Et%xY4(OZ{GCbQ{>WscWNWbce|oTSdXf=ID>n^3(V;y;(_h7oBNV)Z#8Y^{?@m5 zJ!gx^zA0vmSPO{c$UjPGbDRTr2KrTSqAP|Ltfy@=Z#R;6feb99uK2KrZ>EUelCRHk z*4!cJbUEz_{sb4k#OMm~$s^U>z_lxf#I&5g$0rXeJslhjA29ZMuCwj<<{tN%*IQRj5&x|ZvJb1htTwu+uN@m%(&uFV-`4qomYoR+~p zHJ?=yoy=MJtP@0!IJOotCR*?44D`=W;Kf9Hwb?h?$?bUTqITYIU_NhzPo&Rev#cI# z>%AX9Gp&2vhfi~(Z+cj?4J}{R15GcWY+E#QopOQ|#S9&5>I@&K@b8|ix1KAZDq__FPX*hjq6-r!NZS9$T$&zK)G&~LYcr|vZ_ z;@w04;2ckMqi2|Jp3PtSmSaxjFT9s-5?*Z|#EV?ozZO9LZBH**4?mgl(K##5_?SMz zJCE{CZ9GDoKjOOdEL(q^3QWoSKY+toM>+EjrrgiZ`lo%Zd-pe#XQPvzpT_+OZ5vgL)J)l{=MC?FX=KC8vh6rUTL0JE4lA39h*Ks~V9p_6;xIn|MeNi;b`ULD`8HTqT8(lvJe zW>&-p4vF-WY%sFa)!7@Z@T)Fd$0k>K*^m3N+tjB9@Q|Kv#}<>0o(hjjKD>wyZ%2N+ z_-QOO$7&C!vvzCSx)ER_Bl^xksBmJ%xpfz}Q${jE`b+IeMyz5ViDGNwea@O*GaC6| zEx)H%HvEt_Ebu%;j#~TzTQ-Q#gtK^K7j@B7G0l%>D7!`aig=sWK*ei0f4_fs-&o{C z&Sor(K2&be7aT(yIoK)KoFzxj^s)zJWXX}~-qItTgG%%CeK^zaG020_k#B&jvd6r}RuZ2TtgIHiK<=9VRVxE7b?v2Pw;aE!fDxbf*hP}Ogyc3Ge zPw0=8#kv)JgTt_+FpaCx3xuLnn(L7IQDU zYaUF62gUF5WA%J3d>`jsn-6;POg6()jDwk9_`7$p$4&h3HOeaXbrbKR;8lBx>SRT} zDcH1eCHyH~mtQSDO^h$P-*O+wHHaE@= znQ!{Z_wImyiP4AOn_}ZMh(7LTUT5&XS^IE+Jxp^G+T{ROJd&k<_yD<8qWy{Qqis6OPg%!vgjlojsj6d<6 zJ)Lv@q9a$oSRB5P_ZmO;u(2h~{_d#$m z(!KD}i{?Kk@@xIS6^i|m|GSJ{$%?EMeLL-W_aWEPF^P0C-%>r(@tJ*@C(K0)$FQ#_*9q2;{}Eq}^bwb9o$+U}sQot@ev5sZA!r8#lL=x+3>a~9<`#Ei zccQzMqhb{{SR6-TXLO04iB>M1UVz7bPTT(2{ifWF z%<%@kGcj|7wWJQ)>rSp!ehp=w;QQ~A9ptd=QVxsgtQf>%(ezzs{==(A#-{h_x~9SS zeA0<$Nhf9%ZudL((ns;lM<-jcqsYXb4al^u=wZ$s5NGLyDEP@bauWThV)%1ApOvIqPTe z>@S8}#ouJ?+_pYNTT{}lYpOUOqK5d1;7{cL2FWh3f3+WacszmaQF!<0MlbXlUwCAr zO*hW%(>kG{ojJz=y2&;p{t?r+Htcg+gOOJmKaE)rFhp0)k+-~7w`aI*=P2(;Hp(?l zIniw|V|d*#bS1bq46|)HmoJu!J_)!nS8Y7Dl!TuIhV-QWrHQLGW&zd_yZE1(HgRta zG9%^KRiDn-jW4Ws#x4W+p6^*ZW0{>x1OFPlwEtB+{SDfZtos1_+MIvL zct zM&4Kc-gryTyJfK>ofWM|f#Cyo4*i&ckHPw2oVMbAenEcmtzPo52a|`LPW<1`UdaIa zLNl6=)qBIPEs-cgo9oAsj_hqtj2oW{Z1LlD_~eo?lAY2clH0TY&$d&qpw&b&aoaD3iZO#UlS>RL&ZdZ^KeR(suntThvy?{1}H5(h|Fl`tcrqc@R z`83AwzzE`S%o~+e%%_EYe9}SlHMZ#ZPV}?nwP?6E-^PEB6Bm=6YGREWZ5!%+=e^sv zS9z~%ol&efsO+EIXV{NH45tpc=vi;=JdjD8lHWUNHlJftwYt3iApEVfSAUcpn(+`k zfA+#J&3M)`WcK0-R_5Q+L#>NF!=`joem3V3)@Xn|C*acb1NMg$SbJ-TwbuPW{XDgBIP*<*L({AFyLw_*i=-FB2v%0&G)uTBx*QV*{NHsK-EPnk^eDf29=9?_v z(HJY2QMu4{&@Ik6=26<3O@Ip+yqtME1GtucOON^>$%FgINhyz zNV|;nhZBp-j#(3|W3uTJ>rbP;=$*|s3{vH1C{Gkx$GUQ?SOam;=vXUOH<n4@jQ^a@a{T_G>oAU->wPo6KaEv<#>#eY! zKZh-7)=Z2IAB?D7^_jc}BO}BoSHeHyr80E3d31#VY?I28W4=iasxMmqv(J~~doT{&iN_jWW0d9z zGDmSe$wu*-$u&kk6+#!q+k|rtI3HPD-dsC;%zAzZjO%Vhcl&+V*~iHJ z<^Qio<1HqpM-H%$ePnHv3sO&WqKJH)b?}bLvuB?(d##w_m97kA9kk_Jyl;@tMZLk) zla7Cqd8#qp{Gnoa><8lcD$3mn{Z1Ima@OhKw;hT67UvtezoM?|yWS7qxW22NFGaT7 zJ}Wtcw0AGh#B-0*_b7C%g^ucvcSj64TC^=l9OC;aaN|2Qzzhqvp=K?erBIF~vm=P~`yw!Arj%)kjLUVuHJdNY92 z29By1f6LoUOr*7aqjX*{vchTO=h&_KK3x>Mq89({Zj;B99r+sgi6?7^k6t|nUWK_g zUjU5{!z=O^D=W%M;gh1u1)L?YPitX;#abh*JQvw^n|LtL{gUiQ#zOp?Mjxb~-e3$v zlS8q~xL+_?_8T#pGwtuhRl@U?$Kpjd^6VF^rIqr(48GNO&~xG2jl@+X=l=uT#CPIR z>FBS)b9!Dani@YdGjbZ^FCG!EuHgNj&amSt`>*yQ^L)rWVpzxsm!IC@y~Yq;FP6Ud zAFJBkr0@ID=dOu$-_g2Z6#hw$cet?*@d5U8Z>*x7ycUhC`hO-k2=;5_kO^MCCsd*_ zIn8;_yUn`4Q1{@ZGJ&s@?Jn}HC=j${SG*!keN8@FbJhdC`Sjukw0yZV@>QnUTZbDSR{!_Tz&IM>FpzH!&99JcfF* zd*T(+8AFi6Ly^bBkjul7&*+QgBRRKakg*@N@1dQ3N){;=wH7++J1wQ~VH9||r?6%T zA80=-w#Iy|)2x(F$hSpmz~fwS*azR%el^58b7ps$^RA3{D~Q>6uvP4NJT}q-Y+`qR#Dy-Hm<89ko z&$~{w=iIN!>A|0)?zqS}%8F-u23akSfG0llraZpcE!=mk#zfNi7vC$My9QclES?x?6)%OyIJ-NR&;K^o zs{PlXOPMp4XXYN2X@^$ob3Nw}9KJdf!yeq5?|bq|@tOCOC!YK~b!BI5bm0Hdf&CSr@FtdzjNvwG(Fk++gj<`+7O;<(T%OwAX-+!x!FE{-e{wm$8rG znGdI-dp%*zqfYopxvr0Zi@_fm*$>tOeX#1#_ePJ5xgzF~-Ez9og`52rZI_0~jh?xu z8owpE&mG_p1uu(lnCV~NMSTZ;FyG4ow^ZfJSi7s?C;GlkpC58)p#Gmi|8HQQP(M5$ z>ci9YIm79*e_Hq^#!&UX$vEr(>*n8zZNWxyVkJ9zV06BXivQYT)*-2P zk5m7y6V-owlBxfgQ(wA!?>KAS&yB8!PFa1t@I22d9&;w%~{2?4y9K#vu3#Y0J7f9M{M&o1`jJT2K!pyad_ic ze6!X!@N+i5=*{VVfH+r-v%`z9U8YKw!Kd=$Ryp zK8e4MvFBa<^($Zr4|ERuaQp8uu=T@)!q3vS9N6Ox$}O7jitOP$@NZypYl9|$doMP za5jE?nvuhj73()zJKZ&b^Bveh^m}9dXJ2UNUa~UNtf6H_ZsESsH-WsUtVk8ts&CG# zK$a_xHjZcTY+>|P=X(}w*=x@HHfMB$e<$Un*QX$Z_p?Vgh^;DEms3x4YV>`!r-Ez6 z-Pbdo*u`eQnPTbMZ`R0}7MJi|@?}4L)marP-w6H7_!li+G5?}(Urr!7sLq~@RZS{yIzgAiHp#L;vR#PXuShtu$s`$QG3kYX2^J%Gm!E_PD&`yencoMe^t)@DP0- zVGKJqy0%&-wit-d1)au8B=(*Lz8*L2^A|bxij^4 z-+$oLd5rljoc}^ua<_t-gH61%IOnF0GbOA~=Y|{U2kT)m{FT)Pexu-LMW$27&;)t6 zlCpV}#a{i6=&pHu2XNeb*Oy(yGqs_Z&7byQyE*Ou5?GQY^rNr@Jm8~U8k2{dF=;_p z_t{!mk^kYj`b^#m{AlAW+VG1VVw@#|#NRcvXU6N7oGG$mXmgY}r9W+2SZDcd(0*ga zxs$S5lU%}_JTx`b+UB#uPf~BXc-`R{+osBjJma*x06u8jSk~+#ZjNqWqg>?<=(wGF z!b`S+d%n-t=$mAw=(3XQ1Lis_as#l$AEN(qo}2QtC;s>u@1#c)m1$0fd1^I{P4 zAr1L382R7{yE(pQjK~YT2l|Sivx4}yHSnqN;jx*)QO~cv5Un!l5Gk{{Df z5x$uboyld^;2D3}`s>NPd9i*%&kAp_yN+wq)^9Efx3RzLIj;>jYouMbg1U{_(g&H5 z-|PBR3)&LX(Df)Q#<%!lFODT1k6!lYjnMv#4^YAHN^6VwoV?OO{@}GZv zJAQvCHtRcY?|R_0S3WA3^|Ox_e&=f+1-|miQyIkf?L5Qs-Lv<8W%sPWtnK&*+p%*t z6|5W)&L8Gq9l#c0t-*W;Th|lQ@D)8)3>gp;+~oYl{%|kr&0jQd!9723+gLyOi)v#E z`H!5{7RevxjkU19rYQp-ioTni#5C*tYT|K?(9nN7dr6?9o6i^^pRs^^#zojL`Rg-G zK4ajavYuxA{e|$B@GJ&T=5vfSB2(WF-9a!6jsHkM5w{!kvU#(J(9H{}{%4zFH@eS9hLUpH5pGERHlz->gYaaQ0ueAB3qz8M}OM|B%Hs{6sc zVfeq7quL;!(4oP4a1hPTh6Zi;havP((?EHuuiJU5{$Zh5RAV|O)XKNS7H`1^s{vm> zV_b`G9ak*Jf&U!?KbL(Bec#-IUPjMq%}RXH3@pC45Ss#j@C^o&Q<;Gr4)F8yJVU%) zZG|(IE$n#^`;_?_o=J@Q0p^!%@dn{C2)?Jj?sc6{ous+9#GT_S!S(6kUek{Bnv3hL z!nMK*kAfERFKdC@h76m+J$hm8pNx$(h_N2YSf9dJk3t3xLI&y#2z!sMADm|;>|yWn zS+Vz^#ca>;a44HCMJU?zA zIlJX=o)IhG^^PcCSbMa5{KRw07v>+GWUlkhnZ&h`F&@ue4>XWHa4+Xx>3=@i}y6vi=20h-7?^$I_`7r%a!i@kAym(N98g#$2#l^GIXoXC7fM z?8xK2(Fe@&(Ug;o*oKXGY0Q}=zwfCez%@ooN4P{;UspyJj6B~OY{uujNirU~8**OI~Z%EuPJWYCtHHMtJi(h73%eR%XzRCJ! zh5Uc}Y*A~ZwN7!3J@Aci`afW_gNNS#4>*a3uQ%;Ue&0mjZ-fRn5ZAb#Sbe&Y8;#(m zaWeBeMZSLEe)Op2>e0)3^<98x$@%(CjAJEwxB)$!j~=c?5Bu-m_Ef-PJuz+8>cFw` z-3933{6HnC4E{bnysWloo8%5UV0@SOtYi)H!L>z@f!Aal8`AJBwg_^u$mM%{N7Hw7(ue*hJkm+>=XY4&of+16 z9h7WJ!MCz$-FEL99$ek@?XsRG_*A}xWbXs?!Iizbm%I%iJ2ehF;;ge0XK7+z=sM=% z)8~*E$a zx1aI-2k)zi(=^bR2KxH|duF98bg%3D6X=SGtSP#%-cmczo!W*)VgE#51C%41sApc*)SiKi7+-iE?MUt>%DCfYv%O#Nkz2e5-b_#V z-Y7Bm$Um#LReAi~(wWWw%-HrIe5v_cHPiRHU^YR+fG6`=eNR-rx5nX*^q2XtIcVkf zD30C)48JFHd(%Gy+nT9wXp;UXTdP2-G!4|Is3|-`R_wAEbY~Nm62u4`f zGJPwCS8G>&t|xn?wYLL$o4MZZbLaYpR+}eW2TpI{2d!H5=#wrT78*P=Ba934K(y%J z&Oka%b5k*!+Tovjp#Z)rfUmUH(g@!b{2?-T*0=3@#aJk7#}5Y$;%oup>hArF!Qq=| z|IR(3=6vc@Qm58y`&{b(1@NtW&nEclfmPPd49*jnjX#5o+a?*83fIJWARPY_`eDe1_(VyCm!E`@vc5y=LMBS&{#uta$r1 z>>`b2JNCNhyocv?;Dn5wTaBM1nb5aS^Y}4H?pO5%q1dLK@yAwNfKFg<(__F}f$v&9 zDHLPP^syDJ-LII${ghBl^XVzh`CKuD`*ZAj7D(5v;5??>oHLggrxn9_cRBC)uf5OS|IyAoufB!-`fBqQ;D4F*4_*HUWxve*9iiCm zy1#?#Z-ioB()BlZH`vp<;un0c^P_UD6BSk87mEFd-rdK$kI0J_d~(@5@Kg1T#QpW| zMqqp{6#I;>Kj+{u#wqhDXC0M3sIKU#9IF+dvSPWHu_qWltftIWs(U$Y@VwvnWBVSx z&BHo~m-P@Ic0+Qk0v=%gHw?eBrxto@o$oB#sQq1e>CKlL-B6To@lDxZlXoYYl!s!s z&>rimh3_EuwQjJL@e(iX!44A5rU(~@W@qZ!p;X4K99SKz9P$*hf4Qp4DF+)_fR26maxBFBd~iYI%!*E43d`dLCb zJyUy!x$gqzEY@pp8e)YR&XaiG1E7$dn5VXwd4ir-Jmg{ z`|`{_j-1GYz%2Dyrd^91rzq<^rn^GEC;c-#3XbZF)>=H4-@r)a=Nm;H7mat-*DX=Op^x_))y&^OX5HW#;g&b?#aG zlV@4_IsTL7RxP}w`GX!e=bKdz55=}1mk+UKRgGM!lYI%?TI5U>&$yP~H@6mfWS%3N z66Y;GN#Rl28R!fM`CZcerQj}ofNU<@jofalx7QQWY2(0Tz76>l>j*b-u0Cf5HIj$# zBjzGG-v9idV1%{o-q`5*uSt(&MwS9w->R{7O5d75zjFdkn&;#r$Hq&Jz3nH)FZ7gh zuGTWaBn!UA^bdAyaRWS(4`0jzrvh*)04K$E>)?4~yKeG_XEBb7$BQvQ)#I;Ww+mChk%jHXAiM>IzGM5P7t zmoh@7esbU3@mM}Cchr30!u!hi;>F?(ofGc8;ohEuUYE7g1L z8?f^n#zchcb;`$PtnW2;(~>{o?HI+uo8O`F&_iEWkwPq5l6gx{FR|8if)dg1?X@7=?yuCmAf_W_jy zn4%yzFMwKsI$aP1x^X}=)UHPNX2eSkUdl+jpq8Y43dI^uS(-VC))bta$tjo#Ym(Gv zu$nS$x=l0TrRE@AwA8?~^L?$o_Z#0J==^@a@9%j&e{i1XJZta$-q*F)UVH7e*WO$D zr*Swk2lxAyJzrA$HTC^^KDNPILYnuL0T;VdFJ*i!s~X$V_^?&GgfZ5*#ofGbg;m>h z1?zq8teGBEa%baB>{Tr6q4uS$tej&F=Uc~Iq0|q2>_SU-ayqep>f8JcooQ>3xBq%uGx*N_!oDp1zcHS!Je08Exzb;EB}1z za!-Hmlj7~*NsU%f-oLHMRXZV;$-H8Y0fyq`KX zY_zJ+1y%rKN@NVh_C>lYj(}DcK`WE2u%>O>t^8o}l=Gb3T1pW>YzW9+F!!!e#<$&$;~?pEjRXH{ z^cnLfG+XlwW3K`ktKi>S#;Qcdk~wXKji2|dbneHZS^g^ed?UE0jh-#a zUan{|VIN=_2I8Pg=GSU> zaD}>ao%d_PDp?cCc_X1Av11kb5!#V-yV+A|CVxp=yn%er%*`r&En*bsifTj2Bb0mF zQ(R-N3gzvmB~s^&6{D&)=Vndc2#ryfP~-?Zp2Vr5EU9}AZ76&#bCjA7WKW#(uvbgn z8?4L4j$W0S{b$Z=!AIn*me8WQo5R|=Bg|d#{dns^buUK>a#JaDqJK1f|6BCC;A9{9 zji)bVoQcexBKuE_Ls<|0)%(5C&#>*00aI&nSc$cfhgF2pZxdwfa%Cca328oG$(o6tqY z-`mnfA43D@U%X-i>skc_*vtNIqFT&1lK*^`-7LnSAOp*mi0^J+d)|}HyAu_5I!w@Kxks! zOJWZBoB-oS@nHR@f7N<+JQVF?GW9@Qx91+|FOsXK=z_WbMKkM z?^?~8ko95x(^fk2tELggZ_d+Jel2>Gxc{+gJ|?e^SJCgtWeE?!zg9uxJ$V0ucrM(G ziw#NBu%8L(pZe<~oROuimFQkdUx&AG-`Z}%WgV~+yFJOXu0rf{;(R|4cN6izjl#F^ zt!(l{ZqDbPuA-zBhEGD@(jUUl)OW^$oMVwVt|#Fu@HqE^h^q@PwbItxZ6lwG3Gg7{ zyW_0<=Lwg)BNSe+1-&83s#$BoNMBru{B+QDy!|DYX#VAToU*9b1aPDHIPcC)evG-0 zyeV?(Kf?ZtsoUn?TKVD7 z&In`-Ik$Kzbz3TPhbz3P@fj=s((ay@*U0=2O$_JzWiHRl>iie#2DH1q$1ZRM6yfewjKLW2}iM>Bd#w~aW`5uiz!#mt%&@WjD5bOsYCYSt^+;CK5=}GJ)JO_Uz~Ve#Tw;HaI4pR zq7&3-Y4(!mNbo5*l)2_3(iT6CJd5sM`0Z55|L5SU+W5BpRy$*KRqZua%`a_y^nw4+ z1RwA?siS`e_e@Yn)@?P>rj7;h75IFr$cG~TJL@NRqj{!_oYK!1YG~-w1;_{X9PN%) zbM)JN^t>qaBDAvN9rG3iG$QqV0RN51I2o5)8B!Pcbjv>Of+~qo?-nY5CVnf%N-uWxRUmLz#Jy{ z{`4;0zI4ixxyXr+O6uFg#x45{lM6I%V`xuIfmQt}@Tp6v8}f(9!O83ceVS+0u;HWI z)X!5a=f*FkO|AS(WFGKt{R-KA9{t1}K-bYX&ao!-x&c~I^K-1+hcO^^VY8W^=P^Go zw5rvbiMSXQ193M(QaQAk)J%$Uo)9yLDe$aSQzOJ9pRo&HA^*Zuyk3UsckryuD z91Ur0K0Rfsrjukd&x;J!2#uy7OSoMrVTGYq+7jYNU#0p--#L4wo^uMX)N8(3Er!2N zg$K_7=W@R2T;klS#+}mHyYLIn{jASlf}hCRP-Ktsu18meGcPTKuLn)ibs3@RGSjgp zbT_3yYolqO(3V;gA~!kLgo)j_1BiMG?~}cWQ04`ZtNdBy3Ey`A@ys@N{#^@>oV0C? zj~yjzzxr|d4416sM4oc;%AgyM^GcCdWzGx*UkO&|Ojq9V_FYIlLg;hhcYgE^+=o}> zEDK(fkA7=I%7HW6oY5BA-Alc;i~NSpq3~kXEzGa()5rrE-am#p_C|PoH`dSKOve5s z@RoaxmWQd7nIGjLCXQ&QZ#I z;8*(0e!f@WH^@Zt!l~h)4uSr7^_zDmHu8!9mK}{1=@km$9EpZKP zCD9IT|K8ts4&UqI(d+SzwSRu{5704p;T(?>?>mz?6>-S5)GdxPJ&iH6lRDKwOWD*h zhckZ8Iu&xRO|=u)S|@moU8hB-s8cxK6QfUFry$~3{Z6dYF4}F^C7JUJN5IVy&WPs; zURV!3KpS(y$5iEIduoG2gRYji@Prnj#l7{qpWvbC{yZNB&vZGMk8w@Z4Ryv=VBr{J{XZAN~oWsWMc+br`Cd&sKI z@H5?J`e!X|7CIYB9de~SJK}(LKDPUPZ^#tOP%43r`>+q+m7~Pxfzh{GEIp=Dp%Z0a# ztkEuA`Gf7!RhqsrC1ZaA^>#Bqb0=p@eJ{7>0qj#qpCCi1@rHbq zzHtU)8XU+yZ-wBcf_dhA+P+J4XUL1Q$ftsFSvYf^+NYO&?K*=$u`NB9xx#~vOr33J zEC^5ek@IX~%j}lDmD9N+gZ+D@=QeYe)Ncg&I_tg#9EhHD6XDFasy*^u@qOyUK2^)d z{Ixt}DS1fl;j4{4E|2F#TluSynWf);Pd<|N{K(7<=e(19#_@S)f|+;1Ti4^>x_nV{x{%pnhS7$fy#25m02Fh3(=b_C|Mx{&Dg(fqeOXPrL6G`GHY)sCvfv zlE8uRSuWLDo*isqdM!AP^Yu63XPIzkKjdr;TJ2<*&GULXUN96v({~=!10limqH*1fFn71UoCHZx0oxfEd*VSTyb?hNM)b+ypxpYIkMmKa|;`8vOIE<3%RF$sNFqq9G-=cPb?R&Y$&jlnVR z#C;d2Nmk|c_dQNJ;rr(TXA>s0C3JQp_00xKoj<2e*iy!bTz$X9hZlT`ZY%3I>0an7 z_55$LN424^$m8@i+R&Gb{f=mA6g1`Re>Ep^hDms>?90k}vk^Hnxlie;FjuUPJ9w0w zqU1a1N6RQD?hmE((fdPN&JE;$O}oaqLa`sQ4v0?qrtV8tjdS&XCyV{3r{D*Pb1W}w zf%2p)M|$r&6j)L55d90@3gw;Us}j7{AL}l#Hk4c-HrD9sFRXmX(_-BwXX}JN#QA;= zek6?j+_Hq*tSqt96r2j)5TgXH9u$^hLI9n~_gK?B!*>_A<<)Q3Rvi}`;-h{=E$#Qoe*w=qBkS2Q; z>!^Dk_7Q^_%N0G)ZyyX)=gi_<9C$zvT#{TV_T2q^(+{_eEA(;03jv0+vb`<0 zdZuFEja@AAO;WJz18IHZZtis&#hkMZc{#h-Dk|lhT0haR3AC%9ojxs9?LV^jS#DjL z?(Kzb1!bh#`wbLw1_ug!~KS}k<9gvczoGVNOiX0sn&N~E=u42)N zWh3)WVUF~XPdN4nLc6=Mms-j^A##7u;QL>`487I_^j6;npXR%rHNfr2rnfO>UbJ;w z$WynW9>jMVjVkNiDrfJa@Yl}VaP=ED)3tIET_lr=!uxEYyj z{HF_FQuU-?WxiBy`Utsrxf+k=Etlz>g_H4E5L9wu=}y*{oWp2y=L`3q1h%+OdS9g6 zzaV^B#;Di?uScgc0emf^KC{Nn%AECMK=$LyE&8~D?;=YKa5SWY`Kd zM&=Yx$5yED4_4K`h$mzFU+mA%R(V^g73i6MK8XGhd&P>uo|d1)jjn0aU`y;aV?-86 zA^ud{t9T!I?r!dP;=k;xKwvfhe2mm*@n68-Pq_S-JXFj(@`yR#k<$10o4J6&P zla;O08T7erM^8TLyh%szp#6v~$3fm1k~e1@jGWn>S;BDYC-3BjRF zQ>X*Rgx*Qmu?6Agtb($gl07hV*ZHB86HYlZDaXwm5KcMoP!9Dec2kaTaVY zgiAT!!1s~q6)h>+39_=}Y?jT7O0gqsfTo;w^UagC>T_%0yNI3hI&&VVx_weXIML z_}03-n(n=&U0vi%gPb*By&?L8Hf{Kkx=24BQZyRGT>~fH87c2iOZ{eWCtq?mtpnN& zJuHl}{wQ@-IAE@5<;U>mF|BoId*`El-(!l!J=Lz@vU|~OvNw~plDR|rMvaoKR1{qsypDM=x|J+-hlF7@V>fTOB{Rv8G$zCol3m#`|l< zi#Y#_Ofj)Hcw%iaQO;%L#8~;<;h6@Ho_LV>*ovpp@C`ri=;ke@AN>hd?L$C`A0BQM zZRv-sz&YrJ(A!kpjp5uW%^c(owfZEFE6j93GwcatdqdfOukZJjIPydy1QoU&f=ef;MNaV@%E>&+(*LLwvCd-glikeR zFXSofmioR+;zb_5zMs_>d99C&GNnH+p+Dg>qrjEwmz>kAzBZlR$~XA-D4~z$Ge@Uj z9~YkBik)elJ8qtPUm#!VC1ZIyylF7w8N5zx3=a1(<;E0p9b__h#TLqavADT^CgA7K z{1r&#@8K`uOrwD-ja&Tk{~Uk&b6|rDxl3>;viN>*9~_%8$%<+k4L;JRaSv>w=!L|d zSDytN%3JWlqbq}=du`Ma!-KUx0LuLtT)trj4Um7 z;P4uCK2^$b!E=%+$EC_~`+D-tJ}(>uP6Y?{d}*IcmNEqoyjRW{;{Kdp9e~~TK+Y+L zaCR5oE4Hbv_h1feE)-ilc&wZulJ`uJA2&GVM>qSAGA|sP|4Z_^nKLanRmofE!e=Re z#}w)$w()X~iF-QPS8-!=WmOd*gX|h2e50T5Y2t{CA-K8$_lI(yWeD~yO|o}dsO<0x zvCmWU4fc8erv7q{>2qK#b~;XZ2fF86zU-s8yu*qM@15jw&4eGRvk};G96)wd>o3t~ zvUZg_*@_x~dFZ7g;puXgDN(g4(zox2z=}lrN5V?jA2T>r_y3*=e(m^me3QQUH}UJ_ z+>PWxSiBwQEYh?0Suf`*b8>4Zhe8Kup))}LB=<8Eunx?i9XClh=cg?0f{J7ge4I3b z!=B_Lan2$R2fS3A0_3;I2v5r#^4N*&J!e&zqK_lQ5qfi;UkHqr`K&vA(}O+=p}*bS z0TI+ee-D7{t*SyJkJN!T!P72yE@8E9aP+9uWw7O)EN9hA66wDIskc+6)yGPcxp{Xa z^MKGD`};yOo<8U(xWBiww|diP;@rO6kG_X@16bqu;Xl?5cQ;R=yj{@3KGM{2hgt)D z@1_s)xW7d1VdUD7C_w7XL27H%mRZ!>@3#C#!L>$h6$=$U1cT8J?_t4|}k& z51aWW{By=IPgYZzCrkLZ={`7ZwR@IP(7!$%4)!oS9R7k@7PXU%u!fx@x)UohXrKOX;!<~z75yd3{a=DYYO z;)e%In?%+vycR!mp7@i*e79_V;B{z~q|I)S%9|C+btLARGc zzhgN!cQN+|>btVzBp=5;3&Ot&(Q}rvPNCc#1!2&{y>pxYLOeMiUNAVPYE2Mtl)wY* z@iFB zeCDQwSyd&})1sb#rEYS^`C!&dayQ27_~Tp=85e`I56!nEzE$w;ZTu}E5u;RjSE;*- z;g43)b77t%?*6&+!lA)RSwDbNH)j?~dsrF7-S5r`^~Q1Mk6K$*XP7%U2BdyZeg()f zi4S|43)qvGhJV)(m-l__D(Zw+RYZ8x33G$X#xp%FZxc3tSA_RPSKW>#_onZ|t+MYg z<(`2x=nI#j4=Cv~?no#!Xiy+b*GJ z!lf=O9+z{TNZk<|n93QeK)0&N#FIW2{Eo)m0Q`+fyB7PS-S{PaGHI_RT=G*mpQqn50%!+&4B!346*>|(=d$$K4{RcIT?Y7~$WQpPjH7knXU}MOt>oSA9LZMl zJ&HcY&KEtN&a3qt$pD{=yhMhR`*U6f?nPGJ3$1l}j^q+#X=H~z+#jaOYU)2m;7$5L-+3;$?(h4Y@0FaT^AqQ_AZ<^*0vdXqFgstN zVVzFyMwfI0eD9G??3|w9GDp6O zjkWA!FAR=2AU5w)Mp94cZAeMU#J9Nb#E&~+`uUkZfy2^ltM5A6mYbj9m3g+3IiNJ# z^B7}lf66YmcQE697j|fS__HpDuHt=5sn?ot-W)_%DYUT*dTSwE>b;Y1N8tH&=q#m< z|1N~HYbW`0p_ZG~#yCBYm>9>z|Ju721PTsN;8cIdaA#0f( zvNupj{ba8Agmo=%%vUL%l`nVl#`>o5jWjhXY^4sHL>NMN+Tri4D)ygR)VEJE)%^%Z zW}EcgvQ+wf;)+eQ?1QC@#9keIsQ8Kc`=#bPGPurXj1C`5crx*mp~=>7S7v$pLznUv zXdW~bie5wZ77C!HY-q}b9O3SMT*su|9YcnxWPjd|Y=bS!RqUB6dyr(->8<&eXL&`x z!+a!qOI?ozx*kKNe#{&7)VuZD=la_~zNxl+t^INM1!sML?wOvfWZrOfV-HXm+?*ld z-Ocx41<^&zJvQ83lEm7_=p?sK-8x+9Bwh5m?6Ii%{!o^>3!}sM$-|Ybe5kjzT;%yv z#=k?yZzR6dX%FSpum=Y%m%E<`({jaAnO-?3Dd&8igqHo>2_3dy*INPn~)=1w}+R8b(EaA(@5?9IH3VFSi?N)h;t7jYAtw3X_X_6A_eHF0*yHuX3su^noZ`z&x_azpDxuSn#-E2QQ93vm zIa}}5y8D&JkC1PaSI@URWCOeWWRs?nz3b%Ql8J+jKN)`^emTD+b*sc)#?P8X)|ui@ z#-GgnozeDp?g!1o-`D<*zaGEXkVxGtd84)zysL8Y+xddaYCqxKOu9n+g}fi6;!#dv z58k_%Z|i73>)lqI=H?X3SXMY^+{?Ly)->Q$)&Zr_ImLc>QnH;N{zCAn`j7McPFY;x z9~Diq!HwX5aUFN}Q2t@)s2lp20sP1CFW_IoecrFZ!CV`5)!q6aCEq{vYxm z!T$pOoD~jCCZ|Z##xhpY> zbux44_S~&<_E+nFhHp0eD70O|!tm?0&58H0G(gLzUW>RtXl4#+Vg5L5&h(3(1$qC3 zx8Lo1;2&W;2Ns4@1!l9aj=cN=eyw+j_GNv;nZqsIv-gV3=`p?!*prs^)DJ<;8UEQy zU!E>$Do7)C8N3J0xl-%E1;Hy<$vm}p5AOjjmbA!;%vGYFub{8Qu4Way37)Oq24Ow4 zJ>~Zosyo0Xj6M5_a&BIQr(fW`1{!J37QI=l?{AbPa*ND=Q_LQ@)a`5B4U4VX-q`(# zjfu?v5}v`C3n_0Nw3io*4&f@vCtlsVUQYWO=2*OSN_fBH;Y!xY6uCb})jPe1&O_m` zWvseaodF|uOVw_45|XFftG+<;yXVCGcA;01y!P{6W(B&VjmXIJxcjvd+xmo@J_i;f zV^W9OJZL13^)g{ayO53Ap>$ z1zxdTI3fJlh2DL0JS{IG)6M)coxLFI!1z98tCXL4MC8_R{Jck8yODlsJezmhX1c2O zbvBQjbC#ONMuQWnN8?M}Lx?_)d+TJLJaOL1JX^)*9%i-XU)aMcdXYBnI^WZR{=8b& zP+8KS^!Y-;=@p)q`vhL%X?YlXu?Fg1tZ1wIv48xRF7G^K{iDz{Jl9u9 zJ_ESp#m${Bq3jb#nCOya|D-|P=Md&QEcIectYPnwbq!~a-0vj129#-=9Jh~qmX>=W ztu(cs`ANnv??Id*&7FL&K;Ng*^ww*x&rgx&7QR~%Ce7J8&HJZFb3NY+u`osuPq zC+p9%iEGCZyPuZxS&xjiYFp@w^CW(7e4F?~i0>I~rJpz2s=gsa`YyiAP2b5nFTwPk zsz+Ur_hI5n-pt_prog?R+z1OXib?(cRQtn!K;L{KuzRX9;bWxoVHT!+m0> zu}&W%_h)uP58Ka&eZz_)6Fjx625NqaDivl0doS)NF5wdQed404)p3Ugd(Z1AF5wb)D{%`#Ox!Djz0!9l z)PZn`TT5JQ19iSDgS|sLic7e}{R43;kfl_8{lVV2j^Yw7ai1lwhj~H89oo&?tE0Gt zOWc*jZLs^cpqn?iqqu}i+((F8B79~KXV$S{)h2cW;79Q|b5{Lbck9p%|P^G4y9O}s-*+=U_N1n6J%wOPW~L*Sc% zKxmcF0b_dm{ETeHZ~kt|5dDjxh3)K$srp>UH`a~%eF5_EkEVSxPm%vNUm>zY;C-uB$sW7`LtpLx-TreKLqY1!BY6Wx^gW`xYm<+9`$gwd z!d>)AMv2pJzodw~!F;M@lq@Zy2w&LE{K>vkxxDovP~Li3Mx8yqtx^;gA?o!hX(~CRmWK{n)`^YadmOZ#$DUX#eok|Ho3OJiR`VMCAP`n1ZC3shtG zTrG2)=xklsFUuTu4Sgtc7;?I@4U>Gfv5rki>f!yAd~BIT^;wR~`(gXAe|7V|PgpW? zIJN^Vjnp#?{DiYljx3Re-2ie;XwzcmJ-5&Rb`kXo7h1kl`F`p4zCj*RH~A*@6WVNm z*NMD(9`d;CReVC6gqas)2F^r}MO@);*YHirmGXuaG}D5fA?4Yetd!zGeUrPphb2GD zJB-kg=xx3^s^fl!y?mg|QgUoR+OO6O@JYR9(0BaIdPB!;E|YV6YR#}ew>*?FA$M5C z`37y$-#I(WnjzMAjQCQ<2-X_X4%)RnrF)pS)PXM}OK(VdD%-nA+AI8;ezxhT>IU8+ zek51b)uzWv@Dcb}(c|`9-scgyu1$Pz+xUup?fASg1O0CQT|?>#^g9jRpUOwc+lKz3 zr$YLy5qyoK9~<9C)@4onHGR>zQ@fXm`(v&DY1$pgZ-j%T zY0~Qj8Kb&a6$1VFXW~|EILHn_a zKW!K7l>SAKUtV$sW6oJO)n~`+=C|ucf5}?hF^0CMJks48OyA3VE_$@Qts$cn9WWOp zFb3P?tNQkMzV0EW&33;=WS-FGZ_#&3n^iulZ*}^A!l!pZ0mQ*q6A`J0?8hDuM^9yB#WRz0%}CZS+ck-rU`S{#fbb z;Q^eL=AIPZm6vw#4gN{HxT_9*67y=g=-XWMvC$81nCd^>dj#5`jT2v|E(u;&Q3-p< z2~W6+JlH!WJmpe**s>qA`=7zw2h+{FcTceQQzowt-%MFcBz?O& zb7zLaiG>V((mK}-@z$7p?s3$kJLwa#mpElT63_Jh&ZPgfBRz7eYO@42U0+k#(smzgpym$=BYdDylFRGNg2`+EHu-i0Pjj->f6 zr+7DWM8a=fMZ4Iuhex$kQYV>%1-h=uZ4uj*Q?@rb*^B+QqM_j?U)iTx3++mON*R*3 z3;M7BZ}Q6==Do(`7eju#PuAz25#I48u3G0)R^!RyzdF==k%|8kdcWkoAsIo`NyeiE z{0V!VgN#@4e=p+}T~Y{qQ0bqTgJr(E0ez9!6$`&Ofcq)>j4@U%vel399Em#@KXT6o z_m?@`k8a$&lM|D}eP}^i=Gp}m-I_hW`QbUcqZd|b-3(`1p$G0>^1aS|gMRiOf1H9n zC+GE4dd1Il+Q8y&S=iE-yWdRoiVc0kB_$V1y+5U$YA+XFw;i|04f6iqwx7^#Q_rm! zSn*Chpf{_A6_u-MG~{3>7gS0sCykv`$cincD)G!~R2b9SWfa_T2^UpO%+<*v_MRSO4+OfoQa z74ZwAwVMmTMW@|T0G|6u0v& zmF7v@`#W0O-L}>HTfPbz6N!Dj1E{0aJ@kg$7S0K@MBWf2c1_g2`cdq;#JySE;JgC2lHH*{p<8v& zc6g+V^VgTe|8C_P^?Z z2RS>?h@E(cw95OMLaWi_quxr^{0)HKkAM810Z}$K^NX|+)?d5Gd_4c-=ayO;aL;6Ja zB&5%8w(IefT@TH>l)P#5*Xt;w!KN>xzkc^WdOsqFI*P57MVZ|!B#$0o9ghA7?LX@pxPQ^B=MGI_{S-+EIVYdmuINql#N| zTS_<|1x;9a zk$e8zkAs69(@TO*e1B#oVIRRK>al+LAU+H-d1K8@__`&H!p`XvGm&6x5 zh|ZC>D}6iI_etb_;0A0bX48g$P@cq*{Y#GnAf(>6i`zY==qd~dWWCN2qm=uSIMFm|K| zBW3Q6^8GA%a(_Q>A%jU(3 zNya$+zadHbpLYsxq5rY_^{oKs;BUJ{zYU^H!M&Tfc7GM1$FuuO^nW6s1=j{vsPUzE zlDxsL?o^L*(-)=au?~J_RY^YnAgkri^D>+5{CktXN{8M~#(yMF(?XnLdlYYlHssGMbg|EfLzcuN*$)d6PCayW(0B1t(;G0%`^l4p2L`!EOrB-+#^gGoK2sAP1>D} z=zqxjfI#6T(~+f8tk8F`VQ!kvcuC@o14$=x)f3c{cKDE$l#QU|EAi!xml@Pk=4sMY z%h*zNN4}Cdu>$)CXT9YdBcgnV=NF*^bw7&m4)lseZ(`phWlvBzLN_Dh(Tu0bgioOk z=b7;%^7eH6{xhwr4#&}}y_M|pAM`1LcYFQ{Y_Yr}ze0EVTrO*Tcq_K!VQ%n`?o<3z z@F$}aN#Oj$WO2K(qrvt{&LE47witX*c(-L4)CmH4q1oq!giIp#Jks=1Kb49x6q&Z**C8g-J-~+*bSv{ z-Yf+kCGyqP^l^crW!@SvGJxPv$`l%i!p@`=e((e9KsgI| z%*48^;<)ZsF?;`4iLIQ>4+$YwQ6YSpcYSNcb|)Grabw8)aB%c6;T85=*o(2e5ghn~ zqRY5LBom$2RiEiMttJ*epHt;_MZF{AGuahYrp7G!5LSi_PD{dlR*KNRmPe1jhbe2g zBfox2o#FJ;=0?WtzWKa+!=2HE)GuuM)XW)_Dd_~Cw{)}mNFVLyPJQ%d6Zg`$>%nP9 zXLWxtXLX%6EW!ixXa{{vyJD2wDDyl=v{x|3(ws7meYR9^d46je(IJRz(DofTiMw5B ztCRJ3M|BaIYd2?FZl-MEBgkB}7H7DwgPvsmfOx8T6ISUT;Uj5o^o#XDRLKp| z*=ZA@(|pnht-S&i+VdmF72+4%i@&q=v%GKI`P)HSkAQ65lFzs-KaKCAfA|Ns5o#XU7Omvn4tZ5t zgyL1NW0xasIi$|sw0-B+eh9?u-`F@7S*>(Amx-g!(Z#P=ild~rBE{<{^ zbi^CHxOC|rY=>oEMQ|aM>pbfc`U{R0Ustd@& zS+|cJW!iO%Hg((1w~u&#NO1ReN4(9nLFnJE*ZX`ET>e+}>e)x(ays>TiF!%iyQFUP zr}WQWXnVcM?~vS2a>{n<{H`Itr%y5l4l*7OIc&D|hoWk|vQp zL+;aQ?uhdaBMs}X4c68e@7L5_{K(+s5$(%v%_G6&5$*fLl#6Vs^C*w^#*s$K*$th@ zyY>1!g?{hzArqf|(eYpH?-d(HiNB7%+k^b&j6cuRk@1{*aEM7$J;3`Gb(3~9gP&9B z!I*d2yt`??Q7-AjTHB=0tqBi%mNFZ_C3x3${CuFdit>b4$T&j=Pi;S^ove%lq*c6? z^B5wNN*PPrmvMBExBUM@8K2l?sIw@#jH32sWF~s=Ib|8aA2bee-*$91b_2f-V@?i7 zXVVki&1vYedhu>)aO<11jFJ}NfA6!O04??%jIHdRXSsVp_9ws}coJRA25VW8_Xf(n znm0wJfxjPEOZ^z*X<0eg!}Xvgec8j{O|K0T7pz-!C*x{6=T=*O2>fN@&cK>G`@=`) zzc{wVos)B{hP-Mf4(1J6Y+S%2wx>!z`(!AxNPq4ly9rrnOZR3!XBYf?dZrXIhW(sx zXub#A8|;LB9AdScMLinWYxWQ4Yy!I6AbICx54NR*%lfE3C^9@D%PMjsL*)&rkDqRp z%33k3RN8}1K8bikXan~{rL!kon=sI&-iAy0^}30nArIXt=lXVut;3K@QW{;&83}*X z@~MBS=rygP>8F?U9mRc-qFa;vLdZ|fW8Zy7NnaTUPx4*#Sa$=FCDmJb{+mdPoGUt3 z{~GR}!VPZoB~JbQ@mFuVwb#{ekFxqUzGzi3PFMpl2hay!?C5r`q~YSHKH11L6AlOR zr5uru+_d|LVDyIcgNJ$X4(T)K^4R>#>Fdkr^GoUb3DCfJ-jW-Kt}pMlz?NVoza8Fk zar2>jJhh5XSwn?S`8Kf+FYC56_{|FD!btjU&bmu@dj&oUer0ZBt)XxXKS=}Enl^@> z?q#EovKjY`@lb}{i0k}%a)V!V0jZ#ze}6QnPl1DImSJ~YVJ_{v!Bl*e;LCKL!5TV z{e0K`$?OpzQ$%ZM&Htl_ttHM~0GFk0?ixiVg@ z;p^F76MXEUjj|?h2vfF@Bj?E|3QS`}?z6SFhnx>AizD@Wg?;j~k_dk?3|gz#JoSzb5WZ+`_R><#6+3%E0ELTYsur_p7sT z+5ZeF5?z(-=RL<=#Ue|*${uYza?D2TIm9;ma`K3?qRSE|SRbhTBcN6I?U%c>{)fvO zsUfyC9)f;XqhA#pI>E^T?wZ)k`cCFrC1>stS{6F*r_P>_F6_mqp}Z6qdKnN{wO5_vd&Pp)}6*16RqO?TkIkjFIlwXAEu9v%^wH7 z6iXZEVk5 z>~-(|ld*r5O%EN6{VMa#9{Z*EJ01I@JKi^zyRG!z@o~N*>;GfbnrHn$xz{qMNxSY) z`FGAUW!+$1oO7&TkabMzA?v3bz)8ViOYZBhzLowdI78-e(TB>Kns*?{Q}{{ru|T@q z?IqvJNh5Nv@Im3jtkpYRXLnZrzjsi7&wo?@ac%3L;;8?q4(gxRLH!Fls(%Ok-rj$c zb}AaIPJ>>9d~uXxfphj56mRT^m#>32!f&dDpBh_`4PuYkgYhN2J59}@QNB>}I&p4~ z@)dv|drs+R&+YY6zRWF=zP_|ezT32QfcP?Z2|h%J+~HVvM|!#Ue7W$89mJ`mjv}*l z7&kFW$pc%7e+d1~U!{*b#F6j;O`C1nirvdQ+~+N0FH-S9-ePBbwr#6kE1cd@TQlvp z@~*G>ZnyPMs;$^TH0Zam!9&Mwi0Z4_z}+gU4V{g>_Ir`S*RTaF&t0CO_5p{}XVMOI zyBpkQpEZv>3m7wQ3%Tzqy^nt<^(i?EJu`9}bxM6A*UEZ@H@xJ`=uU|%>5W~WjH3+l zka4H-$kKU;o>k~d_8h}-OFnL(tousHPyB_lH_>JIJEXZ;gH(T=NjYM-ayso+IQvHLsY*Teu`i+QIT=6P7c()Bb(Z^LsiU?_ zOyEA_&FH9AIQ#YTCZqk0J5AU_iSvC*9(C+>o~j)sR`y4+tY5I}VQFFO>&7z2Ud$Xj zhB;QhcWvvp+V*dhZxiLfC))IH338yKEqICCiB~FpIZ)$R_Mgx(E^i<90b$Tz$2hw_ zQQ_<};=Iy9ew#bU?=ObYsH$mn37V(}T&$jzfE?)sOBI}exKSJ-wPTV^q zXLtJ)UT)QDou;FfM#gfNSo`L+>MZ zKWN^v7n=Mf>nRz(YR>!OxD24{+IHM@R#y9ZFL#u=mVMJboEvtQ>2Z{~^%P|uo4<)W znnbS<%s313&EXv!v9FPP4jZtqIX3@IrH^kP@99qBMZjkw){TV^C48jZ&pX_IaJXM~ zxc}sEZ*;idaJV-++<$er-*&j)bGScqxc}{N?{>Jqa=5>DxDPwrKRet(=(X*3g*n{4 z9PYjjceKMj$l)IBaG&9D4|BLv9qv&M_eBnOuERan;U4dBU+!>U>u}%baR18Tp5k!d z+UhQknBj2W?r`7faNq54&vUr%ceo#NxR*NIk2>6sIowY=+^Zb!XB_V59d4h){RfBp zWrzDu4);cf`wfTtZHN0khkJ*^{gK1{nZx~WhkLif{guPL&*A>o;r`y?KJ0KGakzhO zb#I7(hquxsys_1dPN>z*USO*my?(13eO0TQy`@$+_J^(R!4CHs4)-vJ`z(hWxvn+s zD2MwzhZ{TG);PHi_gIH}yu*FD!#&aAzSiNs(c%7;!#%~}zSZHL;c(yXaNp^0-|cYE zbGYw!xEDFx4>{aR9qvaR?#CSNCmrrp4)-$-_d19Bd57EQaR0&Ke%ayvlf%8y;eNy6 z-t2Jy)!}~I;eOBI-r;b6>?Ak?F3VFA`|Qj%;a}ey)596>pz$9z&}A}cpHA`%CO^+wogelg z>i4rrSMv7@RXHKWI{#1uPnKVh<=O5jZ(Hx7CfyzH>io_%{*mqSllqt{pi;FsW*P`g zoqgL`lkd1=)-7kvxn=5IcTS&MeAb-Fw@;fg`(8Wd$>F(YopbUCr}*luQ{5bmhqrlX z%=xQ3{m%;jpBuRH0_|V&C!ax@Wx-ig%fi4VmVW0~GT^Q)X zK*cK))OtJ5hSqh;|J+k~3LZ3YIj`u*dVhg|EBoau{{_$M^gW-`&~M;}XN^`dWUcvRh(eRvJI-mWO+F$X4hIPG7 zISVdR@jscbVctC&j_Il4t4DOcQ7`H8kG`Ry`{!tt?wrkT1udgbs5jxO1N!^Bk83?c zw>aJ2>zBl-_{&WF2Y7UQ<{H1Pm#CYh^WAV;xQahwW2}PfU(@jB*EL*Srt7o3*Lmvu zgS|DZG=6ta?Z3YCeD%HX30 zt7#g(9dK_wC#1QQ-wXRX+-5b#U4UA6hX-K2{!>D#tBg;zh>U%^+6e^z%L@AYQ={qrLlHk_-= zyK3pe56y8Ls>wSV=8 z@hX0-TZbnbI4wl`^9LB%!=y8?q?bhHF{Jv?in&Zm9&sr;V|c~zC`zUbt7#>{r#r?vBUR!)P-f7X8)zq5SW zhp+#CnP0c;w(VTj&fmVAF8}{s41CxLzSBIqUm6T-U+RLKw*A)r`~P5IeBW5*rGf3^xA)JwL&tyDz^J0O z<=x!Q-#&eN|8^69uYrkow#~17{Ce}fp_6#corJf~=l^ei)EwQ8n+<%8G4V7H_O0k1CJUw=3f1MnSmb~Xs7QC4k*^?rWv^2 zz|P{^;Rj8;3+Czc4;uKcfp)ykVAOn_F4n+u0}n3H;j`}3aIb+I7Ha>r5)HQ+*z*DH zx66rLr2PvFjD1l1R~q=-|7icvhczrUaKC|eJ~qr-qT@YRrlB3~Ue?xchi~sBJnfOT z@mCsu{i8ZO?>FXqx$%27TyJ2+W7Pig-$18qEfZT!<#wJopS_%D6BZFsfuN3GW3M}OP)d*K@G zuQxEcqV4y0jo-btZFuFP7$r|`FtE;7S844Xicr zT?7AR;CBXE|D($dGcd-$VFq4k;FSgz8dzlDeFi>g;3@-uXW&Ky-#73>1HUk^#X$E% zx*h`!JjcM%23~LAOatc`_^5%;8@SoPj}83Z!0?B4{%06?j)4~%INreP44h`*JqF%y z;DZMK*1$>w-!iblz(WSQN_Dx>1|}JpZs0fruQTvg17{n!(7kuNnB3 zfgc&zWMJ?TU5_{e2OD^ifxk3xfq_d6eAd7X2EJk7rw0CDVCYiQe+H%+IL^RZ4ZPpL zB?guo_*(;iXW$;+O*#_nsm~Y@M2F@|C)WD|< ze8IqK1GgHu!$7}*&po2ctunCIz;6sJe^h^e*1$g*_?Ch18EErU8~*t*oz7mD+kVdK zs^2#Ao%^KJ?+fEkGX6uxKiK%gAJ_SDKacv^eos4pPCNgEcK)gD{0G|k4;lX;Q(lYl zryKvz#(%l-bMJ@x%{2ZX;Y;Pq|8_jD3&_fHq>!ax@Wx-ig% zfi4VmVW0~GT^Q)XKo + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb new file mode 100644 index 0000000..61c72ba --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb @@ -0,0 +1,1591 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.quicklook.readonly") + (extension-class "com.apple.app-sandbox.read") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone"))) +(allow file-link + (require-all + (require-not (subpath-prefix "${HOME}/Library/AddressBook")) + (require-any + (require-not (subpath-prefix "${HOME}/Media")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.sandbox.executable") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal-prefix "${HOME}/Library/Cookies") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath "/usr/share") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath "/Developer") + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/SMS") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${HOME}/Media/Memories") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPad.settings") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPhone.settings")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.AdSheetPad.plist") +(literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.AdSheetPhone.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/ptmx") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist") + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$")))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/run/syslog") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Media/Memories") + (vnode-type SYMLINK) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/run/printd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any (literal-prefix "${HOME}/Library/Cookies") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/SMS") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPad.settings") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPhone.settings")) + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState")) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches"))))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (require-all + (require-any (iokit-property "interval") +(iokit-property "mode") +(iokit-property "useMag") +(iokit-property "QueueSize")) + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name "apple.cfprefs.")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.passd.assertions") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.dataaccess.dataaccessd.active") +(global-name "com.apple.passd.in-app-payment")) + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (require-any (global-name "com.apple.eventpump") +(global-name "com.apple.mobilemail.messageuiservices")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (b4 0017 a080 9ba8) + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aaa8 a080 9bb3) + (global-name "com.apple.bird") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.trustd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (b4 0018 a080 9ba7) + (global-name "com.apple.cache_delete.public") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.coremedia.audiodeviceclock") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.librariand") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.contactsd") + (34 a381 a080 9bc0) + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.sharingd") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.backboard.display.services") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cache_delete") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.twitterd.server") + (global-name "com.apple.bird.token") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.chatkit.clientcomposeserver.xpc") +(global-name "com.apple.companion.camera") +(global-name "com.apple.coremedia.cameraviewfinder") +(global-name "com.apple.iad.") +(global-name "com.apple.imagent.Embedded.Launched") +(global-name "com.apple.mobile.deleted")) + (global-name "com.apple.mobilemail.services.xpc") + (require-any (global-name "com.apple.WebBookmarks.webbookmarksd") +(global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd")) + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.PowerManagement.control") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (34 aae0 a080 9bbb) + (global-name "com.apple.accountsd.oauthsigner") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.passd.library") + (34 aadc a080 9bba) + (global-name "com.apple.webinspector") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "PurplePPTServer") + (global-name "com.apple.FileProvider") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.logd") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.ait.client") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (34 aad7 a080 9bb9) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.managedconfiguration.profiled") + (34 ab2e a080 9bc9) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.calaccessd") + (global-name "com.apple.mobilemail") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.dataaccess.dataaccessd") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.global-name")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow mach-register + (local-name "com.apple.accessibility.gax.client") + (local-name "com.apple.assistant.contextprovider.") + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (extension "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/printd")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (require-any (preference-domain "com.apple.AdSheetPad") +(preference-domain "com.apple.AdSheetPhone") +(preference-domain "com.apple.reminders")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.da") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.youtubeframework") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.InputModePreferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.logging") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.mobileipod") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.WebFoundation") + (require-any (preference-domain "com.apple.AdSheetPad") +(preference-domain "com.apple.AdSheetPhone") +(preference-domain "com.apple.reminders")) + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.youtubeframework") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (sysctl-name "kern.bootsessionuuid") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-not (sysctl-name "sysctl.proc_native")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-fsctl + (fsctl-command (_IO "h" 31)) + (fsctl-command (_IO "h" 32))) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-socket + (socket-domain 39) + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb new file mode 100644 index 0000000..004c51b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb @@ -0,0 +1,836 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (literal "/private/etc/master.passwd")) + (require-not (literal "/private/var")) + (require-not (literal "/private/var/root")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/private/var/mobile/" #"^/private/var/mobile$" #"^/private/var/euser[0-9]+/" #"^/private/var/euser[0-9]+$" #"^/private/var/[-0-9A-F]+/" #"^/private/var/[-0-9A-F]+$" #"^/private/var/Users/[^/]+/" #"^/private/var/Users/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/PPTDevice") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (literal "/private/etc/master.passwd")) + (require-not (literal "/private/var")) + (require-not (literal "/private/var/root")) + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (regex #"^/private/var/mobile/" #"^/private/var/mobile$" #"^/private/var/euser[0-9]+/" #"^/private/var/euser[0-9]+$" #"^/private/var/[-0-9A-F]+/" #"^/private/var/[-0-9A-F]+$" #"^/private/var/Users/[^/]+/" #"^/private/var/Users/[^/]+$") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "installcood.f.")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.pegasus") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.backupd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cache_delete") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.mediaartworkd.xpc") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.nanoprefsync") + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.pairedsyncd.progress") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.coremedia.admin") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.voicememod.xpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/lockdown/checkin") + (literal "/private/var/run/lockdown.sock")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname")))) +(allow system-fsctl + (fsctl-command (_IO "J" 18)) + (fsctl-command (_IO "h" 27)) + (fsctl-command (_IO "h" 29)) + (fsctl-command (_IO "h" 28))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb new file mode 100644 index 0000000..7af9d70 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb @@ -0,0 +1,394 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "hw.machine") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb new file mode 100644 index 0000000..3dd2366 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb @@ -0,0 +1,933 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/uart.log")) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Library/AddressBook"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/wireless/Library/Logs/awd") + (subpath "/usr/share") + (subpath "/System/Library") + (subpath "/Library/Application Support/BTServer") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") +(literal "/private/var/wireless/Library/CallHistory/call_history.db") +(literal "/private/var/wireless/Library/CallHistory") +(literal "/Library/Application Support/BTServer") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db") +(literal "/") +(subpath-prefix "${HOME}/Library/MobileBluetooth") +(subpath-prefix "${HOME}/Library/Logs/Bluetooth")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/lib") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/dev/uart.log") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/bluetoothd-" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]bluetoothd-" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?bluetoothd-" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?bluetoothd-" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?bluetoothd-"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal "/usr/sbin") + (literal "/dev/btwake") + (literal "/usr/sbin/BTServer") + (subpath "/System") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/usr/sbin/BTServer") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal "/usr/sbin") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal "/Library/Preferences") + (require-any (literal "/private/var/wireless") +(literal "/private/var/wireless/Library")) + (literal "/private/var") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter")) +(allow file-test-existence) +(allow file-write* + (require-any (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") +(literal "/private/var/wireless/Library/CallHistory/call_history.db") +(literal "/private/var/wireless/Library/CallHistory") +(literal "/Library/Application Support/BTServer") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db") +(literal "/") +(subpath-prefix "${HOME}/Library/MobileBluetooth") +(subpath-prefix "${HOME}/Library/Logs/Bluetooth")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/wireless/Library/Logs/awd") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/hci") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/bluetoothd-" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]bluetoothd-" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?bluetoothd-" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?bluetoothd-" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?bluetoothd-") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/wireless/Library/CallHistory"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/uart.log") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "BTDebugUserClient") +(iokit-user-client-class "IOUserEthernetResourceUserClient")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleBasebandUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "shm_pcm_audio_sco_write") +(ipc-posix-name "shm_pcm_audio_sco_read")) + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name-regex #"^..:..:..:..:..:..-tacl$") + (require-any (ipc-posix-name "com.apple.bluetooth.magnet.shm") +(ipc-posix-name "shm_notif.tacl.R") +(ipc-posix-name "shm_notif.tacl.W") +(ipc-posix-name "shm_notif.tsco.W") +(ipc-posix-name "shm_notif.tsco.R"))) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.BTServer.le") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.contactsd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.suggestd.contacts") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.BlueTool") +(global-name "com.apple.BTAudioHALPlugin.xpc") +(global-name "com.apple.BTServer.avrcp") +(global-name "com.apple.BTServer.map") +(global-name "com.apple.BTServer.pbap")) + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.MobileInternetSharing") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9806) + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.carkit.service") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.TelephonyUtilities") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.purplebuddy") + (require-any (preference-domain "com.apple.BTServer.airplane") +(preference-domain "com.apple.BTServer") +(preference-domain "com.apple.CoreBluetooth.cloud") +(preference-domain "com.apple.MobileBluetooth.debug") +(preference-domain "com.apple.MobileBluetooth.devices") +(preference-domain "com.apple.MobileBluetooth.ledevices") +(preference-domain "com.apple.MobileBluetooth.services")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.CrashReporter") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.BTServer.airplane") +(preference-domain "com.apple.BTServer") +(preference-domain "com.apple.CoreBluetooth.cloud") +(preference-domain "com.apple.MobileBluetooth.debug") +(preference-domain "com.apple.MobileBluetooth.devices") +(preference-domain "com.apple.MobileBluetooth.ledevices") +(preference-domain "com.apple.MobileBluetooth.services"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.wakereason") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb.xml new file mode 100644 index 0000000..39d099f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb new file mode 100644 index 0000000..7ec97ab --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb @@ -0,0 +1,706 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/AppleInternal") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/usr/sbin") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath "/private/etc/bluetool") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (literal "/dev/btreset") + (literal "/dev/btwake")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleBasebandUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.hostname") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb new file mode 100644 index 0000000..34fae0d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb @@ -0,0 +1,191 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (process-attribute 4) + (require-any + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb new file mode 100644 index 0000000..1280e79 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb @@ -0,0 +1,766 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.avasset.read-only")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link + (subpath-prefix "${HOME}/Media") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow file-read* + (debug-mode) + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/Logs") +(subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL") +(subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/Caches") +(subpath-prefix "${FRONT_USER_HOME}/Library/com.apple.nsurlsessiond") +(subpath "/private/var/logs/CrashReporter")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CPL-diagnostics")) + (subpath "/private/var/db/diagnostics") + (subpath "/private/var/db/uuidtext") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs") + (require-all + (require-not (subpath-prefix "${FRONT_USER_HOME}/Media")) + (require-any + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/ptmx") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (subpath-prefix "${HOME}/Media") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.avasset.read-only"))) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CPL-diagnostics")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (subpath-prefix "${FRONT_USER_HOME}/Media")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.logd.admin") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cloudphotod") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 95b9) + (global-name "com.apple.photoanalysisd") + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (global-name "com.apple.pegasus") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.mediaserverd") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.coremedia.endpoint.xpc"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-priv-task-port + (debug-mode)) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia"))) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-exec* + (debug-mode)) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (require-any + (sysctl-name "kern.proc.") + (sysctl-name "vm.footprint_suspend"))) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb new file mode 100644 index 0000000..ed48cb3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb @@ -0,0 +1,334 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (require-any (subpath "/System/Library/Frameworks/OpenGLES.framework") +(subpath "/usr/bin/codesign_allocate")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.trustd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.cvmsCompAgent") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (require-any (subpath "/System/Library/Frameworks/OpenGLES.framework") +(subpath "/usr/bin/codesign_allocate"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb new file mode 100644 index 0000000..828ebd1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb @@ -0,0 +1,455 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/tmp") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Containers/Bundle/Application") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle/Application") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/tmp") + (subpath "/private/var/tmp/com.apple.LaunchServices.Placeholders") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Containers/Bundle/Application") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.cache_delete") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb new file mode 100644 index 0000000..c9b178a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb @@ -0,0 +1,614 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (require-any (literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/uart.umts") +(literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/cu.debug") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log")) + (subpath "/private/var/wireless")) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (require-any (subpath "/private/var/wireless/Library/Caches/com.apple.CommCenter") +(subpath "/private/var/wireless/Library/Caches/com.apple.coretelephony") +(subpath "/private/var/wireless/Library/Caches/CommCenterClassic")) + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/usr/local/lib/CarrierBundleDevKey.dylib") + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (subpath "/private/var/logs/WirelessLibraryLogs") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.coretelephony") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.coretelephony") +(subpath-prefix "${FRONT_USER_HOME}/Library/LASD") +(literal-prefix "${FRONT_USER_HOME}") +(literal "/private/var/tmp/CSI.scratch") +(literal "/private/var/preferences/AeneasCustomFlags.plist")) + (literal "/dev/ptmx") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/dev") +(literal-prefix "${FRONT_USER_HOME}/Library/SyncedPreferences/com.apple.coretelephony.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (require-any (literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/uart.umts") +(literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/cu.debug") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/dev/uart.log") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (literal "/private/etc/hosts") + (require-not (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/[-0-9A-F]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/Users/[^/]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/[-0-9A-F]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/Users/[^/]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile$" #"^/private/var/mobile/Library$" #"^/private/var/mobile/Library/CallHistory$" #"^/private/var/mobile/Library/Carrier Bundle.bundle$" #"^/private/var/mobile/Library/Operator Bundle.bundle$" #"^/private/var/mobile/Library/Voicemail$" #"^/private/var/mobile/Library/Preferences$" #"^/private/var/euser[0-9]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$" #"^/private/var/[-0-9A-F]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$" #"^/private/var/Users/[^/]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/uart.umts") +(literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/cu.debug") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.coretelephony") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.coretelephony") +(subpath-prefix "${FRONT_USER_HOME}/Library/LASD") +(literal-prefix "${FRONT_USER_HOME}") +(literal "/private/var/tmp/CSI.scratch") +(literal "/private/var/preferences/AeneasCustomFlags.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/logs/WirelessLibraryLogs") + (regex #"^/private/var/logs/CoreTelephonyTrace$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-.+$") + (require-any (literal "/private/var/CommCenter/spool/loading") +(literal "/private/var/logs/CoreTelephonyTraceScratch") +(literal "/private/var/logs/log-bb-live-stats.txt") +(literal "/private/var/preferences/SystemConfiguration/preferences.plist-lock") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist-lock") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist-new") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist") +(literal "/private/var/preferences/csidata.tmp") +(literal "/private/var/preferences/csidata")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/dev/uart.log") + (regex #"^/private/var/logs/CrashReporter/Baseband/log-bb-$" #"^/private/var/logs/CrashReporter/Baseband/log-bb-.+$") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath "/private/var/wireless") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/[-0-9A-F]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/Users/[^/]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/[-0-9A-F]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/Users/[^/]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist") + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-owner + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist")) +(allow file-write-unlink + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name-regex #"^com[.]apple[.]CoreTelephony[.]LogChannel[.]$" #"^com[.]apple[.]CoreTelephony[.]LogChannel[.][-0-9A-F]+$") + (require-any (global-name "com.apple.CommCenter.lasd") +(global-name "com.apple.CoreTelephony.BasebandStateReport.LogChannel") +(global-name "com.apple.CoreTelephony.powerlog-Full.LogChannel") +(global-name "com.apple.CoreTelephony.powerlog-Lite.LogChannel")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*") + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.videoconference_override") +(preference-domain "com.apple.tethering_override") +(preference-domain "com.apple.cellulardataplan") +(preference-domain "com.apple.commcenter")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.TTY") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.apsalerts") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.operator") + (preference-domain "com.apple.MobileSMS") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "net.link.generic.ifdata") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (sysctl-name "sysctl.proc_native") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) +(allow system-socket + (socket-domain 39) + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (require-any + (socket-protocol 2) + (socket-protocol 1)))) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb.xml new file mode 100644 index 0000000..ce4ed0d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb new file mode 100644 index 0000000..f5d1415 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb @@ -0,0 +1,1006 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/WebClips") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.app-sandbox.read")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension "com.apple.odr-assets") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation") +(subpath-prefix "${HOME}/Documents/com.apple.DataActivation.settings")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (require-any (subpath "/Applications/DataActivation.app") +(subpath "/Applications/MobileSafari.app") +(subpath "/AppleInternal/Library/Safari") +(literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.DataActivation.plist")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/usr/share") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/Memories") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Safari") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Library/Caches/Safari") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") +(literal-prefix "${HOME}/Library/Preferences/.dat") +(literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilemail.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.OTASyncAgent.plist"))) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/printd") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Safari") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/Safari") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") +(literal-prefix "${HOME}/Library/Preferences/.dat") +(literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation") +(subpath-prefix "${HOME}/Documents/com.apple.DataActivation.settings")) + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-all + (require-not (literal-prefix "${HOME}/Library/Mail/AutoFetchEnabled")) + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Library/Mobile Documents"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/asl_input") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/printd") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (require-any (preference-domain "com.apple.DataActivation") +(preference-domain "com.apple.youtube.dp")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.VoiceOverTouch") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.mobilesafari") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.youtubeframework") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.webcontentfilter") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.DataActivation") +(preference-domain "com.apple.youtube.dp")) + (preference-domain "com.apple.mobilesafari") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-exec* + (require-any (literal "/Applications/MobileSafari.app/MobileSafari") +(literal "/Applications/DataActivation.app/DataActivation"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb.xml new file mode 100644 index 0000000..9cd646a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb new file mode 100644 index 0000000..6a067e3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb @@ -0,0 +1,405 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.trustd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb new file mode 100644 index 0000000..c3132e1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb @@ -0,0 +1,292 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids.IDSCredentialsAgent") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.ids.IDSCredentialsAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..3bbc2b2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb @@ -0,0 +1,671 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (literal "/private/var") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.marco") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.facetime.bag") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb new file mode 100644 index 0000000..689a42d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb @@ -0,0 +1,501 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/AddressBook") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS") +(subpath-prefix "${HOME}/Library/Logs/SMSMigrator")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/SMS") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath-prefix "${HOME}/Library/SMS") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS") +(subpath-prefix "${HOME}/Library/Logs/SMSMigrator")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.contactsd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.search.appindexer") +(global-name "com.apple.searchd") +(global-name "com.apple.suggestd.messages")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (literal "/private/var/run/lockdown.sock")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.imdpersistence.IMDPersistenceAgent") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.imdpersistence.IMDPersistenceAgent") + (preference-domain "com.apple.imdsmsrecordstore")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..835997f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb @@ -0,0 +1,663 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}")) + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb new file mode 100644 index 0000000..c6b92ec --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb @@ -0,0 +1,829 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-read* + (subpath-prefix "${HOME}/Media") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.avatar") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/lib") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.im.transcode") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (subpath-prefix "${HOME}/Library/Caches/com.apple.avatar") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.im.transcode") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aae0 a080 8d36) + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mediaserverd") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8d4c) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.coremedia.decompressionsession") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ET") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.MobileSMS") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security") + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.coremedia")))))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "kern.bootsessionuuid") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname")))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb new file mode 100644 index 0000000..f0086bf --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb @@ -0,0 +1,203 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb new file mode 100644 index 0000000..93cdb31 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb @@ -0,0 +1,276 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library/Extensions") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb new file mode 100644 index 0000000..e2a80ff --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb @@ -0,0 +1,1390 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/AppleInternal/Library/Frameworks") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Media") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/ConfigurationProfiles") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.MailCompositionService.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService") +(subpath-prefix "${HOME}/Documents/com.apple.MailCompositionService.settings")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/ptmx") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/run/printd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService") +(subpath-prefix "${HOME}/Documents/com.apple.MailCompositionService.settings")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (34 aad7 a080 8a2a) + (global-name "com.apple.contactsd") + (global-name "com.apple.hangtracerd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (b4 0017 a080 8a03) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (global-name "com.apple.coreduetd") + (local-name "com.apple.assistant.contextprovider.") + (global-name "PurpleSystemEventPort") + (require-any (global-name "com.apple.bulletinboard.utilitiesconnection") +(global-name "com.apple.suggestd.suggestionmanager") +(global-name "com.apple.dataaccess.dataaccessd")) + (local-name "com.apple.iphone.axserver") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aaa8 a080 8a0f) + (global-name "com.apple.bird") + (global-name "com.apple.suggestd.contacts") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (b4 0018 a080 8a04) + (global-name "com.apple.cache_delete.public") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.librariand") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (34 a381 a080 8a21) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.sharingd") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.backboard.display.services") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.springboard") + (global-name "com.apple.bird.token") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.mobilemail.services.xpc") + (require-any (global-name "com.apple.WebBookmarks.webbookmarksd") +(global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd")) + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.FileProvider") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.PowerManagement.control") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.logd.events") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (34 aae0 a080 8a36) + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (34 aadc a080 8a64) + (global-name "com.apple.webinspector") + (global-name "com.apple.springboard.services") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.logd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 ab2e a080 8a4e) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.audio.AudioComponentRegistrar") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "PurplePPTServer") + (global-name "com.apple.icloud.fmfd") + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mediastream.sharing") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.global-name")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/printd") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.ZoomTouch") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.MailCompositionService") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.preferences.sounds") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.TTY") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.youtubeframework") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.PeoplePicker") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.GEO") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.MailCompositionService") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.youtubeframework") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (sysctl-name "sysctl.proc_native") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb new file mode 100644 index 0000000..addd126 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb @@ -0,0 +1,12 @@ +(version 1) +(allow default) +(deny file-read* + (subpath "/private/var/run/mobile_image_mounter")) +(deny file-write-setugid + (subpath "/private/var/run/mobile_image_mounter") + (require-not (vnode-type DIRECTORY))) +(deny file-write-unlink + (literal "/private") + (literal "/private/var") + (literal "/private/var/run")) +(deny job-creation) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb.xml new file mode 100644 index 0000000..c2485d3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb.xml @@ -0,0 +1,21 @@ + + + + + + + + + +]> + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb new file mode 100644 index 0000000..f308e77 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb @@ -0,0 +1,1381 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/MobileAsset/Assets")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath "/private/var/MobileAsset/Assets")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write")))) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (literal-prefix "${HOME}/Library/Logs/awd") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes/iTunes Library.itlp") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.app-sandbox.read") + (subpath "/usr/lib") + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") +(subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") +(subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") +(subpath-prefix "${HOME}/Library/Siri") +(literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") +(literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log")) + (subpath-prefix "${HOME}/Library/SMS") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow-") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.camera.settings") +(subpath-prefix "${HOME}/Documents/com.apple.mobileslideshow.settings")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (subpath-prefix "${HOME}/Media/Memories") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.mobileslideshow.plist") +(literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.camera.plist")) + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$" #"^/private/var/euser[0-9]+/Containers/.*$" #"^/private/var/[-0-9A-F]+/Containers/.*$" #"^/private/var/Users/[^/]+/Containers/.*$")) + (require-not (subpath "/private/var/containers")) + (require-not (regex #"^/private/var/mobile/Library/" #"^/private/var/euser[0-9]+/Library/" #"^/private/var/[-0-9A-F]+/Library/" #"^/private/var/Users/[^/]+/Library/"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist") + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")))) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]" #"^/private/var/[-0-9A-F]+/Media/Pano_[0-9]" #"^/private/var/Users/[^/]+/Media/Pano_[0-9]")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") + (extension "com.apple.tcc.kTCCServiceMediaLibrary"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/run/printd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (literal-prefix "${HOME}/Library/Siri") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") +(subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") +(subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") +(subpath-prefix "${HOME}/Library/Siri") +(literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") +(literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log")) + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (subpath-prefix "${HOME}/Library/SMS") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log") + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]" #"^/private/var/[-0-9A-F]+/Media/Pano_[0-9]" #"^/private/var/Users/[^/]+/Media/Pano_[0-9]")))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.mobileipod.plist")) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow-") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.camera.settings") +(subpath-prefix "${HOME}/Documents/com.apple.mobileslideshow.settings")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (subpath-prefix "${HOME}/Media/Memories") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type SYMLINK) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")))))))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Library/Siri") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState")) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Library/Caches"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath "/private/var/mnt")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (extension "com.apple.sandbox.application-group")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-"))) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs."))) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow ipc-posix-shm-write-unlink + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (local-name "com.apple.accessibility.gax.client") + (local-name "com.apple.assistant.contextprovider.") + (extension "com.apple.sandbox.application-group") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.app-sandbox.read-write"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.demo-settings") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (preference-domain "com.apple.VoiceOverTouch") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.accountsd") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.ImageCaptureFramework") + (require-any (preference-domain "com.apple.nanocamera") +(preference-domain "com.apple.legacycamera") +(preference-domain "com.apple.videouploadplugins") +(preference-domain "com.apple.youtubeframework.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.da") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.cloud.quota") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.act") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.nanocamera") +(preference-domain "com.apple.legacycamera") +(preference-domain "com.apple.videouploadplugins") +(preference-domain "com.apple.youtubeframework.notbackedup")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileslideshow") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.cloud.quota") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb.xml new file mode 100644 index 0000000..6799460 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb new file mode 100644 index 0000000..ae73790 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb @@ -0,0 +1,395 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/preferences/Logging") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath "/private/var/db/timezone") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/Developer") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (literal "/System/Library/Frameworks/UIKit.framework/Support/pasteboardd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "sysctl.proc_native") + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb.xml new file mode 100644 index 0000000..42afdf5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb.xml @@ -0,0 +1,52 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb new file mode 100644 index 0000000..a02be99 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb @@ -0,0 +1,277 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb new file mode 100644 index 0000000..9a6b409 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb @@ -0,0 +1,462 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.SafariBookmarksSyncAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.SafariBookmarksSyncAgent")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Safari") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.SafariBookmarksSyncAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.SafariBookmarksSyncAgent")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Safari") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.cloudd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.awdd") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.Safari.Support") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.SafariBookmarksSyncAgent") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Safari.Support") + (preference-domain "com.apple.SafariBookmarksSyncAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb new file mode 100644 index 0000000..5bc0a81 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb @@ -0,0 +1,358 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.apsd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.SafariCloudHistoryPushAgent") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.SafariCloudHistoryPushAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb new file mode 100644 index 0000000..35dd76f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb @@ -0,0 +1,377 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/private/var/db/icu") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.Safari.SafeBrowsing")) + (extension "com.apple.app-sandbox.read") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.Safari.SafeBrowsing")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.usrstack64") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb new file mode 100644 index 0000000..bb74e00 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb @@ -0,0 +1,419 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-test-existence) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.pegasus") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.trustd") + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networking.captivenetworksupport") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 83a5) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.ScreenSharingViewServiceHelper") +(global-name "com.apple.springboard.statusbarservices")) + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.corevideo") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb.xml new file mode 100644 index 0000000..6351937 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb new file mode 100644 index 0000000..1895bee --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb @@ -0,0 +1,364 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb new file mode 100644 index 0000000..fe6591f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb @@ -0,0 +1,307 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (extension "com.apple.StreamingUnzipService") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.StreamingUnzipService") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.StreamingUnzipService") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.StreamingUnzipService")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb new file mode 100644 index 0000000..0ac247f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb @@ -0,0 +1,275 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb new file mode 100644 index 0000000..9c1c7c1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb @@ -0,0 +1,204 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/private/var/containers/Bundle/Application") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb new file mode 100644 index 0000000..f9ab5c4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb @@ -0,0 +1,1305 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets"))) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.mobilemail.plist$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.OTASyncAgent.plist$")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.WebSheet.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet") +(subpath-prefix "${HOME}/Documents/com.apple.WebSheet.settings")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/FairPlay") +(literal "/usr/sbin/fairplayd")) + (require-any + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/ptmx") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/printd") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (literal-prefix "${HOME}/Library") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-not (regex #"^/private/var/mobile/Library/Mail/AutoFetchEnabled$" #"^/private/var/euser[0-9]+/Library/Mail/AutoFetchEnabled$" #"^/private/var/[-0-9A-F]+/Library/Mail/AutoFetchEnabled$" #"^/private/var/Users/[^/]+/Library/Mail/AutoFetchEnabled$")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet") +(subpath-prefix "${HOME}/Documents/com.apple.WebSheet.settings")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.certui.relay") + (global-name "com.apple.CARenderServer") + (34 aad7 a080 8052) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.hangtracerd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (b4 0017 a080 80ad) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aaa8 a080 8041) + (global-name "com.apple.bird") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.mobilesafari-settings") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (b4 0018 a080 80a5) + (global-name "com.apple.cache_delete.public") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.CoreAuthentication.daemon") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.librariand") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.contactsd") + (require-any (global-name "com.apple.eventpump") +(global-name "com.apple.mobilemail.messageuiservices")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.sharingd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.backboard.display.services") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.bird.token") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.mobilemail.services.xpc") + (require-any (global-name "com.apple.WebBookmarks.webbookmarksd") +(global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd")) + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.FileProvider") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (34 aae0 a080 805d) + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (34 aadc a080 803b) + (global-name "com.apple.webinspector") + (global-name "com.apple.analyticsd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.parsecd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.nanoprefsync") + (34 a381 a080 8042) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.managedconfiguration.profiled") + (34 ab2e a080 8051) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.assertiond.expiration") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.mobilemail") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.global-name")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.camera") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.ZoomTouch") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.preferences.sounds") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.InputModePreferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.WebSheet") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.youtubeframework") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-exec* + (literal "/Applications/WebSheet.app/WebSheet")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb new file mode 100644 index 0000000..0de9a6d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb @@ -0,0 +1,663 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/accessoryd") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/CrashReporter/accessoryd") + (require-any (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (require-any (iokit-user-client-class "AppleAuthCPUserClient") +(iokit-user-client-class "AppleUSBHostDeviceUserClient") +(iokit-user-client-class "IOAccessoryEAInterfaceUserClient") +(iokit-user-client-class "IOAccessoryPortUserClient")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "AppleUSBHostInterfaceUserClient") +(iokit-user-client-class "IOAccessoryManagerUserClient")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AGXDevice") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (require-all + (require-any (iokit-property "Authenticated") +(iokit-property "InterfaceProperties")) + (iokit-user-client-class "IOUSBHostDevice")) + (require-all + (require-any (iokit-property "PowerState") +(iokit-property "VirtualMode")) + (iokit-user-client-class "IODPController"))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (require-any (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+"))) +(allow network-inbound + (local udp "*:*")) +(allow network-bind + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$"))) +(allow network-outbound + (remote udp "*:*") + (remote tcp "*:*") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.accessoryd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.TelephonyUtilities") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.carplay") + (preference-domain "com.apple.PeoplePicker") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd")) + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.accessoryd") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.videos") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd"))) +(allow process-exec* + (require-any (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iap2d") +(literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iapd"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-kext-load + (require-any (kext-bundle-id "com.apple.driver.usb.cdc.ecm") +(kext-bundle-id "com.apple.driver.usb.cdc.ncm") +(kext-bundle-id "com.apple.driver.usb.cdc") +(kext-bundle-id "com.apple.driver.usb.IOUSBHostHIDDevice") +(kext-bundle-id "com.apple.driver.usb.networking") +(kext-bundle-id "com.apple.driver.AppleUSBDeviceAudioController") +(kext-bundle-id "com.apple.driver.AppleUSBAudio"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb.xml new file mode 100644 index 0000000..9cd646a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb new file mode 100644 index 0000000..96f76da --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb @@ -0,0 +1,605 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/usr/local/bin") + (literal "/usr/libexec/fmfd") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/usr/libexec") + (literal-prefix "${HOME}/Library/Preferences/com.apple.icloud.findmydeviced") + (subpath "/private/var/containers/Bundle") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (literal "/usr/local/bin/accounts_tool") +(literal "/usr/libexec/fmflocatord") +(literal "/usr/libexec/locationd")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Accounts") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/usr/libexec/findmydeviced") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.accountsd") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Accounts") + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.accountsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.accountsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties + (iokit-property "IORegistryEntryPropertyKeys")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.homed.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.passd.library") + (global-name "com.apple.securityd") + (global-name "com.apple.SafariBookmarksSyncAgent") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (global-name "com.apple.awdd") + (global-name "com.apple.dataaccess.dataaccessd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network-outbound + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info-codesignature) +(allow process-info-rusage + (require-entitlement "com.apple.security.exception.process-info")) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb.xml new file mode 100644 index 0000000..9c28723 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb.xml @@ -0,0 +1,28 @@ + + + + + + + + + +]> + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb new file mode 100644 index 0000000..0274c8b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb @@ -0,0 +1,417 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-journal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-shm") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-wal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (regex #"/private/var/containers/Bundle/Application/[^/]+/News.app/MCRestrictions.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.cloudd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow user-preference-read + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.AdLib") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.AdLib")) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb.xml new file mode 100644 index 0000000..fbc7162 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb new file mode 100644 index 0000000..e6657c9 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb @@ -0,0 +1,680 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension "com.apple.afc.root") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (require-any (literal "/AFCDEBUG") +(literal "/usr/libexec/afcd")) + (literal "/usr/libexec") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.afc.root") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/Library/Preferences/SystemConfiguration") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/Library/Preferences") + (extension "com.apple.app-sandbox.read") + (literal "/private") + (literal "/private/var") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.afc.root") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.FileCoordination") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.xpchelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (literal "/private/var/run/lockdown/checkin")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.afc") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.maxvnodes") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb new file mode 100644 index 0000000..ea5151f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb @@ -0,0 +1,438 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/preferences/Logging") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/Library/CoreAnalytics") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/db/analyticsd") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/Analytics-" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]Analytics-" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?Analytics-" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?Analytics-" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?Analytics-"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter")) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/db/analyticsd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/Analytics-" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]Analytics-" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?Analytics-" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?Analytics-" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?Analytics-") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties + (require-all + (iokit-property "product-id") + (iokit-user-client-class "IOPlatformDevice"))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow user-preference-read + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.GEO") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb.xml new file mode 100644 index 0000000..9c28723 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb.xml @@ -0,0 +1,28 @@ + + + + + + + + + +]> + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb new file mode 100644 index 0000000..45c1d19 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb @@ -0,0 +1,537 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.mediaserverd.read") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.mediaserverd.read") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/Developer") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobileipod") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb new file mode 100644 index 0000000..89e1ff6 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb @@ -0,0 +1,627 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath-prefix "${HOME}/Library/AppConduit") +(subpath-prefix "${HOME}/Library/Logs/AirTraffic") +(subpath-prefix "${HOME}/Library/Logs/AppConduit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle/Application") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/MobileIdentityData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/AppConduit") +(subpath-prefix "${HOME}/Library/Logs/AirTraffic") +(subpath-prefix "${HOME}/Library/Logs/AppConduit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.atc.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.online-auth-agent.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.misagent") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.cache_delete") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.mobile.installd") + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.pairedsyncd") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb new file mode 100644 index 0000000..ae19f17 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb @@ -0,0 +1,510 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") +(subpath-prefix "${HOME}/Library/ApplePushService")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (literal "/dev/aes_0") + (subpath "/usr/share") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Preferences") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/System/Library/CoreServices/SystemVersion$" #"^/System/Library/CoreServices/SystemVersion.+$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/private/etc") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plistLibrary/Keychains") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plistusr") +(literal "/private/") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicEffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}") +(subpath-prefix "${HOME}/Library/Managed Preferences")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/Library/Preferences") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/Managed Preferences/mobile") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Logs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/Keychains") + (require-any (subpath "/private/var/preferences") +(literal "/Library/Managed Preferences/mobile")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (process-attribute 4) + (require-any + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") +(subpath-prefix "${HOME}/Library/ApplePushService")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-inbound + (literal "/")) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/ApplePushService.framework/apsd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (sysctl-name "sysctl.proc_native") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb.xml new file mode 100644 index 0000000..ce4ed0d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb new file mode 100644 index 0000000..4803828 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb @@ -0,0 +1,426 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (literal "/usr/libexec") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Bundle") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/private/var/preferences/Logging") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read-write") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/System/Library") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/Developer") + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.spindump") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-task-name) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.assertiond") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.assertiond")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow sysctl* + (require-any (sysctl-name "kern.ipc.throttle_best_effort") +(sysctl-name "kern.memorystatus_vm_pressure_send"))) +(allow sysctl-read + (require-any (sysctl-name "hw.targettype") +(sysctl-name "kern.max_task_pmem")) + (require-any (sysctl-name "kern.ipc.throttle_best_effort") +(sysctl-name "kern.memorystatus_vm_pressure_send")) + (extension "com.apple.security.exception.sysctl.read-only") + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb.xml new file mode 100644 index 0000000..f2e83c7 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb new file mode 100644 index 0000000..8c70ad0 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb @@ -0,0 +1,968 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension-class "com.apple.sharing.airdrop.readonly")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.avasset.read-only") + (require-any + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/PhotoData"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension "com.apple.sandbox.executable")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assetsd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assetsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (vnode-type DIRECTORY) + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Media/Memories") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assetsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assetsd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AGXCommandQueue") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXGLContext") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AGXDevice") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AGXSharedUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.pegasus") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CloudPhotoDerivativeGenerator") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.securityd") + (global-name "com.apple.contactsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.cloudphotod") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.photoanalysisd") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (global-name "com.apple.mediastream.sharing") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.demo-settings") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.assetsd") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.assetsd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileslideshow") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (sysctl-name "kern.proc.all") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb.xml new file mode 100644 index 0000000..d06b1e5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb new file mode 100644 index 0000000..3449ef4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb @@ -0,0 +1,577 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.BarcodeSupport.Notification") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.BarcodeSupport.Notification")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.BarcodeSupport.Notification")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.BarcodeSupport.Notification") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.BarcodeSupport.Notification")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.BarcodeSupport.Notification")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.appstored.xpc.updates") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.calaccessd") + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb new file mode 100644 index 0000000..ccd3667 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb @@ -0,0 +1,51 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb new file mode 100644 index 0000000..eb5bb03 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb @@ -0,0 +1,798 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/")))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/BulletinDistributor") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored/BulletinImageCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (literal "/usr/libexec")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/BulletinDistributor") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.bulletinboard.observerconnection") +(global-name "com.apple.companionappd.pingsubscriber")) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.sysdiagnose.service.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 771a) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.pairedsyncd.progress") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.awdd") + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.bulletindistributor") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MultitouchSupport") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.Accessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.mobileipod") + (require-any (preference-domain "bulletindistributord") +(preference-domain "com.apple.sysdiagnose")) + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.pairedsyncd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.bulletindistributor")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb new file mode 100644 index 0000000..72c405d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb @@ -0,0 +1,156 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-not (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/")) + (subpath "/Developer") + (require-not (extension "com.apple.sandbox.executable"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/private/var/preferences/Logging") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/System/Library") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow mach-cross-domain-lookup) +(allow process-info-codesignature) +(allow process-info-pidinfo) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb.xml new file mode 100644 index 0000000..4d996cb --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb new file mode 100644 index 0000000..90dec87 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb @@ -0,0 +1,23 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-map-executable) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb.xml new file mode 100644 index 0000000..54e3d99 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb new file mode 100644 index 0000000..7438b1a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb @@ -0,0 +1,640 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/preferences/SystemConfiguration/NetworkInterfaces.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.AssetCacheC") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-bind + (local udp "*:*")) +(allow network-outbound + (remote tcp "*:*") + (remote udp "*:53")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AssetCacheLocatorService") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.AssetCacheTetherator") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb new file mode 100644 index 0000000..c0ac93f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb @@ -0,0 +1,275 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/db/heim-credential-store.archive") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (literal "/private/var/db/heim-credential-store.archive") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb new file mode 100644 index 0000000..70436bc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb @@ -0,0 +1,232 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.system.logger") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.appstored.xpc.updates") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "vm.footprint_suspend") + (sysctl-name "hw.availcpu") + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname")))) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb.xml new file mode 100644 index 0000000..58c58e4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb new file mode 100644 index 0000000..a5f757f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb @@ -0,0 +1,429 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-test-existence) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.ocspd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network* + (local udp "*:*") + (local tcp "*:*") + (remote tcp "*:*") + (remote udp "*:*")) +(allow network-outbound + (remote tcp "*:*") + (remote udp "*:*") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (sysctl-name "vm.footprint_suspend") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (extension "com.apple.security.exception.sysctl.read-only") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (sysctl-name "hw.availcpu") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb.xml new file mode 100644 index 0000000..58c58e4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb new file mode 100644 index 0000000..6007a41 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb @@ -0,0 +1,1234 @@ +(version 1) +(deny default) +(allow device-camera + (extension "com.apple.webkit.camera")) +(allow device-microphone + (extension "com.apple.webkit.microphone")) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension "com.apple.odr-assets") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/Library/CoreMediaIO/Plug-Ins/DAL") + (extension "com.apple.webkit.camera")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.app-sandbox.read") + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (require-not (xattr "com.apple.security.private.")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))))) +(allow file-test-existence) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type SYMLINK) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-not (vnode-type SYMLINK)) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (vnode-type SYMLINK)) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (require-not (xattr "com.apple.security.private.")) + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.analyticsd") + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (b4 0017 a080 7397) + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aaa8 a080 73a2) + (global-name "com.apple.bird") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.FileProvider") + (global-name "com.apple.librariand") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.libinfo.muser") + (b4 0018 a080 73df) + (global-name "com.apple.cache_delete.public") + (global-name "com.apple.coremedia.audiodeviceclock") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.contactsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.sharingd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.compressionsession") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.locationd.synchronous") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.bird.token") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.logd.events") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (34 aae0 a080 73b0) + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.webinspector") + (global-name "com.apple.securityd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 73af) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.coremedia.videoqueue") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.sharingd.nsxpc") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (34 ab2e a080 73ae) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (global-name "com.apple.audio.audiohald") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.awdd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (extension "com.apple.app-sandbox.mach") + (extension "com.apple.webkit.camera")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network-outbound + (remote tcp "*:*") + (remote udp "*:*") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.da") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.voiceservices.logging") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (require-any (preference-domain "com.apple.LaunchServices") +(preference-domain "com.apple.avfoundation.videoperformancehud")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.InputModePreferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "vm.footprint_suspend") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-only") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (sysctl-name "hw.availcpu") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml new file mode 100644 index 0000000..58c58e4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb new file mode 100644 index 0000000..eec1bcc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb @@ -0,0 +1,811 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/Info.plist" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+/Info.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath-prefix "${HOME}/Library/Assistant") +(literal-prefix "${HOME}/Library/Caches/com.apple.siri.")) + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/local/lib") + (subpath "/usr/lib") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${HOME}/siri_recordings") +(subpath "/Library/Audio/Tunings")) + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/Assistant") +(literal-prefix "${HOME}/Library/Caches/com.apple.siri.")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.contactsd") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.BTLEAudioController.xpc") +(global-name "com.apple.assistant_service")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (global-name "com.apple.accountsd.oauthsigner") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.awdd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.WebFoundation") + (require-any (preference-domain "com.apple.AssistantServices") +(preference-domain "com.apple.assistant.token") +(preference-domain "com.apple.siri.backedup.encrypted") +(preference-domain "com.apple.weather")) + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.avfoundation.avvc") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.AssistantServices") +(preference-domain "com.apple.assistant.token") +(preference-domain "com.apple.siri.backedup.encrypted") +(preference-domain "com.apple.weather")) + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.assistant.logging")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb.xml new file mode 100644 index 0000000..d06b1e5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb new file mode 100644 index 0000000..3a63301 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb @@ -0,0 +1,920 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (extension-class "com.apple.clouddocs.version") + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs") + (extension-class "com.apple.quicklook.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents/")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.librarian.ubiquity-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.quicklook.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.bird") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.bird") +(literal-prefix "${PROCESS_TEMP_DIR}/com.apple.bird") +(subpath-prefix "${HOME}/Library/Application Support/CloudDocs") +(subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(literal-prefix "${HOME}/Library/Mobile Documents.") +(subpath-prefix "${HOME}/Library/Logs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") +(literal-prefix "${HOME}/Library/")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Application Support") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.bird") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.bird") +(literal-prefix "${PROCESS_TEMP_DIR}/com.apple.bird") +(subpath-prefix "${HOME}/Library/Application Support/CloudDocs") +(subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(literal-prefix "${HOME}/Library/Mobile Documents.") +(subpath-prefix "${HOME}/Library/Logs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") +(literal-prefix "${HOME}/Library/")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird")) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird")) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (vnode-type SYMLINK) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Application Support") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ubd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.librariand") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.lsd.installation") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.FSEvents") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.revisiond") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cache_delete") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.and.xpc") +(global-name "com.apple.bird.ContainerMetadataExtractor")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.coresymbolicationd") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.mmcs") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.bird") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.iCloudDriveApp") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.iCloudDriveApp")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30))) +(allow system-info + (info-type "hw.uuid")) +(allow system-package-check) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb.xml new file mode 100644 index 0000000..f81a4a2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb new file mode 100644 index 0000000..73e1e0b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb @@ -0,0 +1,160 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/usr/libexec/captiveagent") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb new file mode 100644 index 0000000..2a626a4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb @@ -0,0 +1,800 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (regex #"/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit" #".+/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (regex #"^/private/var/mobile/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/euser[0-9]+/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/[-0-9A-F]+/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/Users/[^/]+/Library/Caches/CloudKit/[^/]+/[^/]+") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (subpath "/.TemporaryItems") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (extension "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/private/var/logs/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/Ubiquity") +(literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") +(subpath-prefix "${HOME}/Library/Logs/awd")) + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/CloudKit") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.cloudd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.cloudd")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/CloudKit"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal "/private/var/logs/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/Ubiquity") +(literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") +(subpath-prefix "${HOME}/Library/Logs/awd")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Caches/CloudKit") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/.TemporaryItems") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.cloudd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.cloudd")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/CloudKit") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_com.apple.cloudd") + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (require-all + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name "FNetwork.defaultStorageSession") + (ipc-posix-name "com.apple.AppleDatabaseChanged") + (ipc-posix-name-regex #"^/tmp/com[.]apple[.]csseed[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name "com.apple.AppleDatabaseChanged")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.datamigrator") + (global-name "com.apple.hangtracerd") + (require-any (global-name "com.apple.SecurityServer") +(global-name "com.apple.coreservices.quarantine-resolver")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.contactsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.CoreServices.coreservicesd") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.fairplayd") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.awdd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.cdp.daemon") + (global-name "com.apple.analyticsd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7007) + (require-any (global-name "com.apple.protectedcloudstorage.protectedcloudkeysyncing") +(global-name "com.apple.windowserver.active")) + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.ocspd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.purplebuddy") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.springboard") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.purplebuddy")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb new file mode 100644 index 0000000..e6a459a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb @@ -0,0 +1,375 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mobilephone") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.message") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb new file mode 100644 index 0000000..e86b258 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb @@ -0,0 +1,1115 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-entitlement "com.apple.private.librarian.container-proxy") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-link + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit")) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/homed_") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.Home") +(subpath-prefix "${HOME}/Library/HomeConfiguration") +(subpath-prefix "${HOME}/Library/homed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.homed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.homed")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (literal-prefix "${HOME}/Library") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/homed_") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.Home") +(subpath-prefix "${HOME}/Library/HomeConfiguration") +(subpath-prefix "${HOME}/Library/homed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.homed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.homed")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceSendRight")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coreduetd.knowledgebase") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.contactsd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.librariand") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.revisiond") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.sysdiagnose.service.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.bird.token") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.FileProvider") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.PairingManager") +(global-name "com.apple.assistant.security") +(global-name "com.apple.corefollowup.agent") +(global-name "com.apple.coremedia.endpointpicker.xpc") +(global-name "com.apple.coremedia.endpointremotecontrolsession.xpc")) + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.trustd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nehelper") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (34 a381 a080 6d53) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.awdd") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow" + (require-any + (global-name "com.apple.coreduetd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (extension "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.homed") +(preference-domain "com.apple.Home.ControlCenter") +(preference-domain "com.apple.avfoundation.frecents")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.coreanimation") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.MobileAsset") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.pairedsyncd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.homed") +(preference-domain "com.apple.Home.ControlCenter") +(preference-domain "com.apple.avfoundation.frecents")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaremote") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb new file mode 100644 index 0000000..fa9c78d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb @@ -0,0 +1,810 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (extension "com.apple.app-sandbox.read-write") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/dev/ptmx") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (regex #"^/private/var/preferences/com[.]apple[.]networkd[.]plist" #"^/private/var/preferences/com[.]apple[.]networkd[.][-0-9A-Z_a-z]+[.]plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/containers/Bundle/Application") + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (literal "/private/var/preferences/Logging/Subsystems/com.apple.network.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.networkextension.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.][-0-9A-Z_a-z]+[.]plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.]networkd[.]plist" #"^/private/var/Managed Preferences/mobile/com[.]apple[.]networkd[.][-0-9A-Z_a-z]+[.]plist") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/usr/share") + (require-any (subpath "/usr/local/bin") +(literal "/usr/bin/DumpBasebandCrash")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (require-any (literal "/private/var/preferences/Logging/Subsystems/com.apple.network.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.networkextension.plist")) + (regex #"^/private/var/preferences/com[.]apple[.]networkd[.]plist" #"^/private/var/preferences/com[.]apple[.]networkd[.][-0-9A-Z_a-z]+[.]plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.][-0-9A-Z_a-z]+[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.securityd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.networkd_privileged") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.CoreServices.coreservicesd") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.logd.admin") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 6c0c) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.managedconfiguration.profiled") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-register + (global-name "com.apple.nehelper") + (global-name "com.apple.networkd_privileged") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network* + (local udp "*:500") + (local udp "*:4500") + (literal "/private/var/run/racoon.sock")) +(allow network-outbound + (remote udp "*:*") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-any (control-name "com.apple.flow-divert") +(control-name "com.apple.net.necp_control") +(control-name "com.apple.net.netagent") +(control-name "com.apple.net.utun_control") +(control-name "com.apple.network.advisory") +(control-name "com.apple.content-filter")) + (control-name "com.apple.net.ipsec_control")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.operator") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl* + (require-any (sysctl-name "kern.ipc.io_policy.throttled") +(sysctl-name "net."))) +(allow sysctl-read + (require-any (sysctl-name "kern.ipc.io_policy.throttled") +(sysctl-name "net.")) + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb.xml new file mode 100644 index 0000000..e14b98f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb new file mode 100644 index 0000000..4c0442b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb @@ -0,0 +1,770 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.vpn-plugin") + (subpath "/private/var/containers/Bundle/VPNPlugin")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal "/private/var/run/racoon.pid") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (subpath "/private/var/run/racoon") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal "/private/var/preferences/com.apple.networkextension.necp.plist") +(literal "/private/var/preferences/com.apple.networkextension.control.plist") +(literal "/private/var/preferences/com.apple.networkextension.cache.plist") +(literal "/private/var/preferences/com.apple.networkextension.plist") +(subpath "/private/var/containers/Bundle/VPNPlugin") +(subpath "/private/etc/ppp") +(subpath "/Developer/usr/libexec") +(literal "/usr/sbin/pppd")) + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/sbin") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nesessionmanager")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nesessionmanager")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/run/racoon") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/log/ppp.log") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nesessionmanager")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nesessionmanager")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.CoreServices.coreservicesd") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.UNCUserNotification") +(global-name "com.apple.neagent") +(global-name "com.apple.symptom_analytics")) + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networking.captivenetworksupport") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ocspd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.networkextension") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-exec* + (literal "/usr/sbin/pppd")) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow sysctl* + (sysctl-name "net.key.natt_keepalive_interval")) +(allow sysctl-read + (sysctl-name "net.key.natt_keepalive_interval") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.key.blockacq_count") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb.xml new file mode 100644 index 0000000..c122ac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb.xml @@ -0,0 +1,48 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb new file mode 100644 index 0000000..b08659d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb @@ -0,0 +1,509 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/preferences/Logging") + (subpath "/usr/libexec") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Logs/awd/awd-networkserviceproxy.log") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-networkserviceproxy.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "networkserviceproxy") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "networkserviceproxy")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow sysctl*) +(allow sysctl-write) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb.xml new file mode 100644 index 0000000..951b1a3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb new file mode 100644 index 0000000..3933b52 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb @@ -0,0 +1,836 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.quicklook.readonly") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Media/Books") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look") +(subpath-prefix "${HOME}/Library/Caches/com.apple.QuickLook.thumbnailcache")) + (extension "com.apple.quicklook.readonly") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Documents" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look") +(subpath-prefix "${HOME}/Library/Caches/com.apple.QuickLook.thumbnailcache")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type SYMLINK) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "AGXSharedUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.revisiond") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.FileProvider") + (global-name "com.apple.librariand") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.bird.token") + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.distributed_notifications@1v3") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.quicklook.ThumbnailsAgent") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.quicklook.ThumbnailsAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb new file mode 100644 index 0000000..09d26c8 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb @@ -0,0 +1,658 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal "/usr/libexec/rtcreportingd") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/rtcreportingd_")) + (extension "com.apple.rtcreporting.upload") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/rtcreportingd_")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (extension "com.apple.rtcreporting.upload")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.powerlogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "rtcreportingd") + (preference-domain "com.apple.rtcreporting") + (preference-domain "com.apple.timed") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.VideoConference") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.rtcreporting") + (preference-domain "rtcreportingd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb new file mode 100644 index 0000000..bd0c2f2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb @@ -0,0 +1,67 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/dtracehelper")) +(allow file-link) +(allow file-map-executable) +(allow file-read*) +(allow file-read-data) +(allow file-read-metadata) +(allow file-read-xattr) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.sandbox.system-group") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]Sandbox-.+[.]ips") + (regex #"^/private/var/logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/logs/CrashReporter/[.]Sandbox-.+[.]ips") + (require-all + (require-not (file-mode #o0000)) + (literal "/cores/"))) +(allow file-write-data + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.cfprefs.")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (34 a381 a080 6878) + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.containermanagerd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger")) +(allow mach-task-name) +(allow network-outbound + (literal "/private/var/run/asl_input")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow socket-ioctl) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb.xml new file mode 100644 index 0000000..4f2f666 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb.xml @@ -0,0 +1,47 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb new file mode 100644 index 0000000..a11eadb --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb @@ -0,0 +1,583 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.webinspector") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.siri.ClientFlow.ClientScripter") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.assistant") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.siri.ClientFlow.ClientScripter")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb new file mode 100644 index 0000000..98acf00 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb @@ -0,0 +1,212 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/var/mobile/Library/Caches") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-register + (global-name "com.apple.snhelper") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb new file mode 100644 index 0000000..a6f7256 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb @@ -0,0 +1,604 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.tcc.") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/private/var/preferences/Logging") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (extension "com.apple.sandbox.executable") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/tmp/com.apple.tccd") +(subpath-prefix "${HOME}/Library/TCC")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.services") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.librariand") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (global-name "com.apple.backboard.systemservices") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb.xml new file mode 100644 index 0000000..eabff4c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb new file mode 100644 index 0000000..19bd1d2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb @@ -0,0 +1,27 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow file-write-create + (literal "/private/var/db/timezone/localtime")) +(allow file-write-unlink + (literal "/private/var/db/timezone/localtime")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb new file mode 100644 index 0000000..0235986 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb @@ -0,0 +1,356 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/sbin") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal "/usr") +(literal "/usr/sbin/wirelessproxd")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.server.bluetooth.le.att.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.touchsetupd.wirelessproximity") + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.appstored.xpc.updates") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.wirelessproxd.debug") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.wirelessproxd.debug")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb new file mode 100644 index 0000000..3d1bfe2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb @@ -0,0 +1,456 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/AddressBook") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.contactsd") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-entitlement "com.apple.coreduetd.allow" + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences"))) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.contactsd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AGXDevice")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb new file mode 100644 index 0000000..332e8b5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb @@ -0,0 +1,3638 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-entitlement "com.apple.private.librarian.container-proxy") + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.usernotifications.attachments.read-only")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Calendar") + (entitlement-value "com.apple.mobilecal")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/ReplayKit") + (entitlement-value "com.apple.ReplayKit.RPVideoEditorExtension")) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (extension-class "com.apple.mediaserverd.read") + (entitlement-value "com.apple.mobilemail")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (entitlement-value "com.apple.Music") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (entitlement-value "com.apple.mobilemail") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (debug-mode) + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Caches/com.apple.navd/NavTraces") + (entitlement-value "com.apple.Maps")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper"))) + (require-all + (entitlement-value "com.apple.Music") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (entitlement-value "com.apple.SafariViewService") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper"))) + (require-all + (entitlement-value "com.apple.Music") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (entitlement-value "com.apple.SafariViewService") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sharing.airdrop.readonly") + (entitlement-value "com.apple.UIKit.ShareUI")) + (require-all + (subpath-prefix "${HOME}/Library/CallServices/Ringtones") + (extension-class "com.apple.mediaserverd.read") + (entitlement-value "com.apple.InCallService")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (entitlement-value "com.apple.mobilemail") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))))))) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/usr/lib") + (extension "com.apple.app-sandbox.read") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal "/AppleInternal/Library/Frameworks/CoreAutomation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iStreamer")))) +(allow file-read* + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (require-not (literal "/private/var/mobile/Media/iTunes_Control/iTunes/iTunesPrefs")) + (require-any + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/Developer") + (require-entitlement "com.apple.media.ringtones.read-write") + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (subpath-prefix "${HOME}/Library/BulletinDistributor/Attachments") + (extension "com.apple.bulletindistributor.attachments.read-only")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.apsalerts.plist")) + (require-any + (require-all + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (subpath "/private/var/tmp/com.apple.dt.XCTest") + (require-any + (process-name "/Applications/") + (require-entitlement "get-task-allow"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (regex #"^/private/var/mobile/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/euser[0-9]+/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/[-0-9A-F]+/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/Users/[^/]+/Library/GameKit/Data/[^/]+.gcdata$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/")))) + (require-all + (extension "com.apple.fileprovider.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/Fonts") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.tcc.kTCCServiceMediaLibrary")))) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/SpringBoard/OriginalHomeVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/OriginalLockVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/LockBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/LockBackgroundThumbnail.jpg") +(literal-prefix "${HOME}/Library/SpringBoard/LockVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/.LockBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/.HomeBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/HomeVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/HomeBackgroundThumbnail.jpg") +(literal-prefix "${HOME}/Library/SpringBoard/HomeBackground.cpbitmap")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension "com.apple.usernotifications.attachments.read-only")) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (entitlement-value "com.apple.mobilemail")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (entitlement-value "com.apple.mobilemail")) + (require-all + (extension "com.apple.sharing.airdrop.readonly") + (entitlement-value "com.apple.UIKit.ShareUI")) + (require-all + (subpath-prefix "${HOME}/Media/Safari") + (entitlement-value "com.apple.mobilesafari")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (entitlement-value "com.apple.Maps")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$") + (entitlement-value "com.apple.PassbookUIService")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (require-any + (require-any (entitlement-value "com.apple.Music") +(entitlement-value "com.apple.PassbookUIService") +(entitlement-value "com.apple.stocks.watchkitextension")) + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.restrictionspassword.plist") + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync") + (entitlement-value "com.apple.Music")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$") + (entitlement-value "com.apple.stocks.watchkitextension")))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.safarifetcherd"))) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (entitlement-value "com.apple.Maps")) + (require-all + (subpath-prefix "${HOME}/Media") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (subpath "/Library/Application Support/Mail/Plugins") +(literal "/private/var/preferences/SystemConfiguration/com.apple.AutoWake.plist") +(literal "/System/Library/PairedSyncServices/com.apple.pairedsync.mail.plist")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (literal "/AppleInternal/Library/Frameworks/CoreAutomation") + (entitlement-value "com.apple.iStreamer")) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (entitlement-value "com.apple.mobilemail")) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (entitlement-value "com.apple.Maps")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mobilemail") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mobilemail")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (entitlement-value "com.apple.Music")) + (require-all + (literal "/usr/libexec") + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices")) + (entitlement-value "com.apple.ios.StoreKitUIService")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.parsecd/CustomFeedback/SafariAutoFill") +(subpath-prefix "${HOME}/Library/Caches/com.apple.parsecd/CustomFeedback/SafariAutoPlay")) + (entitlement-value "com.apple.mobilesafari")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp"))) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (subpath-prefix "${HOME}/Library/CallServices/Ringtones") + (entitlement-value "com.apple.InCallService")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") +(literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock")) + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$") + (subpath-prefix "${FRONT_USER_HOME}") + (entitlement-value "com.apple.SafariViewService"))))))) + (require-all + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (require-any + (require-entitlement "com.apple.security.exception.carrier-bundle.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID")))))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/GameKit/Data") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type SYMLINK) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/printd") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-entitlement "com.apple.system.set-alert-tone") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (entitlement-value "com.apple.SafariViewService") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper"))) + (require-all + (entitlement-value "com.apple.Music") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (entitlement-value "com.apple.ios.StoreKitUIService")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (entitlement-value "com.apple.Music")) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (entitlement-value "com.apple.Music")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (entitlement-value "com.apple.ios.StoreKitUIService")) + (require-all + (vnode-type DIRECTORY) + (entitlement-value "com.apple.mobilemail") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))))))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID")))))) +(allow file-test-existence + (3b 0000 a080 6288) + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all (require-not (literal-prefix "${HOME}/Library/Application Support/CloudDocs/session/containers/")) +(require-not (literal-prefix "${HOME}/Library/Caches/BridgeIconCache/")) +(require-not (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.CloudDocsUI.CloudSharing/")) +(require-not (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird/")) +(require-not (literal-prefix "${HOME}/Library/CallServices/Ringtones/")) +(require-not (literal-prefix "${HOME}/Library/SpringBoard/PushStore/")) +(require-not (literal-prefix "${HOME}/Library/SpringBoard/ApplicationShortcuts/")) +(require-not (literal-prefix "${HOME}/Library/SMS/")) +(require-not (literal-prefix "${HOME}/Library/OnDemandResources/Manifests/")) +(require-not (literal-prefix "${HOME}/Library/Mobile Documents/")) +(require-not (literal-prefix "${HOME}/Library/Mobile Documents/Media/Recordings/")) +(require-not (literal-prefix "${HOME}/Library/")) +(require-not (literal "/private/var/Managed Preferences/mobile/"))) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow file-write* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.revisiond.staging") + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (extension "com.apple.fileprovider.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type SYMLINK) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (entitlement-value "com.apple.Music")) + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp"))) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mobilemail") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mobilemail")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (entitlement-value "com.apple.mobilesafari") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.parsecd/CustomFeedback/SafariAutoFill") +(subpath-prefix "${HOME}/Library/Caches/com.apple.parsecd/CustomFeedback/SafariAutoPlay"))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (require-all + (entitlement-value "com.apple.Music") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync")) + (require-all + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI") + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.restrictionspassword.plist")) + (require-all + (entitlement-value "com.apple.Maps") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/")) + (require-all + (entitlement-value "com.apple.mobilemail") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail")))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") +(literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock")) + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.safarifetcherd"))) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (entitlement-value "com.apple.Maps")) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$") + (subpath-prefix "${FRONT_USER_HOME}") + (entitlement-value "com.apple.SafariViewService")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper"))) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (entitlement-value "com.apple.Maps")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-all + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail") + (require-any + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd")))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (entitlement-value "com.apple.Music")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (entitlement-value "com.apple.ios.StoreKitUIService"))))))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (entitlement-value "com.apple.Music")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (entitlement-value "com.apple.ios.StoreKitUIService"))))))) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail") + (require-any + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd"))))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null")))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-entitlement "com.apple.container2") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")) + (require-any + (subpath-prefix "${HOME}/Media/Podcasts") + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary")))))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow generic-issue-extension + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari") + (require-any (extension-class "com.apple.webkit.camera") +(extension-class "com.apple.webkit.microphone") +(extension-class "com.apple.webkit.webrtc"))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (require-all + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (require-entitlement "com.apple.private.amfi.can-load-cdhash")) + (require-all + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (iokit-user-client-class "RootDomainUserClient") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (iokit-user-client-class "IOMobileFramebufferUserClient") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow iokit-get-properties + (iokit-property "IOClass") + (require-any (iokit-property "IOClassNameOverride") +(iokit-property "IOCFPlugInTypes") +(iokit-property "IORegistryEntryPropertyKeys")) + (require-entitlement "com.apple.system.diagnostics.iokit-properties") + (require-all + (iokit-property-regex #"-mac-address" #"mac-address-" #".+-mac-address" #".+mac-address-") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.wifi.manager-access"))) + (require-all + (require-any (iokit-property "IOProviderClass") +(iokit-property "IOFeatures")) + (iokit-user-client-class "IONetworkController")) + (require-all + (iokit-property "boot-manifest-hash") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "soc-generation") + (process-attribute 4) + (iokit-user-client-class "IOPlatformDevice") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-property "IOMACAddress") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.wifi.manager-access"))) + (require-all + (require-any (iokit-property "IOAccessoryBatteryPack") +(iokit-property "IOAccessoryDigitalID") +(iokit-property "IOAccessoryInterfaceDeviceInfo") +(iokit-property "IOAccessoryID") +(iokit-property "IOAccessoryManagerType") +(iokit-property "IODeviceMemory") +(iokit-property "config-number") +(iokit-property "controllers") +(iokit-property "AppleDiagnostic") +(iokit-property "CrashReporter-ID") +(iokit-property "Device Characteristics")) + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "model") +(iokit-property "platform-name") +(iokit-property "regulatory-model-number") +(iokit-property "region-info")) + (iokit-user-client-class "IOPlatformExpertDevice")) + (require-all + (iokit-property "client") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient")) + (require-all + (iokit-property-regex #"serial-number" #"SerialNum" #"-snum" #".+serial-number" #".+SerialNum" #".+-snum") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "AGXParameterBufferMaxSize") +(iokit-property "InternalStatistics") +(iokit-property "InternalStatisticsAccm") +(iokit-property "PerformanceStatisticsAccum") +(iokit-property "MetalStatisticsName")) + (iokit-user-client-class "IOAcceleratorES")) + (require-all + (iokit-property "IOClass") + (iokit-user-client-class "IONetworkController")) + (require-all + (require-any (iokit-property "CFBundleIdentifier") +(iokit-property "IOLinkSpeed") +(iokit-property "IOLinkStatus") +(iokit-property "IOPropertyMatch") +(iokit-property "IOMinPacketSize") +(iokit-property "IOMaxPacketSize")) + (iokit-user-client-class "IONetworkController")) + (require-all + (require-any (iokit-property "idProduct") +(iokit-property "idVendor") +(iokit-property "Product Name") +(iokit-property "kUSBProductString")) + (iokit-connection "AppleSynopsysOTGDevice")) + (require-all + (iokit-property-regex #"UUID" #"-uuid" #".+UUID" #".+-uuid") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "ForceSupported") +(iokit-property "SupportTapToWake")) + (require-any (iokit-user-client-class "AppleMultitouchSPI") +(iokit-user-client-class "AppleMultitouchDevice"))) + (require-all + (require-any (iokit-property "interval") +(iokit-property "mode") +(iokit-property "useMag") +(iokit-property "QueueSize")) + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient")) + (require-all + (iokit-connection "AppleSynopsysOTGDevice") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "udid-version") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "root-ticket-hash") +(iokit-property "backlight-marketing-table") +(iokit-property "device-imei") +(iokit-property "IOCPUID")) + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "gyro-interrupt-calibration") + (require-any (iokit-user-client-class "AppleOscarNub") +(iokit-user-client-class "AppleSPUHIDInterface"))) + (require-all + (iokit-property-regex #"[Cc]alibration" #".+[Cc]alibration") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "Size") + (iokit-user-client-class "IOMedia")) + (require-all + (iokit-property "PerformanceStatistics") + (iokit-user-client-class "IOMobileFramebuffer")) + (require-all + (iokit-property "AppleJPEG") + (iokit-user-client-class "AppleJPEGDriver")) + (require-all + (iokit-user-client-class "IOService") + (require-any + (require-any (iokit-property "software-behavior") +(iokit-property "3d-maps") +(iokit-property "3d-imagery") +(iokit-property "no-sdio-devices") +(iokit-property "navigation") +(iokit-property "display-scale") +(iokit-property "display-rotation") +(iokit-property "decoding") +(iokit-property "chip-id") +(iokit-property "video-stills") +(iokit-property "video-cap") +(iokit-property "rear-slowmo") +(iokit-property "rear-max-video-") +(iokit-property "rear-max-slomo-video-fps-") +(iokit-property "rear-hdr") +(iokit-property "rear-hdr-on") +(iokit-property "rear-burst") +(iokit-property "rear-burst-image-duration") +(iokit-property "rear-auto-hdr") +(iokit-property "post-effects") +(iokit-property "pipelined-stillimage-capability") +(iokit-property "pearl-camera") +(iokit-property "panorama") +(iokit-property "live-photo-capture") +(iokit-property "live-effects") +(iokit-property "front-max-video-") +(iokit-property "front-hdr") +(iokit-property "front-hdr-on") +(iokit-property "front-flash-capability") +(iokit-property "front-burst") +(iokit-property "front-burst-image-duration") +(iokit-property "front-auto-hdr") +(iokit-property "flash") +(iokit-property "auto-focus") +(iokit-property "aggregate-cam-video-zoom") +(iokit-property "adaptive-ui") +(iokit-property "tnr-mode") +(iokit-property "encoding") +(iokit-property "bitrate-")) + (require-any (iokit-property "name") +(iokit-property "device_type") +(iokit-property "device-type") +(iokit-property "Protocol Characteristics") +(iokit-property "IOSurfaceAcceleratorCapabilitiesDict")) + (require-all + (require-any (iokit-property "unique-chip-id") +(iokit-property "uid-aes-key") +(iokit-property "AAPL,phandle") +(iokit-property "#address-cells") +(iokit-property "system-trusted") +(iokit-property "software-bundle-version") +(iokit-property "security-domain") +(iokit-property "secure-boot") +(iokit-property "root-matching") +(iokit-property "random-seed") +(iokit-property "production-cert") +(iokit-property "mix-n-match-prevention-status") +(iokit-property "mac-address-wifi0") +(iokit-property "mac-address-ethernet0") +(iokit-property "mac-address-bluetooth0") +(iokit-property "image4-supported") +(iokit-property "gid-aes-key") +(iokit-property "firmware-version") +(iokit-property "effective-security-mode-sep") +(iokit-property "effective-security-mode-ap") +(iokit-property "effective-production-status-sep") +(iokit-property "effective-production-status-ap") +(iokit-property "dram-vendor") +(iokit-property "dram-vendor-id") +(iokit-property "die-id") +(iokit-property "development-cert") +(iokit-property "debug-enabled") +(iokit-property "crypto-hash-method") +(iokit-property "consistent-debug-root") +(iokit-property "chip-epoch") +(iokit-property "certificate-security-mode") +(iokit-property "certificate-production-status") +(iokit-property "bootp-response") +(iokit-property "boot-nonce") +(iokit-property "board-id")) + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "boot-manifest-hash") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))))) + (require-all + (iokit-property "PerformanceStatistics") + (iokit-user-client-class "IOAcceleratorES")) + (require-all + (iokit-property-regex #"die-id$" #"chip-id$" #"board-id$" #".+((die|chip)|board)-id$") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "iommu-present") + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "BaseAddressAlignmentRequirement") +(iokit-property "IOGLES") +(iokit-property "MetalPluginClassName") +(iokit-property "MetalPluginName")) + (iokit-user-client-class "IOAcceleratorES")) + (require-all + (require-any (iokit-property "AppleTV") +(iokit-property "DisplayPipePlaneBaseAlignment") +(iokit-property "DisplayPipeStrideRequirements") +(iokit-property "hdcp-hoover-protocol") +(iokit-property "appleTV-VID1") +(iokit-property "appleTV-VID0")) + (iokit-user-client-class "IOMobileFramebuffer")) + (require-all + (iokit-property "emu") + (iokit-user-client-class "IODTNVRAM")) + (require-all + (require-any (iokit-property "als-colorCfg") +(iokit-property "noMultiColorSupport")) + (iokit-user-client-class "AppleARMIICDevice")) + (require-all + (require-any (iokit-property "battery-data") +(iokit-property "BatteryData") +(iokit-property "Serial")) + (iokit-connection "IOPMPowerSource") + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers"))) + (require-all + (iokit-property "home-button-type") + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "camera-front") +(iokit-property "camera-rear")) + (iokit-user-client-class "AppleARMIODevice")) + (require-all + (iokit-property "SupportAlwaysOnCompass") + (iokit-user-client-class "AppleSPUHIDDriver")) + (require-all + (require-any (iokit-property "BSD Name") +(iokit-property "InterfaceRole") +(iokit-property "IORequiredPacketFilters") +(iokit-property "IO80211Band") +(iokit-property "IO80211Channel") +(iokit-property "IO80211ChannelFrequency") +(iokit-property "IO80211ChannelBandwidth") +(iokit-property "IO80211RSNDone") +(iokit-property "IOPrimaryInterface") +(iokit-property "IONetworkRootType") +(iokit-property "IONetworkData") +(iokit-property "IOMediaHeaderLength") +(iokit-property "IOMediaAddressLength") +(iokit-property "IOMaxTransferUnit") +(iokit-property "IOLocation") +(iokit-property "IOInterfaceUnit") +(iokit-property "IOInterfaceType") +(iokit-property "IOInterfaceState") +(iokit-property "IOInterfaceNamePrefix") +(iokit-property "IOInterfaceFlags") +(iokit-property "IOInterfaceExtraFlags") +(iokit-property "IOControllerEnabled") +(iokit-property "IOBuiltin") +(iokit-property "IOActivePacketFilters") +(iokit-property "NetworkConfigurationOverrides")) + (iokit-user-client-class "IONetworkInterface")) + (require-all + (require-any (iokit-property "AdapterInfo") +(iokit-property "AtCriticalLevel") +(iokit-property "Voltage") +(iokit-property "MaxCapacity") +(iokit-property "IsCharging") +(iokit-property "FullyCharged") +(iokit-property "ExternalConnected") +(iokit-property "ExternalChargeCapable") +(iokit-property "CurrentCapacity") +(iokit-property "CapacityEstimated") +(iokit-property "BatteryInstalled")) + (iokit-connection "IOPMPowerSource")) + (require-all + (iokit-property "HEVCSupported") + (iokit-user-client-class "AppleD5500")) + (require-all + (require-any (iokit-property "artwork-device-idiom") +(iokit-property "artwork-device-subtype") +(iokit-property "artwork-dynamic-displaymode") +(iokit-property "artwork-display-gamut") +(iokit-property "artwork-scale-factor") +(iokit-property "watch-companion") +(iokit-property "thin-bezel") +(iokit-property "product-id") +(iokit-property "product-description") +(iokit-property "offline-dictation") +(iokit-property "location-reminders") +(iokit-property "large-format-phone") +(iokit-property "gps-capable") +(iokit-property "graphics-featureset-fallbacks") +(iokit-property "graphics-featureset-class") +(iokit-property "dictation") +(iokit-property "device-colors") +(iokit-property "device-perf-memory-class") +(iokit-property "car-integration") +(iokit-property "compatible-device-fallback")) + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "IOProviderClass") +(iokit-property "IOFeatures")) + (iokit-user-client-class "IONetworkInterface"))) +(allow ipc-posix-sem* + (semaphore-owner self) + (require-all + (extension "com.apple.sandbox.application-group") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (require-all + (extension "com.apple.sandbox.application-group") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-create + (ipc-posix-name-regex #"^/mono[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-unlink + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (b4 0017 a080 5fbf) + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (global-name "com.apple.gamecenter") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.calaccessd") + (global-name "com.apple.healthd.server") + (global-name "com.apple.springboard.backgroundappservices") + (34 aae0 a080 5fde) + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.cloudd") + (global-name "com.apple.itdbprep.server") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.marco") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.wcd") + (require-any (global-name "com.apple.AdSheetPhone.server") +(global-name "com.apple.AdSheetPad.server") +(global-name "com.apple.MediaControl.daemon") +(global-name "com.apple.MobileAccessoryUpdater") +(global-name "com.apple.MobileFileIntegrity") +(global-name "com.apple.Music.MPMusicPlayerMigServer") +(global-name "com.apple.ReportCrash") +(global-name "com.apple.ReportCrash.DirectoryService") +(global-name "com.apple.ReportCrash.Jetsam") +(global-name "com.apple.ReportCrash.SafetyNet") +(global-name "com.apple.ReportCrash.StackShot") +(global-name "com.apple.VoiceOverTouch.xpc") +(global-name "com.apple.airplay.sender.xpc") +(global-name "com.apple.appleprofilepolicyd") +(global-name "com.apple.assetsd.keepDaemonAlive") +(global-name "com.apple.assetsd.notificationServer") +(global-name "com.apple.audio.AudioConverterServer") +(global-name "com.apple.audio.AudioFileServer") +(global-name "com.apple.audio.AudioUnitServer") +(global-name "com.apple.backboard.checkin") +(global-name "com.apple.backboard.watchdog") +(global-name "com.apple.backboard.workspaceserverconnection") +(global-name "com.apple.bypassBasebandAutoBooter.msgport") +(global-name "com.apple.callkit.callsourcehost") +(global-name "com.apple.clouddbd") +(global-name "com.apple.commcenter.dm-helper") +(global-name "com.apple.commcenter.mobile-helper") +(global-name "com.apple.coremedia.audioprocessingtap") +(global-name "com.apple.coremedia.cpe") +(global-name "com.apple.coremedia.cpe.xpc") +(global-name "com.apple.coremedia.cpeprotector") +(global-name "com.apple.coremedia.cpeprotector.xpc") +(global-name "com.apple.coremedia.formatreader") +(global-name "com.apple.coremedia.wirelessdisplay") +(global-name "com.apple.coremedia.wirelessdisplayserver") +(global-name "com.apple.cvmsCompAgent_armv7") +(global-name "com.apple.datamigrator.dz") +(global-name "com.apple.devicecheckd") +(global-name "com.apple.distributed_notifications@0v3") +(global-name "com.apple.dt.xctestd.target") +(global-name "com.apple.fileprovider.pushkit") +(global-name "com.apple.gamed.note") +(global-name "com.apple.iTunesStore.daemon.notifications.public") +(global-name "com.apple.iTunesStore.daemon.public") +(global-name "com.apple.iapauthd") +(global-name "com.apple.iapauthd.xpc") +(global-name "com.apple.imavagent.embedded.auth") +(global-name "com.apple.instruments.server.mig") +(global-name "com.apple.mDNSResponder") +(global-name "com.apple.managedconfiguration.mdmdpush-dev") +(global-name "com.apple.managedconfiguration.mdmdpush-prod") +(global-name "com.apple.managedconfiguration.mdmdservice") +(global-name "com.apple.mediastream.sharing-nowake") +(global-name "com.apple.midiserver") +(global-name "com.apple.mobile.softwareupdated") +(global-name "com.apple.mobileipod.MPMusicPlayerControllerInternal") +(global-name "com.apple.mobileipod.MPMusicPlayerMigServer") +(global-name "com.apple.mobileipod.MPMusicPlayerMigServerExists") +(global-name "com.apple.prdaily") +(global-name "com.apple.sandboxd") +(global-name "com.apple.scrod") +(global-name "com.apple.spotlight.SearchAgent") +(global-name "com.apple.springboard.UIKit.migserver") +(global-name "com.apple.springboard.alerts") +(global-name "com.apple.springboard.remotenotifications") +(global-name "com.apple.springboard.watchdogserver") +(global-name "com.apple.telephonyutilities.callservicesdaemon.voip") +(global-name "com.apple.telephonyutilities.remotelogdaemon") +(global-name "com.apple.videoconference.avconference") +(global-name "com.apple.vsassetd") +(global-name "com.apple.wapi.client") +(global-name "com.apple.watchconnectivity.complication") +(global-name "com.apple.weibod.server")) + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.midiserver.io") + (require-any (global-name "com.apple.WebBookmarks.webbookmarksd") +(global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd")) + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.Music.MPMusicPlayerControllerInternal") +(global-name "com.apple.Music.MPMusicPlayerMigServerExists")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.locationd.synchronous") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.parsecd") + (global-name "com.apple.FileCoordination") + (global-name "PurplePPTServer") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.mobile.installd") + (34 aaa8 a080 5fc9) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.testmanagerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.networkd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.assetsd.changehub") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.sharingd") + (global-name "com.apple.revisiond") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.twitterd") + (global-name "com.apple.webinspector") + (global-name "com.apple.securityd") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (require-any (global-name "com.apple.dataaccess.dataaccessd.active") +(global-name "com.apple.passd.in-app-payment")) + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.bird.token") + (global-name "com.apple.syncdefaultsd") + (34 ab2e a080 5fd4) + (global-name "com.apple.passd.assertions") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.dataaccess.dataaccessd") + (34 aad7 a080 5fdc) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.certui.relay") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.gamed") + (require-any (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (require-any (global-name "com.apple.iap2d") +(global-name "com.apple.iaptransportd")) + (global-name "com.apple.cache_delete.public") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.contactsd") + (global-name "com.apple.bird") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.homed.xpc") + (global-name "com.apple.calaccessd.xpc") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.coremedia.endpoint.xpc") + (34 ce53 a080 5fca) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.atc") + (global-name "com.apple.PowerManagement.control") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.passd.library") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ait.client") + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (b4 0018 a080 5fba) + (global-name "com.apple.coremedia.videoqueue") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.iap2d.distributednotification.server") +(global-name "com.apple.iapd.distributednotification.server") +(global-name "com.apple.iaptransportd.xpc")) + (global-name "com.apple.mDNSResponderHelper") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.iapd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.librariand") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.gizmoappd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.fairplayd") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.VoiceOverTouch") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.twitterd.server") + (global-name "com.apple.voiceservices.tts") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.accessibility.AXBackBoardServer") + (require-any (global-name "com.apple.accountsd.accessmanager") +(global-name "com.apple.accountsd.authmanager") +(global-name "com.apple.healthd.restriction")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.FileProvider") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.coremedia.sandboxserver") + (34 aadc a080 5fc4) + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.replayd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.assertiond.processinfoservice") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.accessories.transport-server") +(global-name "com.apple.iap2d.xpc") +(global-name "com.apple.iapd.xpc")) + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.springboard") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-all + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (34 a381 60f0 a081)) + (require-any + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.diagnosticd") + (34 a381 a080 60f3) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.personad.xpc") + (require-any + (require-entitlement "com.apple.private.persona.write") + (require-entitlement "com.apple.private.persona.read") + (require-entitlement "com.apple.private.contactsui"))) + (require-all + (global-name "com.apple.icfcallserver") + (require-entitlement "com.apple.private.icfcallserver")) + (require-all + (global-name "com.apple.VideoSubscriberAccount.videosubscriptionsd") + (require-any + (require-entitlement "com.apple.smoot.subscriptionservice") + (require-entitlement "com.apple.private.subscriptionservice.web-sources.read-write") + (require-entitlement "com.apple.private.subscriptionservice.internal") + (require-entitlement "com.apple.developer.video-subscription-registration") + (require-entitlement "com.apple.private.subscriptionservice.all-sources.read-only"))) + (require-all + (global-name "com.apple.cache_delete") + (require-any + (require-entitlement "com.apple.private.CacheDelete") + (require-entitlement "com.apple.mobile.deleted.AllowFreeSpace"))) + (require-all + (global-name "com.apple.icloud.findmydeviced") + (require-any + (require-entitlement "com.apple.icloud.findmydeviced.access") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.SystemConfiguration.PPPController-priv") + (require-entitlement "com.apple.networking.vpn.configuration")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.spotlight.IndexAgent") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.unfreed") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.suggestd.mail") + (require-entitlement "com.apple.private.suggestions.mail")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.siri.vocabularyupdates") + (require-any + (require-entitlement "com.apple.developer.siri") + (require-entitlement "com.apple.siri.synapse"))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.aps.alertprovider.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.suggestd.suggestionmanager") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.managedconfiguration.profiled") + (require-entitlement "com.apple.managedconfiguration.profiled-access")) + (require-all + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.bulletinboard.observerconnection") + (require-entitlement "com.apple.bulletinboard.observer")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.utilitiesconnection") + (require-entitlement "com.apple.bulletinboard.utilities")) + (require-all + (global-name "com.apple.familycircle.agent") + (require-entitlement "com.apple.private.familycircle")) + (require-all + (global-name "com.apple.locationd.spi") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobilestoredemod") + (require-entitlement "com.apple.private.mobilestoredemo.enabledemo")) + (require-all + (global-name "com.apple.suggestd.spotlight") + (require-entitlement "com.apple.private.suggestions.spotlight")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (local-name "com.apple.iphone.axserver") + (require-entitlement "com.apple.accessibility.api")) + (require-all + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.suggestd.events") + (require-entitlement "com.apple.private.suggestions.events")) + (require-all + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.lskdd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.AOSNotification") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access")) + (require-all + (global-name "com.apple.suggestd.contacts") + (require-entitlement "com.apple.private.suggestions.contacts")) + (require-all + (34 ce9a 604e 6054) + (require-any + (require-entitlement "com.apple.private.imcore.spi.database-access") + (require-entitlement "com.apple.private.imcore.imdpersistence.data-detection-access ") + (require-entitlement "com.apple.private.imcore.imdpersistence.database-access"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.systemstateconnection") + (require-entitlement "com.apple.bulletinboard.systemstate")) + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (require-any + (require-entitlement "com.apple.private.imcore.imremoteurlconnection") + (require-entitlement "com.apple.private.ids.remoteurlconnection"))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.ABDatabaseDoctor") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.bulletinboard.settings")) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (global-name "com.apple.nanoprefsync") + (entitlement-value "com.apple.stocks.watchkitextension")) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI")) + (require-all + (global-name "com.apple.FileCoordination") + (entitlement-value "com.apple.stocks.watchkitextension")) + (require-all + (global-name "com.apple.nanoprefsync") + (entitlement-value "com.apple.Music")) + (require-all + (global-name "com.apple.routined.registration") + (entitlement-value "com.apple.Maps")) + (require-all + (global-name "com.apple.FileCoordination") + (entitlement-value "com.apple.Music")) + (require-all + (require-any (global-name "com.apple.nanomaps.xpc.Navigation") +(global-name "com.apple.nanomaps.xpc.Maps")) + (entitlement-value "com.apple.Maps")) + (require-all + (global-name "com.apple.mobilesafari-settings") + (entitlement-value "com.apple.WebSheet")) + (require-all + (global-name "com.apple.nanoprefsync") + (entitlement-value "com.apple.PassbookUIService")) + (require-all + (global-name "com.apple.Maps.SpringBoard") + (entitlement-value "com.apple.Maps")) + (require-all + (global-name "com.apple.rtcreportingd") + (entitlement-value "com.apple.mobilesafari")) + (require-all + (global-name "com.apple.safarifetcherd") + (entitlement-value "com.apple.mobilesafari")) + (require-all + (global-name "com.apple.assistant.analytics") + (entitlement-value "com.apple.Maps")) + (require-all + (entitlement-value "com.apple.mobilemail") + (require-any + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.mobilemail") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.backupd") + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.bulletindistributord.server") +(global-name "com.apple.harvestd.manager")) + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.routined.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.coremedia.admin") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")))) + (require-all + (global-name "com.apple.Maps.mapspushd") + (entitlement-value "com.apple.Maps")) + (require-all + (global-name "com.apple.lsd.xpc") + (entitlement-value "com.apple.mobilesafari")) + (require-all + (global-name "com.apple.FileCoordination") + (entitlement-value "com.apple.PassbookUIService")) + (require-all + (global-name "com.apple.nanomaps.xpc.GeoServices.Navigation") + (entitlement-value "com.apple.Maps")))))) +(allow mach-register + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (require-not (global-name-regex #"-idswake$" #".+-idswake$")) + (require-any + (local-name "com.apple.iphone.axserver") + (local-name "com.apple.accessibility.gax.client") + (local-name "com.apple.assistant.contextprovider.") + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music") + (require-any (global-name "com.apple.Music.MPMusicPlayerControllerInternal") +(global-name "com.apple.Music.MPMusicPlayerMigServerExists")))))) + (require-all + (global-name-regex #".+") + (extension "com.apple.security.exception.mach-register.global-name"))) +(allow network-inbound + (local ip "*:*") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (extension "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$"))) +(allow network-outbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (extension "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (remote tcp "localhost:22")) + (require-not (remote tcp "localhost:23")) + (require-not (remote tcp "localhost:873")) + (require-not (remote tcp "localhost:62078")) + (require-any + (remote ip "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/printd") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (literal "/private/var/run/lockdown.sock") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mobilecal.alarmengine") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.itdbprep.server") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (require-any (preference-domain "com.apple.MobileAddressBook") +(preference-domain "com.apple.VoiceMemos") +(preference-domain "com.apple.XCTest") +(preference-domain "com.apple.certui") +(preference-domain "com.apple.gamekit") +(preference-domain "com.apple.imagent") +(preference-domain "com.apple.madrid") +(preference-domain "com.apple.managedconfiguration.janitor") +(preference-domain "com.apple.messagesbadgecontroller") +(preference-domain "com.apple.mobile.SyncMigrator") +(preference-domain "com.apple.mobileme.fmf.assistant") +(preference-domain "com.apple.mobilestoresettings") +(preference-domain "com.apple.mobiletimer") +(preference-domain "com.apple.mobilevpn") +(preference-domain "com.apple.network.eapclient.tls.TrustExceptions") +(preference-domain "com.apple.nike") +(preference-domain "com.apple.preferences.datetime") +(preference-domain "com.apple.preferences.network") +(preference-domain "com.apple.softwareupdateservicesd") +(preference-domain "com.apple.voicemail") +(preference-domain "itdbprepserver") +(preference-domain "mediaremote")) + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilenotes") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.da") + (preference-domain "com.apple.hangtracer") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.OTASyncState") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.atc") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.apsd") + (preference-domain "com.apple.TTY") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "com.apple.ConfigServer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (require-any (preference-domain "com.apple.LaunchServices") +(preference-domain "com.apple.avfoundation.videoperformancehud")) + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.dataaccess.dataaccessd") + (require-all + (require-any (preference-domain "com.apple.MailAccount-ExtProperties") +(preference-domain "com.apple.OTASyncAgent")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.coreaudio") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.avfoundation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.homesharing") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (preference-domain "com.apple.coremedia") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.coremedia"))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (preference-domain "com.apple.NanoMailKit") +(preference-domain "com.apple.internal.Voltaire") +(preference-domain "com.skyhookwireless.wps")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.medialibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.security"))) + (require-all + (preference-domain "com.apple.books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.corevideo") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only") + (require-all + (preference-domain "com.apple.ist.AppleConnect") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ist.AppleConnect.extension")))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (entitlement-value "com.apple.mobilemail") + (require-any + (preference-domain "com.apple.cloud.quota") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.OTASyncState") + (require-any (preference-domain "com.apple.MailAccount-ExtProperties") +(preference-domain "com.apple.OTASyncAgent")))) + (require-all + (preference-domain "com.apple.youtube.dp") + (entitlement-value "com.apple.mobilesafari")) + (require-all + (entitlement-value "com.apple.Maps") + (require-any + (preference-domain "com.apple.GMM") + (require-any (preference-domain "com.apple.NanoMailKit") +(preference-domain "com.apple.internal.Voltaire") +(preference-domain "com.skyhookwireless.wps")) + (preference-domain "com.apple.assistant"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (entitlement-value "com.apple.iCloudDriveApp")))))) +(allow process-info-codesignature + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension")) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow process-info-dirtycontrol + (target self)) +(allow process-info-rusage + (require-entitlement "com.apple.security.exception.process-info")) +(allow process-info-pidinfo + (target self) + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (target others) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd")) + (require-entitlement "com.apple.DiagnosticExtensions.extension")))) +(allow pseudo-tty) +(allow signal + (target self) + (require-all + (target others) + (require-any + (require-entitlement "com.apple.DiagnosticExtensions.extension") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd"))))) +(allow socket-ioctl) +(allow sysctl-read + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "kern.bootsessionuuid") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-any + (require-entitlement "com.apple.DiagnosticExtensions.extension") + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (sysctl-name "kern.proc.all") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd"))))) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.") + (require-any + (require-entitlement "com.apple.DiagnosticExtensions.extension") + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (sysctl-name "kern.proc.all") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd"))))) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-info + (require-all + (info-type "net.link.addr") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb.xml new file mode 100644 index 0000000..e18b609 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb new file mode 100644 index 0000000..f36ef90 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb @@ -0,0 +1,589 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.containermanagerd") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/installd/Library/Caches") +(subpath "/private/var/networkd/Containers") +(subpath "/private/var/root/Library/Logs/MobileContainerManager") +(subpath "/private/var/root/Library/MobileContainerManager") +(literal "/private/var/root/Library/MobileContainerManager.") +(literal "/private/var/") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/MobileContainerManager") +(subpath-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager") +(literal-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager.")) + (literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers" #"^/private/var/[-0-9A-F]+/Library/Backup/SystemContainers" #"^/private/var/Users/[^/]+/Library/Backup/SystemContainers") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers" #"^/private/var/[-0-9A-F]+/Containers" #"^/private/var/Users/[^/]+/Containers") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (require-any (literal "/private/var/installd/Library") +(literal "/private/var/installd/Library/Logs") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs") +(literal-prefix "${FRONT_USER_HOME}/Library")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/installd/Library/Caches") +(subpath "/private/var/networkd/Containers") +(subpath "/private/var/root/Library/Logs/MobileContainerManager") +(subpath "/private/var/root/Library/MobileContainerManager") +(literal "/private/var/root/Library/MobileContainerManager.") +(literal "/private/var/") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/MobileContainerManager") +(subpath-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager") +(literal-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager.")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.containermanagerd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers" #"^/private/var/[-0-9A-F]+/Library/Backup/SystemContainers" #"^/private/var/Users/[^/]+/Library/Backup/SystemContainers") + (literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/containers") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers" #"^/private/var/[-0-9A-F]+/Containers" #"^/private/var/Users/[^/]+/Containers") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal "/private/var/installd/Library") +(literal "/private/var/installd/Library/Logs") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs") +(literal-prefix "${FRONT_USER_HOME}/Library"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb new file mode 100644 index 0000000..026d978 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb @@ -0,0 +1,150 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/System/Library/Caches/com.apple.coresymbolicationd") +(subpath "/private/var/root/Library/Caches/com.apple.coresymbolicationd")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/root/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb new file mode 100644 index 0000000..12b2942 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb @@ -0,0 +1,230 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/logs/WirelessLibraryLogs") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Logs") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/logs/WirelessLibraryLogs") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb new file mode 100644 index 0000000..d34cec2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb @@ -0,0 +1,147 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ctkd.slot-client") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb new file mode 100644 index 0000000..cbe68b2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb @@ -0,0 +1,796 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/AppleInternal/Library/Frameworks") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/DataAccess") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/") +(literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.activesync")) + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (subpath "/usr/lib") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal-prefix "${HOME}/Library/Safari/BookmarksSyncMetadata.plist") +(literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (subpath-prefix "${HOME}/Library/Mail") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/") +(literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.activesync")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Mail") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Notes") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal")) + (require-any (literal-prefix "${HOME}/Library/Safari/BookmarksSyncMetadata.plist") +(literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/DataAccess") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Safari")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "RootDomainUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.calaccessd.xpc") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.calaccessd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.persistentconnection-mcc") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-any (preference-domain "com.apple.dataaccess.activesync") +(preference-domain "com.apple.dataaccess.babysitter")) + (preference-domain "com.apple.purplebuddy") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.accountsd") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.dataaccess.dataaccessd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.dataaccess.dataaccessd") + (preference-domain "com.apple.DataMigration") + (require-any (preference-domain "com.apple.dataaccess.activesync") +(preference-domain "com.apple.dataaccess.babysitter")) + (preference-domain "com.apple.mobilecal") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb.xml new file mode 100644 index 0000000..1d2d1e8 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb new file mode 100644 index 0000000..0ba30c5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb @@ -0,0 +1,275 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/db/datadetectors") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/db/datadetectors") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb new file mode 100644 index 0000000..b495e8d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb @@ -0,0 +1,224 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (literal "/private/etc/hosts") + (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-priv-task-port) +(allow network-inbound + (local tcp "localhost:*") + (remote tcp "localhost:*")) +(allow network-outbound + (literal "/private/var/run/lockdown/checkin")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow system-debug) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb.xml new file mode 100644 index 0000000..5aa82b6 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb.xml @@ -0,0 +1,48 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb new file mode 100644 index 0000000..54f2c3b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb @@ -0,0 +1,512 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (require-any (subpath "/AppleInternal/Library/CacheDelete") +(subpath-prefix "${HOME}/Library/Caches/com.apple.cache_delete") +(subpath-prefix "${HOME}/Library/Logs/CacheDelete")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/System/Library/CacheDelete") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath "/AppleInternal/Library/CacheDelete") +(subpath-prefix "${HOME}/Library/Caches/com.apple.cache_delete") +(subpath-prefix "${HOME}/Library/Logs/CacheDelete")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "cache_delete.fb_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name-regex #"^com[.]apple[.].+[Cc]ache[Dd]elete$") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.mobile.cache_delete_") +(global-name "com.apple.ind.xpc")) + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name-regex #"^com[.]apple[.].+cache-delete$") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (remote tcp "*:443")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.cache_delete") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.cache_delete")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-fsctl + (fsctl-command (_IO "J" 18)) + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 28)) + (fsctl-command (_IO "h" 29)) + (fsctl-command (_IO "h" 27))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb new file mode 100644 index 0000000..7c29093 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb @@ -0,0 +1,512 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties + (require-all + (iokit-property "public-key-accelerator") + (iokit-user-client-class "IOPlatformDevice"))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.proc.pid.") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb.xml new file mode 100644 index 0000000..6807187 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb new file mode 100644 index 0000000..a9dba3c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb @@ -0,0 +1,110 @@ +(version 1) +(allow default) +(deny file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]"))) + (require-all + (extension "com.apple.sandbox.executable") + (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(deny file-mount) +(deny file-mount-update) +(deny file-read* + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (require-all (require-not (subpath "/System/Library/Frameworks")) +(require-not (subpath "/System/Library/PrivateFrameworks"))) + (require-not (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist")) + (require-not (subpath "/private/var/preferences/Logging")) + (require-not (subpath "/System/Library")) + (require-not (subpath "/usr/lib")) + (require-not (subpath "/usr/share")) + (require-not (subpath "/private/var/db/timezone")) + (require-not (subpath "/Developer")) + (require-not (extension "com.apple.app-sandbox.read-write")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-only")) + (require-not (extension "com.apple.app-sandbox.read")) + (require-not (extension "com.apple.sandbox.executable")) + (require-any + (require-all + (require-all (require-not (literal "/dev/zero")) +(require-not (literal "/dev/null"))) + (require-all (require-not (subpath "/private/var/db/datadetectors/sys")) +(require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library"))) + (require-all (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo"))) + (require-not (literal "/dev/dtracehelper")) + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-not (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist")) + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")))))) +(deny file-read-data + (require-all + (extension "com.apple.sandbox.executable") + (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/"))) +(deny file-unmount) +(deny file-write* + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-not (extension "com.apple.app-sandbox.read-write")) + (require-any + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(deny file-write-create + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private"))) +(deny file-write-data + (require-all + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")))) +(deny file-write-setugid) +(deny job-creation) +(deny sysctl-read + (require-all + (require-not (extension "com.apple.security.exception.sysctl.read-write")) + (require-not (extension "com.apple.security.exception.sysctl.read-only")) + (sysctl-name "sysctl.proc_native"))) +(deny system-info + (info-type "net.link.addr")) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb.xml new file mode 100644 index 0000000..2669993 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb.xml @@ -0,0 +1,25 @@ + + + + + + + + + +]> + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb new file mode 100644 index 0000000..1e3b401 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb @@ -0,0 +1,640 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath-prefix "${HOME}/Library/DuetExpertCenter") +(subpath-prefix "${HOME}/Library/Logs/CallHistory") +(literal-prefix "${HOME}/Library/Logs/coreduetd.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.duetexpertd")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath "/usr/lib") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/libexec") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/proactive_" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]proactive_" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?proactive_" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?proactive_" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?proactive_") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter")) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/CoreDuet") + (require-any (subpath-prefix "${HOME}/Library/DuetExpertCenter") +(subpath-prefix "${HOME}/Library/Logs/CallHistory") +(literal-prefix "${HOME}/Library/Logs/coreduetd.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.duetexpertd")) + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/proactive_" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]proactive_" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?proactive_" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?proactive_" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?proactive_") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name "/sas_prediction_cache")) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.contactsd") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.awdd") + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.coreduetd.knowledgebase") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.atc.xpc.sessions") +(global-name "com.apple.duet.expertcenter")) + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.calaccessd") + (global-name "com.apple.routined.registration") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") +(preference-domain "com.apple.duetexpertd")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.spotlightui") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") +(preference-domain "com.apple.duetexpertd")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaremote") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb new file mode 100644 index 0000000..082061f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb @@ -0,0 +1,332 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.network.EAPOLController") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb.xml new file mode 100644 index 0000000..9c28723 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb.xml @@ -0,0 +1,28 @@ + + + + + + + + + +]> + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb new file mode 100644 index 0000000..dd2ad1d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb @@ -0,0 +1,634 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.fileprovider.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.fileproviderd") +(subpath-prefix "${HOME}/Library/FileProvider")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/MobileIdentityData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+[.]appex/" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+[.]appex$" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+[.]appex/" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+[.]appex$") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$") + (subpath-prefix "${HOME}")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.fileproviderd") +(subpath-prefix "${HOME}/Library/FileProvider")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties + (require-all + (iokit-property "soc-generation") + (iokit-user-client-class "IOPlatformDevice"))) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs."))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.apsd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (extension "com.apple.sandbox.application-group") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/"))) +(allow network-outbound + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/"))) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.fileproviderd") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.fileproviderd")) +(allow process-info-codesignature) +(allow process-info-pidinfo) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb.xml new file mode 100644 index 0000000..4d996cb --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb new file mode 100644 index 0000000..93a76fd --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb @@ -0,0 +1,865 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Preferences/com.apple.icloud.findmydeviced") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.findmydeviced")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/MDM.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/MDM.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/MDM.plist")) + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/usr/libexec/findmydeviced") + (literal "/private/var/empty") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences/com.apple.icloud.findmydeviced") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.findmydeviced")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/euser[0-9]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/[-0-9A-F]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/Users/[^/]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "ProvInfoIOKitUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "findmydeviced.boot_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.accessories.transport-server") +(global-name "com.apple.iap2d.xpc") +(global-name "com.apple.iapd.xpc")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.pegasus") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.mobile.obliteration") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.marco") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (34 aadc a080 5506) + (global-name "com.apple.securityd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobileactivationd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 9a2b) + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.demo-settings") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AOSNotification.notbackedup") +(preference-domain "com.apple.managedconfiguration.notbackedup")) + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.Security") + (preference-domain "com.apple.assistant.support") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.springboard") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.DataMigration")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb new file mode 100644 index 0000000..5711398 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb @@ -0,0 +1,761 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/usr/libexec/fmfd") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/private/var/empty") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.fmfd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.fmfd")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.fmfd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.fmfd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.apsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.aps.alertprovider.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (34 a381 a080 9a2b) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.icloud.fmfd.notbackedup") +(preference-domain "com.apple.mobileme.fmf1")) + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.da") + (preference-domain "com.apple.icloud.fmfd") + (preference-domain "com.apple.apsalerts") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.persistentconnection") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.icloud.fmfd") + (require-any (preference-domain "com.apple.icloud.fmfd.notbackedup") +(preference-domain "com.apple.mobileme.fmf1"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb new file mode 100644 index 0000000..55747db --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb @@ -0,0 +1,389 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pfd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.MobileInternetSharing") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (local ip "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb.xml new file mode 100644 index 0000000..23f0acc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb new file mode 100644 index 0000000..4bae1a7 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb @@ -0,0 +1,783 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/GameKit") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/usr/libexec") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Bundle") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.gamed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.gamed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") +(subpath-prefix "${HOME}/Library/Logs/GameKit") +(subpath-prefix "${HOME}/Library/Caches/GameKit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") +(subpath-prefix "${HOME}/Library/GameKit")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/usr/libexec/gamed") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (literal "/usr/local/bin/gamecenterctl") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.gamed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.gamed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") +(subpath-prefix "${HOME}/Library/Logs/GameKit") +(subpath-prefix "${HOME}/Library/Caches/GameKit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") +(subpath-prefix "${HOME}/Library/GameKit")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.gamecenter") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.gamecenter.gsEvents") +(global-name "com.apple.authkit.xpc")) + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.fairplayd") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound + (remote ip "*:*") + (literal "/private/var/run/lockdown.sock") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.WebFoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MultitouchSupport") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.accountsd") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.conference") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.gamecenter")) +(allow process-exec* + (literal "/usr/libexec/gamed")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb new file mode 100644 index 0000000..fe804ed --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb @@ -0,0 +1,500 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb.xml new file mode 100644 index 0000000..9c28723 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb.xml @@ -0,0 +1,28 @@ + + + + + + + + + +]> + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb new file mode 100644 index 0000000..a5b7607 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb @@ -0,0 +1,675 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") +(subpath-prefix "${HOME}/Library/Caches/PlaceData") +(subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Maps") +(subpath-prefix "${HOME}/Library/GeoServices")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") +(subpath-prefix "${HOME}/Library/Caches/PlaceData") +(subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Maps") +(subpath-prefix "${HOME}/Library/GeoServices")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (literal "/private/var/run/lockdown.sock") + (remote ip "*:*")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ConfigServer") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.GMM")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb new file mode 100644 index 0000000..c539a59 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb @@ -0,0 +1,636 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle/Application") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.healthd.server") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.misagent") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.cache_delete") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (require-any (global-name "com.apple.appconduitd.application-manager") +(global-name "com.apple.carousel.backlightxpc") +(global-name "com.apple.carousel.glanceservice") +(global-name "com.apple.carousel.tilenavigation")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.mobile.installd") + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.sockpuppet.activeComplications") + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.ids") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.sockpuppet.activeComplications")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb new file mode 100644 index 0000000..9f224e2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb @@ -0,0 +1,594 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/private/var/preferences/Logging") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/GPUTools") +(subpath "/private/var/root/Library/Caches/com.apple.opengl")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2"))) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aae0 a080 9ee7) + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.securityd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.appwatchdog") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.coresymbolicationd") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-priv-task-port) +(allow network-outbound + (local tcp "localhost:*") + (literal "/private/var/run/gputoolsdhelper.sock")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-exec* + (literal "/Developer/usr/libexec/gputoolsd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "kern.bootsessionuuid") + (sysctl-name "sysctl.proc_native") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb.xml new file mode 100644 index 0000000..4ebb58f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb.xml @@ -0,0 +1,51 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb new file mode 100644 index 0000000..4f7e52a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb @@ -0,0 +1,401 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (literal-prefix "${PROCESS_TEMP_DIR}/HealthWrap-") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (literal-prefix "${PROCESS_TEMP_DIR}/HealthWrap-") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.cloudd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.healthd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.private.healthd.server-internal") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb new file mode 100644 index 0000000..2ea544a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb @@ -0,0 +1,739 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") +(literal-prefix "${HOME}/Library/Logs/MobileBackup/MobileBackup-healthd.log") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches") +(subpath-prefix "${HOME}/Library/Health") +(literal-prefix "${HOME}/Library/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.healthd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.healthd")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.healthd") +(subpath "/Applications/Fitness.app") +(subpath "/Applications/Health.app")) + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (require-any (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.healthd") +(literal-prefix "${HOME}/Library/Logs/MobileBackup")) + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") +(literal-prefix "${HOME}/Library/Logs/MobileBackup/MobileBackup-healthd.log") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches") +(subpath-prefix "${HOME}/Library/Health") +(literal-prefix "${HOME}/Library/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.healthd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.healthd")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.healthd") +(literal-prefix "${HOME}/Library/Logs/MobileBackup")) + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.apsd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.backupd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.nfcd.hwmanager") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.cdp.daemon") + (global-name "com.apple.cloudd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.carousel.sessionservice") +(global-name "com.apple.health.records") +(global-name "com.apple.healthlited.hummingbird") +(global-name "com.apple.locationd.smoother")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 8e67) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (global-name "com.apple.awdd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.companionsync") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilephone") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.ET") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.MobileAsset") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.dt.Xcode") +(preference-domain "com.apple.healthlite")) + (preference-domain "com.apple.mmcs") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.nanoprefsyncd") + (require-any (preference-domain "com.apple.Fitness") +(preference-domain "com.apple.nanolifestyle") +(preference-domain "com.apple.nanolifestyle.privacy") +(preference-domain "com.apple.SOS")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.pairedsyncd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.ET") + (require-any (preference-domain "com.apple.Fitness") +(preference-domain "com.apple.nanolifestyle") +(preference-domain "com.apple.nanolifestyle.privacy") +(preference-domain "com.apple.SOS"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb new file mode 100644 index 0000000..9a8707e --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb @@ -0,0 +1,641 @@ +(version 1) +(deny default) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/usr/libexec") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (subpath "/usr/libexec/DataModel.momd") +(subpath "/private/var/mobile/Library/Logs")) + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (require-any (subpath "/private/var/root/Documents") +(literal "/private/var/mobile/Library/Preferences/com.apple.internal.honeybeed.plist") +(literal "/private/var/mobile/Library/Preferences/com.apple.Honeybee.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/honeybeed.internal") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (require-any + (require-any (literal "/usr/local/bin/gzip") +(literal "/usr/bin/bsdtar") +(literal "/usr/bin/bzip2") +(literal "/usr/bin/tar") +(literal "/usr/bin/split")) + (subpath "/usr/local/lib") + (subpath "/AppleInternal") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath "/private/var/root/Documents") +(literal "/private/var/mobile/Library/Preferences/com.apple.internal.honeybeed.plist") +(literal "/private/var/mobile/Library/Preferences/com.apple.Honeybee.plist")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/honeybeed.internal")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/honeybeed.internal")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.internal.honeybeed") +(preference-domain "com.apple.Honeybee")) + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.internal.honeybeed") +(preference-domain "com.apple.Honeybee"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb.xml new file mode 100644 index 0000000..2cf04bc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb new file mode 100644 index 0000000..0d524bd --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb @@ -0,0 +1,285 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.foundation.upload-prep.read-write") + (require-any + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.foundation.upload-prep.read-write") + (require-any + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb new file mode 100644 index 0000000..5aa35c1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb @@ -0,0 +1,412 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin") + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.TelephonyUtilities") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.carplay") + (preference-domain "com.apple.PeoplePicker") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd")) + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Accessibility") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iapd") + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb.xml new file mode 100644 index 0000000..9cd646a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb new file mode 100644 index 0000000..cd08690 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb @@ -0,0 +1,727 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/Caches/com.apple.setmme") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") +(literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") +(subpath-prefix "${HOME}/Library/IdentityServices") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}")) + (extension "com.apple.identityservices.send") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/AppleInternal") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (require-any + (require-any (literal "/usr/bin/lskq") +(literal "/usr/local/bin/figplaySS") +(literal "/usr/local/bin/netdiagnose") +(literal "/usr/sbin/lsof") +(literal "/bin/sh")) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (subpath "/usr/local/lib"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") +(literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") +(subpath-prefix "${HOME}/Library/IdentityServices") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.identityservices.send") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.awdd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.wirelessproxd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.fairplayd") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.server.bluetooth") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.asd.scoring") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (34 a381 a080 8e67) + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.tccd") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.datamigrator") + (global-name-regex #"-idswake$" #".+-idswake$") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.idscredentialsagent.embedded.auth") +(global-name "com.apple.imtransferservices.IMTransferAgent")) + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow network-inbound + (local ip "*:*")) +(allow network-outbound + (remote ip "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.migration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.da") + (require-any (preference-domain "com.apple.Messages") +(preference-domain "com.apple.registration")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.identityservicesd") +(preference-domain "com.apple.identityservices.idstatuscache") +(preference-domain "com.apple.ids.deviceproperties") +(preference-domain "com.apple.ids.subservices")) + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.identityservicesd") +(preference-domain "com.apple.identityservices.idstatuscache") +(preference-domain "com.apple.ids.deviceproperties") +(preference-domain "com.apple.ids.subservices")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.conference")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb new file mode 100644 index 0000000..516f1b5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb @@ -0,0 +1,426 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/usr/libexec/installd") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath "/private/var/installd") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/MobileIdentityData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (literal "/com.apple.xpc.launchd.bootstrap.plist"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/installd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (subpath "/private/var/containers/Bundle") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "installd.firstboot_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.online-auth-agent.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.misagent") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb new file mode 100644 index 0000000..a91fb54 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb @@ -0,0 +1,292 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/private/var/iomfb_bics_daemon") +(subpath "/private/var/hardware") +(literal "/dev/disk1") +(literal "/dev/disk3")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/iomfb_bics_daemon") +(subpath "/private/var/hardware") +(literal "/dev/disk1") +(literal "/dev/disk3")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleEmbeddedTouchEEPROMDriverUC") + (iokit-user-client-class "AppleSEPUserClient")) +(allow iokit-set-properties + (iokit-user-client-class "AppleNVMeController") + (iokit-user-client-class "AppleSEPUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "iomfb_bics_daemon.started")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb new file mode 100644 index 0000000..76db1cc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb @@ -0,0 +1,748 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media/Downloads")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${HOME}/Media") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Bundle") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/com.apple.itunesstored") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.itunesstored") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/Snapshots") +(subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/MusicLibrary") +(literal-prefix "${HOME}/Library/")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Media") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.itunesstored") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/Snapshots") +(subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/MusicLibrary") +(literal-prefix "${HOME}/Library/")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/com.apple.itunesstored") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ondemandd.itunesstored") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.networkd") + (global-name "com.apple.mediaartworkd.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.GSSCred") + (global-name "com.apple.cache_delete") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.lsd.xpc") + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.securityd") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.biometrickitd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobile.installd") + (34 a381 a080 495d) + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.homesharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.itunesstored")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb new file mode 100644 index 0000000..472ebec --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb @@ -0,0 +1,1258 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-entitlement "com.apple.private.librarian.container-proxy") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+[.]appex/" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+[.]appex$" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+[.]appex/" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+[.]appex$") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath "/private/var/MobileAsset/Assets/com_apple_MobileAsset_LinguisticData") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Keyboard") +(subpath-prefix "${HOME}/Library/KeyboardServices") +(subpath-prefix "${HOME}/Library/LanguageModeling") +(subpath-prefix "${HOME}/Library/Mobile Documents/com~apple~TextInput")) + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${HOME}/Library/ResponseKit") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.kbd") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.kbd")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.kbd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (vnode-type SYMLINK) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.kbd") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-any + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type DIRECTORY) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-any + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type DIRECTORY) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type SYMLINK) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))))) + (require-all + (vnode-type SYMLINK) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/ResponseKit") + (require-any (subpath-prefix "${HOME}/Library/Keyboard") +(subpath-prefix "${HOME}/Library/KeyboardServices") +(subpath-prefix "${HOME}/Library/LanguageModeling") +(subpath-prefix "${HOME}/Library/Mobile Documents/com~apple~TextInput")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (literal-prefix "${HOME}/Library/CoreDuet/Knowledge/knowledgeC.db-shm") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.revisiond.staging") + (require-any + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.kbd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.kbd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.kbd") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AGXCommandQueue") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AGXSharedUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.revisiond") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.suggestd.contacts") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.librariand") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.networkd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.contactsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.contacts.donation.agent") + (global-name "com.apple.bird.token") + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (global-name "com.apple.SharedWebCredentials") + (global-name "com.apple.calaccessd") + (global-name "com.apple.healthd.server") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.InputModePreferences") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.kbd") +(preference-domain "com.apple.textInput.keyboardServices.textReplacement")) + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.spotlightui") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.kbd") +(preference-domain "com.apple.textInput.keyboardServices.textReplacement")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb.xml new file mode 100644 index 0000000..d06b1e5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb new file mode 100644 index 0000000..d73225c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb @@ -0,0 +1,706 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable")))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOSurfaceSendRight")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (require-not (ipc-posix-name "apple.shm.notification_center")) + (ipc-posix-name "apple.cfprefs."))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (34 aae0 a080 464d) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.frontboard.systemappservices") + (34 ab2e a080 4644) + (global-name "com.apple.ibooks.BLService") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.UIKit.statusbarserver") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-not (34 a381 4655 a081)) + (require-any + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (global-name "com.apple.system.notification_center")) + (require-any + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e8d) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.logd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))))))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$"))) +(allow network-outbound + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb.xml new file mode 100644 index 0000000..aaa0d47 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb.xml @@ -0,0 +1,31 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb new file mode 100644 index 0000000..47ea0af --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb @@ -0,0 +1,441 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.iad") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.iad")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.iad.limitadtrackingd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.iad.limitadtrackingd") +(literal-prefix "${FRONT_USER_HOME}") +(literal "/usr/libexec/limitadtrackingd")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.iad") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.iad")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.cloudd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.AdSheetPhone.management") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.persistentconnection") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb new file mode 100644 index 0000000..6005fbc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb @@ -0,0 +1,514 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/run/lockdown") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (require-any (subpath "/private/var/root/Library/Lockdown") +(literal "/private/var/root/Library/Preferences/com.apple.mobile.lockdownd.plist") +(subpath "/private/var/preferences/SystemConfiguration")) + (literal "/private/var/run/lockdown.sock") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/private/var/logs") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (subpath "/Applications/Preferences.app") +(subpath "/AppleInternal/Lockdown") +(literal "/usr/libexec/lockdownd") +(literal "/private/var/db/launchd.db/com.apple.launchd/overrides.plist")) + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${FRONT_USER_HOME}/Media") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/Applications") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.WebAppCache") +(subpath-prefix "${FRONT_USER_HOME}/Library/Calendar") +(subpath-prefix "${FRONT_USER_HOME}/Library/Notes") +(subpath-prefix "${FRONT_USER_HOME}/Library/Voicemail")) + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Media") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Containers") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (vnode-type DIRECTORY)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/containers") + (vnode-type DIRECTORY)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (process-attribute 4) + (require-any + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Media") + (require-any (subpath "/private/var/root/Library/Lockdown") +(literal "/private/var/root/Library/Preferences/com.apple.mobile.lockdownd.plist") +(subpath "/private/var/preferences/SystemConfiguration")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/run/lockdown.sock") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/run/lockdown") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/logs") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (literal "/private/var/db/timezone") + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "AppleEffaceableStorageUserClient") +(iokit-user-client-class "AppleNANDFTLUserClient")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (iokit-property "auto-boot")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.syslog_relay") +(global-name "com.apple.streaming_zip_conduit") +(global-name "com.apple.mobile.notification_proxy") +(global-name "com.apple.mobile.insecure_notification_proxy") +(global-name "com.apple.mobile.installation_proxy") +(global-name "com.apple.mobile.assertion_agent") +(global-name "com.apple.AOSNotification") +(global-name "com.apple.crash_mover") +(global-name "com.apple.crashreportcopymobile") +(global-name "com.apple.atc2") +(global-name "com.apple.afcd") +(global-name "lockdown.")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.ait.client") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.atc") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.webinspector") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.mobile.installd") + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-inbound + (local tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (subpath "/private/var/run/lockdown")) +(allow network-outbound + (literal "/private/var/run/lockbot")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.purplebuddy") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb new file mode 100644 index 0000000..721a231 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb @@ -0,0 +1,562 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/oslog")) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.logd.read-only") + (require-any + (subpath "/private/var/db/diagnostics") + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (subpath "/private/var/db/uuidtext"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/uuidtext") + (subpath "/private/var/db/timezone") + (subpath "/private/var/db/diagnostics") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/private/var/logs") + (literal "/dev/oslog") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/usr/libexec") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath "/private/var/log") +(subpath "/private/var/root/Library/Logs")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (file-mode #o0100) + (file-mode #o0010) + (file-mode #o0001))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/userdata") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/uuidtext") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/diagnostics") + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath "/private/var/logs/system_logs.logarchive") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/userdata") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/oslog") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-any (subpath "/private/var/log") +(subpath "/private/var/root/Library/Logs")) + (subpath "/private/var/logs") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs")) +(allow file-write-xattr + (xattr "com.apple.logd.metadata") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-priv-host-port) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-kext-query) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb.xml new file mode 100644 index 0000000..034577f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb new file mode 100644 index 0000000..0cb7769 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb @@ -0,0 +1,467 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath-prefix "${HOME}/Library/Logs/useractivityd") +(subpath-prefix "${HOME}/Library/Logs/Handoff") +(subpath-prefix "${HOME}/Library/Logs/Transport")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Logs/useractivityd") +(subpath-prefix "${HOME}/Library/Logs/Handoff") +(subpath-prefix "${HOME}/Library/Logs/Transport")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.marco") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coreservices.uauseractivitypasteboardclient.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.SharedWebCredentials") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mobileipod") + (require-any (preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites") +(preference-domain "com.apple.coreservices.useractivityd")) + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.mediaremote") + (require-any (preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites") +(preference-domain "com.apple.coreservices.useractivityd"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb.xml new file mode 100644 index 0000000..8a6c1dd --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb new file mode 100644 index 0000000..6a61401 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb @@ -0,0 +1,151 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/aes_0") + (literal "/dev/bpf")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (require-any (regex #"/private/var/folders/[^/]+/[^/]+/C/mds/?") +(regex #"/private/var/folders/[^/]+/[^/]+/-Caches-/mds/?")) + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/run/mDNSResponder") + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/db/dyld")))) +(allow file-read-data + (require-any (literal "/private/var/db/crls/crlcache.db") +(subpath "/private/var/db/mds") +(subpath "/private/var/tmp/mds") +(literal "/Library/Keychains/System.keychain")) + (require-all + (require-not (literal "/Library/Keychains/")) + (require-any + (literal "/dev/console") + (require-any (literal "/usr/sbin/mDNSResponder") +(literal "/Library/Preferences/com.apple.mDNSResponder.plist") +(literal "/Library/Preferences/com.apple.crypto.plist") +(literal "/Library/Preferences/com.apple.security.") +(literal "/Library/Preferences/SystemConfiguration/preferences.plist") +(literal "/Library/Preferences/SystemConfiguration/com.apple.nat.plist") +(literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") +(subpath "/Library/Preferences/Logging") +(literal "/Library/Preferences/ByHost/.GlobalPreferences.") +(literal "/Library/Preferences/.GlobalPreferences.") +(literal "/Library/Security/Trust Settings/Admin.plist") +(literal "/private/etc") +(subpath "/private/var/preferences/Logging/Subsystems") +(subpath "/AppleInternal/Library/Preferences/Logging") +(subpath "/System/Library/Preferences/Logging")) + (literal "/private/etc/hosts") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal "/usr/sbin") + (subpath "/private/var/db/timezone")))) +(allow file-read-metadata) +(allow file-test-existence) +(allow file-write* + (require-any (regex #"/private/var/folders/[^/]+/[^/]+/C/mds/?") +(regex #"/private/var/folders/[^/]+/[^/]+/-Caches-/mds/?")) + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (literal "/private/var/run/mDNSResponder") + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (require-all + (file-mode #o0000) + (literal "/cores/"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/console") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))) +(allow iokit-open + (require-any (iokit-user-client-class "NVEthernetUserClientMDNS") +(iokit-user-client-class "mDNSOffloadUserClient") +(iokit-user-client-class "wlDNSOffloadUserClient")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.snhelper") + (global-name "com.apple.awdd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mDNSResponderHelper") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (34 a381 a080 43e3) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.bsd.dirhelper") +(global-name "com.apple.bluetoothd") +(global-name "com.apple.blued") +(global-name "com.apple.distributed_notifications.2") +(global-name "com.apple.mDNSResponder_Helper") +(global-name "com.apple.webcontentfilter.dns") +(global-name "com.apple.awacs")) + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger") + (global-name "com.apple.server.bluetooth") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.ocspd") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.SecurityServer") +(global-name "com.apple.coreservices.quarantine-resolver"))) +(allow mach-register + (global-name "com.apple.d2d.ipc")) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow socket-ioctl) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb.xml new file mode 100644 index 0000000..cc8e01a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb.xml @@ -0,0 +1,56 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb new file mode 100644 index 0000000..7e89f68 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb @@ -0,0 +1,745 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-read* + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Library/Audio/Tunings/Generic/AU") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath "/usr/local/lib") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.tcc.kTCCServicePhotos") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AGXDevice")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aae0 a080 42c5) + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.audio.AudioComponentRegistrar") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.xpc.activity.unmanaged") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 42bf) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.distributed_notifications@1v3") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (global-name "com.apple.pegasus") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileslideshow") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mediaanalysis") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaanalysisd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.corevideo"))) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.mobileslideshow") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaanalysisd") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb new file mode 100644 index 0000000..7e46064 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb @@ -0,0 +1,1083 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.rtcreporting.upload") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/usr/local/lib/libAudioDiagnostics.dylib") + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (subpath "/Library/Audio/Plug-Ins") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/wireless/Library/Logs/awd") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (extension "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.sandbox.executable") + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (require-any (subpath "/Library") +(subpath "/usr/local/share/firmware/isp") +(literal "/private/var/Managed Preferences/mobile/com.apple.springboard.plist") +(literal "/AppleInternal/Library/Conference/Environments.plist")) + (extension "com.apple.mediaserverd.read") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-mediaserverd.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") +(literal-prefix "${HOME}/Library/Logs/AirPlay.log") +(literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") +(subpath-prefix "${HOME}/Library/FaceKitVault") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/Downloads") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/iTunes_Control/Music") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/PhotoData/OutboundSharingTmp") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/tmp/mediaserverd") +(subpath "/private/var/logs/mediaserverd") +(literal-prefix "${PROCESS_TEMP_DIR}/AirTunesHALPlugin.log")) + (subpath-prefix "${HOME}/Media/DCIM") + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/Podcasts") + (subpath "/usr/share") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Recordings") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (literal "/usr/sbin/mediaserverd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/local/lib") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mediaserverd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mediaserverd")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-data + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${HOME}/Library/Caches/CoreMotion") +(literal-prefix "${HOME}/Library/Logs")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.mediaserverd.read") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/Podcasts") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/wireless/Library/Logs/awd") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-mediaserverd.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") +(literal-prefix "${HOME}/Library/Logs/AirPlay.log") +(literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") +(subpath-prefix "${HOME}/Library/FaceKitVault") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/Downloads") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/iTunes_Control/Music") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/PhotoData/OutboundSharingTmp") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/tmp/mediaserverd") +(subpath "/private/var/logs/mediaserverd") +(literal-prefix "${PROCESS_TEMP_DIR}/AirTunesHALPlugin.log")) + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mediaserverd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mediaserverd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${HOME}/Library/Caches/CoreMotion") +(literal-prefix "${HOME}/Library/Logs")) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (require-any (iokit-user-client-class "AppleUSBHostInterfaceUserClient") +(iokit-user-client-class "IOAccessoryManagerUserClient")) + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (require-any (iokit-user-client-class "com_apple_audio_IOBorealisOwlUserClient") +(iokit-user-client-class "AppleAOPAudioUserClient") +(iokit-user-client-class "AppleAOPVoiceTriggerUserClient") +(iokit-user-client-class "AppleAVDUserClient") +(iokit-user-client-class "AppleAVEUserClient") +(iokit-user-client-class "AppleAVE2UserClient") +(iokit-user-client-class "AppleD5500UserClient") +(iokit-user-client-class "AppleExternalAmpControllerUserClient") +(iokit-user-client-class "AppleH4CamInUserClient") +(iokit-user-client-class "AppleH6CamInUserClient") +(iokit-user-client-class "AppleH9CamInUserClient") +(iokit-user-client-class "AppleH10CamInUserClient") +(iokit-user-client-class "AppleVXD393UserClient") +(iokit-user-client-class "AppleVXD390UserClient") +(iokit-user-client-class "AppleVXD375UserClient") +(iokit-user-client-class "AppleVXE380UserClient") +(iokit-user-client-class "AppleSRSDriverUserClient") +(iokit-user-client-class "AppleSPUHIDDriverUserClient") +(iokit-user-client-class "AUCUserClient") +(iokit-user-client-class "IOUSBDeviceInterfaceUserClient") +(iokit-user-client-class "IOTimeSyncDomainUserClient") +(iokit-user-client-class "IOTimeSyncgPTPManagerUserClient") +(iokit-user-client-class "IOTimeSyncNetworkPortUserClient") +(iokit-user-client-class "IOTimeSyncClockManagerUserClient") +(iokit-user-client-class "IOTimeSyncUserClient") +(iokit-user-client-class "IOStreamAudioUserClient") +(iokit-user-client-class "IOReportUserClient") +(iokit-user-client-class "IOAudioCodecsUserClient") +(iokit-user-client-class "IOAudio2TransformerUserClient") +(iokit-user-client-class "IOAudio2DeviceUserClient") +(iokit-user-client-class "H3H264VideoEncoderDriverUserClient")) + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "shm_pcm_audio_sco_write") +(ipc-posix-name "shm_pcm_audio_sco_read")) + (require-any (ipc-posix-name "shm_pcm_audio_acl") +(ipc-posix-name "com.apple.audio.abl.")) + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name-regex #"^[0-9A-F][0-9A-F]:+[0-9A-F][0-9A-F]-tacl$") + (ipc-posix-name-regex #"^AppleAURemoteIO[.]." #"^AppleAURemoteIO[.].+") + (ipc-posix-name-regex #"^shm_notif[.][^.]+[.][RW]$") + (ipc-posix-name-regex #"^AppleAudioQueue[.]." #"^AppleAudioQueue[.].+")) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.NetworkLinkConditioner") +(global-name "com.apple.accessories.audio") +(global-name "com.apple.airplay.receiver.controller") +(global-name "com.apple.applecamerad") +(global-name "com.apple.audio.AUPBRegistrar") +(global-name "com.apple.b184_mcu_commd") +(global-name "com.apple.b184_monitord") +(global-name "com.apple.carkit.monitoring.service") +(global-name "com.apple.coremedia.virtualdisplayserver") +(global-name "com.apple.filesystems.userfsd") +(global-name "com.apple.internal.mediaserverdtracerd") +(global-name "com.apple.lskdmsed") +(global-name "com.apple.mediaanalysisd.realtime") +(global-name "com.apple.securekeyvaultd")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.mediaremoted.xpc") + (require-any (global-name "com.apple.accessories.transport-server") +(global-name "com.apple.iap2d.xpc") +(global-name "com.apple.iapd.xpc")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (34 aae0 a080 4113) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.logd.events") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (global-name "com.apple.lskdd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.rtcreportingd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptom_diagnostics") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.homed.xpc") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.timed.xpc") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.PowerManagement.control") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (34 a381 a080 4111) + (global-name "com.apple.SharingServices") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.tccd") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.carkit.service") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.accessibility.AXSpringBoardServer") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.iap2d.distributednotification.server") +(global-name "com.apple.iapd.distributednotification.server") +(global-name "com.apple.iaptransportd.xpc")) + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow mach-register + (global-name "com.apple.midiserver.io") + (global-name "com.apple.coremedia.") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local tcp "*:*")) +(allow network-outbound + (remote tcp "*:*") + (remote udp "*:*") + (literal "/private/var/run/lockdown.sock") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder") + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.voicetrigger.notbackedup") +(preference-domain "com.apple.audio.puffin") +(preference-domain "com.apple.audio.virtualaudio") +(preference-domain "com.apple.coremedia.bag") +(preference-domain "com.apple.facetime")) + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaserverd") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.da") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.quic") +(preference-domain "com.apple.settings.bluetooth.audio-route")) + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.carplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.rtcreporting") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.mediaserverd") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.celestial") + (require-any (preference-domain "com.apple.voicetrigger.notbackedup") +(preference-domain "com.apple.audio.puffin") +(preference-domain "com.apple.audio.virtualaudio") +(preference-domain "com.apple.coremedia.bag") +(preference-domain "com.apple.facetime")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-exec* + (literal "/usr/sbin/mediaserverd") + (require-all + (require-any (literal "/usr/bin/trace") +(literal "/usr/bin/syslog")) + (debug-mode))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl* + (sysctl-name "kern.min_audio_buffer_usec")) +(allow sysctl-read + (sysctl-name "kern.min_audio_buffer_usec") + (sysctl-name "net.routetable.") + (sysctl-name "kern.bootsessionuuid") + (sysctl-name "sysctl.proc_native") + (sysctl-name "vm.vm_page_free_target") + (extension "com.apple.security.exception.sysctl.read-only") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb.xml new file mode 100644 index 0000000..54e204c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb new file mode 100644 index 0000000..cfe3dec --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb @@ -0,0 +1,317 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.appstored.xpc.updates") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.system.notification_center") + (require-any + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e8d) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.logd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb.xml new file mode 100644 index 0000000..302e6ac --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb.xml @@ -0,0 +1,32 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb new file mode 100644 index 0000000..3ca4fc1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb @@ -0,0 +1,611 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable")))) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (literal "/usr/libexec") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/usr/libexec/mobile_house_arrest") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/GeoJSON$"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.securityd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (literal "/private/var/run/lockdown/checkin")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb new file mode 100644 index 0000000..51d918b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb @@ -0,0 +1,429 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/disk")) +(allow file-link) +(allow file-mount + (subpath "/Developer") + (require-any (subpath "/private/var/factory_mount") +(subpath "/private/var/personalized_automation") +(subpath "/private/var/personalized_factory") +(subpath "/private/var/personalized_demo") +(subpath "/private/var/personalized_debug"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/run/mobile_image_mounter") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/private/var/factory_mount") +(subpath "/private/var/personalized_automation") +(subpath "/private/var/personalized_factory") +(subpath "/private/var/personalized_demo") +(subpath "/private/var/personalized_debug")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (subpath "/dev") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/factory_mount") +(subpath "/private/var/personalized_automation") +(subpath "/private/var/personalized_factory") +(subpath "/private/var/personalized_demo") +(subpath "/private/var/personalized_debug")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/run/mobile_image_mounter") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/Developer") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "AppleMobileApNonceUserClient") +(iokit-user-client-class "IOHDIXControllerUserClient")) + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow job-creation) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.trustd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-fsctl + (fsctl-command (_IO "A" 1))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb.xml new file mode 100644 index 0000000..2aae38a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb new file mode 100644 index 0000000..2efb3a8 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb @@ -0,0 +1,399 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath "/private/var/run/mobile_image_mounter") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/run/mobile_image_mounter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.mobile.storage_mounter.xpc") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb new file mode 100644 index 0000000..1303722 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb @@ -0,0 +1,660 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/mad") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (subpath-prefix "${HOME}/Library/Logs/mobileactivationd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/mad") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "ProvInfoIOKitUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nehelper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.icloud.findmydeviced") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.managedconfiguration.profiled") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (remote tcp "*:443") + (remote tcp "*:80") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (debug-mode) + (literal "/private/var/run/mDNSResponder")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileactivationd") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.mobileactivationd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb new file mode 100644 index 0000000..c4520e9 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb @@ -0,0 +1,710 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (literal "/private/var/MobileAsset/AssetsV2/SplunkRecords/")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath "/private/var/MobileAsset"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (extension-class "com.apple.assets.read") + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath "/private/var/MobileAsset"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/MobileAsset") + (require-any (literal "/private/var/root/Library/Cookies") +(literal "/private/var/root/Library/Cookies/Cookies.binarycookies") +(literal "/private/var/root/Library/Preferences/com.apple.MobileAsset.plist")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/usr/libexec") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/private/var/root/Library/Preferences/com.apple.WebFoundation.plist") +(literal "/private/var/Managed Preferences/mobile/com.apple.MobileAsset.plist") +(literal "/usr/libexec/mobileassetd") +(subpath "/AppleInternal/Library/PreinstalledAssets")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath-prefix "${HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (process-attribute 4) + (require-any + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/MobileAsset") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal "/private/var/root/Library/Cookies") +(literal "/private/var/root/Library/Cookies/Cookies.binarycookies") +(literal "/private/var/root/Library/Preferences/com.apple.MobileAsset.plist")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cache_delete") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.installcoordinationd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.security.ut.updatetransparencyd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AssetCacheLocator") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.MobileAsset")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb.xml new file mode 100644 index 0000000..98518bf --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb new file mode 100644 index 0000000..278b5aa --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb @@ -0,0 +1,770 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/preferences/Logging") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-test-existence) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.Maps.SpringBoard") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.Maps.IPC") +(global-name "com.apple.Maps.gsEvents")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 8e67) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.marco") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.pairedsyncd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.MapsSupport")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb new file mode 100644 index 0000000..a590a09 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb @@ -0,0 +1,582 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.MapsSupport") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.MapsSupport")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.MapsSupport") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.MapsSupport")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.locationd.spi") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nanomaps.xpc.GeoServices.Navigation") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.MapsSupport") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb new file mode 100644 index 0000000..5d69789 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb @@ -0,0 +1,458 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (require-any + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/dev/ptmx") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ibooks.BLService") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (34 a381 4655 a081) + (require-any + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.system.notification_center") + (require-any + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e8d) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.logd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb.xml new file mode 100644 index 0000000..302e6ac --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb.xml @@ -0,0 +1,32 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb new file mode 100644 index 0000000..bd1df3b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb @@ -0,0 +1,480 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/tty.stockholm")) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath "/private/var/containers/Bundle") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal "/usr/libexec/nfcd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (subpath "/private/var/logs/WirelessLibraryLogs") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/logs/WirelessLibraryLogs") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleCredentialManagerUserClient") + (require-any (iokit-user-client-class "ApplePPMUserClient") +(iokit-user-client-class "AppleStockholmControlUserClient")) + (iokit-user-client-class "AppleSSEUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.appstored.xpc.updates") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound + (control-name "com.apple.uart.stockholm")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "nfcd") +(preference-domain "com.apple.nfcd.nfttr")) + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.stockholm") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Duet") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "nfcd") +(preference-domain "com.apple.nfcd.nfttr")) + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-socket + (socket-domain AF_SYSTEM)) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb new file mode 100644 index 0000000..475b595 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb @@ -0,0 +1,148 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.pfd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb.xml new file mode 100644 index 0000000..e14b98f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb new file mode 100644 index 0000000..433b13c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb @@ -0,0 +1,5 @@ +(version 1) +(allow default) +(deny file-write-setugid) +(deny network* + (local ip "*:*")) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb.xml new file mode 100644 index 0000000..12f6fae --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb.xml @@ -0,0 +1,21 @@ + + + + + + + + + +]> + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb new file mode 100644 index 0000000..9ca7013 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb @@ -0,0 +1,789 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets")))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-link) +(allow file-read* + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-all (require-not (subpath "/private/var/logs/MobileLibraryLogs")) +(require-not (subpath "/private/var/logs/MobileMediaFactoryLogs"))) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (subpath-prefix "${HOME}/Media/Downloads") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/usr/libexec") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond-launchd")) + (literal "/usr/libexec/nsurlsessiond") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (subpath-prefix "${HOME}/Library/Cookies") + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.coremedia")) + (require-any + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/ptmx") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-all (require-not (subpath "/private/var/logs/MobileLibraryLogs")) +(require-not (subpath "/private/var/logs/MobileMediaFactoryLogs"))) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (subpath-prefix "${HOME}/Media/Downloads") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond-launchd")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/"))))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.trustd") + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cache_delete.public") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coremedia.assetdownloader") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.coreduetd") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.installcoordinationd") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ocspd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-all + (require-not (global-name "com.apple.CARenderServer")) + (require-any + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.diagnosticd") + (34 a381 a080 60f3) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")))) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.nsurlsessiond") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.Duet") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.nsurlsessiond")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb new file mode 100644 index 0000000..fe8a2b4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb @@ -0,0 +1,534 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (literal-prefix "${HOME}") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (require-any (literal-prefix "${HOME}/Applications") +(literal-prefix "${HOME}/Containers")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.nsurlstorage.extension-cache") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/libexec") + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.nsurlstoraged") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.nsurlstoraged")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb new file mode 100644 index 0000000..d3c675e --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb @@ -0,0 +1,478 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/MobileDevice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/usr/libexec/online-auth-agent") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/MobileIdentityData") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/MobileDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/MobileIdentityData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAESAcceleratorUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.online-auth-agent.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.misagent") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (remote ip "*:*")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb new file mode 100644 index 0000000..2d3a038 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb @@ -0,0 +1,726 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/News.app") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-journal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-shm") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-wal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/share") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/DifferentialPrivacy/Reports") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.DataDetectorsSourceAccess") +(global-name "com.apple.dprivacyd") +(global-name "com.apple.networkserviceproxy") +(global-name "com.apple.siri.vocabularyupdates")) + (global-name "com.apple.VideoSubscriberAccount.videosubscriptionsd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 3698) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.managedconfiguration.profiled") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.private.bmk.allow" + (require-any + (global-name "com.apple.biometrickitd") + (global-name "com.apple.pearld"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.lookup.shared") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.parsecd") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.parsecd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb new file mode 100644 index 0000000..4c0ef08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb @@ -0,0 +1,1119 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-entitlement "com.apple.private.librarian.container-proxy") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/Developer") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.passd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.passd")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.passd") +(subpath-prefix "${HOME}/Library/Passes") +(subpath-prefix "${HOME}/Library/Caches/PassKit")) + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.passd") +(subpath-prefix "${HOME}/Library/Passes") +(subpath-prefix "${HOME}/Library/Caches/PassKit")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.passd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.passd")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.stockholm.plist")) + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXDevice") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (iokit-property "reportStatusMessages")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nfcd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.networkd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.GSSCred") + (global-name "com.apple.seld.tsmmanager") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.seld") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.biometrickitd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.CoreAuthentication.daemon") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.pluginkit.pkd")) + (require-any + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.NPKCompanionAgent.Server") +(global-name "com.apple.hsa-authentication-server") +(global-name "com.apple.passes.usage") +(global-name "com.apple.springboard.carditemscontroller") +(global-name "com.apple.AdSheetPhone.analytics")) + (global-name "com.apple.contactsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.librariand") + (global-name "com.apple.cloudd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.securityd") + (global-name "com.apple.icloud.findmydeviced") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.FSEvents") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.bird.token") + (global-name "com.apple.asd.scoring") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.FileProvider") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 350d) + (global-name "com.apple.SharingServices") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))))) +(allow network-outbound + (remote ip "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.biometrickitd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.LocalAuthentication") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.Security") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.purplebuddy") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (require-any (preference-domain "com.apple.Passbook") +(preference-domain "com.apple.PassKit") +(preference-domain "com.apple.PassKit.passes") +(preference-domain "com.apple.passd")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.Passbook") +(preference-domain "com.apple.PassKit") +(preference-domain "com.apple.PassKit.passes") +(preference-domain "com.apple.passd")) + (preference-domain "com.apple.stockholm") + (preference-domain "kCFPreferencesAnyApplication")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb.xml new file mode 100644 index 0000000..8635cc4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb new file mode 100644 index 0000000..af99317 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb @@ -0,0 +1,638 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Personas") + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/usr/local/bin") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (literal "/usr/local/bin/prtool") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Personas") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb new file mode 100644 index 0000000..4c0940d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb @@ -0,0 +1,199 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/pfm")) +(allow file-read* + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (require-any (literal "/usr/libexec/pfd") +(literal "/dev/pfm")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write-data + (literal "/dev/pfm")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name "apple.shm.notification_center")) +(allow mach-cross-domain-lookup) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb.xml new file mode 100644 index 0000000..b22cedd --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb.xml @@ -0,0 +1,28 @@ + + + + + + + + + +]> + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb new file mode 100644 index 0000000..6a56cfb --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb @@ -0,0 +1,816 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd") + (require-all + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AGXCommandQueue") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AGXGLContext") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AGXDevice") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AGXSharedUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aae0 a080 329a) + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.contactsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.securityd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.calaccessd") + (global-name "com.apple.routined.registration") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.photoanalysisd") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.photoanalysisd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb.xml new file mode 100644 index 0000000..d06b1e5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb new file mode 100644 index 0000000..9309e6b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb @@ -0,0 +1,114 @@ +(version 1) +(allow default) +(deny file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]"))) + (require-all + (extension "com.apple.sandbox.executable") + (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(deny file-mount) +(deny file-mount-update) +(deny file-read* + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]")) + (require-all + (require-all (require-not (subpath "/System/Library/Frameworks")) +(require-not (subpath "/System/Library/PrivateFrameworks"))) + (require-not (subpath "/private/var/preferences/Logging")) + (require-not (subpath "/System/Library")) + (require-not (subpath "/usr/lib")) + (require-not (subpath "/usr/share")) + (require-not (subpath "/private/var/db/timezone")) + (require-all (require-not (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) +(require-not (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) +(require-not (literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist"))) + (require-not (extension "com.apple.app-sandbox.read")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-only")) + (require-not (subpath "/Developer")) + (require-not (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist")) + (require-not (extension "com.apple.app-sandbox.read-write")) + (require-not (extension "com.apple.sandbox.executable")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")) + (require-entitlement "com.apple.security.system-groups") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")))) + (require-all + (require-all (require-not (literal "/dev/zero")) +(require-not (literal "/dev/null"))) + (require-all (require-not (subpath "/private/var/db/datadetectors/sys")) +(require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library"))) + (require-all (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo"))) + (require-not (literal "/dev/dtracehelper")) + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-not (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist")) + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(deny file-read-data + (require-all + (extension "com.apple.sandbox.executable") + (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/"))) +(deny file-unmount) +(deny file-write* + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (require-not (literal "/private/var/db/PlugInKit-Annotations")) + (require-not (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-not (extension "com.apple.app-sandbox.read-write")) + (require-any + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(deny file-write-create + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private"))) +(deny file-write-data + (require-all + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")))) +(deny file-write-setugid) +(deny job-creation) +(deny nvram*) +(deny nvram-delete) +(deny nvram-get) +(deny nvram-set) +(deny process-info*) +(deny process-info-listpids) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb.xml new file mode 100644 index 0000000..f77bfb4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb.xml @@ -0,0 +1,31 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb new file mode 100644 index 0000000..ed68786 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb @@ -0,0 +1,650 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")) + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable")))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.application-group") + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (require-all + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (require-entitlement "com.apple.private.amfi.can-load-cdhash"))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (extension "com.apple.sandbox.application-group") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/"))) +(allow network-outbound + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/"))) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb.xml new file mode 100644 index 0000000..f773995 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb.xml @@ -0,0 +1,27 @@ + + + + + + + + + +]> + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb new file mode 100644 index 0000000..f3468ca --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb @@ -0,0 +1,277 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/powerlog") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/BatteryLife")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/powerlog") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/BatteryLife")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb new file mode 100644 index 0000000..aa8ed98 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb @@ -0,0 +1,645 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/run/printd") +(subpath-prefix "${HOME}/Library/com.apple.printd")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/com.apple.printd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/run/printd") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (process-attribute 4) + (require-any + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath "/private/var/run/printd") +(subpath-prefix "${HOME}/Library/com.apple.printd")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AGXDevice") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.springboard.services") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-inbound + (local tcp "*:*")) +(allow network-outbound + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.printd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.printd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb new file mode 100644 index 0000000..9228182 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb @@ -0,0 +1,461 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ProgressKit") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.progressd")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.progressd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/ProgressKit") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.cloudd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb new file mode 100644 index 0000000..7fe0a47 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb @@ -0,0 +1,483 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${HOME}/Media") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.metal")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.metal")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (literal "/private/etc/hosts") + (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.metal")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.metal")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coremedia") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.camera") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.ImageCaptureFramework") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileslideshow") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb.xml new file mode 100644 index 0000000..95bc3ef --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb new file mode 100644 index 0000000..57883e4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb @@ -0,0 +1,201 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb.xml new file mode 100644 index 0000000..aaa0d47 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb.xml @@ -0,0 +1,31 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb new file mode 100644 index 0000000..aac3073 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb @@ -0,0 +1,13 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb.xml new file mode 100644 index 0000000..aaa0d47 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb.xml @@ -0,0 +1,31 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb new file mode 100644 index 0000000..b571282 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb @@ -0,0 +1,1173 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.quicklook.readonly") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.quicklook.readonly") + (extension-class "com.apple.app-sandbox.read")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.odr-assets") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/System/Library/Frameworks/QuickLook.framework/PlugIns/QLWebKitBundle.wkbundle") + (extension-class "com.apple.app-sandbox.read"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/System/Library") + (subpath "/AppleInternal/Library/Frameworks/TypologyRecording.framework") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.quicklook.readonly") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/run/printd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.app-sandbox.read") + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID")))))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents"))))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.contactsd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (b4 0017 a080 2ce3) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (34 aae0 a080 2d0b) + (global-name "com.apple.bird") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.FileProvider") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.librariand") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (b4 0018 a080 2cef) + (global-name "com.apple.cache_delete.public") + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (34 a381 a080 8d4c) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.sharingd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.backboard.display.services") + (34 aaa8 a080 2cff) + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.lsd.mapdb") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.logd.events") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (34 aadc a080 2cfe) + (global-name "com.apple.securityd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird.token") + (global-name "com.apple.nanoprefsync") + (34 aad7 a080 2d17) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.frontboard.systemappservices") + (34 ab2e a080 2d13) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.calaccessd") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (extension "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow network-outbound + (literal "/private/var/run/printd") + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.camera") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.homesharing") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.quicklook.quicklookd") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.VoiceOverTouch") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.logging") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.quicklook.quicklookd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb new file mode 100644 index 0000000..3053309 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb @@ -0,0 +1,118 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/private/etc/master.passwd") + (literal "/dev/sha1_0") + (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") + (subpath "/private/var/run/racoon") + (literal "/dev/aes_0") + (subpath "/private/etc/racoon") + (literal "/dev/dtracehelper")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/etc/racoon") + (literal "/dev/sha1_0") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/db/icu") + (subpath "/private/var/run/racoon") + (subpath "/usr/share") + (literal "/dev/aes_0") + (literal "/Library/Preferences") + (subpath "/private/var/Managed Preferences/mobile") + (require-any (literal "/private/var/run/racoon.sock") +(literal "/private/var/log/racoon.log")) + (require-any (subpath "/private/var/preferences") +(literal "/Library/Managed Preferences/mobile")) + (require-any (literal "/Library/Managed Preferences") +(subpath "/private/var/root")) + (literal "/private/var/run/racoon.pid") + (literal "/private/etc/master.passwd") + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/sbin") + (subpath "/private/var/db/dyld")))) +(allow file-read-metadata + (require-any (literal "/etc") +(literal "/tmp") +(literal "/private/etc/localtime") +(literal "/var"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal "/private/var/run/racoon.sock") +(literal "/private/var/log/racoon.log")) + (literal "/private/var/run/racoon.pid") + (require-all + (file-mode #o0000) + (literal "/cores/"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name "apple.cfprefs.")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.system.logger") + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.nehelper") + (34 a381 a080 43e3) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.trustd") + (global-name "com.apple.ocspd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd")) +(allow network* + (local udp "*:500") + (local udp "*:4500") + (remote udp "*:*") + (literal "/private/var/run/racoon.sock")) +(allow network-outbound + (literal "/private/var/run/syslog") + (literal "/private/var/run/asl_input") + (control-name "com.apple.net.ipsec_control")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow socket-ioctl) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb.xml new file mode 100644 index 0000000..06a645a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb new file mode 100644 index 0000000..53e2d04 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb @@ -0,0 +1,696 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/usr/libexec") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle/Application") + (subpath-prefix "${HOME}/Library/ReplayKit") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/ReplayKit") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pegasus") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coremedia.audiodeviceclock") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.coremedia.virtualdisplaysession") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.coremedia.admin") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound + (remote tcp "*:443") + (remote tcp "*:80")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.replayd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.replayd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb new file mode 100644 index 0000000..27cb51c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb @@ -0,0 +1,368 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.webinspector") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.reversetemplated") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.reversetemplated")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb new file mode 100644 index 0000000..9ba3168 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb @@ -0,0 +1,491 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/fsevents")) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (require-any (extension-class "com.apple.revisiond.revision") +(extension-class "com.apple.revisiond.staging")) + (require-any + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-not (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist")) + (literal "/dev/fsevents") + (require-not (literal "/dev/ptmx")) + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (subpath "/private/var/preferences/Logging") + (require-not (literal "/dev/dtracehelper")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all (require-not (literal "/dev/zero")) +(require-not (literal "/dev/null"))) + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-not (literal "/dev/aes_0")) + (extension "com.apple.sandbox.executable") + (require-all (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo"))) + (require-all (require-not (subpath "/private/var/db/datadetectors/sys")) +(require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library"))) + (subpath "/System/Library") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")) + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")) + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (require-not (extension "com.apple.sandbox.pty"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-all (require-not (regex #"/dev/ttyp[a-f0-9]")) +(require-not (regex #"/dev/ptyp[a-f0-9]")))) + (require-all + (uid 0) + (require-not (literal "/private/etc/master.passwd"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/log/com.apple.revisiond") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.revisiond") + (global-name "com.apple.symptom_diagnostics") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 2a6b) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb.xml new file mode 100644 index 0000000..98518bf --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb new file mode 100644 index 0000000..3041e9e --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb @@ -0,0 +1,811 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-journal") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-shm") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-wal") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_coreduetd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_duetexpertd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_routined") +(literal-prefix "${HOME}/Library/") +(literal "/usr/libexec/routined")) + (subpath "/private/var/db/timezone") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.routined") +(literal-prefix "${HOME}/Library/Logs/coreduetd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") +(literal-prefix "${HOME}/Library/Logs/duetexpertd_") +(literal-prefix "${HOME}/Library/Logs/routined_") +(literal-prefix "${HOME}/Library/Logs/") +(literal "/private/var/Managed Preferences/mobile/com.apple.routined.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal "/usr/libexec") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Bundle") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (subpath "/Library/Audio/Plug-Ins") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/usr/share") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.routined") +(literal-prefix "${HOME}/Library/Logs/coreduetd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") +(literal-prefix "${HOME}/Library/Logs/duetexpertd_") +(literal-prefix "${HOME}/Library/Logs/routined_") +(literal-prefix "${HOME}/Library/Logs/") +(literal "/private/var/Managed Preferences/mobile/com.apple.routined.plist")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name "CDPM/com.apple.routined")) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.contactsd") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.awdd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.CallHistorySyncHelper") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.lsd.xpc") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.coreduetd.knowledgebase") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.locationd.routine") +(global-name "com.apple.navigationListener") +(global-name "com.apple.passd.usage")) + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.carkit.service") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.calaccessd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.Maps.mapspushd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (require-any (preference-domain "com.apple.coreduet.perfmetrics") +(preference-domain "com.apple.routined")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.coreduet.perfmetrics") +(preference-domain "com.apple.routined"))) +(allow process-exec* + (literal "/usr/bin/ditto")) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb.xml new file mode 100644 index 0000000..4fa9541 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb new file mode 100644 index 0000000..b4e147b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb @@ -0,0 +1,475 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (literal "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/Keychains") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/Keychains") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleCredentialManagerUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.security.swcagent") +(global-name "com.apple.security.cloudkeychainproxy3") +(global-name "com.apple.security.keychainsyncingoveridsproxy")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.cloudd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SharedWebCredentials") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb new file mode 100644 index 0000000..41537cf --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb @@ -0,0 +1,690 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (subpath "/System/Library/StockholmPlugins") +(literal "/usr/libexec/seld")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.seld") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.seld") +(literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.seld") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.seld") +(literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleCredentialManagerUserClient") + (iokit-user-client-class "AppleSSEUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.nfcd") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow mach-register + (global-name "com.apple.seld.aps") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.logging") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.passbook") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.seld") + (preference-domain "com.apple.stockholm") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.seld") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb new file mode 100644 index 0000000..f93befd --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb @@ -0,0 +1,1210 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sharing.airdrop.readonly")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal "/usr/libexec") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/Sharing") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${HOME}/Media/Recordings") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (subpath "/AppleInternal/Applications/Sharing.app") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (subpath "/usr/lib") + (literal "/private/var") + (extension "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private") + (subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-sharingd.log") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.sharingd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.sharingd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Downloads") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media/Memories") + (vnode-type SYMLINK) + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Sharing") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Notes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Media/Recordings") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-sharingd.log") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.sharingd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.sharingd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Downloads") + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-flags + (literal-prefix "${HOME}/Downloads")) +(allow file-write-mode + (literal-prefix "${HOME}/Downloads") + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (literal-prefix "${HOME}/Downloads") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "RootDomainUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coreduetd.knowledgebase") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.trustd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (global-name "com.apple.librariand") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.voicememod.xpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.studentd") + (global-name "com.apple.securityd") + (global-name "com.apple.contactsd") + (34 a381 a080 7007) + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.logger") + (global-name "com.apple.coreservices.appleid.authentication") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.passd.library") + (global-name "com.apple.analyticsd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.MobileInternetSharing") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.bird.token") + (global-name "com.apple.nanoprefsync") + (34 aadc a080 25e8) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.passd.assertions") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.calaccessd") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow network-inbound + (local tcp "*:*") + (local udp "*:*")) +(allow network-outbound + (remote tcp "*:*") + (remote udp "*:*") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobilenotes") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (require-any (preference-domain "com.apple.eventkit") +(preference-domain "com.apple.coreduet.logging")) + (preference-domain "com.apple.Security") + (preference-domain "com.apple.sharingd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MultitouchSupport") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.mmcs") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.wirelessproxd.debug") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.sharingd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb.xml new file mode 100644 index 0000000..8635cc4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb new file mode 100644 index 0000000..0c04c0b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb @@ -0,0 +1,934 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath-prefix "${HOME}/Library/Social") +(subpath-prefix "${HOME}/Library/Twitter") +(subpath-prefix "${HOME}/Library/Weibo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath "/usr/lib") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (extension "com.apple.app-sandbox.read") + (subpath "/usr/share") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$")))) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath-prefix "${HOME}/Library/Social") +(subpath-prefix "${HOME}/Library/Twitter") +(subpath-prefix "${HOME}/Library/Weibo")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Cookies") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.FileCoordination") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.trustd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.contactsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (global-name "com.apple.accountsd.oauthsigner") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (34 aadc a080 2462) + (global-name "com.apple.springboard.services") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 2463) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.global-name")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.twitterd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.springboard") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (require-any (preference-domain "com.apple.weibo.xpc") +(preference-domain "com.apple.vimeo.xpc") +(preference-domain "com.apple.twitter.xpc") +(preference-domain "com.apple.tencentweibo.xpc") +(preference-domain "com.apple.flickr.xpc") +(preference-domain "com.apple.facebook.xpc")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.accountsd") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.weibo.xpc") +(preference-domain "com.apple.vimeo.xpc") +(preference-domain "com.apple.twitter.xpc") +(preference-domain "com.apple.tencentweibo.xpc") +(preference-domain "com.apple.flickr.xpc") +(preference-domain "com.apple.facebook.xpc")) + (preference-domain "com.apple.twitterd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb new file mode 100644 index 0000000..9769e6e --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb @@ -0,0 +1,335 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") +(subpath "/private/var/MobileSoftwareUpdate") +(subpath "/private/var/db/UpdateMetrics")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/.overprovisioning_file") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/MobileSoftwareUpdate") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") +(subpath "/private/var/MobileSoftwareUpdate") +(subpath "/private/var/db/UpdateMetrics")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/OTAUpdate-") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/MobileSoftwareUpdate") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-set-properties + (iokit-property "IONVRAM-DELETE-PROPERTY")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.MobileSoftwareUpdate") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb new file mode 100644 index 0000000..6a239da --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb @@ -0,0 +1,500 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal "/usr/libexec/streaming_zip_conduit") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media"))) +(allow file-write-data + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY)))) +(allow file-write-unlink + (require-all + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Media")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY)))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mobile.installd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb new file mode 100644 index 0000000..e17556c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb @@ -0,0 +1,613 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/Classroom.app") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/WebClips") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/studentd") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.studentd")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/studentd") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.studentd")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.contactsd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.logind.client.machService") +(global-name "com.apple.sharing.classroom-transfer")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.securityd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (34 a381 a080 9a2b) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.accessibility.AXSpringBoardServer") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.studentd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.studentd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb new file mode 100644 index 0000000..d3288e8 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb @@ -0,0 +1,693 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Suggestions") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/ResponseKit") + (subpath-prefix "${HOME}/Library/Mail") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.CoreSuggestions.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/personalization_" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]personalization_" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?personalization_" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?personalization_" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?personalization_") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter")) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Calendar") + (subpath-prefix "${HOME}/Library/ResponseKit") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Suggestions") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (require-all + (require-not (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/personalization_" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]personalization_" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?personalization_" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?personalization_" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?personalization_")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.contactsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.securityd") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 2157) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.syncdefaultsd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.reversetemplated") + (global-name "com.apple.calaccessd") + (global-name "com.apple.routined.registration") + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.spotlightui") + (require-any (preference-domain "com.apple.CoreSuggestions") +(preference-domain "com.apple.suggestd")) + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.CoreSuggestions") +(preference-domain "com.apple.suggestd")) + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (preference-domain "com.apple.suggestions") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb new file mode 100644 index 0000000..9826184 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb @@ -0,0 +1,514 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Preferences") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/Managed Preferences/mobile") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/SyncedPreferences") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.syncdefaultsd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.syncdefaultsd")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Caches") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (literal "/private/etc/hosts") + (require-not (literal-prefix "${HOME}/Library/")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/SyncedPreferences") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.syncdefaultsd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.syncdefaultsd")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/Managed Preferences/mobile") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-outbound + (literal "/private/var/run/lockdown.sock")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb.xml new file mode 100644 index 0000000..18bd525 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb new file mode 100644 index 0000000..d4691d4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb @@ -0,0 +1,336 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath "/private/var/db/uuidtext") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (file-mode #o0001)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.trustd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-priv-task-port) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb.xml new file mode 100644 index 0000000..68ca6b1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb new file mode 100644 index 0000000..15c1984 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb @@ -0,0 +1,23 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb new file mode 100644 index 0000000..f6ffb1b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb @@ -0,0 +1,606 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.testmanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.testmanagerd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.testmanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.testmanagerd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AGXCommandQueue") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "AGXSharedUserClient")) +(allow iokit-get-properties + (iokit-property "emu") + (require-all + (iokit-user-client-class "IOPlatformDevice") + (iokit-property "product-id")) + (require-all + (iokit-user-client-class "IOAcceleratorES") + (require-any (iokit-property "BaseAddressAlignmentRequirement") +(iokit-property "IOGLES") +(iokit-property "MetalPluginClassName") +(iokit-property "MetalPluginName"))) + (require-all + (iokit-user-client-class "IOMobileFramebuffer") + (iokit-property "hdcp-hoover-protocol"))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.logd.events") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.securityd") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.logd") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.instruments.deviceservice.xpc") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram-get + (nvram-variable "emu")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.testmanagerd") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.testmanagerd")) +(allow process-exec* + (literal "/usr/bin/sample")) +(allow process-fork) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb.xml new file mode 100644 index 0000000..599c58a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb.xml @@ -0,0 +1,30 @@ + + + + + + + + + +]> + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb new file mode 100644 index 0000000..cd8a39a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb @@ -0,0 +1,286 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Media/Vibrations") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Media") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal "/private/var") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/Vibrations") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Media/Vibrations") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb new file mode 100644 index 0000000..89c1f01 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb @@ -0,0 +1,62 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/db/dyld")))) +(allow file-read-metadata + (require-any (literal "/etc") +(literal "/tmp") +(literal "/private/etc/localtime") +(literal "/var"))) +(allow file-test-existence) +(allow file-write* + (require-all + (file-mode #o0000) + (literal "/cores/"))) +(allow file-write-data + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.cfprefs.")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (34 a381 a080 183b) + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow socket-ioctl) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb.xml new file mode 100644 index 0000000..550ca15 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb new file mode 100644 index 0000000..185e85d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb @@ -0,0 +1,101 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/spool/mdt") +(subpath-prefix "${HOME}/Library/Application Support/Containers") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.mdt") +(subpath-prefix "${HOME}/Library/Inboxes")) + (literal-prefix "${HOME}/Library/Application Support") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Downloads")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb new file mode 100644 index 0000000..8b4e33e --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb @@ -0,0 +1,201 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.trustdFileHelper") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb new file mode 100644 index 0000000..75c7287 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb @@ -0,0 +1,488 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (subpath "/private/var/personalized_automation/AppleInternal/Library") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/usr/local/etc/scripter") +(literal "/private/var/personalized_automation/usr/libexec") +(literal "/private/var/personalized_prod_automation/usr/libexec")) + (literal "/usr/libexec") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/private/var/personalized_automation/AppleInternal/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath-prefix "${HOME}/Library/Logs/CrashReporter/UIALogs") +(subpath-prefix "${HOME}/Media/uiautomation") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.uiautomation")) + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Logs/CrashReporter/UIALogs") +(subpath-prefix "${HOME}/Media/uiautomation") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.uiautomation")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AGXDevice")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.logd") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.UIAutomation") +(preference-domain "com.apple.Carousel")) + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.purplebuddy") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.Accessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.UIAutomation") +(preference-domain "com.apple.Carousel")) + (preference-domain "com.apple.Sharing")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb new file mode 100644 index 0000000..e8a876f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb @@ -0,0 +1,426 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]"))) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]")) + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]")) + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb new file mode 100644 index 0000000..58d1942 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb @@ -0,0 +1,551 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (ioctl-command (_IO "d" 22)) + (ioctl-command (_IO "d" 24)) + (ioctl-command (_IO "d" 25))) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.filesystems.userfs_helper") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (require-any (literal "/System/Library/Filesystems/exfat.fs/Contents/Resources/fsck_exfat") +(literal "/System/Library/Filesystems/msdos.fs/Contents/Resources/fsck_msdos"))) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb.xml new file mode 100644 index 0000000..51b8ed8 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb new file mode 100644 index 0000000..79d20ec --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb @@ -0,0 +1,279 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Application Support/videosubscriptionsd") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${HOME}/Library/Application Support/com.apple.spotlight/subscriptions.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Application Support/videosubscriptionsd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb new file mode 100644 index 0000000..fac0b3d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb @@ -0,0 +1,459 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")))))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/private/var/containers/Bundle/VPNPlugin") + (extension "com.apple.vpn-plugin")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (literal "/dev/ptmx") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (subpath-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory")) + (require-not (subpath "/private/var/logs")) + (require-not (regex #"^/private/var/mobile/Library/" #"^/private/var/mobile/Library$" #"^/private/var/euser[0-9]+/Library/" #"^/private/var/euser[0-9]+/Library$" #"^/private/var/[-0-9A-F]+/Library/" #"^/private/var/[-0-9A-F]+/Library$" #"^/private/var/Users/[^/]+/Library/" #"^/private/var/Users/[^/]+/Library$")) + (require-not (subpath "/private/var/tmp")) + (require-not (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-not (regex #"^/private/var/mobile/Containers/" #"^/private/var/mobile/Containers$" #"^/private/var/euser[0-9]+/Containers/" #"^/private/var/euser[0-9]+/Containers$" #"^/private/var/[-0-9A-F]+/Containers/" #"^/private/var/[-0-9A-F]+/Containers$" #"^/private/var/Users/[^/]+/Containers/" #"^/private/var/Users/[^/]+/Containers$")) + (require-not (subpath "/private/var/containers"))) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/private/var/containers/Bundle/VPNPlugin") + (extension "com.apple.vpn-plugin"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow ipc-posix-sem*) +(allow ipc-posix-sem-create) +(allow ipc-posix-sem-open) +(allow ipc-posix-sem-post) +(allow ipc-posix-sem-unlink) +(allow ipc-posix-sem-wait) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name "com.f5.f5_sslvpn_plugin") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (socket-domain 39) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb.xml new file mode 100644 index 0000000..d550490 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb.xml @@ -0,0 +1,60 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb new file mode 100644 index 0000000..cb17ba5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb @@ -0,0 +1,760 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")) + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/com.apple.itunesstored") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.watchlistd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.watchlistd")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.watchlistd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.watchlistd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.watchlistd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.watchlistd")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.watchlistd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.watchlistd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.lsd.installation") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.VideoSubscriberAccount.videosubscriptionsd") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb new file mode 100644 index 0000000..b4827c5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb @@ -0,0 +1,951 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (require-all + (debug-mode) + (extension-class "com.apple.nsurlsessiond.readonly")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-all + (extension "com.apple.wcd.readonly") + (require-any + (subpath "/private/var/containers/Bundle") + (subpath "/Applications") + (subpath "/Developer/Applications") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$"))))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath "/usr/libexec") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/WatchConnectivity/Clients") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (literal "/dev/ptmx") + (subpath "/Developer") + (subpath "/usr/lib") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (debug-mode) + (require-any + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/usr/local/lib") + (subpath "/AppleInternal") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist"))) + (require-all + (extension "com.apple.wcd.readonly") + (require-any + (subpath "/private/var/containers/Bundle") + (subpath "/Applications") + (subpath "/Developer/Applications") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$"))))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ClockKit[.]activeComplications$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.](ClockKi|sockpuppe)t[.]activeComplications$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.](ClockKi|sockpuppe)t[.]activeComplications$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.](ClockKi|sockpuppe)t[.]activeComplications$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/WatchConnectivity") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (debug-mode) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/WatchConnectivity") + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/WatchConnectivity/Clients") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/WatchConnectivity") + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.pegasus") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.locationd.synchronous") + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.logd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 193e) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (debug-mode) + (require-any + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.GSSCred") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.nehelper") + (global-name "com.apple.networkd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))))) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (debug-mode) + (require-all + (debug-mode) + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.ids") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.wcd") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.coreduet.complications.pushLimits") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.pairedsyncd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.CFNetwork") + (debug-mode))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.coreduet.complications.pushLimits") + (preference-domain "com.apple.wcd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (debug-mode) + (require-any + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (sysctl-name "vm.footprint_suspend") + (sysctl-name "net.routetable."))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb new file mode 100644 index 0000000..c9f6691 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb @@ -0,0 +1,369 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/usr/libexec") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Bundle") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/private/var/preferences/com.apple.security.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.webinspectord") +(preference-domain "com.apple.WebInspector")) + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb new file mode 100644 index 0000000..2cbc8a6 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb @@ -0,0 +1,358 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/usr/share/zoneinfo.default") +(subpath "/usr/share/firmware/wifi") +(literal "/usr/libexec/wifiFirmwareLoader") +(literal "/usr/libexec/wifiFirmwareLoaderLegacy") +(literal "/private/var/Managed Preferences/mobile/com.apple.wifiFirmwareLoader.plist") +(literal "/private/var/root/Library/Preferences/com.apple.wifiFirmwareLoader.plist")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/AppleInternal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-test-existence) +(allow file-write* + (literal "/private/var/logs/wifiFirmwareLoader.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleBCMWLANUserClient")) +(allow iokit-set-properties + (iokit-property "PlatformConfig")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.system.logger") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.corecaptured") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 184b) + (global-name "com.apple.tccd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.lsd.mapdb") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/sandbox_bundle b/tests/iPhone6__2_11.0.0_15A372/references/sandbox_bundle new file mode 100644 index 0000000000000000000000000000000000000000..ce8c39de65c1a5990385f94dd4662dd3e38267ff GIT binary patch literal 471472 zcmeFa2YeJ&_s6}Vivd|IB-u_6J@no~4TN420#ZWnoj@Q90i^d{vXcNJC?KLz73ruT zRRu(Pk)kNrK;ixU?(CE#yGug!dH&D)zM0R=ch2qi%(>^@nVsDj;wHMb8aBH!8#WrY zxC{oTEBO{D zLgg~$m@s#$rU{M2)-<7MLPKmR^J#gmtybbLt^VG9esOgiO6BHseYX13)qB)5a#|%; z&+n0E=jx=@JCmhNOeV=~mDI5PYrSiz?doQ$6%EC$8o4U_s%)!RJKJ=4<>8gzU|^)`8B{7S92PM4;ki7UBLLvbs8X=wEdrPL)WsG<2Q=C7E!Lg~BH)o?}V zit1__Ijs__r>vo(EA$#FyrNL5oK6=tR=EFK6xS?d;{V zmphk_#&P!Ykvtb6eMP*|8-?8ws%WU&@@~t!V&|528~S0HQkG^z*Ow`Mce+k2JH9OK zHgss2UPJqq`PNYWE#5VxA7$??+qi7pviC$w+1oM8#w;7UtPhT3mi59eheWD9QF=s1 zAXL#1WzB~EsZrKuS*vttsA)0{IbFU-SrM-qYO<`%veL_xQTFT7`%5=3-L#ZFWN%k3 zUA1)j(l{JfEgg?t4jC%q_1fWiZ-jc%P>-eE#MWbJkELC)rOc=0*}g=HlWj<`9+^(p zk|m3lEKt+PX_KdsC3%!hU!u1m?;4UvS*!QG+t9Ej+9+$kr1g@5OWKQ8u;un8_9X#J zUcu46Bo}r$#4klF<+eUu>{&x;A7yt?g1l*?Ow)kVbz||h#c3a9-z`p$hPtLvLkAY` zTb#7`fM_W-#L<ewh5N8OU1t{VT(}8Ly=8oqtyRnQtf3_f7cJCm zNN$0m6+K@>L(R8(^VIVfj$Rn&>hEq_o`ty=e!n1(kZ42iEO=*uYrzs6-&wG5!GZ-0 znYUmvn0k}jsD-D0wr7p*h&n-L82qoGY<<$~Kg8P3>(xB+vHWZ}YC9@~B18(2RN0=5?GmL$reJ zZ9A{+yk_(2p5MYWZB4Q1R9g{b9v9%ae>kX*N3Gs^jkjIy77Xh^>v;%x6X z@4q(N&s8+8Y3SBmrQc51#km*eo>S92PebXO?H~Kl&~CIrv7wc7m(T4ucco|rZ76(h z_}tLB)o~1;TNS$;QYu9&<+f(rQ@^T~>sdqD=4P2|P}BUg8fyBXuTiGmbzGctVa~=m z7w52cYA9(=(wvoZ7T}mPXC8JrWU`2tTc{l;B2@DvFLGZtNG(^>&~4qFYt)>`IUUqA z&(l!)o_@sm&``BGnhjaznC6_DZ4s?tZ%@oVG5g@`-8i0@y%W0}vI$JRW!#3Us^w}L z(vPyzvrEn{uBLgOhSE36_W01ypR=?z^}$*DXDyg@a29K)hNjM%I%~qLkvLABH5|Jf z(p$u*)KOQ2X3U0)tL17M(yytr&&oP0vzq348v1Ky^4Z?oTqc)O_#Ev}Boi3hzJ3Xa#D4&>~(G}z4 zX-c`;it*QJ+HAjOTH>@-Y8pAM604`Y9$Gj}KgtTP@HWci72`c|)D_v#e9Iq{^##ckS%i6yBHpHs!Y|nhx=d zamu18v!^Ka$<*StvlqGRXuiX{ryhw`C@aP;Q=+Dnn$ktIg6%CjrRWsLlmHxyPI&{n z9Fj9dEA?&F+OOQXYAu(~v=mA{B}CJZ=eaETUB^pPUP3!kmQGpLQ06K6QRe*#np}H- z9~#o%m))Oyck=GZ_a`$K+xzk4k0)=L{5FmsPhN{%4p}DRm3}Gw-}clq(x{=h$>S&2 zo*buYsLJFjlS3vK#j(od!q}ZIo(26&8p@-V>)D2KPR=notC~i>GTv<{eQWBiY1Ghz z_#fjxjeiiY*wBA=J+xEQ%ep;l=)?FA;@?-({IeSR)Q5)j_x3B|m&NyqU!iI!IzBo+ zD!vVl(ebUYJ6$|$kfN1xTQh#w;pwvu{ar`;KI^CzpEf@v&-Q10Xvh|?dFqTj{jfl9 zny-D4JJ+R?WL@iRNE<~?*ISdOOiIf$M&{YMI(_$LKl#v*-ct{rG;mU_NrOd8+1vDt zvg*i{F%4DppdtNzS;(Z)Y0}V(JVE;22ukiEAg0ocOkA1?^$j#9>mj*TO)uKni)biY8Z}gVV$F%KOsuVHC_SU>e_KQTJ~Xt` zsXZSGbJlg1c9wGT`p|}QJ99f9#@&e{Z{sM3d>5B`j5%GW<1%{ZT1qX~^PTIj6CO_Z zd4f{+g9#6Cu33(DCfiW@?p#m!(9jnXw5PB$CrqC(c*0E43Tmk9gsu~sPN<7x*9o<; z%OT~}Rw}I}gC`W4kTFlK<+e}YeVJ{7WkMjzlsBjA!T2A?-x#mdd42qKoGY<<${O-C zmt9kHGpGIyt9`q?`=KM_wb?##ylecx@rj}wme6y2&+(ndx5csN_}19vkcPT?l=eDZ zTn{zS#VGe>X@B=4x0+j9G2Yfaxz9O1$M}@9J$p)RW*aYW)Q)!zX{}AEp|ZQZYe>Ih zyc2snc1P@;Se8T$(GR8P-H(iEXtSu7b!!^Z?8@m{7rQ1lQB9-t_Mg#Em=6t2iPdbV zcWlqtkl5a;hJs^*V;!*pI0nbQfgNKB$DFBJ$<}7vQ~RmqY8o=2b;>AvGVafDDQ!rJ z)l;^iU&f_vO)YDBvJVaEXZzFRPL6YpOBlyoyn4&WEysuF({Wrr?k((c$T$(NTtkJ_ zP>e1n{iAG{np@M*MT{V2>pQM@Dh;uno<~_a?_7OosL43ZhANCJH!jP#3ZkXTDErU7 z9dmE2q6@u-6zg!hu8h4jHtjZ)J`L^hp`pWLH4VKzcJ0`KW8W4nrG|Qq?KQUT*f1P> zjctNm4ymd3MClP(9ie)!k$xL0pqA@dL;1$O{;z4M^&an@`u7-3Lq}o`#q5eX62l&| zw_9Si#H@{3iQ|@-<=Ewr*&<%A9XUO(wicRx4QaV$4b6&~g|;c1(={a~K1Q>lNimbq z4kcDk*$>6Wq|Fb>_x2ZjXh`peqGP(pl#hv4HI$w;by?BgjA$rW)%+#Q*>XwxJJ*6S z`D5&A8aZCC8U496CTol}Sz2$Obx_Mr*RMV_^!XU={h_5}7LRE+X6YE#&U~R`LdTRI zQy9n4F$J;9Aps&@(}jGN2cb&87?OS)Iy+h^QyXPkuko#g(Vvdqt)`LFYVq2cY(v{d zr^kj$ed2wTEgP+kve?mMM>iQAD_X(c)*W4Ubk)%zIMy9q8oL})AVn+Xwr2c|^L%Q# znuhc?^y+BiXl;}|PebYR)Zsofq#tGfw?CEkAD#1G(@-lP8oDw{v!PE$?HV<4)F-2O zeP~0YM~xoUV^k!Lqepeb&XBgF8jE=O8fwRe2+i0i%c_>^*@o_p{9)v+ky?#%E49(3 zoXMl?^2oG}GP%6hKlMJ!XhYw+>pd`X-^c|c4+x39O^>JMiZNq%9iHE8&@|%d`4F#) zykd+K_h!_NtfBOcvV2}Oq+AEB9m<*B9+a@>@t@1XUdx+e8H${oN~}hw&`|PJo}}b$ z4fLv^Sl7sr+9+#3vhB!%BipMsWFBcA`Rd4=IGRW1!0vSM?5`1?YRvd&9k-5lxZ6BG|H4%Jzr#$b@()sLEjsm%T|{BTb!KBk{18B-mn^| zYTmP_PM?ONN64O98BN|-jMPRK9~ugS9V>4(c=~Qo(-CR=ZctNG53SO+zYoK}g|Qyyi_hUsnS zd2d*4^5KVy4bz@e-y3>o=;opKhO&0rL(mJHcFgfWcA zON~Qfh77@R=8!?y<&f?oUeS!gZV1hohAOD#de%_kAq9un)HHIvng+Eq*@lv9$TGy7 zET`Om32O>jLqDa`kkXr2m;O0*rXhwQNsBXyve?`7KBvx@hCIF5p!GYw-{MT)(~m!V zXz0{nZIrDVykcfL90PQPaq2l~_GJ+0gUmvdca+^q{}ysdx9^*?(&P-Thg+u%Z5A`Va2k3&%12 zqp`y?;n-2cE4@*e@in!dTJDp6->?3oAGe?TDSdakZuh&{FReCoz2E2kuJ=>gMtYme z#EJ_wO)GxGO^?v1W4DAT7zic`UW$l+$)t-_@W9ELh`({?ld%lJq_|TAkE<4osK;H#@5A|h<)X<#1 zbNWu{8;j$dzGJb=A%jG`q8Wu5|E!~xTCV1Yv_3msjr%t28>*&}>($~@p2gx*0HtlD zHye^?d&2?mHk7}wW3%z=Ri74pnyYE#`cvwKvh0VFdus1~NG@lf4-J*+qiHC2pO^c5 z(>u3l1$%qE_wnBQdhfvTc<+y~GvuS*8^F|C#{JMjwOm<4wh1=%%@4L_M(=68r>JS3 zr=jF4#^=rUA0F^Cr0kP?y(ge%>OFaVlo%G*o7;GC#&+eZh@v5?ab3C z^X`Y_aV<+G|TMXRocI71U6ApHu6vTl)Qw_5^KQFXbt$UPI}7K9t-K zJx@bM9~$c0OVdzzuV%ge>=~|V=*ONv_WZi%F&uyFd9>%@o=z9fwu7m+jQgQAYPp_m zXj#uCJ=3xtqBZSYoxX3rZ1$lcy$yN#ylipLT+9FbD68`v8>-&3YR}4Qnt#?0o${$6?cUze)7JAr^!;eoP7VDK{X_KC z=yN#!5d95yIpm;-PdUyGAT(os=o7VE&o=aN^oP-D8D%fxsn7Y)(D5E$^w`qF-QVtg zyD#rHzZ<2gIOgsaop7@2{;s*ZvgHu#nvSbdgtbJP3s)rxo2l3jm+rI5uH1B zj_%yPb2#?)IFEBR#=diPaA*Bzu7y_=PLY!(YERHMp71`Gy^Qjdx$I8V?Wm8V?nJS6 zmhg7e+ffNoi*bBAY9V$xNaWAP>rZ+QAvwy z2o2C4DnwO?Diu`-#|lveu*)I&{$Hq}H`AygPqY1h?ipiVRrCM(QP#_chJNX!&1Jhf z?dUYB)2>d6AL`htW2f*=4RGw(sXlh6i)WQZyncl7yc|LmKSVkGYifVBTunpz=hTlP ze~G*snY>=bkLxMVWodbm&-ThsKhF5jklqh{9eE~lZRFRY70fL~N|DPW=iw+t&cQB+ zOiIy8xy}FEe&}KvHPk1vS7hbLKB|V&b6=*+$;vfOzYQrC80Y@hLdD36krg5p>qz(bj4h1?KZ-1;k zwM7l>ZNInuJMCRK?rp!a{c?o!Y=(%Jtz0{LyDyv8eyZ4}wV&303N|f=e5P5+n`)e9 zL;B}K4cgalUq?-&*=nB}((XD+wlCiPuXZIxE7RT6T_=mrU)L$AmK)rTy?*r8qqhpH zVOY7ev$eD6WVv=lLm7J)w)ko9p8D6enhky0c30cjwx70T-PF*awu9PsY}*{iL2bjZ zGo(q|nj&7W9iCT5s4`-zwXN2+Dt2yZpUeJiqm-%H(64Qjv4ig#w>jD7n3_gTtHkQ* zX)b%-XB|KJ(9o7Pnjae5W=xyvZN`dLu(u`JlxXutn_M`SX!A05IpkSur6+oN^FwLZ z&^fhSO+)%M_1@N>wBDtr`DZm`JLBDk^s{|ZYpM0n)=8oj)KGe7d&P#>`tB{(fj5XA9H4Rlm z>*USpD%G+?%c5!;xo#y^PtP{wTSF^-XegIXL-$(TY4LuGdo5TyHMG9P`WA~?%*1hh zi|N?qkntj3uN|Ie{NBE|TCS!c{faTNMaLHH)HKi2Q2IVmJmo_})mmsal)r_&#ZTe+ zMJuSGTj96DFNJ@N1^d+~q3w_Dr!gT*>cr zy%)YQTpMK@!Z(N-mH6b`xq3}_+V0Ebc4Rs0eJ(4HRx3~P=Y-D+?;Jiyw3IE62#*MF z9o_`Ti10?(<&f&`o+y2knQmladX)ik7E59My|-#mw!Ms9(34W)0k@BMXZ z8SeIx==&)<-Q@ z(~vd>ovt3ux;1-KP1B`Wmu8-ypm|*X6&xQm zy@Vb2+c=&EQ*Zh^SH>!HS=#T*B(+?5l#O37e!=Rdil@PEHZ+ZI8mp!m*K}Ode{Ph$ z@l9$!qK#}g)^23ME{7OJd`cbpBQ#?gI?+%mQ`QjQ zr`CGzbZu+6wc$oJ&GR(0rlEdK?frdf`7_tj-+K2$Z5qb8>bvXxt-;R?4mS9$0c+>` zL+|1&p}~R%?_!&Wogvd2#EN*OHwt4A>RCgh8*qF6H(x5M<%Tri{d&uWEgP0ur@;P_kUHSBW8H(=^5a z=&aDCqNUW(q|iyB<3fkwI0;|9n}l$l^-z1F*VCJ!T|zzEP+H%x3RTOMHB>jWZfG5p zDQ|cZ9$GaW8cKQB;oA>g`_|h#`Bg$~XqV!t|EmAE{^#}os?VOYxBKevtG~1U79980 z--MkZ8|$wY@p|p>JmcSdS+3Trw;`>b^v(9(-WFD_BFRsKlL6I^ye3 ztlz4ByxP*{^_$mkSidHY&Ffdkj&GCWSms~S(CccsdJSndl&k*B^|PyK&I85t|aPP}A!7wUw}MYjd{$ruH|rPt|6ra>)s`SJj@UrkP!PcI{be ztdfePhGx`u*2b=DrzabdKb2++CS6GBhny&h`D0!B_0XW&eQVdOJ*YNg^-yQETunn!wG``cy3+T%u<6s#daoMlR7+Vg zM%0R^Rkv2{T1FgY4Mo&?8C#ZGPim5X;)wq}g|quL^_o%6?;ungG0*oyN?L{Zv{EhC zvmf$gLyG?Nl>Jb04c(~e?HQxo{-a(slzg^7QS*4sgqkNrOWE=jHCNPJSaSxBD{4-| zE{DXbJyEnndLLzJT``VU%l+py^t`){(>^rRp{DNMzGkJGS!-5NHT0y$lN!I&_yNZ! zHEv;trQ>)3Ouc=JP|Y5mZ$nB6TAsaXxtfM{)=;d&>H46?`!zPJY2^G$te&zBrEg9B z@^{`n^+dEmSyOkd(WOS~8eK&z*z$%o8rG;%qYRD>Ym~w+hvZMuO1Z5Ww;`iiuBIXV z(~lfAven3Sl!VESHFvTc{l~uAv{QDW!SV&^Oi2Ry(bxk<;pJM>+RwL!LCGy@M8U(Yp=l zHMFkUnrgkPtrM-FhPqbkTCHidx;S>NRvWt!BfPxtfOb zPd_}(WwdqA?|vko%RG-V?aptC|c3;M}#tuvMFoov_Gf5q?W5`==&aQ=j}oh=r`g`S zhK`F8H+t1j^4b2s``w_UYVS1-Jpno-VW4W;#WVdbm(9yFxn&j@KH|EcXr6?yy5 z)VJA(4JE*imDzqkm3~z!RT&_zC3Wkl;;8aUm25aVs${{=5JQzmm6egCr*}V;))nJM zwOq}HH2pYTD=ROryi`r|yit~NJ>+{X8}PmNxolEpO+(!(zganHaW~NlYACXDWaT!M zo8lN*xiNM*q(+KX%5BZKhDxdBY8tw&`~UVuD;KU@P)+mCYADW!hV<_-W~rR1^65%h zL@TJFW0j6oI#_8pj>jtP#4d+y0#k1r5Gs#pIWGO4dW~AHrlIP(xAfBY&6kumlfVVkb3?+y-qFYG*I9Vmy{gLoAPV#JUPs)IL$XQQ<;`jTJ6dU<~6IS6Eyjw!&~6 z7grdHT@HyB@hP>`8DAI9m<@eaUMW-75I<4eTVCn8)3vnx;_~y=G;&%cR!><&$?rOz z_laV~OWys^2(&@*)a}Z*DWAW5JJAaEHmH11d1Lt;I0lu^hFuPMTu$kUo*DN;*VS@0 z8`6IR?^3yo<wR_hrxG z_^|A0>`oWY4uh$;JqXR%D4VL5tJ#n?dYrByWe1fVpr(;qpv7xv@+eFGxxM!_wR~?s z5*kvz|EEy-j$-Sw9A)x%6l<2PUN%?Rnq`@Wy?qk$B;--ZT^yf;{D55!xfr69p(nqi zctIDF-tQ=$4>_Uc)_+G)xfY(kqsXfw-++spTgp>)1 z5fU|&A7^<(vW4WwmIXUQ{wnjJjM8d7?<2Iqcsb<7zF+o(TCV*4vh^YBLvE^JDZeYN z)SYeoKXK=}!H0(QcdjSPd{xF(=A>v9HMFwK$})?}%*1hJnd#W&kny@!EA9MWf7A0L z9~$afMw`p(mZ@E)LYca%hDwwvQKmqdARJ4S3BZo;m*ME|QA0TpnjSwCogiyh%X6=^ zqHoy`-7S5$^sUm0f5B%&r7xDgpr%oBEAbj%WIgnq4-M(p)CWrME4`rf0nrM!d}isH zrQ=JF#c^ioG1%ph0V!H3w>9IleJ{0K&z?GczmuQ7**@20@9Uv3TqR|;FI~E1>3gM0 zs~Wme>Po3^N*%}XN~tfgM7e$%6C7!-F3({dFX?e8y{w4dDY*{iC$NnYjVP{CSlBGqwHlF0O5+yVG-zZL$P|B45 z8^sqTz9@0Dgff1du2m&glvt*wk<%)%db(GP$-X`1{k}{tr;%3;%}0$aT~0Ty#JCb; zu~TB$m=fGZh$GLG5IJ@7W4RbPPx4So!%A>V9WI9`bvs>sbZNd{-LnL@?m7+O`GGEl zl3TAExhK?+yy@%om*KcQcnNl=i)S-Ld`cZnoFm(v60WR= zrUg$G+qB?m!Bem)@d~w8Hdf;_4e6gT77i{LoL^1j2zCT3I!Vs-jWW6Zm#%nUG3wXU z*@CkKpDmhAw1PQL7Cl+?Xwkhmo-Fzab~$7#n0niSP_4Hw;)j-~<$Bgo#-3AqvLWqr z`+Pn$6jM|iWgUvPEBb2D4x**(ZH}TjiasgwOA+z`j&jKLBB}M`bX`Vh#x!(5E%(zR zykF<0x1p^?wiMZ@rjg^5TaPTI&xYjZLlLPo#IjgNtShpJ_8)I^7BLiAS~!zv1>;8* z9#uH1a2p(37jA*w>1tiLdEq)>>a7MsGp3=dg_Kfd8@gQRa-r`EDLTM6%L{EO^q!hV zPOHS~=}AN0*F&;~PNdS1(wkV<;6j>)3Kq&==tjYUq804z`GV&Q9xAv8$MXeuVV6TT zgQ>TSe^)wEE!XoXt5L98!OCiy^l9jM&lp3mrp*so3z`ewEnpR`poVT1xLM$0fipPX zEN}|D9C8Ruy&Wj9zd*)p$kQ*y=||a~0=o+QTTk)_`_NDl`lZbFGYU*C(6+z~p#k=m z>!D@^niSAK$qy}%{wMkTT>AOno~o>BUb7)XtTKM^8*CFlnV5DBC7d;YF!8o33E{`B)fUgySAZ z0(LoMfrwA3qm28ZaJ5{`hV*OdYIwn-f|}-e8cLrHJ@lcW*B#m@+hPCMKGMF!u4t&2 zy_Y@8-Ui2B_Ey-PE}k_I@hLSF2c2fj4{5nI4Taj}av4{{Ud^7CQN|p}fAy4Y^}Qa- zf6cq6*58*EusiI(*a`>@uubW?FU$B{$B#C}E;J44{ZK~kI=pL0uCq`YHT2(o2hH08P*fzzsLtIPR5PpcvHp(`TKS*Zlk6jLV(|xUzkF!n)ZL5n> z?#t5dsq3k^^)|#>>WY|Zwko!YYMKhR3TU|#BP!+RW%4LX-?yj2eP~GktEUBQ4%-83 z0nrN9e%E@}dewRk$Gg^Vu*)G|fT_2Pd+Pt@f1`-VNazevuCi zaV}fnZreC(jJ2tCoRB!m8d@7#Yg;Sf*w9)5yBrd%_C!C{iXfDElr8;!=nb`8O+)(i zP%i7s*6eB;xgN!j>nX1o)3+Wv<6== z6+JVqq3de7o^2@kY=6ys&8)W^?fgY-=%wpvTQPoNK5AZW{z9~rHnhmR$UNIT8OKHD zN!aC(QEE^ASq=TOo;rOtWc8t;H*qCeyZe03bjCE_bk4+{Q$zfI>patJQ(C^~s`u2| z^-O)H*Q!#F9Hx1(X(rl1@-4l;oSXbjPw#8$siL=SeP}4!q~vOD|#gGNZ`i6L>!LA-fSrOf4u#>-rx0V2mD=6v7z|h+-e5MjPH$K zUlt*H&FIhd8q>m*A$!$JOc2it*%!S>)+U?g*X*BLWO1vlu!DLc4=t9NaXjIhLI?DxR8y~$bb<624`l}gYbO$q)|+7HA`axMuX8H zWup`mFjnN7O*#!o&vM%(#xmZSU6%bmaK*VM$Z~*F#G@UshmR0GF~DGX_H0r>JmiQ( z*auiRF*;!~NV}N=(r!?mC6i%Bz*~@uCruOehe*>&w42_@;Ac*n=?A_@4zH*FSrIg46X&A zBHcQ059GJOW8ix51o#ffer*6h+7aj4h;rGVcfp6?Hwgyw*RYFCkaMk#b8QYVm`_38 z0y6x4@Cfp6Mf^3$AAlFYgR2eMs&0&PeF%Hvxcms@IQz#*aM z!vV)(Z;um?khtDQg=~~Q5BNgJ$4ODommupsChR57h4irVuL8~>zrS>XME;XPHcF=g zP7C=A>C9q?b0Hq~em3Ad(wn7k0=@>LLCQwy+kkT-{dv;Kafoo(<(`BKh!2sz3%DlY zFOq%^T&M3rGum^>-M-82_FWPAu8MSwXZk!zHv+DU_!|MYP@W^{CW-dq|JR849|CTR z_#d!#F<6Tv-62Ihi0gijvan;&Z}GY~*N-6W_$QF|_5i#E`}`T{srO$%+UY}tUqSdI z@SQDju3tgg)o-HQIM?rxX{UdHd%-_J+UaAEcKQUQo&E*VPX7jJr%#ce*Yg?V%)8@U zhCunc`+*!UnLu9mx+Um8`5BfW-|Mi~tO&P**#a4!JuqgGp>W*hI9HB9Lt!(*UjnB= zM!0#`jX2lKfd=zF&>#6|$Dgd0?L0SR+W#wvH=$p7Kr3hjIUe$Y91pL8v76#tuYr#t zzYdOp{02C6Q@+3e(T+G5DC!FYSzizsz9-IQ0)In3Gq?`!f1 zqd=}RI)f&(rwjNx_$IC&{bX0jT;Fs9-$l9I!5PqV4{#d#5e00D z;r@*BaMD_0(}=*4A|CTU(wEsZDsZ%02CWq~jbXXM?||8=ZWnKr&|WC;hQD~PIAkjwe6;OmLtjqvsJ+Lp90=TzovpegKvR9fYZP~ z!Rg@N;0(|Y>1Tr3z*(R_I2+6h&H+sz^oaG(Jlq9yUYH-a81?!~3rN(vP{>AUap0mr zdHsWM%m+)D9`nJnz@=a`NZBYY4_qPg9U;Z~2jLb!!>Yj5fd;?x@PC3^6GVMyx5nYl zo9iQqvREI1Vtte(oy1O5O(lE;1*#A?=u{Bu$4r=KM=A}+UB-{4@vlsj{-kN zc?CB_Cx9q_d*COKBjEQ?p5N1TJ1INgho9L6ZUJ|Lo54NcJ0Rkrk52>lB0cp1qMQSP zpFu93v@h@g+7Tk{C(#akQX}FIQa_kC4+%YoNQX&b7YzUQdYtPh^u+n=bCC1L7a-RY zU!vZ34aWkHBi&QXf1q=d;j6$Ac3B23T%VjoJl6@QK(0qlgY4HCaLYS!uCt&E{2Ju? zhko9xDd!1&f1RkCgzq z9xDlQJyr@l29`!Sw9hgi$4dyvbzfPK>#%Yl?YTV2aa19Qc2qH_2J){)eU-p%D5o;G z9jpRQL3mY=>&$B47KB#^-+_#L`C_iu3~B_K>&jXn*MGIaQI|0PgItH!1)r{~7t{d# zeba#XAKVCrf>S_*qa6)JIjk4uIbSw34r+pY@u&yH_-+~$Cd$G55BWVqv!Legco6;| zJg9{`9(3k3v~VDnY9C|>I0JS@JoVTS zq#h$gcw|r%Wa_gMNPR*^zAj83P+#g2^d`coR}kfN59$hLlDY?V16zR6h^PL0xYJR7 z=;|5N3+>~5DG0fDP(P6$^S{tbUm-VvUKpN9>K`KPa`$Ss3t$Kar$D2MGI z0CaKW zSg%h*{an{i50d2>U?SF6GeNGuXMtSb&jzPLo`dwfFPIB*{hW6$)(2Q$%?~n&b?^d^ z>)wSR*S(9t&R^mFALM#;3Ah#Oho#_Gd*fWoz@M>xUk-BJwF2b2Y$eEb*(#9hvel@M z>%9cXTz|O0?5I})xt>b|xt>V^xz1Swa-Fjl~ByJwQ4KB0nhBMTa0~HyjQ+BJyFKgK(~kj>3OGd-i$I7m&FwBDpU5 z66Ct*7|3-I%E$chRnQ5@^z$UwGbcs(sh~5EEgxY12X|xsg^ctUgU&*Jy6)?s^P*kf zkfNX8y4!aSWIqv(bk#C_d-wRq)Q~?FOy=vV87d6k8@oGFTu}T zLp}5l*CBUC_zlP$r#B&=M?Y?Xk5e_cO{^ZyHP>`tL__{x`|@9hphkRTfh=lfl{5kd=h~asO{( zcy`lE2p?p~L5grPPtwb#oS;8w6!pDg@;A|+UQ<4# z^Os&Fk?u7i8>QDxZwNUbDb^*3$2bWvS&-f=1(^cDXppi|GMUUGy@eF(5`?3DHj`Df z&t@tl+E>727wvOUM*H%UsJDQSjZ#5(`wEd_T~iq8LZl+5QX*YZQe2Ns}7o}@CS(jvZ$sVvHKB!!Tu7xTY}FK;R*;>(+=A-+gb1yaO=n0G3f zDx+VVhd}7R3gdBIs*+;7g2IlfgKJq@=)YHUyyq9T! zyZqknbbUm4UsHc~`hFnGfsA#>K&HohKhQJ?;nWw1a)z1)gPEkErXgSpa5&=G{$cKP zlpnfAm_|bXyxt(>QKm5>f1GPH*aZEjoJoo?jYU7GR}kfoGsU`PFrc_J-ZTNS1L;Au z%V~-e>71sC?r;$4CYjHijk^p{IeF7>z+yiHHx>cst&>!s@gq&bHqAMuU{G4lsQn(r+V$-$FRr_mSyC(Y}vNyG8qUnm!io+fEtn z+d-n7J?@p5<9)!K0HGK_z(EdSOzi$|i>-#M!><1M7;5a4*Wa1s(=(gB))^fb?T` zke}oJE=YU42hxAs2Wh82g0#<{K-%vEkpA>%@WR1gOuw_dbq`5lua7|b;a@@e;om^| zVW!(6JvRLTZUg@Ww}VgI{tSd&{$=tr(=Pueq0gs6HcHP-1|cKVY;b0UUU7!>nanvv z`phKKXA!bd%4*Igmb*eZ;1NxnJuEeKy!eoFHp!vDadRR z^;t+Ue#{`RAJY5PNVJ=+;8V~BW>2!43!%Kai4M}*AThtWfXEMj201LTAj5?nf>`$! zHWxwqc4!xf^=?sfFv{V27qnzX|B8WGz~Tsh6X7Mm9$-n77b2B1mlNfcCdE8f26R9V zA>c@)D+_X-WBdTHJUB72g1MTReyNJNqM7TdN|Z5vE0btn6(Jj?s%DIL$kj-{jfvIG zbw$3~<{BbjP0Gkui$uEGLN-cu-1+K?d?yp@nM0B8o5cF0=s)Q9U19@sBN5(^6yc!X zjl?GA#^6IR4DmlDHYG(o=vVMMekls<_N~*^9C}<2{e(k4{=U=I0z5C__mdI+Ho{v$ zp19qKD=m-XHjuYS?agh$ZD2caJJ><=2lGEe42U~!H5YKTx(4CI*L)T#Q5O;e)$V1J;MSjfxAm??+=*I~2 zNKqc{|3&;8wK4zVzH&6)(d4)tV~&O1{iPTZdLJufqZDf%hw?d25sq;>p6M}8018o8J-gyQHXR1IT(eihknrf0UP9de6KS`TeC$B=T<-vQgS% zeqYF2N#R!!kL&b-c{|eM{@=U}#QndJasO}rSft-h3jc<5oZl06AYF*G)BKr;-$e?) zvK!<)yvNq;JHwo( zkB}lBg#CU_S&TnWT&FKV&d0|<&XdPMj>oS+&dVo2&dVo3e!hJQd=1z4G|20H2HYZj zV?GOR1HT5hgWtNxKPblkIgs}m=fS<;1(5UecW4*w;-Y9D=6{fOa|xu~Tn0I=uYera zS3zEXK5u+{O}w8YoGb^gWtGtx(cl#S9u^COWjhXoYlk>$2a{EhKqJc438 z{(<=HhCj`ZQ6A?dP>jbXxW3Px{bl|eGRGsy@%R+vczgzOJfa-fPZo>SRhP(WHAg@z^yPiOh^#@rvPg*S| z3+G9*r2zW#IMG6)KUN_dC7Z=AN#8$Urlp36uZeF%aNO1+ zMLdXcTZgh3x1boW^}sDs1515y8yE_12OA2#;{G2p=iNpi$6aG^FW3a+xN8b>yoZ4t z@6AAt_vRqSdpOAJ+d|Zj`+tzvvlU3YX$|svwgG8RZ9$IHb|A-Td+5Q>(9zOC=%b^B z+%in$A8z6Eed-C!^F|NM{}w}@0B{r-2*!%{2gl(1KD5^u%XnO0e`zd<>pM=! zMrphy7VVHTeb-K15(ucKFD@#745|Pe<&}zw9T>u`TeC2N#y@X$VTa7%XT5}Acg-y zJg)0b%cn?hmUdfqfzcpkqqN8JiAet`Df|z@h5y-$_z>wc%MlU3j}-oAKS=*_0Hj_H zf^6R*k?*ib$9SgClk~aesEGgE@+Hc1Bz-}my}17u@y9L4MEr4lUyc6fD^kRR7&j*= z3;zQO|8pALB7JQ+18xJ)g4@Aw-2Mj?e&<_oFYM?XNWXI)36;d zX}_01Uf;_g{n!=J4$S``uj@6C_H!NNb-e-7u5N<#L$^Tsq1(`hpW%+>2cefc!Vl5D zWIuG@a!-uo`<939a(;A|^OFdFVEM&e-p}sxAY=SLVtV+YN0wg^&US$CCx2Le12ai~ zSbhgvfR7Q+_WtQkNBN=aiRCZ1K0)OB+wu(kq+Xtic+CHz9D~)*Du;vcLz%3ZAyY3P z+L6_o1v~@N4>6pi{@{1af8%q!99DyQFXWfNg82L`rxnjJ)@bkh`9tRCg1Ox3a=X*L z0`l{~JRslqGlG7|pBF6oKIVUr<-dmf{Cx0rcex#x8L~CN=W6+^2C*Is0P8>w1o?Sk z5XkkJ32cjSGx*)Rxc>+FxttZ``*1dppWE3%zGvnD`TkpeFbpgJwgd};eDAH0)sQ_H zER1%z*L%iR`24RZWWL8ea4FY+#qiBkj@#na(pHY!5+v-rq>znLX=^E~?1vGK@mhxI zF<#4BL%?W|vQa8$EidvlB!wSlx$P1wGG6#$Q25`vMt6AxPt6OV8 zrvD}Be`|vDzqLU6Uz7tsP~Tbya`B|PqW%!69*K7ITekEAq3-Yo?r@RMPr`L?gnDV8 zjX{o&CLqU)avv6k{PY{mK>Cs9ApL7NNPpVGoxi0!Un_SxtwGv#8!Ojy9jtAwT+g+$ zMnON16Wfz$Uk4!@rHN>Ov~`q-AB}HF)1QtZMLdY{ zKbErar=VY@br`Q8@59D}^mh|Lz8??=^1T2j^3k771bICtA^aoUkHv#auf@40i*j-Q z51H$|so-AlEs%b98c6>#9i-o#0UiTqg7mwyK-$Y}l*8*f2c(_MMfetk&x1_AIv=DR z;r(OL-i3^pmRJ{o+rY)(c5tb%2h9JF*`H;|_t3T6y29OWP_$_(r(jbkxi8+a-R$bYh${oa?L)h5V8AV-b({ z{}Ik{z8&`S?AZ?MPRJbRB**zKkmGze$Z?KxV4t5^KY?64=~K~;5NR)o_VX7RXrKGs z;rrd;BA;IuwCf<^x9-LKk9Mpx9JU^T%+G^CaUG9>w42XCUO%j_psz3Sdl=N$G3!a8 zuj3@@`%1`0>7?}p%A>vz4trWuHQiV&EMVS`~iyj-(B8gko7zfe)F02FELL3wq~)>Z$2f_?q@{^MZC>s74bG(0mK(cvXdeng#XA-S@=y*_@9Cz9P>Y9 z`kBHY{aq1|{;nuU{}K$+-xUMt?}~%G{v|+O|B@j6W+`wlSQ_Qh-#b^t=envo$aPc=clw$j z*Il(huD5Et^Vb2n&cgbtbOV&j&uh8Ps&AA1V<^aVRs)dhtcD={Wh1aH!W)BJXEg!2 zzG?~%2gAU4gf{~lKyD6lofQt&Mm;S+uD4o(TyM1kx!!7Rlh<2q&@TGl?zIeg3w??E zf1AO$X?J^D2b&@9M$BKJaoCp~Z4r>Gqdd^K`O8RKgYkyEmSbq|c!Mz)z7G+F@H$wp zbp~IB+y&)w-Bx1~{Zv={vJvgPo2@78!e8o6!Y+CU*(mk2MZ+%Wrw|VN?#1-5?>@HP zU^GbCDD}1V6Zs~P!cVc>c8LQRFZ>iJ{L~;J54H^v@p%6a;q+5OVb{-|4YLi0Og}}^ zPmKWSr$&PGQz!@HW~^;AB z%?Z*DCxT-BNBMq+$+mb=&tx0?xnBs>TofV^*>3DRH9 za+g0F6!X8kp1C0FpJ(GbZ;@@jjqAJxw&l?0>`D~LOiagWLt;yW+};*2u6dHjnW$1T9JMo zDf|_}g}-_m@gdTB+h!5}4k`TA29W+}qq}|Yy4&}j$hS$PV?5L6NqXP5MZ~{v`vB!R zlD3j)FYfN*- z?-wBL=u42-_ZUd~Iu6p$eFf70oq%5a45w@-g?>)izDbbn48;BCS=$*K??2DlF1XA2 z+Fi~!BK%w1d3Sl|+~q+=zVDbG_s`$iE+U-m08!3m+xK85>9Xw-*aEzYc((V7J00bR zu4}gIZoPuYcf)oI{iObGig?`ri*jz;esG6_xPQK5y9=525279SZTCd}`!?P;GaMBD z^C$Q@t~(!q^rJtc+}>dKTJn0}AkMx-T?Rk(M^S|96#QZO0%>VXRMEX3WJpYS&_9PgQ4)eb~P{hAVit+Rs zDCU2VdUyk5`|^o=0V184|3$pX9wg#Tb_>eG{7;JU0wTZ7ZWZx1djZ5_{wGB|$oZeL zJpUsd$5BCWi&Vs32;2r12DgJn?etTa{~^=exmFDu%C`5)wUEDzFtD}cPt6+vF-N+8EkWsu{j3iRP;sA^9vV8}xM z0m}0~;<+BEVKe}wn{!0TWwkn4cjAlC_XK)#n<7wnF8K|SQ-x}rYlem~nU8u7Qp z`^*jTOPjQdM)ol1(O+szLXS;^Y?Q+6O`%85mk5VFG-G<$L%6*;7!6W3N-gXyMZR97 zm@ipwyTsOv7xN`3=F7H1Zf9>V;_>{SdPBcEpx@7)b+ku7=6p$VzKjGpUv>gHU$Pv& zXWUuXO*eZN$iOriFSra(WI~wP|Ryg_uExG{|EUV zWgnsce)hhi{C@WS2!Hh&-v2|phZqLf2SVok68Sgs4MIP7T?a${Y!Bvt$h^KoA@77d z4Ezz-Z8*Ytz4?79t|yiGcNAofgV7-U!5EP5566IP*I1DA?>La-CKjas7!R`C3GVvh z+~qq#+S^2s?V2R|5pSPw=e+!ueX_9kDU>lUPbHy`w}fnzrrG0Ml&6!ZZ>D_)>hTBV z{B!NIME=?C{Bzv-=eqOHbLXE=!mbwBm!ckjX(5Sn7YP~jzkP|2my*KYARhL$%)T1w z&C&|{axfaCY?M~oSBdniN#So0j`q3i38H;2`#RCTHFim~FOf3(mqeo8H9|H@Yu)Wz zN6Pa*(qaC$Zx-p^A^jY;q}f`@y@?0sBF_{Qes#?BfvX8)7(YKZ1C1|Brt889uik75)3%{sqEm z_ayD`OOSSZ45WWM4t@uI1?~k;fb^FqLHf&6ApPZOkpA)vNPl@2a7 zZ$ZAlcMk2lg8b(p=h}tm|Bz|N-+}a#7ZJ|!@I7RXr%T{N@G{78cLmHYUA5nWp8ch3 zB=me;$VTag{icv_kzDJ~!@5>=v_^)3ayc9?iTrr}4>>F`C&Pt(g7Dw|j$BC3_Yy$(>D-Q2P!9bxDBhRL1M+=2 zBf@(iJTJ)i-d+W5*IskbpYT08e;3zN`5bRJxE{;ru%KLCw*ZjWGf;#FIn0oGy-gtP z0W$JgnI7vwtHXwH+69Pm@;mHcCMmze0k!}OBA$M*fIA)Khps}7!srj*D+3`H!M_Ay ze$4-16I>U{nWSQl;%GPR7({#tM@hE~q8+6jr9^mXM;V0E4}(}YhB(SX=6C^-uDqk1 zNLSv`1pQ|?XubzlbQsLpkgpQjaRKvlWym4#YoE7NMR+d6S3`I>=JD!aQ^eN*Ip5a= zzXof8v6#xXDJHgf(o13)`C5G(`^0{OkP!C*1SL%_1&P_QyM4CL<@3 z`9H$xN7oAfwa)Q2Wcn|X>&*2a{qQ^B1NZ@ygZ05i$48LwytB#iF3Nk&@SbBE@(JsGBhu|j=e;(hf`4s#R_P>`h+Wi^&OFy~~q<`EG(!U-+e8IQz z{Xg*Oxza^_(sjoTA^$`|zc(E} zpnU!=z%4L--EGR^cL9{}J0czK{}Io2-2>T=`y$q@M%V`x)B7b*KR{+vx|gotdEjOoso5s`HMIs`&o*5=tmhvq%$zNZKZwY)e8@ z5fP-RfFPlYfCNFLs}w;D#SV%hiYVk}Lm&tW7$6{B5d=}}6bslz5fDX1CBNr=_WJsM zet$i$GiTbJJ9EyNxp(hYO;$eX#l&chxia@_{)nVoBxCspI(BTNclu$#d}_O0M>;E;id5J%{>2y+nKlZ;VSNX1E_i25NaMb zf||#dNv2$5sNdyZ4)weIB)FRNCQxzb6>tY^3irS(q5O3-`lW9I{q-?s;ngKCHVz`|OdP;%Inp?y~%f~<9x z1O3a{|HClMgOix|&7tOf3#jM0Eor}3X{+RG81H_itwqNBDv|f}@&7P~e8`1$J#CV& zMb^B7h08o`ldnTof5av$u1{_UCzV~F+@5-yt-${?52|=>NbX?s;f7?L%V}N5&gD8M zcS=@#(>b{t`87^mpvJGOrQeu*GqT3(CaCd3Ca&qO{KR41lY5Y^afQ^=EBO`}=k!YM z346fa=rz8#y7?rZEy_>sL;n?rLCW<_?yu`0Uq931|E-<@$phVVNPKl$@*rf5AEY0H zlW({3gOe3sDP8f^QaF@)6jyCq5{r|DAzwuNQ;_UQdWX1WINS~Igo>v|K*dudp`Nqc z1@&BI6x8qE?}n;(G(1PXF;KsU9}D$8s&P=?qZ$wOJ*o*%-=mrcbslpMRGf7$R2+35 zR2(%4Dvp{ASHdZ9J)BB^6~Eo@UdMB@VsXm!WRJyJ4?x8^Goa$C2ce$Z6vElWEi+*y z?azYxp44nO0?vUwj^h8Jp5HtSpXIt9f%@J3qi_px)nib8Bd6(z^@O$#lhX>F<4SQ41Gf>Zg7C=3BdKT(=)IxX~J_pai=b_@cMNr?Z zdI2gvSq$}^fES^@SM?Iq_o|jaeXnXM)c2~2pyE0Q>U&kiP~WSHLVYiw1nND2Wv~V; zg^DYeLwz4$1=RNf%AnpOS_zv`{$;4|39N!U;A*J2@fE1=O1%p8eSkGkao}30?+mPi z%}IX^Dh@4&ia*yweYa`@tPeLzCSL{A_YP`LQM|O7e^HWOc|CbMb|JypB4QV|n(TG9 zCvRi@C|)8Rf3idQ@h7{IcftZF+3UQK{HB#VBwDXL`>6 zNmsnIAG=Xm`A+fyWW`IO;-zE#|1tSA<95FIgh+pXGTH0=oP5&c)1tNa3sn23 z?0Px>r@naSO!7I(Cpf=~ls{{-*ZD2^cazVF76+i`zWtH>5BZavzmori1yHirIiLKu z<^M;tIDqsf`hCd1=p)XB%t}YrAuKM ztVg+CrS(%TqrQHn4Mgf|D4L&Z1artI`61XC>ip+&%E|8}(VpUrCZz90e+B#;Hic`P zf;6i17%0Ag|ee-{hvp959j0MvL5gc`5gpvHAjiq`GW zl-un-4^Fw0_Rbd%5ovFz$zJDvww|X#t=IdZ#%CH-zo%Qd2P~iT%AXi5OnK1sg(*P6j59{Z7D7&!;D!zXK?tqKwpXR}f)=$<6)O=V1 zH6NBjt)C)z96C_*gXduJ>h}g^Dxw@V}p$=X+D$VO}ISZ;Q-}eI|RIcT)D#f5jQ3 zGrtcgKlA&&ly_kPl%UC-z6IC)HB5?r z z_Ul)-{8^}Z@f%eAzeCl3&g|Fuls|0!{Fze8IG!*5OQiqjP4+r}r~G4brD*N`3)PPc zcKz)CsW0B~q*hPW{i`BUKF(yXQ#G}k$<;-(Q|P&mHB#%4Kgp??8V?JgWUo^zwYKH2 zBbuEe-Rx8X`iOH;YCY3mESjCV1j-I2LXC?Ts(*E@+@+RJdgV`yHb|{+`Ua_usIOVH zp-6w(|C_#X>Sd;HoO%U%U-WX(^pN$`M6%f_Xy*h?q3qL@P;o;uC_kGF6@R2a#UH7Z z*L_Gs)_qS$K91}|UgP*vGhjK)gcUF=H5NZWvrE}fb}0aNz#!ZMLs08E3}x>kQ1&hd z%HHMDj_gVv)ctP`^}MPD)I4YjHP4>!?@4Mwzgnkyl5*fxr2p^!^%`WY|2F8gf4vs! zyuU5fdH;2AI&24JAFhYm-?pcm>_7)(*^wKd>hB2EUMIJm&dAz-c7fWDc7^NVjZp6q z+ywRB!Oieq(z`+JgS$iRgL^>jgKvS_2ls^92ls;72j2>1r+UMeU_P7$`#^oKxi8fI zxF6L1xIfhX_-lSAGJ*LsFx6wv4Q_*qiw42L@OHQv4u*Q}FeKHJ_Zj=Bp|BA74$>7r z4TFlG3ZUYr;ZX6@olyJG5m5W&kx=`%yI?=kN5Q6~-wm}t9SyZV9RsyL9SgNT9S5~P z9S^lXodC5zod~r*y$7zNANNA-Pw#`;pH6~DNS_RKu0I9pxxrMZ=Lq*hJs+3`KY-Jr z_NNa(?N4VwJqLIY>N!hcs>hyR%tY36jal&b=Jcs&D;qhA2E zzkL>JAH5K2U;Z4_bBpJpo^vdMdS3DZ)V_N$)V};hsD1iNQ2Xm8P|rh_LhY}Mp!U}e z)V{tLYM&p4_WnQAK7AR~e!CRvIm>dW=PWCrp1+jA=IB?#8T9*QsPmLnP~VSU4Ry}& z3e-73KYKrZ4gWAMJG?e^J$5U>Stnw*UNhP2tWPb+ZdLWL|0iEVXM^%%e=AZq!U8DS z>ugHhY~_xK=0{1#k8Y9P{3tX(y3OS6sXI)M|0jI|c4Q}Zx3Y3q>Kn-NqoVxin{X5Q z-B5m%da&zzQr|~DQMNC2FZI>)yq$Uwd3NbOwHK)7c{g>x*}->|j(<8Ja$WD5>~-Et zjXmc%DB3x`>XU!|!0P`b^+V*W=trraP(I>(EK;8D|Cs($wS)gSWY-^Y4vS{*m44wk z`+u(Q1pWRDS?9u^BgUnA>0_8a&M_Vd5< zgYS^#r@n{s*FQkD_aoH#!3n7RKSBAmpP~HyN$NdC`@bOTxy32BozqbLJOkCgUv2!( zrJl9%`z^J4n#S*Uk?T8Wve)?|^-sIrxHQQ9_$&1v>eX|J^Kf?Q-;(XQ#DD4kT0ZN-4W%2y>VE=}dw|EGBxCY4rAqdm)44Jscp^Rz}<9r}~t#EbN&rpfsKwAv=u z5eut%`29cm8#)PTUh*e77pGkW3!r4Lb4gmF<@bsfFOY8WLS6I`=hC#srmrVjyigx1 z9%$h9tD)PkMpo`J%O}0^Cq|RfE;oHr+7;B-EZRi0`2o>inby?wSEi++_eGnDrib|1 z6v-AZz$&jZE@`mD!T-b6&EW~-;R9$8=&TA$26_)PHA1pKWs&3 zk?Xl>iR7m_$LIxFxf}8=Fdz1Wq0(MTXI$|A z+=m2D@3ef6bPDdDx2nqV-3z+8GGPmK7G=26g^3i1L?s@c+m< z2O5lA+cP9>DDnklXy-+Dm^>`40J#?Vq1l7s(7zo255sT-)OsHY^<3sI+V535Ds3$D zs$c2dBJ*mrXy;X9pw6q1c`lRjZ0vc;gtYN#+UHG3n@oAlqlr-CeUGKzn>Gnq^XxvT z`+>|pbBgk_&zzDrm2}-VNIlcj?uT*C^t5TP2b_Uk^YQ^VpJeWDS|R<={vGn1WMWKan;U`8YB}o|pC{ z@(;)m`Kh$|$fuAY^3!S0Ape03xxQ!97Qm0-bEID&eIe9%BXix)r@cV`G+v9K#tWH# zE>2sDtnqr$)xQKaZcE&J=qX>67DY}fb&RT~*wvFxJtb*nre9`MeWl3Cw;Zaz6>fg= zF>hCJ(qD&q4z&dyMBWN_)9yB?_a_-V9fF5m_vtR=FVkZGzcPQZr{-|3?|7Q0=0fyOFZS5` zJ71^8_6^@a?Hj&@+Bba1^(ub-J}tIi_=}$b=^SYW)@oX)q=ZLkT&Xemvy@!VI77LG63$L+yJSK*jY9VFK+nf{M#8gNoA|L+ukThuV)NLG62*K<#_3 zfZ9Jah1w@v3H84&&7k%P$x!=^6sUbbD%3t94Qii|4z*A4LG2GRp!PeNus-y|=A>sq zJqOK(+IIw?_BlZ~h3g4H?GM86V;F(k$e#oEz+8Ae>3OgZY!0=rXaTjKXbH9dYz6fk zv^CT|^D3x))YVY?sB571QGbs0c=Krg+H{Y%8*B^P!0Xau=X!O*o+=x;-`A(>e6M}_ zB+}!Z4(XlK74O|3;>S9g>~%V)cS?`#OGqcq>!SR`c{iqag#}PDzXM3W*~(24ZC^q< z-|_Em^?$q$KZdM!Z=s(2;+{&k{mOso;%nI1-j<%9-pBH>|0iAhmcHrQxAaTzkF0%* zsC~--xC#A0c-pach%X1F--UdlY)Ja;)K||lIQ>rK*`-6$N2e=}C`ccgt~luqr4x4# z6S?jJlldKBdTifvr)d2iLHUhk_<#5fRQ=k=jG|w0p1ae>BClP~{vYc7{4r4RKk4Wv zrjJ9;ijGg8NP7`yf=GLXMG*Zx8V};$du==;&V3^K*tm^k+$J*~@<&sk{NGflIN*M+ zZ-!?^`ZUUSc$@t{97z5L;K(EF`=R0~@d)En2uGuz3HL3VmHrU*yoW!UO}{=~Hb=6x z3#$wz-^1`I`bXfe@KJaUJ_gUj$KeV11lLi;^JMy5yPhZ0=fUd8^U+T$drEBh7~>&X z@0~vl=TQGM^grrZkp3*P`U$D$x%7or&vWVQ$Er*v-+%kEMdZ^y*4Iu4e6U~ z-fk3GUlp2%LB-yG-W!zgy3n zR?og=yVLj5Z_S6dY(DIfOn&^o-Ix98Z`<|kPu~Ztd-kUvpxtR@?}&DPA@}cK`n#6z zVETKO?_m0eEBuY z??v0Ml1~4AO#i|9_hb4g>)*-r6V|_@O@AT1 zwom)rO40O?eLxjooG-QyfZV6*zN#<|R)f_c`M94oeDUPhdWGD#TE3ca5mY_8Z_1~A z7as+;{c-|a?co2R*3ZRI>*o@v^^*wCLod|&scZeg|09p2o_feyH}#P}qn-wE2W$xU zz(!E}k;~v#neZHOmmkW$WI^qRv!Tub0#N4&LCR|%5rW!3gyAo5;s2rR zLJs+6m*)Cfa6e{v@c%FYHivZ}>Fn=Y`&z1A*a}v_t9-HjJ*<+p;%eVD)EA(Ah&^xP zyAE0F_ge1%$IIGEw)+pc-|c+u$(Ot0da>cvl#{G|a|ft#y8&t+-w|pb-^t2#@pZO& z(#6-6blGFk_Wy7W@=Z{7{bu?f^>p)fN0vQ@?2~)=Zlyo{N^cSAPfyYI$-SWV$&#C_ z$oKVzlgjdaeJH2*6UC3$_4V~5UH=Ot4yC>RQ0ES@ef4d=fj;dYZ}Z(je$AsnP~&{N zr4RNEMb`Zo0(C!-*>?_8e)fmMd(B z)(7>{uPMH%vNJD2*_oH% zdAJ11&XAA%MLq{vb_Ozj#l9%%U8z^ha!P#5&<{P%`9E@;v(i@zJHX}eqoS3*6>uvo zgFQ&+xx395J%8^>xm7;))t})1VaezCf7qM!S84D6+y5im{vW;e`L99k`^%yB`|F|h z_Zy)0#~Wcc>ZyQgXA@LAo1xly9jcuz)T{G>t;jl0*ygr-sF$A0?C|YG-bFgB(UttW zkoT3m;p4eK&wrQ~P`|s`jb8iTw_ty`2M&XKq4rB}L+!ivLG8QtL+!KPf!dcGfZC_L z3$<@~4{HB)5Nbd7KGgo}1E~Gdhfw?8kD&HnA4BcGK7rbQeG0WdI|Q{4I}Ek|I|8*I zJPHqf$oW6izWQ@`@t5rXVRQ6fa-AdS{|7gEysfGCxXXVJ%de)IiKefjKbpzU|gVQ(ud|M2~Zto@Ft{mx%d`mes_AL_$KumM!R8bbA}kz4*U$(D}{-$n! zuY|JS&D{2rt-mQ5kqpJjzKqli`PDSZ#B=E)*X=Xe>ttjQ$028mw4asXr~U*OD<8_p zw(tEZ98|?bpXIy9fYbTlOyI!Q-_9lCs4sQQ$5G`Kq zNWO^EDWjX^>nvKl+65*t?p>`N&i}0){J)Lo&6ZDk6X<2G0h2f+$B z*sh!Ne`L*vAyD&pDD`VT-r>%NVK$G4XB60V49~ceeAkg5n*SbwtoU{${0!a&cfe6_ z54;=7?~jIxPsc#Tr(@wkI1Vaa8V?n>On{2BCPKwo_t1{!=e>XS$p30ZX5eQHZSg<3Xr;k?~`*lpp^#D`Ph4T91%= z9?qBpx9)dmKqv+MIN8Egp&lWwF@wj_mAo3F#^Q=7Q|FA3lmK^6inei0;*SJ9H zpP%uxD?|M5GZ_nzbzdO;TA1;yi z@>4HEd;cHGzpaMyZ?8c4w^yP3T9^JYzq6M9$=|fOU;gH`jQ5fG{%=MF^Plhkip>8F zCbRF)*vL4`-;jukx`YUSP+&EKfr{NnA>o4NF;fS06s9Vox zZatqv&DSr??tPWnHZA~aUR150<)rPW9b)f880+e052(EDwGcSha z@Df-7y_vCnD>Qpom-cj@E=87Itp{aS>%$$e0o(%{LfMZ-PGt(=%i5wfUf)KV?A0 z=b2FPxgRQi&w`4#v!UYn0Ob{j2a)xBEd=%4Ee!R0`3Tf=tQ=T_c5bX%b_}MD<|FAy#-cZlE^5M>1?Ehgha$l(5 z_4k8%zSSS3S%;g#gO56aI>g7R0Bq5RwwsQu4WsQu6VFv@sLgGrQ|4mZLFU~}{{ z;5y_7VLU8^32-Ld4`)F=f13?gAkTrTVBdM3IW;|;_h)*lpF#gf=Ksl^8PCU*&bYI0 z#E(6ZS;75|cjji!XZ|EO^F-#)lO}te`I%2)SLDY?$38x-{Mg3@na{uiDB0^go4L@+ zRfy)tRBwLq^U|9igXYIxFnMw2i>Al_lPSP_&TbKq(02K8Wf zqnWFbPn4BrmQY_k&$7%_$g@jJ)gJqTm6^-UZmm!{{-aFfx>lOZcYrgotjMdx*!e%@ zUqj{r2qFkA7BBL%sD{j zPnQ2@(fl~+^mpshljtMPFPXoa{*-8b{4|uGJ_FUyU!nSW*2?{6`J`9=#ONQH=S=@c z=3ms;Ec&Nt^8lj%JM+Bh|IVyL?~DE;njYfEFGw~&4sG6e{4qaX1+HfP$3gk)s!;oo zYEb)->i*b!Q#Fv|SwHc9)rbFwx}UX3*ZWnqq28;i1Le09;0|~Z+ygI$^4pg{`Rzn_ z0D9p;SQox}4F6BPnlJUB{BwOMf879TJ~t$v=6fUhmFU6$BkOwsjbW1&_n;HG-dGUoy|EC~drV=d^%#LVXV0O3y-IWaE&Vzd&l9-^e(wexp!$K`sc@ojJE9sC`UHSRY+-3Mg$W1W?sePU;S7t(eAA@$tk?+W9boBTJz z9UUq(R15hLLQc$Yu+`+-q@kG)TSH|Y5%U@J?ej4?L;3FEgjaVj6UI?OL{fxg?vY7p8qN2i1Vaq`CyIQlBfOi;d;0Lean(( zMAO3>jZ2>OFC@JQ^}rfUOP=#TkDQDQYowMe^1pzbi41EbmMr$agj}!WMbYYkH9C|m z@h>I48~Gr=Ybf$Nr0bj;^818hf0X<7Gcv4kYe|WJ1^GJ`FY}kW^+3LJwp{5}FRanG zq|E;^>4QpEik1#*6qKy;ze4)xlGUQ6!y5ONyy{;|db8*n(b6H`Q(EUQC%v%bHPO-` z-(6bo-$?qrk`1DzOXmAO{ukRxzqs8d@~wfJt)9j0NGJZ<;y=uF#XDR5JISBmY!fNJ z-DIz`)4zjtsQ8O?{Ms(%$FIHVe*+dk$zEr-|1B$bShV;{_2w7vmEPhnXz|xRllS}I zF+KjDbj4o>us@ZR@A}_ER{SL@{yGR1f4vVCe^C#1>J$Hm$h`k=?eqS>NWTlE$6tQx zrXOeg)-+zlMru zzJZE=zIE&S&aLlzx4s{s?AwpF?oRqo*t+}4|10Ch^M8?kpEQ~CfBz|ye-*8r(@^c6 zvFpbFQ(wGu*8eBv6P({f%KvV%*E#3^!{k3ji$~CN-~RGnAb*ncxBomWfReq=KmLC$ z{{_+F5z;LlsYD-fJX!Hss=tb8@kkt0yipZu9I8R}uX>is)v$chD}Q3NR#r{Z*UGAs zXRc|u*d#;KomDJ+NeUcZ96<1si6;~ud#T8B9v&ZoNP;pLE+SmNJ()xk_hngqJQ1c`O z%I~E@`Mor#``mbm{7XibFH8OTpUwMgDX)1izo_w;&U4B~U^~kH?|DaiWSw_($cpK2fcoxVN2v3TPEh9^ouSS_ zy1-%U{G9=n&s{BO4`kDU*6hw`&Mp!TV^kWc>Z(4C$p)#+a^u0!+g zR;YQ{8)`k~L#@X?YV3g>eYN+ zg?yO#y&A^R{wq-DJg-8X^Q?h7=UEGN&a)2ceCai)^QdyDbEx&O3i0O#sB@o_pr%c=V;au=C9%z(piU}DL?D* zi>%LK0hG-9e_6+@+;5`AGpaYg_$%oxo`Dw6d}H#rS>KtS^MBG6&wS7NtE~JX>qlh8 zGos>|6HxKYPf+oU>e0E+Nn5XHvVK9%ik`B5M4Zzi{pUNsq$fpxb<@wf>9O*S*vI`& z`&t+0pw`77Q0wNu_~kFk%Wj>AvX_5D*~@>R?B&01{tIqBm2N$r?AUs$k}Z2#Jv%O2 zezt0M?QGf0Y9jrsZnD>@ksWVxZPD7P3Ds_`Y}qmP|I`=n)X7eye1el8QvM>7`Tl?Q zB_=0|W-rlmpS;-($e-j~nq3zbK*?UGUUq%U-#|2bNxIp~hUg8aFhuF&u z$!0HMmBcsj|FDGno&{IKY^ZaD0MxlckaD_@At<{RhPs~-^dI0~bF5y@|B+=+^WYBH z9Lk=yfU>78q3mfZcmTGBvZq%;ooieTb&hil)HzNYsB@fasbBW9Ewbj-b;z1W?V#){ z|GUQhZ=bDmf;H6FfqXjexB=?CBX(}kIlEJ~;*ZYR-6*H)=>l~fT`m2_?3W8fXz+5bb? z^Knq;5aXfz$pk37f2_TydQZ~t$@Wz51Jxhdo%`rd*JJGe)i319P|a@qBm<>!VtS zSiR36tG^4N`ui+YKNmvv=Q(&Y`sbmpkNT3@!xxwr{~Hgyh^%=6)s{d#ms<*_ z;1`SFbm&0E3&n5~a+Gq43rdg`KP-c)zZAZNemT^0uNANqxeWFq4qgfSz?b0wxC-75 zSHt7vd&TYFtH=kD*T55SE&Ls>gXiIE@LyOCt5AMD+={#b)<)h4FNPJcF5Cp`!_BZU zd>vj1x4=}m6=uL~FaWp19Jm9vggfC?a2IR~-+=Amo3Iny4R3^R!R~Mm91r)xJ7N79 zyl2IE{66l7{LOy2Z`nK9w{(iV7kYr})_Q*zJNogm_mpmS6x#E*_nG&4KKKDtob@5p zbHtC}9^#OX;q}A?pFo|zeJYvsLvR=C=rEjtd;}`4ISTdrr_bPV(m#iKe)a{_^R_Rc z;-;42Zs7NS)Zd8uPaz*9{WR2iKLceaeuc6VXQASz-=N~A-=X5Bb5QZpA5ihq zpHT7AUr=${dB$0B=ikVRJO6=-JO9m&{a*0`TtPdPq%Y=rJ%QN&v{iw(kUtJifmNa6 z&}vZeV|A!_uLhh8;{%?D8gLyok@dU8T2S#~?SLom81>gdo=tiJR6KYQ{1{#gN5D&< z;?zW_IMoZa53Ec1AlH8>@=eI~pnf-3AC5(Cfc{hDhRAxZ*(ebEpSa85Y|1qzeJAOc z!=GUi)bq?H@LhNX{17&UpTaAl;^Ag+8%&1Z!xX6Jxv8)Y?WVy*m<}62A5=V?0n=b6 zRNU-`ijTA4qp-`|SR5M&c)a=aI~a(?vnS{4d@dZg8#&&I1eymFFXf1=i(Hd=?=O%S zh{dy{6DPG$e&VE7ftIiUO7=Rf16NtOyG4s zK!(WetRF{rUoRF8<-V$XesKqr^adLMkyWRuJ4^cmHUC+Qkc zfZ~%rN+&+;D>7dFO!hkc1F`3>1H>w2*dx{FC;q<8>K_!i9a+Ecg0wdxFc|ql>5xEy zUDr_2#_10C`i4P`6Y0e5!viB|H{#qW(r#f9q@I!LA93ehBKlFH**9qM(P*gnXbhAc z983P%^lKb!wY*^Ic(`xbguuP%^}hc^>iKxtJ(8^+$a9>@f%~kz$$?3*I`UM?O)Hxs z+V65CcPyJ8xZmVra9#8XhumFL59_%zi0c?N19vjA!z^DLBqSqODspQ9a(=kri;;v%SVeE}*SU2OAZ zY2ZbhFE0gNw)wI|WIUIe>~)F)j>#{J+{fa;GU`7;{ZTl(v_!H!SN<=()bio~(W`$e zpsuIP@~u?8_B>A9w`^75Rr;g*x!UgME0XPgLdJ7lV2#zcF0d9>M=qz_w6fPkyPuGJ z8w2Yt-^RcO%eOJGnSArgHU%o+B8Y6izfyW)bW7lMm;kquuI~?sM|W=v?4X}RJljR) z0si08cLvrk^c0Tu>=G><5?{X=*iC*tr-SrkZ{RKK$KJpm>&M=}0m?sC_I6+&^-W{k zApO{{bi4oWK;3`I7fRo?`Eqpkd!pG7Xup$sA8Oz90bC6~gnAzO5nRIa(vP9`HJ`w1 zkw1mcz(cSA9;RL0_ajixrH_)X{nKY~2mBoFfnPxF3%-PkJCDHw@HkZ5`xOik?|%)) zQ13Ue^)dWEY=!(C_1Ab4{|`0aejt4^=|935@C50ak3YfV@Mm}!o`jmOzmRWs>8Zf4 zT))?Y|A+cr*BPkad6ABNI~zDhzBTmcH>myB@2~nc_hK(3!$n)gt!D?_) zS@mEI(wk8Z^82#*U`^xzGGw0D3ML?Hp4Se_Zq<=&^BnTKvWtS31T}vy7VY|2nAr z?Wi|YdcEZv%=jsPvlShJ9Z7G3d;^@seUiLySts?w?ssRq-(4iz{f1oUjlrAHYaK%5 zn}gjbr+!2F)g#y)IdH5;@D|f^{tr7iJ%hKRSO0oJ^-FT2(%!+omak7RAI3R-Br{(* z|F{113*JV052wFq{Tg8X8YtQN1?l&o;2q@KS~NI#yVW;XvgIFQ`G-oj{7OGjG%PsM z+GGC@JFxzSTRHasa4Y>A0eg_Hd>x#-f(@_Jc#ksbI_{<(T?gsr|HjY{`HQho{%;(V ze;W_wPbQFGU@c-67{6BUf&NJWgNw55g(FMV0OurzwkouZM zpB3%CK=jWCpELdQ!KLVZ(M6)^A@go=@I`n1K*sGQ=?lkrmWYg3VUZ~RPz3itN9l}n zF_d43LivRfD8H}_$}g2d`Kje_jk7Yi0+z!vSOH(Q@nZjvyn}qJ-21m0>b|}LH6LDu zT90d>*5O)c?^AX1Bwf3S{XepuV@!^nKdeXAImU)y?EGOPRK5zRbBj$-=Ma&k6P!0h#`8^+z0O;~-He~k)k$X` zvPb#ZhrAu!3k#rRud^?>-^v{qZ6Bg~^NSBiZ|CaJ_6zTsd@%UF={f%=UHgR(m=Bee z9|k`{)_y_Me&J)d3H>MVG~-G=%$uXZL&#at!`6PpIU>^ULh0@IU!Ot!{_AtN1^e{{ zOp1Q#=0E16o2tk@7W6_B!z@hg?%+-qZ?ROuhuCwn%y%lf6zt=pvIZ77MXMMd+D7mxSt( zKgsci5@7+9>~-pfF17siL_6;%o&Gfl)wljN2qoF|H4Zhj{xy(VCVi#S(=(kx$7(d^QdPNw55gQC}$C^uACg^)-uT zh_s9UH+@#fZ~ClI2)!?wEt(#(zJrp@uS2`DWh4(JxT)vc$y zTTc&5za`Ymt*@tBA2Q{7D?fgehd#4Soz^0y*Hus|K2AY5%SnM zf(6-Pn+zU*$=(Rtj)>9Vt9LQf#aJ7Yr=nI8$xIFb1=-ej*cF*Jex%FdF` zI=M&rSts{}?u7+Vve%gunr!8s5Y5i2-u&XJ(wm)yW@o3FJU#S)>Dm92E;~De`&3!^ zV5ksTc2<;~oe5=UXF=In)uZQ^bL_r88hQvhEBdhYBjP+F(*HusmlS=>O@G`?xAHb` z=F-0A%{-|4_$2)*_RJ4GMSV4o;rF5TqheL$|Lo=hWZBJUq3q&9D7*L^lpTHEt#1+3 z{CvS}XED@#c+u=dQRpRG2TMZB7{BwyOGWx!WU|+BLd7O86Rn*nRJ$d1-S~g%i+4&x zFH=6jSuRq3g~?v0EVR<(mqoL4=(&HZLTkyN_b`XBS@ABWb`S3yLLuAbZQTFO1>ks>XsQdW|)cpAr>V6-BnpcOR?9mY@ zdvs_azo(+!&yfH3dC(Wgile>^#q`IZ;-ceFanx5(an#pP&u6}YdT-=gx1R5y`#zKX zANmiW*!Km0q`!BO??fo}UBS&OrVXp2Xh#1<%0q^v}-!k^e&e2kN=Pzpx7BF2EYF z5+*=TIQITX6?i#v9Nb6#s_Dx$$HlK5$=6N2}Jpa!gwjiJEQcEa%*b2%XwuU+%y$XIvJy%1udyQLP8>sbj zty^zfx8B`Twcgu>uV=h;-TSSN}zw z)7=Ply*EK!@6EKQb=eJhjdM%5J1mDiU$ z!`yrYmOeZ@!p(mt)b$_}AKaz<+W&_~k*;08SCbge70zO zc!E3r5P4$wUMtV@f7q4lk{svU7oNoR>G~n{PYzFUWk}pIHGDs^?mMJk)5Fs&-}JEJ z7NtYhfRT$AU8pEN!GpLDIqrydg` zhl|1sk+Y)DS^E*^dC}IP+DVGO;HEEj)2&>URb2N=w5$8F1nT}Tg}VR$y+7qpUhAqD zYF$O4)>R2qoUzO;U+R`$?v`HxbwA6(+IOuEue5pma(Er%biR0%NdH!w>~&rVziRS2 z(b`!9)$UrmKA!(mU%c~LxWevBxk&l-CVQO?;f*F&h!$s{=l*O8Z?pUJdU&(lpVv+1 z_y6IomVcXQaR&J;&e%@Ah_fTS$Miczi!*jX#Sw3~{d?2x-)<}SmgSRP`4gjWhxeNP z?eKo;YZl!n(qH_)=?{e8G5vw?`{;eqcSX}f=J`R%W_O_3n-Aa`=i~5)upE8_E8r)t zeSl^UK83OehoIKOVJLfW1j-&9g|Y{qLEZn)-TU+fvh2&3Q1;~*>6#bEtv~pGsQK|V z)cp7c%07Gxwchn!)a=sl!@-W6V{ZIGEDUm6f${RDnd?=AcU<==m%ocwXi{Fq<- z1;1Ff?^Kw$;EGrGO)G+|$1~yNi0=EZ;d6{rf^$}6oPINz_x{7bGfrBMq;tRjP=40q zU*SK=&;S3K%>Vy||F&|;5oqgC^&Z{*uk^%K7s8dK>p3t)_C%^gV$U}ra$F>qzp7}@ zfhFe`S2tPDfn)W=M`~HUHAT+V3X7nv^V-Pqo;r~PE64MH(zVVnifEl*9JvHp>s-`2 zPlQ_MUZ{0W{mjp%kxP*;l-7$hvUci=*6#*xdkvwU%SvBk<7JV{kz08hi`<{WA~7qP z6uE+Nia1R~#pTK&3?r0A8pF7(Yro0rh;e+tz7PlcKvY1U49#BcTcA{n&DP!>Vj z%T&6}1L-f6W<^5eKe{_xwCAe{&;Vaq46;-vN%q&Vjm!%-^n&?&M2wZWPIPlgVD^ z=14b_yNhPG&@+#FM0%4y$>|xn1r|WbUZ+>&R?FX8G`mGQ{p%CSxBm5s+-Ch75b10E z>nEB1^%rS(fXQBGpxeLOMDF{b$S^B6G;+I@8!VY}Lqy6AHJShabIT2L%WYj+K)#4G zJTlty-6@*A906qyM_T{b|6Bj?|2EI=wtUhne`0iOWQ^&@M#fWLv*ACMyL|cc@?CAY)jq^Zc8Z3v?VFjFF*UkPP zS$6P2C_7jPcfgrYc6An%U7ZbOSLZ<4)ra6g_%Q8iT|8p_;{89UdHERBynGzWZax8z z!?{rNbROkrmp&Ppk6dHpQ=+XS$wzlT9eED@h0&3#!R(r#Hq@4403xKgzB1c|>^M^;4?r>%~>MtP0TD^TO}s->@q ztV7l~t%VvVWXhE*Kk;OFWIgE`XGlF2kqt1;sfcWZJ>X{a8rMy3KFMc`UXN^XuLDwU zYh=57J=;vr`+p|yi0ribc>fQ1cImFjo9Jt7d_%PR0!iN;(Q~aD8{ZPSzCDq5DA$2; z*$Wk)z72c8eNfNE_CvleS)_b%&Vk6g)EDxw|F`t_tRBhKXTOVmKN9nsA3%Hm56XXj z1oht4$M6jM^iQCEZ~G~n01we$`Pak9`kn3azMe)7{{E&V9`6(Hd=}~WfT!*fWQd>r zBJwx+pd=V*MY=G4s5_*4^Vr@G0!|DO|Ya!s+YI_;w;f32KwKjp72lE040od4&9Ob+*h z_Wbi=+L52T1j^4PLisr_l%K0hed^bxQ2nh3)!+J1^SnWh{8HnbhB@*}jdGgOPtN~E z+HGty=l?lLCN~wWohDH2UXi2mkY*`SRU-eJs6iPJcIlKd5$* zu|ETqANw>g=Qh&S9;BYZIfG!FGdSmV*aHqluX#1Z%_sS6(H%L%-0^~xE66$1FZTP5 z;arEt<4()R{vTPt?-&UuvEJ^o@f($MH*y8nE9$!wlusIuehlUQ_dIeOvd$yN=Wy=G z`QZep^Tvr#=aKg)9o`G4lYSr6`|FdS-d~?gd7Vd2LDqBMsZh^-?}zPq{xA)0izWxq26CFgnEB{Ce-`uv!KpJXG6WeJ_qXk^@rU4Upgap9{5O($M!pq zLY*Hz24%k=hqB*Kzy~=WoJ%>`>3PU{-}XtU^USB^ zvrylES_t*sr{`d8-lu*Zdf}p+*n7t>AnUtEi(!EK@*>pv=u1%Nrc2;CxD@^ki=f`K zcHkP?DTaE_Itq0zTLSgI^)jgUtxKWaw_XnQzV!;I^U^Y?_pMh#y>I<8)Vb>_sPop< zQ0Jzvz;EHJQ0J;^pw3~}LcMRj4(fgD*I-@J%c0J3*F&A}Zh(4kdLz{NYX$rfZh|`B z-3;rae;qzf`WC47p=)=Jozrg1@pvy{{IW z#eLN8@gg(iPxt1WMUHpg&N+bHNpSXw*q!|*dz}M0@34;KPf5pqzN`G$&x1Md!2&4R z>%5=yft5Qenm<*&`NbbeZ~hdTKmEkyPje2L9{*3e{OMurW@Y7(oTJF{r=tAnXHfq1 zb0~jGJ=oz2Lz1Ik|h31#2@La*=4oTuI@o_})ww)#D}RdV^R-O7J+Jh}R= z%mtC}%2bNh4y;muJy5}egS zekDNl_o7^lt2g)JT>0%wa+}bP^TmlG{qUO1bAa4SO>QDGKJ{`NQor8Etq*6HHjr%Z z~fAs2SW2k;#Zuyc_FXcG@ryudo6}c(2o8UARY4=K#y-u^-WRp`w^Y`eP zuc^72*mWaZ|VK3g<@AAs`bL8yL)p!ylM zauLfXz49kU^Kx@dpO@Q$`kFfHW%sPq2zaE;S3w*xGPH^2(m$?hNiA6d@;@G_bcY9E52!fe7O45&llnAodf9bw{tq>OdPB{xe5m-K z50t;}OF7N^eo)_6>JRmOr2$aS0R}?N>)XiRt8`HAP{ylY>FpxpHCVLoDh+}9t`c%# zUC$l4!;m#^#3n0-=N7<8Wy5ptq#nHo3t49)b4S?y8=0&9rq)sHIl|q!qjD8D+?_jt z{ObQ`sQ!AlIY&0ja+*ccv>t+Mks>hw|$8Y^Z)C zQ|_VM$B@qK))OkOTpJIkQjEw%fN|EIoqXGQL6$|pEw zBIQ?_%=iCtSDCz8G<$*`d-6)|YvfOI*5tkl3!r4Lvo?2~<$p~ydqTR|lXCPCXMOG# z({B*Xo@|7&7Zq;*Ho5)VY~^0Je9|j_Vsu;XR?~0G-9dfLqT5CKi~l$MuH2ob-kMpcc?h= z98^5`2UL9dCsf?`7gU_-dqHv8-?@$RG(Z2z_2g-O{ws1nFPQ9gJb9JePsL@VGcT*; zk)L^4H7^bpK*?UGT3&T4*I2Z;O!ej$$4hT<8ML^pmdUmA>X;t?PrBl=ggnJ%7v)`y zthh{6Ty_cEggy}}E>k^v-d>mdah?Wwmm+6H>sdb{PJNO77g|2W9SzYZMH{*L%Upe| zp0?cY%h9)jN%TkaqY2dfxB_baG^L#?o@RMhT6@j%ho4d3)EDox%4Hgx2lNr=hP<0h-%&LC(+SGHbawmK#qD2LD|e&ilV14~ zquuguHhs6e9@N(?+Fhi-_`=Y%>(?je}Z^>qVpxxI#Q1MJ(sQcXy z#v?u4>SBj64=67GR_LD{=eQ1=%HEB!>*4u7)chC+H6O=A&5sFC z^K>GV9lHm*b__o`Det~KiwE+iyZI-(`KMU=)VyhKx%=I6$dr3P`SI%y(qY#HqH z3H~4IoMkzD2Cjgalq-Y!f83RDCFw7_{au9|Sj+w&>bhQm@1TDb?uKjNdbk$qJZ2r# zdCY52=P~6_=P~P{&SN$}oyTm1JIPl855rCHbGR8^fggGuUJkcFeNSL3)c3`=!8<6w z9d^an+>dfP8EdT$1W-Nmy9NE$kDoYX*bIzPIXU^<1*(pm@LZ(tAA{CVh z(LzO(EHn3SO`?~IX z?z4mY@p#m)ZD{K;Kew^1zJvH_+f7`@3Dz+*|Fjv(k8L4ce(W=3`N7Yj&UwBd{dDBZ zwp)?)T}4s;a2u3A{0hn+Zih`5?`*pR_JK#tF79c&%huV~ZTDdZE*9?=u>*Td_Bwmp zM)%$O#0Ix4-rx3sYbRiX){76eJ><%;LDJ&Gs@LoYtQcH;wCzu%r!D@b?J+kUHppIl zyzRHH3>&mx{9W7cT^Tm$viL;XA6ywW=&|@m)noNSdtdKoD1Utt%3q&?^5efi`RmhA z{`yxafBhSjzdi%y*MEnK1O9-D3(i8FKb?aa@I0)@{J8*=kpF~jm@j`pou~Z`m-GGG zi%|bJ{}0snzW;?+QSK7d?;l-;`dy?ea9||A(32GX{z44&qK}1oudp24xSst#)VWy& z*x?ZSe|VO45C`?0gGx~EIah{v5eHR)w{FM(L;c@>d{Xp#s8=KF`At>0hWe@{dF=bB z)sa^)PrOjy9jF0y9(N7Yd0b7X^SD}2<53&xJgyGZd0btn^SEoF&g1IAUDS6S)OlP2 z)OlQesPCjUfFHr@p}zaj5bApnjiA2&&=~5wsy9HL$K42Z9(NPebEhWoAZ!Yk!DdkR zt2rEwd^6N{SX)4S|K%2_`_&TaJo8ql?@+XYI>&1bYr#aQ=U2Buec!bW)c0ZALY?C! zL48lb2lX8VKh*aMlA*qj5rFzWMiA=z7%4D@^bpkd+f$*w-yViKA5DYRun*}_-$%%R zieodO&PB7J)@?S_y3K)Fx4BU3KM(4Awzorlm$n_$cWm23#jzcr=6^@1b#(=U{QrN_ z-AR&fe;e9&ZSR5lt}Xd$#4^8mUTf!=_a#N&SM3Me(tiJ>=(*+qWSxuN53}Jw*beGB z@5Q6}g%8;KtPdv5Ab*_mP}1Ne#b1L&+I`q$uQNF5k)&vRO*(Pc5alQC8k+Pd%!iV_ z&SOc#tlSLI;%n90v-ol8Exv{pUyn5TiKJ1c=lq{^#n(?JDZYLx>1kxe*P`O<(NOXA z7^wJ~dWh$qO`3>&azR1TbJSPUGuC9@mq~ib#&<%}^ESTYl+O5$7rCwpCVQP1lA`u^ zqG<8@B&+wuq?f5z|F=&)_Pbn?70Rpb_t*OI2vPNMU=NIL~Z z5dAb=Kk?-oHcpAobP>H>hs8;6G7gH9-hzr}W~x2Tf!>CDj^h8}7xQK(6{6SwCC{Oq zJ@e*Dwt8U9cJdWL{qB=PyD^@Uq+)BoBq;(bAeW*avtXWR|BnyJH$Uke%Qru10s7yl zM?41Kg?sq_oMHE$&irW`K?IRXLwfjEQcr1bX-t|(beZ(@TeZ+EDhQ17HTt9$C za0S#pWF^$^pRJ-_iW@(K8jp{l;-wa%c3(eE+G_W8oya(>H<|AMCv7l! ztH}6oOxjHSI(PjP^88=2=1b9k>02xx{vW;i{W;Wieqs5(RK0e7CVnw*Thb2tqxV7F-F4#~GaX|LtmpR~{N?N4f&sqYLNOgcdR znGo5&gCL$QI-GQb{^)%UNcm$)N3Hy^q;IVJv7{5$&heyg-F6`LeV_E5)%U&hR-f`| z|L_AWVLkl_72p2^x51yG;`@_O`;Jpk`;K4W66d$1)36Nw3Rl51c0cg{$l8zmPCL49 ze;_ZSp0iN`3$+kW#GM~X;&_()FW<=(Bw}t_*2E*Oy0n zd+HVW{=ct1>AL=QP}h%4Jso^qkahhXU4190ap>&kLr=c$zOGhJcV9QSyQsVG4!9QH z3A>{2L4J)BMBmfbi~eYyLH3h(`FbO3K10gg?dxOt?)Fu?H<}I;K1Y8q_5APt@jhhj zAN%>D-!tnEwa*&>wST-HYTr2!YX6uIwSRm7YXA5k<+Xo&2wC4p8w9m~dl+i}_z2YZ z(*{GeKLl!@`6$%BZ79_K@-e9W+c2p8+i61Xfr-OMQw%-}SxYQye#e&4r*`}7O-LH5f_eap~mzbrOgT;^L2`@r?q-YVY**4_%= zN7mj-k@i-Z>~%i$MdPxMME1q2eQQjQ|0jRz#cO>ZyE0^7yiWC+eT3|bKk4bA^dCTE&dr|K9f# z`Qn`uBJKQOve)^^_ak;#=jWso-~X)q#P_FsC&`}=C3~G;e5b8kRX?=&UiJ1Y{!My| z?_tbx?A!0?<2--(&QhO#?-yEpe-8h1<;r>A1!TqdqT>5Mq2l|$pyGS#!B1WEm7~6s z3oiNop}v})e@z}=ddXM8uX!8ezijj9iqe_49zW!|Vnq5I>yOT(a-zlW<*nWd{)*H) z<1qf;QG{-8cJN zQorKn7I1v&Es`y6{xAJj%g6rT?N4i{{wG?#+f=W`Igt6+)*qnVcqd7uU7yKb$L~)z zIUw5kK6>V1(4R*B1SjNAf%#Cf*Gct1= z?^g9iuHw1R-_Ol2E^+Sn_lIS009*wJ+I`3WBP;&Rhl+O}fQ#tYgV4_Z;d3_df|WU!Ov+b@Mb-d_Ec~z8}N&*6=*ze->HsGvxh+=lli8`mWPhsP8&S)_QxM z`y1mK?;mIPdAwh7uhv^M?w#m=!LK-MqJOg6?j)%GylCk!`Cma+zh8#B4rJo8Daud0 zIK}@e>AD_BJyZR!!B}Ui|8>|EzJXrjFwM;;`E1d2{|v4}aW6!E(?8S7v;T+f85ha1 z&fET3T!+RVQvYoK99M?qo9iz`);L1q$0EPuUN@wl5r46ji}>|CLgN7~PMGKSSR7Ug z6>q%*bJueI58J~9^h@;>tUJ6UZ>2zoa>c;A)R&of%3DiSNd1Ld?=aU0rr1r<+h3DUsP|;;?>fde}U#- z)|&jWf1T+$|0iANN9(!ISFU{G-+(OtBFevPgz_(+Lircfqw}22HZQ*LZ$WMm`ONx} z=zK2H{{qXG5c$$g-|D7E%WK@fqTD3LV>{f+yx&28G=FzO&7)mV^W(q&%iK*q*_}O5 zc4#k@{oV&<@Atd;54iOlbn7_;HIELP9Y5wjV(a;+{{-W9vG^O2{vI>g>m2ugYw`)v z+W8Ku-S6#sc@Kd4;+!A+rzjuq{3ufXCzHL-&;FAppAyX;qvyW;;{Toe3C^$n(=Z=O z_By}$&shH7MYG4Gn?3#meWG*Lf6?^kM6<`|q3rDiw|{@S{rk(x{cZWASN`gefBpZM z{$KxP>T49aB+_5b|4r{nzG8Y$a`|N0;~3HOko8qgvaL55GmiUJ0m>d%gtC8eQ13lg zg8Hs~Wyr!pV12U!0ScoW*^QchW`fdxptgCo4IV`!2gfI`cPM`I*1D$vH3| zO7=Q=$+ug%yG64*s<&rxd+E*YK(jj?P41N3+4SuHNtfN}k}SK^HMtwI?2ahAa|e{& zxf9CnP!H?kuH+ubEh0Uw{Y0miNWTlDXI=Dm)BCvTR?gCJP?+_e7FieX!8aCkNiB}?|KO8cOM3c+^2`(W7PWy ztUrH9@?bb>!I0!fX;1GBLYu!sq2}*nQ1f>fdh`FtI^TF4YMqUMS}!BvdiVs~0!Klu zmnWgt%TrM6L_o7=4x$fGcSCk)r|4Q;?($y}cp4XD6z*y(Crl_X z=Rlp?%!NANDTG?DMNr?*ci{XZ?Ej&jyGNj&yO%&ccb^B2K77HA3!~C zT>)z><@_J&d*-X4o_~G__5AZA>OUP>oxBEF=LzEd^m{GovLhcO>l|kt)N|DJP|qPh zfwkZUn7M)X|Dn!#K81RYy9vI1nDc+A=eS#7b@G1(*R1FKAKt%?^M9!4hhIY3tF2J> zY8$+fet!k^{~X&P&;OHmK%W06A4%5!bWidwTVG!%@59dU{9k09?=hL@|H;w)={`}< z|C0}xp7;OA&-4G}L#_<<{9pB&UxRx7pZpW)JpWHV=B7hE|4;tbm7$*hCx7qCP|yF9 ze{f}}=l`n5>V@|F^k-<#|DiqqhxYs*%1)n#veUmp+3DY)?DQEZJN-M9o&E#rx$IeZ zcwv6wnSQd{=aU-+WVbIQU!?tb=TDLL|1z2X`%nIx^&-1XI(GXX<;QMcO8%Gp`B1Xg zxtx5($~6i=v)iN-@5cmGe=X)oY(V>ja*_)QsZZ(r|G&xl|9@n&>v8DgJe2~KO^^R4 zU3R?+^*UfX+X(kNfZZ zBN@Ho)BsdG9E5s4m;%+W5Y+gjLiwjKRQ#Lh@K2L_rxKky*+HHthS+I)fN2L&E7{h+`Q^i3lV zi>8P8vB8opu7DO-JPMaM!vaHL8GH<`g2QcGiARv-_aBGy`y=3bI1RGf?yTS*ZB@IVe9r7V3T%P+s%=d8m0l4r-o{XIyyx zADBcw*@qWMA746AvaLsG^Xx@ZGwuLLF|&q0RhrvzR_Zj1~q{&@{* zy}S6U-B%dvMKd^-BRJ;i(w=_^jzjR-hL5;(5%ZLBB z^bZ0ntX}*-T(@RbU?t3URs}vmuXX;R@|AuRSWUeef5`Z)39Lod_(Sv`2i75L{2}`F zD$jW1|E;|ZfsNGLo^cjiIG+YKkx%tQu6s*hGu#bzKB9D3Y18t8BK)!KW4;J@EZ+GN zDvsF-8}G*dQ@`R5_90g_q&?0-5(TcEIOUkz-{Vm6+P7}Mzk_-Y z?t7@X>jab^{{bql`4K9v`3WkX`57usI|&t^oq~$reu4Ub)6=xC>u>g~$2*Dke+ziL zQ{Wjm1OAR)=R@sB%HN+2)C|f_o(ueiU5R(ji`bP5CVQQ~0)KMfdBm6(I>_a{Jt#y1I)H+UpTA%;<%Le3= zKe`^uUp9pDgN>m2(-^8hH$eHz8=?H=O>TWnpw@F!x87z@?KKa|Kei0sZ2f5wyp8L= zSbU4fb+)aY_W%6yJ)!!PbKZ!PO?Ek4R&S?`&rhL59R-}BA$zI17^qZV4ntw#k z{SO4g>#xJdC_8%} zl>h7pALswbS|9ny@&gYbms`XBA6fI@A*lO52p)$I+x>qeXy@kC zH<sh&zkIY#s;5b++{yVXZ{o@ zKl5i?@OhXICG#D?-~=l-OEmkTdV3a6l-}$I#IL*xmwMP!EcE75sVRasA|Gr%p&;OAxmo5!1r`|)G zmWc&J=?}DZT1LJ6|6g#8)w4phb-EI29j=1v=Z8@J{>aL$wtUhnKmY$1TxX|6t6(~yG45X`8``@40xog31;2!4 za4TE|zjEy~wDq_hYCZ0NT8}%S*5fXy_4qZ^dfW|V2lha%=e^b+)(zBs*bjAo4?wNY zgHY@65c$WK9u6KwuDJ4uX!je^|8IiV@V%x(o2utQ;+k)R$AgM%z776Je%1RORK4F@ z`Uy){{Xe+%E8p3opMpQT;{qvvGWd(?C*LX4$l+V=qs)~BU-~!t=xI5pYwm%)%iR4r=|ZL{0m;*^mp*0+a9DJ{{$!5_5CaI-K6|B^qbNrbORIDhKs`QhBI2tAb=$5$b)YIH>obDnXsARi?b+ ztt!a-c`x-U_yg(jaO(=r|Dn#&s=|ke2dhDyqg98B+q{%l+&8B~^!=P`Qaok{YeL0k zwV>k3+EDK~)giy)sk+E|Z~a=RbEkSxao2TFaaRJo9y?hd>OKAj(r?HA!f^$pQtI+`$f&5-g9aWb>4F`)HzTKsB@rOU=sak z2^BZq3KciDf{G_wL!ApHLY)iU26Zmf2I^d>nf*U!Qc8cWH_q{;1XE^U^Mon>-%N{;E-|C27e zotq-NotJVuvh21fyWI}TZnuZB+th>o>X_0K`Q(BwDV^Z>(#|P8sJEu4i%7h5XG+%; z5AjgS_S_IfCkUwI7HXT1z_+Z*oI`#4m5F#@W+ zkv3jWr95HdH7aF-jn|VR{eQ}2uk&=uXp<+1T<@5a=cr%rqdWu0mp&`m-beW_eXQkU zKZaiYdLHUJ##z4cs+V%S|7ZDLNSTPN{zB&Cq?F0@Bi?yYq#rMt>~&sFdBx<(qQ$A` znU_;irjb9vc`fBtm=7g;o!3*QTK;LG#i^vz|Fwm0py&Pnl-Z`AA)5bt6Ux861=a7F zQ2l<}%FVKT(kp-U$lR1Urk|TqM174Sg`(Yeh`u<*F@14LDf*_7h-i9hMYoPqFo(Jqj)_K4_{Kk8m z@c&THcMd@Lse@2{>JXHlIxIc%5hy=(l=AXZ-yrMvjE})CYx)0wD8KYAlt20o%Kv>2 z^?vRNsP}V!fO_upBh+)BpWOZ(?H0B3C$Zc1{a+}*^$V2WIt}HwekH&B)^Et&xz022 zU;NSUQ1<>0sQCUY)N_|}P=4w>)bGh&fI4UR6Y8AdFDO6sHpN5z0@+LHWH(P=2p6l;5iY z<@c_F@^A4_ey`^g?MteLazeWQ)k4)no`T*U{C`Mx#2cy|k{zibvhJ=i+3VB{)iSxZ zX!{lP*pWJ_2Rm|Ys4mQhlD$s7&~=tSM>PKyZLhxc)?QS;KGe{aA^xwC>Gga=dYyyZ zfIiN1W9TN+}+L90+p>Z|Fw zHI#%rzO+>+5R(6E6KWlj|4URl{_i%C>u+PS*J&Gy`oAR6&Lw=5AI`k@tKKr6|HDzp z)Mx%BXxEiu?P{H=efi5&>rX}~jNBrU7RsPK_WvU76%;}Go2hZYu4dVICOX-o*+He3 zv0ihb>{%Y;B0F$9lwD{CdD{pkngm-|EckpWPC`F^N#pn*_+JRj=0$^%gSco1s*A9AmI5S0CU7;0P| zff|>=)~_LbBvGa~b?AoQ%Y|D0sz+gMTe-(;`zyj$-$x8Cug z32wcR@tGKU0mj40R^Q8^Nmk#BlBw?{k@{XX+3URG);C#Xolgl(BVWApsz|=qOve9* zrkXrWw0HqM>->$-O!6l=(G*1y8gZ0p|~ z$@FioNV|n5^ZUPU{~Xccjbid8I+4)3majy#cw-(^JW*=xu>ZGq@c(vy7g#>&mA`sq zVdy>6FAOcFzDAKnBJJY;O}`}czUh~Q%Fs8BEEP=;i8q!@ws-?tyzv3D;))f>i&%dv z;TE_G%FllY*CKxex53p=etr$qx?KykZa;>KBi2F15$mDihfm;oxWS#b8==oc>kw;Qy)Ta_N_$uaIXUZ-rIhHdq;wPMotdv>leg9dH%g zW%r5wKl$GFd>z_Ny6lB0d$9*9UfK&4Pwa!TAN!%=rvp&&#zCm{c?c@bIt&$e9f4Z! zN8$L=Z$jVGP7V5V49>3TeOn zbLcn5LF@e_)VQ6p^j|{1B5V9kLyaFY<<2NS&u`9zekWby2&v~>=noj{oC}?WUEu}v z8t?ONKFMc`{tW#^|8yP$k^c_;W99Mxus!!ta;)=j=o0;&m7(5us{$2=T?G|~#luqSxf*J} zUlm>;y_#EJb*Ol3_8ZYSqDHF6;-_n%;-{KW@l!3ReSK~CAglxRK1y9!2(N{TGwMOb zE7!s18`%Ft?d$79#WxM0;+yNC;+uxFuXwBxvf`N=9#NcfLuwxBan6mY%~EBrZW39a zO-$y!|J0_b(RhS(>{N5*$4<3Ky&2|1$zJD{)RtB*PqcVM_4X`oCB5ypp~V}CCf}CY z#`Ns}NmsnlHdXOPQmPMG@rI~)!w(g2Btyj;)PwyBrlugvpNaDOAxlq9O>@)3a0cUr zO#ZCYbmSJ1jMOapo9JYUTxUTMM4zpGV)t_FdJ>&n(d?Act5VPHP|qvdLD`q~Q16p> zfRoU7+Wc@@XC10kwYqneDN2+3x7&zk5Kn*VE0{ z3u;~5MY^u1H`&cUfe(Ca!y+1W?odN>qrfsaA0 z&tY&a@^C2o{Wz5U9svhaek9a*KH>I%6x4VL)?y531p?IKg| zW#z}Ny`1_A>FOWEp1hhm8OA!VrcQxf;p^zt{%dYN$!CkErcQJ32c*8~sc%^M>8Wqh zKi&TsP~(nFy>F$?v~ukKk$L|=bryP!CqzFxb&e}T?A_edLgdEO1F@4usSa{8WXN;% z;?xpkjb{XE{E+J=AD)-`j+D1}M9`5z6j<3S~bx zLD|pEQ1){Rl>PjSc4a?5S3d0W7f|1S`4Y;WZiU((ZiCt%eg(BZ+zywKe+QJ^-U(&5 zcR}qNzlPdx?uOcL?t$93?uFVX?}JH@^HKYMivy`1?}o4O|Mcho{?FoY>OaVF&XLsP z*tdA+sEGag#$?|6Pd&zb({nJ=vE$z=KX&~4)bC(ElKGxhH9@0RKKo*vd8gI_V{Y*S9?{V)_pa% z-Rf?;-mvy3wZb*RnxEH%>xC7s*A%(lS|;=Rf8jbN*AuP&x={Y%TI(%t8w zAMYfHl&^2H*J%*G-sFa&?K9AG-y4OSkUzn>A>0_|L&;v}#_&y+zlmu34AL2wwS`U5 zCpyi-txVrsw0*+OQ2T%uZvSp^``6OS-D>%ySN`ge#BgiVCx+WlU!%xvBK^hxn?5Pr z*7Ql?0Q#m8pJ;lB{YjQ={tMdp2Vn{GC;lr+u8lX|0By^wuka_9pHM{5pIE$KD_2B=Z=Et2-{-Zn8yzBure|kdsonBCWhqxR+(I?zHEPLN4+|SK_x10YS zOTRaKpIff4TMn6W{goeo)jvFdbhQVmCqH~YjCJzE17TPAAbR!d0XLuIvqcYu2f5=9 zksl5Zw({)%VSBDia;!5X{HS~Vkot#)A9H0$KZb{gS^Dtsq9td#HMQ7QZCD*+Xdd@D-CMho_jH z=l`V39=^)F>!SMz5M)clzXb)WzH|FR;=%YHae_No}lUPYknTZx;0o?B0;ThBXC^I^W( zt%czQwhrD6FJ*i#7QZLbzlA1yokiirCNCAOo%f;IU1HbA`9Jl=Im^N;DIf1F7b#z6 zve)?_yu##_qS-C<+@Dq9wd7B5J_>&b^Pyy~vpT%S@~;)mZjo+w>tpnZ&bshs)2|oJ zZhZn}mo~Wl+vxW1Q!BU0@=34!)gzyUx0wF3@E6qADDt^TfARmO-x~hX^jpI_&^L{2 z6HO0UC)*{P-GXMXcETmj?(i;H2ET@@;2zh$K(i}*;dj(RPsQGamYJPkRWnaF7vM=95-Dm7fwU`WhZ_(DwT;iQGBIEMA$zJDd_z%WK z>yLEq?>Xh?{$2>5Cx1Sa>~;PO|7GQ_N`tokRBzAXi_+WrgSP(uMIYz66uwM-`mO-9 z^>>B)dgY2IErxtrf1=i3EY$id2etmFhj~*etpak3NX0Z{=1-hRzYC;i-c)wetGMY_ zE@m;~5Kq4}-d977b5*Euu0}cCm+DaW<-he<16k|h8mRSH6KXxyf?AKY-TLad_0@Ij zyB6v`)k{+x(ID-*G{q4KX*bZ{i^cUt`rE){uXBA`Lz8b1t(`_t?KZaS4Rw@>T4895$P}f-}K?MRMUsk zGSN4Uq=}}7tj7$=wjQC~w=AeQA{**H<-oPv&s=zl^gPOGecTQ;?(LxNYkR2m(}8?T zoX%+-VHxZMSHUiJU-19Py6;_~;)QN-J-h>IUEc|{uDe66>mE?+x+m1S?nOJAS9d|} z$9qG~FV?BmdpG$O(_ekJZz1IUx|rHL5Bu+TI`2!1`pbS${<1&R^RNNbqjh{gvi2nd zq4p*D@O#d;el$P&VA@pj@%_KF!Hg&0{}UO{hfU`De`${}o?6GGGcSfHKl5T}+M|%~ z|C!A9|I&t8xv8S9W7T_T)8o=}jyfW3B0=sq#IG zN1LqYS*l0Rvz~$SyU&s@&huQ_Sj)%$pZRp#J!m zAYU$>nD(;ubCPKNdlBk)KwpCDAL-bOSJI|%y@}3bk?|=gf>w|El@NJN{Y3w|X!8-; zeVhh0pWcAF&(p2F8T!3U+J7_cZQ2<|eQ!biuI5ar-_=xlf6wX(|Ls?1(~j2l94LD- z7s{R#LfMldw|)m|{uD#C8-beFCGgOud1*_@f4Q_Y?H#M1^M8})r!7Dp>S6znTs`t$ z+Pg3wk{>(te%eBt?~5d3hZc)m=ldpmoh51Pz>t@U^8aZo$%p?JNiQ=Q|DU$Pg!q4x@&9RSEdN?D>i?~O>(V~9{;f;fWc}Niw%+>piDde>L8RS{ zCVQPv-TrM7xo?}(wpzI_(zaN+&m>dsbCGginCx}FbjxjZ%dIWkM!rPntF%3qZ@XxA zZU>Yd+iCq{|8M*C?`Iq+R^K=?|qHH2tBpZ_zi6 z92QLvu@gtrzF|Cc-Uqp#$E4@}9v2JVq#kH??>o4}`62ClSO!nPRq#jGenGP{KS9~A zpW%9V63Tv^g0f$~K-sU;Q1d(*#ATA)Bc7pV&^VG?f3qHmrMUm+gGUTyCmB0X3Nl%IW6mGrAf*L6YashS=S zW1Xt$SHrHbI(l74H8-E+vqj$Y8uUZ=1yb&s^jhiB@vCWi{J+&xJDuN)v~h*h*C4&F zr8h{w7H*o?AiW;kUDP1`I^`=(NN+&-L!0W0W*?&R_34SGZHR&8(wk9E`?ba} z8{PoB!W&^Mya`_3G`6S-)OYlnLVZV19%)k zdMom2+#&sIt#sbUbLyqdOtilJwUk=tPg1K zhXjwv~%?|+L!%Hhq8|uQ1&qs%06aMPWL?gkx?0meh}V+XsYcS=`0)>$(4qKnA7>}s;t>6Xq+ zM7~4B&fJ;a+sgGy?{4LKNTys*k$k;O=KufPa=qPhYYY33FVVR>eSqb=M~rF2INl3o zNBTlt=Y3Gu-7j73^|yS|D}VLK!1Vh~KQR3P>T49q7tM}9^be&!X!?iJhoWy986=t> zGM^twAIx}YK10T9i1du#qoVmqXm;i?xWsupeHbi*!{I78!mgY1f8_P_e>C= zjDoT&PeR$1r=aZ0(@=5MXehfh#`=T*hq{l?LfzNrpw{tNsC8T=&(q{-?8o!zo+d96 z=Zu46;duBQ=@ZD;a31IX$W7->N}mWORcLn_^sUGL!@EhJ4)uTeGbF<|saNObZz1RL zp2kerVF&O3LA{?f3+n&(XTvP?AJ2_GkDN<6ov#;?Ud*|85!Cx(4%GW$#Zd2!Mc^*d zOW<+jd6fGOxfFRXd6Ka??Lr{AyoetLG^#JWcWTjPx&S8bu2~J zclnn=UB_~$>nMZv{eP(MQ?7t|4{asXb*+NB{tuzX?<05#{c6~d`qscx2RQ$Shc++{ zQ14~0gU!&dhk8Hz6F7S{`+r!K^o>xzGw>-K1~);y@3t9U;QF^f{Z7GWa1Q(&K0?30 zfVIf~B^*M3w!+1qa{dqX9^F@PB-{@5-rf$V_w9BFL1#8Y`7{5suJ`Azz>n|YFt zya(zz#@_VkbBv7pJe3|;$8+50WCstVA7mUi&@WiA7wsN`L%(AGPx==nM>Nmu|6{}k z=)XZfmbm^H)bozxP|rWUg&)E1puV^HJ=FIlPrzC52dMqRk5JDueu8?Q@iWx(>61|V zhEq`chF_qbXPk!i|Nqeb{~zjk#u=#R8NWk)fASBg?^~XQ`o8Bmn1ud3)N_~%P|soh zgrCB{pq|704fVasi%{RG{09z)|3W>7xdinb<}&<{ak>Ka{-7trW8c+}ff=+D3v*#P z*bSD4Jzxb`p8OS|es3TS>ieCQpnk`*GSvS|R)HND->cx&dPej+o?he;q}M<`MnA7XmLIDLXVG3QsNV;z4W}X3$?(|k2h>H@`~BC#+OQs6 zM!&9uyI=y0Cx3kyLf-)9!t3E1up!(|zDBSX{cQ}VF+Mj)X1?7B^?lQu;BMA)6R77_ zO<^4MHiLRkvpH-|Ja#jDoa<@<^}Cz5K>dG0OQ`oTZ-uRqTfu|W+ZyWk8WN%2-@Fa# zea<#e?{T(;N4N9;|4`po^}&B=-w*52-(;xY2ME9m=z~z-FHM1~=uZglC4VZM$909_ z!Tp^7L;c@FI^2d`$bkATQ6|)TqFGS?KamYzM9zVFk2DuPvzq;XhWza98J#j@_uGkl z#}oe#Uw|Fp64()rf#``-I%jm@zWqY~AaP08jBe=le`{jX#dl`h0sFxFG88xT%IKb< zxS>ZzZ`#BEi?r9vWc+^yGZ?wI$oD|{WZZ3fp8u1-_2PRn?sa9z_dxopUh?DrX(zb2 zU&h0vr!DTEF~CiSd=KRQjDfBU`5s7q#sjVl`5wrF84tNK>qF z^!nt3eE0OJjHi(sBSXHgIyz$va(QIPcUYgvcn*1A@w1}U1NrW0LB?440UU?kU-GMB`;=7M$RpMDdS}~A8gRE_!XsFIau+o zk|`Olk>0oDRngL6#r%@jGp3O~q-3gS>9FF+k~cDDklrXVU9@z_e0nouCg}wwZ;6&J zc}mIK8MD#9P%=xjbVz(QC&Mv$u4wDK5WY$Oi{Nai^fybIDL$D{iTN=v!&BjR)@w<| z|H%iDOG*ES_~jkaXOM3`^6kvu1;|e!zYC|s_uw0FA)E%O*M3iTaYpoc_51KG>RAF0 z;xCu79&}E;47n}qc{$YY@Rq^O@B`Qmu7G>!$4WQ=c@=yBekhrB`4P-U-qJ+Kf*ahj`~>k#SjPGT;5rSf3F+ry`y6gbm8idBUd|8(}__>~%I}Y_@Wz#RC1m zwd(Cz{F(HeCz)KoqUVc@FEjWK|L6FBsB@>Srr(zFmF36(ldf~9?HM|E+L5snS?5lo z&YgBaojZLE&p6R~V?BE^jv}92us>rj_0{z3GkJXJ{*3QzogL0NVC(Fl(phJRM6UC& z$zJD(yUvb^_I&*t+K=@d%Q!*3de8SboXY+97S7}Uz^T{%&*gil=h@^V|IZmeAh(G8 znDI01BsxEdv{O(7(Vx_Ku+KPUN#+1W(T}=6s)($8QykR(u@cn( z1678~Uj^Fpf2e&{Jk);jYN&Cp3N_BvpvJj6ztf=pdy(~ibq%QZt*?O^ubSv}y|tjO zuQt^AL7hzbhwC!yX39TYo7pr|_r0FTcwc9-*Gb5%Z*o(S>uZqNh9mOOY&ZwM*+9HQo*GW+CXZhgtmH2V)cP9$wI1)6On(PLt*3mb_4)wR`gss)T|5N!-ti!)_mUrmT33%i zt%t#kXARGg%tw(mZy@XKvCN@1e;&)^+|AaTsChA*d`p~>nUBLVI0CMMPq_CL+I<;i z*YRZLQ`E2d2JL=44Rt?8!+6>s1HJGW_qy>zI={+%F4NAhGG8EF>#G22yq>r8ahVg4 zHICz<#ub@z6P2Iyv5A?JNZ0*DCYn{I0=97H3XiDa*Zhs;2 zYnfB6JkS4Od-^Ro)|r<1hI>7b`ln~kaAjEcuLEypzJ+{=eJ!M4Z)eW5d~avYB3aV<(gSH0P+r@C@}v=-(mYf{&k!?)T>*UroKG z=(W#(2kKm4KGZqE0=O5x3$_1#4{E=^5NiLv2x{NI7{fGT2w?8XjLg~uPSEon!;j74}efX5=(f@D$DAQy6*ws+`*fmi5*tL|?bFGgv zqx-FOq-!6$9%?`L3Do{-1Jw5fH$r_+@Kf?@Keh>3zoWJpYG1VlzRdpnv&`r|>~rKQ zoFjYz^}A_bLhZx0LhY}&LG81?f?o1%huT-|fZF%&gxU}7g8Cle*HHVf-S7nCvIlCP zxfc##U$PG#r=9&!`|bl!`;~)G`=dip`>(@L`=%pM`lsaqrA5#i5UaLd9|CpyIysP;uY|*cSc?Q{i9qLvf=sL-F3l z% ziWcvw-k!x3rMGwwT6|Z@0`dfU)O>Ok=j{x>0hE#M?}y2|D@~xu&#xQC+b1PA1b$z zd6NJyvTp0cldu7l-@P90K;Mvl%kDLTvS*ELv~t^NjjaABy8XBf%5JuS>Q7s1KPf9W zOYu%1%a^5i$1j<9Cs|}10w(hvfGi?9K4SshI7C>E6Wu>YssI!>poJIJ5l zbjj)r^Pyy~(>1G`<-bEL(ETKx{&ml~)B4vvtB+mxU0FS>e?290-MvKGy~|{;)7$M| zACdXQ_y5Sp|Nm#*Z~5*OV;XVa`$C=b-)HUM|E(STzm4+%%O}0^^Zmc9fu_&TdXW0~ z{+~#@y#H_dL0J!(eo)pB^nCwMG(E(>4VG;F8Jd586!QJQtf7$a|7AS}`Tk$laJxSI zKk_2_`8d4Dd>sKbZ%4vE;1f`B$tb9}?z`8v*(T!{X4ICKHO{|B`$r=f2&|Bb8}$oidv=}_^AujVJl(*Q%@!(QDix@<&;# z$*1-p@|vu5$ZB^jRJ$KTwM#nJxjt(nB(AJ@^(Op(R`gu?OSpjat*{m6i`!rl{0i#)c{`L}-2vrqcf$LLCw4*k z^RHpOukim+@xvadbM?JY=jZ#N&dv8joogR}I?p@^<);rp`RT(@=k!OQ;)|nj75jj1 z;1>FG3@V;E4i%4ln-z_ZzC%9rDgGZS4mgn&jdOI4Gnec7F)QkSD|LwayPp}SzNDXo z@^7c0{M#?E8R@5)7gIg>e`Gz!_zn4W;7t7N-zv-`X)9$9ho)#w$c zR(11LgNmE0L&eQrsQPL^J(s(Na*BIvy7hhcTJ-$6cDBdj+d5G5qApY%do5HPTMz0z zuIr%YQ3AX|z4f7H!r$^@KVn>ID^d z-Q||+?bg=^$}ZmxRqs97@;m*q@6A@+)Hgeyak^N1pGZIZne27?XAdwrU$pk_hiZSI zT_^j0>Wgz8$bN+K@y>%HkP_%*yKmVg7WkqJ@;vF_Av4%IFDuzf%#Cf*BP4q znB^ZPTHHgr#Vy0pCpwR3KW+LEqQxyEq2iJ!-2RPn`}d@kd&=@jul&^`W3oq^eoXeW z)YmBTj7Wd+|IzZ<&qd2;k4N7$QXrZh;!nm&wzvh_{h9zvxbH8(ZEzx#9hwApbFTLy z6x zagLKck8y~1ibcjDVzSqnmtDd*Xum`{_p?;_xu5g1-+}p1ve#LV{jQbUAlkYkJ?1oa zW+5B^7s2V+7q!>3_HjiIU!GlN`SAawuOR&c?(>x^E3#K2Yh8+3 zm#g51=s$#7m(<5R`Z#+va*N0s>tCX?R^+-0q>njId+T6AWWB5Z#MN7Q8}E(i;~1|` z;bq#}1plVoW|)e+h5l*0KZCm8pF`b`;qLnVl6+b}TcOtPHmLRc6;%7%q1NvXx1ODD zJ-eXh#n*0qyKVjM&)#G6W^eWp#`|LNK9TF$Z?e}pkbThPBcio;2&(Wg!Z zW`9Tdc;_3D^2bc({{XYUHTgTSpuC6uKl$r8-)H|!{siZT>=Q5_O7=QGX8&aQe->^1 zl5XqwB>F_>RQ4aH|3$R*dm3te{_6JcH@AOhtlaOGPkQCA9yynN*7WDHFHm2j$a#_e z;{Q$mSN5N#|10}n^i3mwi>8OHhkqp7`i1s>;3cT_dl_n-U4iX*@>&6)eoUHyU7b4$+6FxI&xrv>Z^Z$+=`Yw6~be72}nPV1cL{ehHA%xOcvHGa35 zp8dbcZF7>WKFQUSk%8ABVsZi-**phKi zL$CAAbf`G1-BAAjkMcjg7JaWKi+c6mO*R}&y5f7Cx8>$|%&z7^#b38W+1GYZadvyC z_hC9vuk39{WW`IJpyH*@Q18QZfqEaND^xt+4eEWEJD}qFJK=}4+Z`4XclCgJ|Gpb;CUurItDZh`ke?F;UOdS9Y1)cX%V&h^w-5xp+&BG^AC`doGZ z{nmNf{m6PQ%XQ-?@^i+Kj{nbjILG|I$a;IoWUupZ&LHlm`~>OPjYpIpyD=nZFwBRN zz0RXKL#^C6(fkDIG4pAE80C5v4_7|(3rb(kd>CQ!$ebrkkN+oK{$LdI`^uFkbDlz$ zKM>^)o`&)Vqv09W0rg;)#^yYO+#>R<^&`=FPNe?@(qoqj-1O(&bSoD#lkpmlek}c) z0H^MMA!nkkEBrtG(Yl;Oy4LfHQ1j&_sQL0Tdaa{Zpw`EK=VnvT%PzkP++z;ygp%3Tm`U8>%m#otSB>k-;| z{K4cObAB>C_L6k1$DeIIp3FIgto0~rJ^li<9#6wF%nRya{Qk)K4Y@_+jJ2QW{4Uyh zR6BZ}eikM~&bj*YuHMSq^Tj{WcVwLYq92+Me?!fai%|3Azc}n)@@c(Yf?98vq1M|K z@@YMJ_#U>(#Xyydg{trJ9a+7gb*OdUZzL~F0UU`3PQ3K>!%-8E-L)b7^?=v^fZ3I_Be_y@Ne1pjS zz|Z!L&hwkduX)}iH~QSKDYE8sGi04(G>7u9H$y%DYXS9~?-r={VOx@4>!9~ct=m?) zN9H1LYAqJ@ryUsA9Dj8i`8Jfa$!(h(eNPVZ{%TUL{IA}V6ZKrn&-?sZKgsYH;W^N&QCI--bc*J^|ZZ}^laoGNzZ{= zhq<0Cm z><*~se|N%Kknh>IEr=8p>Hil#Ea{nhPp-B@LNAe5%L!B26fO-yiKmC6m4n)?uU_R72#1-D*U`Q(`aE%TZuEKL819GSneng6 zUOt<<5Sjn~&mBj5@y=M0{uP+a|NrMc&w7`=BprJ>Uiqu{Qtkn{QrOMBrCU2 zG<&If`ToE3%XE?C=~YJ3JT44$~fXctLIv z^5s$|cb>IVELy)KZhIwA{U#lIU79=J?$bM>#;piiJ=BN2epmhHKE5ZSk6xGT>LTiw zU0rPLyq~+=+Fc?R=>Hg(Lj51(GB^N|&iCQVa#tX?_Ix15==a6M%cU!GKeT#QiDo|} z$2lM6uA}{UXSGQCYfSb!YjZy~d7W5Lf%?&Nf7j=ZFVy|rko$?<-wh^vosGGlTK@5c zuppNFA+3W0g*ZBdF`*1M#n3X%4d&tTi zmQ1-LBIS;n>~+3z%N=vett~uGzC`ES+@CGqccSgvzlYkFpRoS%{NMV={=x41PnJ)5 z<*yz&m3z|kr*cnIU!%w`BJJY;P5)c&ucrSk_X7H+ku##{A%5zQ+_Q{FMaCO4KIf!o z{LYIu|DpNcKj9MRV(wqC4E_yQ!GB!;3(ar-3%4-eFG2au%TRvv3fu-g{0@NpW(-^e zW1;+RIetGtezQE(eXIa=Un@fS^Eh}MRwDnC@38-edfv$Y5iw7%%DWnU#g*}*{k{R@ zdaCO87Py{jqRrdtaEJ&05BtIz@Ls5V6<5~GtBu^sQ%j^?{69S9)XA%x=ebpJ24vn} zo7W&u^S++QcwT2R@Bii1H@Sgm^Bz6U)2lW!Ew4x(qB+?01S z`4gO`c}-wGl+1Sk^O{@!n?+kEq?5lzUTe$WGVd14-_m4$|0l1N#T-6UVkImSB? z#$m5+gQ>+yd2Qfj*jDM0q`V;YW)}NI-m~`SC0jlCf8>tE0j1kKf-xJQ4lfBHy%S4vF6lEW?pzLKF=L#jrImmqfCodQB{hz!%$oGHp z+T}&#J!tc%J?)$=>X6rwb~TTo&AU!e^RBb$@&ELj=l^-cGxWQg$o#lNWPaQ!+Wdf= zxAe^G!S8hJhIdn5^RXAye7wujdt18ZWgpTtFO~0X(LH(hy8VEZ@0-`p?azIt$N!t$ zKW_l~So#NH%brpH9H_fdIx-gwhLp7$K-{XHY{MpLdm{Td0g;S;bc z90k?iC*kEy?Em3fuKQ`Y8>(FF<}rECP)|Sl1$mzPtkruTGW9E;+g?H5^W@X|gY<8l z(rq0=#&JU4B=W1>7gR5t2-Pm>tfv?Arf@&wotH%J=gTJZ{olOFCQlIyq2IIy_q+g@(Iq&ytiOJl;o3VAbcO@!6nqEeZf-XH01yOPjNZv z|BtFOkF&A-|Nj|b(8L@mV#p{)DNLo3iV$bcY-hGJ=ZyADiKHkhiqRlTrHHgJ_na}= zx5%C$Qubs|yFJPlrQ-K|z0cj_`}zI#e7vvswcXc!UGMk%y6*ejNBfP1r0aKai=h4f z4{E=$Sm|&Hd{FevI1G{u7qm$GpKe~LG`Z!s@>IYKh_{?|MEH1 z?*P}r?z=euho3FP|3jT0u7^Dr;s0SW@>fv5hui?q(e6g5=e?Vt-h^&aFFsP`bZ zLjAt5&R~A8N8JB)SC8#yw!;Ga={K-D+yV7Fy`A*02l6gtJ;&V*^&EE(Y>K=WYX7ni z>i1UP!eZq8uowH7@1V{PzK4w|_XA8o|08Vj8PES=h;l!}y<0i|hubK30P4NRgHZdY zL-1Oz_b}{8yGNjYmv`OZR}pZ)=LetHh-{PaB3`RSif=cj)`ou6KSIzRmz>OI4Mpnf0ruhO}W zi?9v)OYkN19$)l5#2BdkMJ1^B7cYa_k5z`NU=^r+T2-j`LSv!!XVqXLtPb_wXAP*| zk6jM+zUAdFdAwIJzE}97?={whS0dMfZRuCMFS$;xuv##s=u7QP6ve#+gOR#bsMDw$%H(1(8`XcQwp!vtfCMWuu zn4ahVq{}Z}=aXN&-q#daeo@puq8XH5OoAt|gVaOZd4umZ=JT$iZ#>~rB-`juz-^L;_fpYNOgo+su! z>5zKX_`;UH##dnVtnqC&a{f$e|w2s@6#gV-`m%Rbk6_X``kxFe%6(r z6S;4Zw)^)uI7b3p|b$u^Gjn_b^`7sFA zBmEWX<9_>Iwfcwn23!3@e8bQWnqK4^%5{z+Ka6>Eda>^{I0>S!JDzmq+c0&wZzQtr z>j=BAuS>T33Tc0|ZxoD!Z`-)Mm^@J|s_fzUKmDldyyyFf{0YwczDckUO7=P*_&&7!ABpySmUQ|z#W&gd zH^n#A`WNw)SpOW!^siK;-H6Fvr_Al&RJ%WwJmtPwR&IvxV=FgJGUcX=l$&9)*O}>- zo8^{UIb}BalASreMV4=_X#2}~FoF9s-}=Y-zx9vvf4ff$EuZwtA0Jul`_%M{eM_k? zF|tIYUHrf4m;08Pe!1p9`^y!g=^=64XTDX8hvIT*>!!lmS>s!6^I?r|E#)=eK8Kob z$mCn^TW9&!`@XPz>s2rF=1bpK)T?;|nKv7K8?4+$>22O@_VG1YkH-_cC;GddE$GXz z8(X35#x^Ls^EKrAf4=RI@BjI}fqehZx6{TM|4)5Cu?}}Z#reC@%Wmy~dHD6cFt{E6 z&-IO9JibMqO*{Lc_Osu?3iv(Le)tEd{qT=a`;wpFX81GQ27iG+Q2zlaJ9m(FwI4nN zWfu-Z*@YuecJC;Z-8e@6L%ZWreucx?uO5eb4s-(QInZxV&w+l2O{bmooub^$)A0Yu z8>XK2{ei6Yb%y)5bLv^icK@L5ug^ifZ*v~rI_*#21-n0giFMmi4>Y^^H@uPY{Rg&& z|3cY?i%|RYOXSZf_oP%#@iYpT$B493NsQT#eZLIeLOx`Ezf>iqDzf(9V#8_GQexqN z>D5xIr$m3(1(_$8r__LzAm{C7pLb7*-v3j(wLhtqQZq$ye65tLD5r6YhZ;AprPofW zgRJ{|CDi>!rrg!a&;IA?l)9vA+#&VUPpJnhIrUSnfdQC+UiYVgn@{qYl7=abxDL&G z$oM9vT+4OuoZ2|0nO%3H$oMxAE&jjG>f`-CsC`vasQriZJ4%vLnp?e`|07p&Zb-S2 z@|sT&eT$TvTp7~-%_%KO_cM>g&Q7b8WYTs0t)Z?TnR;$XxgA;8f2*s%4Qd?PxcShN zuU*O=R!_T>JK>I!b}4P)N_ZCxpud~^8YjrU@1B%<>5uL|BwvS=_HYN(djm>`wh!t2 zL3CfyiSpWibWVx>-syg*{YMw5{YO`*{f7^(Bs~Q#g?^}gKq}?6uStXMb3fY`jLwdp zvuE-g@Dc1<0DcOy;4+vEXTTh&_&*ma?#_dHZV`lfZjldfSi}Aw>iy0z)cc+Va4>Oa zH+VhmKadhVCw~xGarr~AGWv(%t>__9<5S*eon9z?SHwO|Fq!}VNqNuY_eFb; zcM@F5{UjgHpFT+Wko$L>`XJB4K1!L4{tsj^X--MX6j%UfS$kzEj;Wnnc>Qi?@Y{8z2s;APdj(bnVqtj^!9V+q|9~G zA>Wypmond#A>Wx;kn)KuL%uVyFlCV|L%uWdsp_$MA>aF0lCq5S3z4Owr9-~|usmf2 z>6IA|$aAEXDXWl^ozFze2l>84Mamk|>y)h)EgkZGiO*B6=DC2rF9Gd6n01U}JI3$H zH?&V%pK=&E*7-7J6XoNauSCjkFxl&DO4*3Ly^QN8oj7f?@)M_RP1ynqp=7VKE#+$~ zcUZK2n(7Ufej~l@)1d9scAC5^Ww+_^|DC)bmeaPCUiQ1=q3$;(%54BHI zJ=#ZoZ~p1$lpl~=M1Hh>Bs)Ke^uNgR>G}IF=o2CbQV!A2Wapr0;{z?OR(+4KZjV4c z*FH-B#(IvW{EB=LKMBpgA4l#K|R z#z3`O3Ce$7=9eF@?62+DdaUNJ;@5htDw*{dD>5F{O!hj}{n7PNL!_NJ|K)!5E6yz+ z@4v#z*L2I*a?8iN<-KnC+M@RV{(7{-{$He>t4!wm|Ngor*As0YfS&nvjlU836PyPA z`mhj6=KSB^(DFADZ6827{cG&M*811j-^{M>dViwzuZd)??>doouQ%E2GYGHc)f+S!}EV@hv)w`o-Hk(^vcio|NX5^pX|St`Vu3zh&In4 z`ZoUCOy9=e7Cqnp7fla|EAEtRaSgQleHT=G-3}`Ly&Ed-ya#HY-b*>f9qpmwj1Hu0 ze%^-P zn}MwPm5HqR9Ds_Cv!LSTY^eF212yk+;o;@@f2j9WgHY=tA1V$GLA{?EhI;R#!0ux= z|3k?0$oBwT2p@z?AnB~rhy9NrYn_S>r#6b_jFnE!G5r|%R%;@Lufce`(ee#Ns| zr;zxmhyO{x;-?<|XUMPdd|L_0M%FPwcuc+Q&>1656uR!xFB_=!mQq%MP zAL;Td5$^k?OJ)A4$nq>FLlc;bL&|SHGfu^ zeXH=Vv~}^Be;wm=p>&l<|0+!8J3#(5Ca)8%ozJ1#U2E6J`9Jl=I$!uV+I?9sQvOSm zz0Ozu4JL0C%`T(o{%rDpZTDx3f3w}6Ehc-Nt^RG6|7+3gGWpD|ZYN)|^NoL>>34`` zS9e0$&0TK)cDw!CW99Z*KIxS|KC<8ct?Bpszo)*$$af){_z>-QY_HDAs{+1Wp#=F4AD^9TD>)xQ$|@AugL z>K~{${a>j4)J3TM$|cy1c-@m4-M7R*?OQ6rE|k9vwjp2T)ad?)|2436T{YEHB`La& zZQb(wNAL6vw$9BC*GN@-czJ4b%EdZysqv{=$5)7qZ%vcEPJC*u)aW`Uoq6I_e%A4o zskLDtl+6GCre0;`nv1rMRd2AguJpE!p{?US6vhO>KhQB66LzpX^*O((fYanSagP^dvXk%Ecrw9yg$uU%C;>AGM$# zx-U0D-Itr8?%RLsx)u4fzFI@A>tv{PeGAmOzSYftn_EvCx1QUf*7Y5!ip$!i-kGYn ztZixs#_K}qT_XK$XR_D1JM|uuJBZfKy-@A8x9i3KQ(vreUuqZ1$2lEE%6Br^>vT@N z-{dZ$t!wn$udb&p_FYK2Ub!S*ZE*9Mt^j3pIcGQLpC9^T>*OUO<+;=nplY2H1UnF;#KN zJj%U9KE*jNL&Z4*VIuWPe|XoBck#ms)sbIK^&~9f{9!QE_hpAbeMhzk>N~PSp}zC_ z8tv%(=D+9B!;p0zG#vdN_7@{yH_l&PhdK`$33VPc3a+O9(eN_b8v~!iuDk(5+t~j@ zJwJX6?)--RKlSQ-=xt>6>m8_mjf3jfc&L883)TM#ZoeiXtDo<|3zVA#UxDw#5%2@} z68unl>i-CShrDp2r+N+gF@^EziCmHz{hsWRNzvc`mSXpGE){|LeQ+6+{hSJAKg;2Y z3j9Ber~EWH7&|&0>U*a%;2EBm&xAT>ngz$h+3=QGJpYIKzUW-omGPSgWsm2>^ORcv z^?lG!Qa!^5dgw3mD#|Z{`u)nMQ0GF6;S%P>61bjvmcrHRc>WJ{ezY8JCVd6ex!6jm z-z9$rbU^jI>U?N5B-PrBm4gV>`>mky;KMwTBDi`3hI#|Do9v_r1-3k!ANULiv|VQ0;osqV>h3dF=N$m7x65Wl;X8GSu&_t3dU) zD*4r3ER-Lr2Gwr$G}-wYY4y_NmujY6o+iH(CmFwVg~)Z+G}-IaN~2}uc#-yMr+KMA z4o1sgopz;_uj7`#$}NAjTfVMazMjbZxF)R;?ePAeNWBeAX8)ho(Bwv<`7iX$lWWti zCx3#InAR8;Ldm@Umv)`yzg{%|MLPX!me$nz*DUQOyS^LKlB|EtC3Af@h_rj7$zG?0 z+rOJc^M5y!FWG6C*2eO+63zd$hVpO8)(-yP+QI+Zc;06Dq*wm<$Q^07oBocpw$zsx zxl^QF-v2j!yR^GZ-!82^`lQI+qUj<2?_SB~|Des24p9E@J~$h8ggP(iM80_H?ToDX zcR$qp>q0&9LtUZ#p$}>vrda*#|H!A`Po+Zreku*hFQ&r^m;vP%Gok!q0Lm|B!Obum zZi6}0r+JkNHP7-$pGSHS{zQBE(Dwi6H6O!J>!N^keHWt}e1_*<4?wMh2cgav9)db= zc$n*}<-z|W>s;bdyPuDx6(Zv=OCE>vqut>`sPv2FPo#a+C;EFU$o}`Kv>s{NUq6-B z$8Eo-+n-*R{&d-t}C z^GQBaG9c|m_dY`8m(m7WdHg^0(_hJzoIz=?sNa-_)c)u=x&MwZ_nmKN0yhw`H%p#1*pP=0?Tl>Z$CSDYJ;^O`6%rxzE=o-HI;Ck2<0(HvI`$!={Md)7X=ShwO7=SC zX&+m;uSD}BsyA3VU3&8)(EP|ulV_#PHa-5Ibor4vtm{jc=BCX)DvL30dcBqSoJL_&4osVLY@>w?eJkZBX;S=U~m_?P=doUe9Tv)wcu6 zKJ9et*#)(ZcSEh?Jy7;)FVs5TM}1mn-y-Y!_CvM%o%QScv>%YwFH!dHM=1OB6Rdzg z!}ahNsC9Dy%03;0vQLNLHh37$bB?7QfeYbLxCH)c_k;6)`l0>#aj5ls!oAMlpsxRS zsOvuoWglkRJUyLOD_!&SOxk(IKh8NTGQNM9%>VwSo#Q$*Pf2H<{;B-T(+g>Tk-rd1 z_Bwy3{bS{7r9+#isyA4AQF@!F(B`Sf6)jN)2kqBo{E~MRiWl- zEYv)u9_B?{dUfO$ks9g9%$v(an>T7FA##PAUeistayAa}w5xIOLd}EPaK^4H(|NuT zvxW6shyFd{xyoeSxBs4d)TLgS1gPC5Pkph@4e2c@ALraCQoe=B zUgxItn@w&hTKs{Y`_?M`Hu5Jp$?2_OA(ZTOZb`q@^4}&}{6RY7yK+h!^vTZc>Gzoa z4$CKa{JfL%H3`Gq*wm$YjkU zrH|RQVzTzd4*vd8^8fFC_i<$Tz3%BzKUWCl=bnJd|0H_(wH|J{qZ6Y0#GdIM+duY# z+Als0wLk1lKJBl5v+s2FNq-YL)_FGldB!=;c}`@U`HT3Llgn7dM|D_K_);brp z&R>IC=fzO#T=i&QGu-CYsPqxYEh4X5Ka!o1BK_z6e$wSnM#F^27+3#>tB=;xlks~C zz5K#hI0*S|>W%S?OMl1eAD2F!^a-RxyWj6Z-R}ud^Wi@`@E-ZJ9w$NBf%l>8zz0z6 zd#2}b>^neGkLyfb^$&2c|rPO@+UY8(?5ZQP%{7j zm;R~cUo4tkAl>Z367asT&2 z&9m>I=GphutNZ=~)cyVu%6|L=Wj}s~nrFY*{XdX?gmPmjcMxhHa0qH&a2U>m(ofiR zRCa~=%lW^1|B;FFPoy7DSKNIf{fyh*Z*Kj+Tl&fL)5vQ76jb}jlsl{Z><`YS|3SLO z15(eQ>E~c2=g;)>FaR&0*Y*76=9A3#f71VP?*~NwH~o^8Xa5hiKagC>@npngM8^?Q zf2EAeTp9AbuX08eWUV7ezhX10TE5r}?HiP?eS>}FVFb@?dcWB zvZpoC>-?}5oVkwo|Dg5}UMTxo8)_eMCDcBm4%9y4D$2{=UX9$C_`fdHIbl7RMSIt{ z?bS!_$~fjUpT4(fdIdZ_(QQ>gt* zGnh&FB&c)F=1}{M8{l5}P=56Mszrv!{J>36=Z7~#`Gb~F=VGnsulzx4Wci0=mbs4J<}~JJfmJ9Z=_RcS4;rwuMLO*In>D`?+?o6W4P$yq9sf2kQ4P z_d=cLwTC)~>;U!qm;0d3Av;1n7wQD{J;csX=b-n)#pt_0o%3~t+c>}VL7gY2z?)Yv zAK-f0ONAq;Ck^VnG9BvtF9WWHnNa6{0jTdFX2Av2n+<2d9H{faT&VNGJgD=^Ak=wf zKAc9r5Y%~P80x&T0P38w8`Sya15oFa4??}4_7H4?+`F&#g^y%>!2B*Qe>CH<3{O$m z!}&k=CDwU7qeq79c6SjwS7@@=c_QOUlY5BfpV4EtpHe;8?Oqu@VIh>v{{Uz7w)`K6 z=AWbO^^xA%i^|Vs^mS#3|L$jc{Z2*tPgvhCppW(R&lq5O&i_f5|9&w;{`;kjmyzYa zMfvZ6Q2u)ml>eq4{KcyoBax3yFUlB9eRVuTGDaZtyYh^;G87LF%NUxWc=$D?-|kQ0MeeF zKaREQemmnGWW8T3>YS1C^mk&$c;pt5cQYo^pJZo(Nc%-45dC`^C;Z$b8}DT2eGz?h z-0JSc|D)Hr)kln*?EPdYdpZTm&X=e>{c)iDL@881Be1x+tN*k}wGB(MM<8xSCzBXe$*Hy=}PGmlR;okrCBJ!86{FTjz;_?lu-{v)>o-G-hte(vo zJFK29BJ*r}##U>8n`GwM*COq2H`(ial!SYG3{PB^0GyXCCzZsXPFEMgaq+R^K z>0>fInHtBK%qp3R>ne$+hr|t)C0kqvW3-;C!ZOxLESwFiL9L(aQ1M(1sP%R^R9qJa zbsl^L^~BR|O;`)oB3-{jh=-cDUZ^;)HmrbG!u7BYRGfDeRGfD;+zjhN#d-CtpZI^M zbzL87zBho1rxKvztA^z7LjM~fYu#T9We*yYuDCN1>b$xMlpVMZDo(u~7MC~8Y)QZ6 zADThgfg~t9&>YGR+yF0!H$pFL0c96%g0c%YL)j7PA#P00Yy}s>)^G{DB~x}6|Bu{o z+HIM)!U5A^PV{{=Xz|1CnbEl74p@Whxf3eBXba`v?}A>^+i`u0FZj+Ke(s*k0_0fd z-pr2N=QyXm$bIf$ve)UDc_01Lev@?Odne^*zTcnO85TmxUZ+cDS1VT_nm<#$!O|4z zZNCZ4U!|IymYHsP{6FdPR~eb|SDBdsWce#m{wfQ~Uu8r2E9zk#d9I{e1xHem@8`KmL3F;$h0mK0g9we;&M;v z-Q9W$-FlvYnqN<5%8vEQ>|yuqsmx~?p9`fuMf%svWc+_-Z`(bPr>{u)ekOAckokhi{YA4!=(#@wG6#`A!Feh3MOX+Wd!3gv2U`9?qS+(T z&7Qo1KG}ISbC~G|i)K%TK-r5Tw|_(3{=H`9iY=e?${!yYkvZJ-BQi%)Ut;8Sk^bWU zO+Pwwl<7xjzJ)$1GDb8##Gbq<+3X24J2Do|bH-)94Hv?9;1W3AT@TRg!n?47c`*UX zE=+{73-3YMg-K9$;e9B(@B!33_z=oYeMI}Z|C6mB_9Dzbj}U!JMo{ZGsM7%qnV&oRIIpDx;U!kCLY?0qQP&&;Bn_C2#Rqx+mWQ2U&@ z@TWQWfAred%!fLES~uBK?T4@N|MdG$>hZkdvG08?VqNRKgipz*b-mbK_e-Gm6-(h? z#J|hnzi>G`z{{hPMm`rLQ+HMR~ zKPm+@E}Z`dbU!Nxs#8ABsUlLos>xm_Hc-vv>Y~{t^xW4Pfm-BGaN+`&!$K(8>s%42 zY58l3W|v4eyA+Q;+3^PInZCAYcIiqeyHm&Q-&Jn^uC{V@EuZwtA0Me7xW@GL0}0fZ z7-=BVU;Mx68wDDgzEPkF`lQIUqUj-aDN(Z7C1`f(Iyld17PuZRgiYZRm=uWmX=rw- zIjmql-2i2mZiKQ+EuieuO;C2}W+=PV5-Lt=1vNifL)oWf>j(ZH>b~9zHBWAXy02}Z z=Fja=cIpl&J9Q`H5#zZl(ALJ~u0Z|C(fJ2Cuem31cR=Sl_XIk*_1x>$)85iM1UkC) z-RIVaOu5d=&-qj5!2P7FACP){fiAF;;|p|!0q94s{-(J3B=h~BK$<(AkaFpPOs-So zl3{xG|5i^RkmaUB&YQ9WIqtYX`jHpNweooZoi}N`bl$WD<_A0p>tTrc{`cIz09p37 zo2!2SD*uB}=S&Yl+24nu&Y2#8I%j$m>YV8@%F7-<;z4l0v9+qbH!AS3l{t z+jwB~oa3p0$Lw=YsCcXwlwE!r4#6JxCco_VGsu@H-v{d4=UKRf{yhg}kNd(WvCsXW z&U>DRdjIPMD7)St%03T(d$+RxhbO4-C3p(H47+gNH4v_+oduT^ib zbhPwluc6uNH%xvr@RsS>|C26zJ(hWU>C)SQcaUYTMcM0dQ1*H}l)a`N?8StDgM4iI zq`*Y#tK)euFa^1|e3IHD9{VWpzOBy>l#bo|P~^HkGTG})4&YIdr-)`(ORU~9tG7j@ zG*CvlWG5n$uc!pl?o`!}Ju0{BPIf*P(ObV_rgHzLqu0J+2AqsMlk3#FodvaSXG5){ zIn)>9nHQLA_09|EIp=Kh|K|@DP+oTU6DWJX5Nf}_$gTHND1WdR%3myj@)t|pc9ub{ z$K`H&E1>$Z(#B_X;4>SaRe{YmJ{2O@vD##>vnKGl$(u#4du?Dn^&g|Xb+EYn3&}b+ zD)}${OUuXm3T}TkK=ps4<=dosDaZLg{fKq81iqo&IA^O!yW33mI$sC2oBWMv{scYq zZbx7*`FY?L*a-`vWUsS3u*dT670sWJZvJE+`ef(Zz|W@NFPcC34$5DA4>fK-K=t!S zEBBM-lV17bBL@P%nEpWE5cMTS4vKcaA^IbM!=^tHIF3Fka#S=u#Qyy%+58E#`EUZ3 zF+YBTviHA3z1MpZ>V4x=l+%4X4RycHK-u}T=(o?u|69HIe`M{G&%+A%CzRj$3(CG; zfbu(kL;0P5p#09iQ1kR6)I7aJeVUJ+tf(J}ftsh4vgF?`%c`2iydz&_xDZx>OCae* z9XzpF)sS^xA^YCySv6c4GQZ=pE{D7qkfrCWn%~jqA+@qZzYq5Ayr}tZN{@|IbQ5uW@YP=9A3t|Fas= zPy7A9mAf`8k^XAD8k?T|ztz(u>pC|b;*YM+YKpA&4CzNwRx>M~lqG+pbonFslN++4 z&jD_P?bwI6px*!WOE)9SFST^_t=#;rq5M*^WOxgdU%C~_FWm;^m)cNXe(82(J%_jh zZi9D1J%?xu{o4P#?cUWl`hD@cv!d@i9~m3n2i%+GF+bHF%1?EG@>BOg`KgYSm!Il{ zyaKs1tbq5!wXh4^0J}o@6(7{|fD||f*$)q*PlYX34G;h^)hICVQO+vmW5S%a4(c zJ$Xp^u_upYJq!z>Wd8pr>oF@=ESeuvy}{D%(wiTH=Et5e`N^yvrsw%T>GESwG2bs; z>Y3FGS$<5EAA1_gkM)M~W7NaC=#%v#^0DcCv!12CI-ciDE-vq@_V8oCZ6FhgrViStF1qB12ohuS2cJkx=$y6xUPRGdgPw`D7nN z*_$_@zC-dRe4Fz9AMiBPIr&&*+2OaL?D9KM{%jo7b&Q9)j(4GcFFL_(XCl-(f6r}y z5|lj|WbcuEko6(`(0Yef?jtDsI~nSFrdU5qvK(af6Pmp#g|a^psOu?n>zxX9o#jyN zeoVP}&Wx;Sa3P!ym%y2J-|+v)vh%Z`?DcF|0p~#3>$y<&XC9Qjo)2ZO7r<@s6R7jY zg;4v2MNsFdpF*8iE`}PAJ^nYF^~)yk~T-Rt-a>bh20dPUY6 zWL@uSD0_>Hom;E?*xR*P>qysi!+JYPzRdapR&u_~S`Pzo1A2|eS8hJZXG%6^ZF0vS zB5%&xYUSDgLqGkMT*=v%^)>y~I6&&(o>l9?s0_^>?x4Kv=1%OJp0n9gc5{!? z;a(`axev;2ehXzc_fuYW^E)Ve{5|QipZpHQzEk%j_C)6@KS9~UpP}sGFHrXI0Oe#4 z4O^?aGM16HUo@~j* z&5qigSkdfGHLEu+yE^so{$F++<#_*3H2VT+_X^dIeW@v;uO*s&fwpeFQ1h}j)O@>= z{QCaef9JJVA_&Ed*Jj^r*VkC2 zABiUO{(ts$Cf_X5@9VRZs9*7KQ&?QyOtQtl|D`v#eE5I#>er1>{cK_RZc@EwUm)|P zW%jMK8|SnVX}7h>eE%=|7L#ukE&fH%ytysAE%_6i+q2uiLMYkm+>w2!um{7X9h zT{-10^nCv>yQAsv7A^k02P(e37pkA_q59du%H3!Aq*wmnZaSRj1hO;WLYN7cz%08T_^&2r_fO2i?&y6%y?63twkIKP8~z_YO8Qe!_NFKG{%_p(G_veh zZ}f`So`IWSA1M3vER_9v4$3a|g{r?F)cYsTL)H5N)O#uY;W_dTfaS<9!W`}Yq0TE_ zhB~hp2p@)nVEiif|M1&2{QeKVK)JzC{T~9=|01aOT!zBODfb#Y@G0>MJOYQo8R&<@ zMQ{YyCA<2%d%Yt`R~$MDu7iB%$=>t%aC|iWe1mZhdO-`%~H9sS)M|9eq&`RD3)e>KuL!)H(cIsB`#vFbmFyd2j*LInXC?H1#ZmI`3HoyK?_Ng$u~H z7HspA~Q$TnTr<&tMbEt%7sNR{=kPtKky32I@OlpTjTV zTG)W=Tn8(`zjAbbv_AU~_kr*KWN%{q^Zg%@^}oSnzW=+Fv+`rdwq|dE zeE-K}zWgfg<^NQVegDVo-Ot%SAh(G8X#L>(KO+4vvV3|^;}`UN|HsuIboJ4CS}PFM*T6KU$cKlt~%qm$anTmhnbD7$?Q%I}?rIv4sA>b;P^pxVFiUwJ6|_K#cdzfkR5B%iMD5|rQcz%s7uayT2tL3{oW^?bc1 zR6lD$d;SkKj$WQ~oBxOE=atl3%ftR3S$6v>^2sk;4J%+>D8En-$}e04}ww19fw^(HtDe{wU_@48#s__oU7dA^;mw1zrgNrp?{EijMr=!

3|F-mf|6 z{hG`2-miJ+{hFViyk855yNl!niZrI!=i-zY=-8^)Jm1$Lg# z_&@sIOEdKSh34pcFD=l1M@#g*msV)MBAK_gPCqW)_N;aK@$9e1(*`{rVy2&vej>5Q z)fPQ2Vy2&zeloGghqRBUq_<l1kD0kjR=c4z~dFc4r`S{PHwEyV%+J$I&?TsVwBDB4^I90wcA$C0RQuIFV zgWj)~;YH-ReBPb)BlQ2%BelL`KZ!&6y^3<|^Eu*>k6pw5U9*n%AI-zAL-Vk{Xdc!N z-T&+HJ-h*LW%>S`j|Gtd-ZwQPj_?@bm<+{o4^}`K`q6>|Y#R-}&x$6}sOe z(fz&?uX~O5AJaJBqj4D9xeNW>*D=@<$Kqg?ABSD|+`I9XS@i$W?^jL0583WS9LRE$ z!hYT3`3UZg(oW-G}fx=0A*XpY=jJI6Xa* z)`xfoI&MD`pTS44F8$A0=s5mte4goZa0jw}c<%5RvCkdmqR$;3$1>xBBI~dK!>ZAGCA!t5!D4LHQhUR03qxskoXg+o% znvWfY=3_^r`B(!qA8Ux_V~y}j_NOuWT%!s4T%#%aoG1+*zQlE$6dpYNz&!f&opGTdC zK94#d@5T#oB3_6-f9s7tf4c~M?szf!9PSdd{9cMahwFpp5tpIQ;Vws?!(D+shr1Ge z4tEv$9PVoLIovhq^RH|1e!LE+VqctocfX7qG9nps?!I0_K8oRf>yO@V1JL{JM)bMr zO}GdL;>uW%UtfOnw%sNuL9N8mqL zi4n>}9R2=T0{y;J75dz8B>MZHcjDnV3LD^P^m*c48IjTX5!!!Z`*CCOCLD)@@NOJ} zBM`9XP|lCOtk;@2-<&}h4$ZOqxs+*wEy-fns+{i=ACoV{@ded|7{-H ze|rM$zs*PcZwt`=+mmSjZ6Vr!TZH!Co}#W*1GOvZDRo8IwfHIy6V{#=sr z0@H^ip4TuPLw>sy&2L|%J{yh8i0!||hoS$r zG9&qZ+UsaPZWTU?tMPGs1LxzLxCqzaVqA;Q;W~T)*W*k07OudzaTUIU_6s-Q|K4-k znDICFyW=v*xafN!c3hM=`W(;4Hsg5K`vC974>Rl!ew49=_3RHK>ut^WnAr6&jHhm6 zx$5dqGCpO#Fwxv>SyS9>gQ-axdY9szd-ZqFL7pkr~AYC`bxw3LdHM8$@rf6 zJ_r1k?dL?k3$f29n9lqkGJa(KFy`xUo|pcFqwwc2|Cfwi#LqDwS^n3I-`P(0=x-Xv z`H|^=Wc*3IndOjpcgA1DJ|9HR!=7-yJP+(w=&${Q_SgPpx#QRI{2!-s9{S1X4b*}Rdq8D%uGHn!swA4cRlp|{)4c_ zU9|sL8|z~|JOnRbdxzo`co??8!!tduBQlR9zJVBtkIFoncp$O*yrcnUbN(7)-#d2= zZ-m9nZ;WoI3H#%F-A#$-&|gl&Comn`GCu?NCNeW~SkCWfWM%rkdA4!5uE_b!&&&;< zpP!kBwTKH@uj}Xn4d25s{*v=kg!9(Y{%1zwr$Nxu`;q#hjHVdEEJhLUsb&a;rupQ$r(N>v%4Nu1Ebw7^zK38pxK38pnK36>+eXe=} z>p8yImUv_3iJ2#5CdWZAjDwuaaoDdv1uZA-(EfaTv>)FA9Va-I<4oc+&~c9L=s3rj=r~6Ybe!WXbey9nI?i!6pP#va z=l{f`InU?dBs>=_$LFEt_|{#93HUd{gaTol7|&ucipX%X6gY#O;PvoF)V?&@>TeoSw| z{OhrCqRiK4)a+ov9f4yiu8> zQ!#R%-<3I*IJ0U@(9b32cRwa)j>F@|OwPO;+v0fafD^C_PQ>mw347r^*c+#$wvXZa zL-(TJAG#0y{?Pqs{qg`>zdVT6FH_O_w}lj z`}Jj<$@Jy80AIl+_$n^P75FB;hJJr&rv=_@2lI?iMu`}~a>{GQf^DDNqhwWf=C-c9?U+^3J6Tig>*Y`WDhu`B-_ycC(k61DKr_7(( zj^7hR+M!=Eeai&im+U4c`+qwjGP2^skH|V4 zY5%j1V!5u-BQHV_a?e! zoyqhXRo$~r&oaL{!)?gwPO3$o6|et2G3 z?}DuJu_^I|tY`gzl&juZmxTGW|6xAuKlWq)oL*RUY1U<-T=mgV&XDa~k##vX!=WQA zcUNkdk71nm>MXwBHjDm0I~)zyitD(2fy!q86|iT0E3MEgmj(044lH0-~hUn4R;Ya;Xge#-=`GmHLz*sn=pKiw~u3-{S%^gf%ya(*B4UbLRL z4_nNn|Bu&G4?TeE9-;lmn~2Se{at{Eh?nBS=<~&C;qz(#(dUaZLOe5T7W3VoN6`J* z7tc<`bI|kqXxPukvgWd1o?qmAKAts?*!@O6XMWZbxD=n{_c9??W7zeGt=|j;p6(I)?8<9E^^))knwM4nfD;4n@b?4nxP=4oAn^jzGuT zjzq`XjzY)Vjz-7Z8ldBC4bkzoM(B83V|2W&2|C`^6di9%L&w|F(ebtnbi6GS2PCqx zbJ*|R@oWwIjf}VDX6G|~NFq@%~I^$}8^w+XTJ zIWhIq3E6F#Z~cVKKQa3xV&`M1?@wmA>grRn+cDqz9z%WK9?p!NN!Xno%it?xUb z^?hfY8Smofa$H?C92bV~1$1NkH6o{HpF!++1+rh=!+yG7EEnqg9%y}k7Ry;r^~7VS zSI)+k*b6VgbHe)PWuF_idtUYh?04tr`5M}1<4(~Fv-ck-*;si|_Ql!BdKW{zdr9hZ zFHL=JAGF@R46S!BN9)}ySl)W~O0?d+itStPUQKMhdktFeUW?Yd*P-=pU$no|53Mh+ zNBeO%p#8Z1Xg_WMdb~HH$9ofcyaUmC`DScGd`md)LD{#4;~tcKdpPdfG#s~ar|979 z|C=8V%O09-9y2U^ILBlDdIx%*iJ3kkJ5KCzSE9#F%=AQd6|u*U}tUn=}Jc|9DsQdD&@SeqH+V933 z@8od2Q?l=6`<4@={N9&+Ke6Q(L-~Dx<*KV6%$~}8%P)rVyLeDC4|tf^JYX7{2TTv= zkM{bo7msVE|09jG?@wgU zPn9zaZv`HWuc7Y?>|6eI_Rscw zRciUwn8W-x(DxwTMBjs0gT4o`77t`Q>(J-x>(S@^Z=w0^+vw-NgXYB>ur|NQ(JOsmY{a?}N`oE#={O@Qx{|DO6 z|B1HqyU}+3FSMQCgSPX3qwV}ZSaaOo?0>QLguU6da%|`S%dSq9Tcn+j@>7ohoGA^No6} zF`5sSpwDefu?N#*=>OH0;W+lY9DNR3f&P!wF<8xZo8bYJ@8;<9%@*i;11)h7_hBpa zy@6xV{XGtSZ=f~$-as4ly@BJ=_XbWt-y3L)zBh0p`rg1v=z9Yvqwfuzg1$G<4t;N+ zJ^J222lTyxQ_<(F9nt5kozUm3ozds4UC`&OUD4` zpNW?19%#8f3oX|@(QBFjXFra@{-U zqEw8O>x*+PNySLHzSQ+X`9;e0WjR+cz3I5iHB84)uCGMP^;KxOz8Wpp*P!M4TC`kW zhnDNUXu0l(mh0=$a(x3@uKT0qdH`CkZ$!)WP3Ze81JUt1kJQ`y24r20xxjBzB-@F8wKQHGAV&`LMf9JDYb@hUr zCz)?vf}uTLi00Lc(7gI7w0(XW&8ruqdG#|mGybff%ke#@;rRUg8j<(cn~x*MvmzXy$HVqRzOoX{S6*j1 zzlXO9{T-FnXukReR&t)-#F4lL58*tn#jV8a@C#gzdlPTvY+!qiZ@e& zb-dL6#m367bH2$*_A4;td*8C0`QCTv`THKt_kKY0y&uth?1T>dZgdG8*ypYb=^&-e%JXZ(wUxE_1a=PUoA z*R>jbt`*5metr})BQDY* zHIMcmeePNxeeQaQG5d8Wj$ygOuqo3IN5`LzK+nsOIEDE~;WRuND@HfSZJ3*UeuCjS zP9yZWUSsrmP7}2M)D(T5lZHOeNyoj3jNEM2w>)O%S{}2ELwQ7=x8&sJ)?dEVnc)7t1YYxn85oG(2xH_PJsO`dsoD z^toa)&VO2j_8*%@TI9B5y7#sET(K3?n=t=aY#cc*w{>d1dVjP*?~mir`{M+b>lkgD zdm^#-hx+~GlhAT|&in0r^nN2|`h~d{5qsbDM(;afreB&b7JM6Z?7BrRMiVKeu0MIp$OD zZpgifxJK2Dx&1@A8(>ViyHVK=?LRiHyg7FuHpAP(dbemOueXNv1{sI)imW#@_jc@u zgTs15bBAD4;$f`k^AKcvcjOLddtO(hpFSct95z_l{4{u>TmIYfR#E9Phm+ zH*#QWelKP+pXYe*l-%Ta@4e`F?|n>9jq`?n)dRW7e$|6~ZgqTW?nAlBeihQMdN_Al zZn9s6A>W*i=9@Fnd~+t6Z$5(No3qe-b2gf9&O!6dN3rI(xw(&F?Fn;p7jYd1Rz03O zFLfP|eDjIi`KcJmHy7kSnTnBobD`^n<3{q$r*aoFz3I58HB85lZ$5+Oo6n;8=5uJi zxdhEOpGWh}7tnljDVlG-h~}Hi(0ubHG~av~%{P~$`Q|HVzWFNp{^klapL`9?Cs(5R z`P z#O8yXguD`fspxjz#-A49(Q3(Hkk@5=p^`R0ol^2OiKeDQZQU;G2j7ym@_ z#ocJW_!rKM@9}fV7ys69J}~5i|Azh88}`fnV0x&>s?mBZlE?da9M`_*XElf&H#-0w zH>;UvyGQ$vj+@nHy7yrn;%KC9-hp|^<459pc?S{uImr6;^9~N%tDkphp4agZ4f}`W zQHSLno|nv{Fyv83u)g)|k?8&%h1Rb}qxEV7v>tEB^5#*E(0rkBUNVnqLTtU>6wRa3 z&^#&~&7(5V_Ae7{|FY2bFB?4%IXK`^`v2(nit=#xY@Yw4-@`4yKN3ZGh1jR6D35k2 zyceR&DNiMNk+hy{$9{-$jQzDkH_UD>&Mn;{n&=-``3>rHee#B7U zv_tEg_Go?60j+ONMeCc6XnoTOt#3M`^-UMFzUhkAH>aWXO*gc@IUTKU&Oqy%?r42; zCR*S0KydZYEtMQD9< zFeqV-K5w7$6v2P7`fyE2s1D>R&cq`tW-?;55LNnEXAI)?h@TC~2oE-zW% z^d+{w>4(-g*Q52#4QPGSAEzb;gzG#de&hbvnfqs8-e|6m^$Aj6+!A8z3u5LE%DavE z-e1W4+w%q!J0C-RGKA%-tB2+dW4`qXhWg|Vv_2V*)+Zy-`lJ%APvU5OlE9hqDnFO{ zWTb}UO@98Uus?o2aYOIZyU_b|4C{5F+>b^31>>0BK2@)5tQ?;=A$6Z)xX&l1)}NGG z{~q){pN!t;Q_%bTUY7ShzYo37@8`JeFFio)ef}VNpHD^a^M}y;{9$ay=TAfTXF7U6 z&%pkV(EelR`LzFNeK!kFVENg2GR{HkiAT|T;xV+In2Xi}kK-SSC-UZDpQ5i|Xnyyu8L56`0Kftcw_@}4L5 zd?0z>3wcY~zQ>Que=%=aDn{a$^8VlaY&rEy3H!0HUV4@7Sud@y9>Ukq@6oNq&h+nI zN5|Dyq2ubS(Q)-R(Cxg5)>~_EQ(|qZ-deYRc@BBnTagH$amejxJ@*+#`2CL0(Q(NgXrA~5nkRmV=7~GeJn<_uPy8Cq6Td<8#BZ_Y zxbO46!`c(R&-;!0XJFM2c|WG^A0$uwDevc0jO2;GxKIb$rFFi`;+NS z$NiyUI)*%PH<~B@h1T19(E9psw7&iat*`$@>+8K}ef=L=Ust2`btFGoUq{jUx&~Tb zAAs}k-Zi`?T3^>f>+9NReO(8wuj``q^?_)8T@S6V4?^qfgVFlBK3ZQNg4WlEqV@G* zXnlP+T3;W5*4Ia(_4QF`eSI`qUpGMO>xMWW(I~%3zIjDs4d(}`ubbwlGkr)RO~Z5y z^>qeXUuWhg>+39H>+5W^zRp4G>s++H&cmsR{CwNxDe(dg+e7N(qWseQNW;0@FU9$h zc>8FHap*50^JDp^GvE3gsjtgJY<*44{A2Q)G2i+WncqCW1+nun)aNZ(uDZHa{;|xr zKF3g>ABWcGt|1V7MntvLx|XnuTcSfBPE&5!$rxL^MD%=f(Q^M)|JfBpcbd;a!$W0-zZ{y?UC{`Pq@ zvH9FB%#TKH%^$@1vm7DuZTYtodw!Aq7?M92m*TK+KMd7yosm5Ij{M>I$vhiF`#U0a zT`E)8C62Z`3AEj*Lfe~>EN}aJC))mw;=I`YjwZJKxeIN7$Dr-+ShW2ehhFEq(d#@O zz0MQR_s=J$wlj%%^Bau+qt}0OIKCF#lZ*^O5PB^7qSI!uZhpEN8!GGp>x#{^v*P z_M8%aHzVX1A5lM>Uu>IQ_`xb4_zC+uy@6q<`2edu=5pBAwmtg?ZO{Hi z+q1oBd-fkrO;o4avq-^y?b$(DoL}P5Z#|$O`MyR?^#43+;aRwEew~73{#cjk=8p%W z?^)DC^T&hG_dO0q*RPMRe+X_$9O~!NZXdS)=ZEWkL_zX;A6XEo*Ma4aD)_(s+6D#5 z>)nvguZ}k=Xk3uI-pKWCQqZ&@dA%{@k7;N=l#b?m8EC$ji9WB-Li53Fv|Qw%w@E%J|xjb!*mSg;smr@v@J;HIVTcZE>1$r#mQ*7 zI0Y>i?Qm+MeYh@D;vM$CE@2$3V?px&DmtP6SJ4?y!Y=6hiCxj($2krEH$HZH!L?i$ z+btx&=^kS98{+6D>ir%Cwr6J*^kg~PGi1553wjZ|9ELpT9G0uDKDXdJ=9>p$$b-&D z^PmgRJm^9+59*EPK^LKU(8V}2eu;$InEo<_NG7XB_4ojoWC2<|EstO zea^aX9PVaf^Nd^2Jmc1|AGH5yo^e}Z53&xkWW8c7sXaU5PRBpz9CC$Yzg?8oSWQMeSxgz|WohVzKz8Dk5^6(sWv40*=g zsq-^Fb$%wG?bAfGeVT-}OZTw6dB$Wk&zQn_G|#w~*mmkZG|#vn%`+ZA^Na`4=V(*W zJmR5n{vR%wM(p`l&;N9^yv@MfvuXeFZ{kPL>oNT-?jzfy1sqp({K~FQWC(GPE9g39WZtM(dsBXub0aTJOAy);lZE zdgnE?-dTy(JFnw_#HxZf!gXG);W{Jr&YJ~mL%p*`!*mSw&N{T-S)ZzR-XgZXc^j>7 z-a+e|4LCLNZmPc7xPN^^xqGkRd(M~T5UCF~huHeS>0=juSg?iZTO%JS*LleZWWB8g zA2Z+bimbP-;1gok!*Ja`Wx49=?FFAP-+BbYb^IKyM|Pm~$QS5!{SvK5cB1vjS2#2N zwfjRo@{NY$M?U|%u%CXu`)Pjm16nWqh%FcWRPYO*yDsvxhW*BdJu7z={Lc2ytNc~j z-ftSOMc#uA$5j4N@E7wZRPHYL6JJB(cn#)b`T@8HYhpdhsr{6H*uM40zi9ojm-#g~ z-v7}0qnhoGT^K2>Q5cDT9EobUU)1{GfI^R_W?`+uaXi99ok%rbA>1e%?fz}(D==Vpn*iOqu*@d~Rw=R;S zVLy@Sd4&Z`UlYmKaDI^EDl9B!`bUu>4bze7C517jzZEIfFddm*RyeIiB)&dUu3v13rqH~%Sz!y7^LU%1$4kugmW9U>d)%$i<0fYMafPjkJ$@vgZ&P?YpXc!+^G_&j zn~IU+II-~LaC|2zpTA@Tvfe3$9m4!}%5k>Wuz$#QPA%*l=66))chWE)`QN;*g>kd?85-6@rl0A2&PNXo(_MZ!^+HePJ1%*4VKT4mg}!%u z4*K5lx#)Yx=b`T%pO3!BdjWnpgYkbf5ABVczGv0`fGv0)bGY&+@8E;0%8E-+y8E-|$83$p_akm%VhP5Z$URcR} zH?V4O;gHmQhm120EgY7Lk#WX53Wuj+WSnt?>xJV+#u?*E}>yMhH=J`=s4q@ z=s4pjG>;yQjyK+g=GSA;@y4;}c;h&9yzy>yym34_-Z%k$J~R;>Z=8gVH{OH3KROwG ze{>4^{^-3p67NIb=e-|oA0I&5#|P2&aVpwAK7_W952NklG_-x3j<%08(DrdAnx{X4 z=IOK0_Hs7bUd}<=%SX}n@-ei%oQt-XkE8A7JhZ)h0tY1K7e2{($ zzPI=u`re|kS&`fp+S?}dM)J`XuRe-{2l?D^S^ zo}Yd3o>crd?ix+|AC~{Oa4)gvYoGrS+rC#bKN^V?MT?T<1&M1E9YE~)ME1W{QB7Qm zb&4$4wKZH%q}{GtbYM}k-Nw*v*JFL#v4ha-a4_0_)koW}L(q2XP?opdJ`8QQ4=+l# z+eZ-Fjva}%+ee}8_R(m&-2iKEW zNUW%g>0Vd$J-%|LH(`DSHjW%q)GRe$-ClF1o4>Tc%t*_kR;l^w`tFbrsxEgZy7ya!{-^dh_)@V-x5AQ{BFX@MJE;6KA&9Fj_crcIt9H>#7u8rbSkme zs{?wyh?(B8s1vc*4apli7j@xtyiUmcu0^M%Vr02)MW-{}@jxxCI-}^!us_{3><^Ov zoK@5#tbbM!<9_UKPYv@i^Meb~{Gd0Q zA6$e!zq}ZIet8M{`<|Dg+wFt?Kig&K|Fd0={{H9{X#Q{|mM-M|f83O~x+s}9T%+MW z*q1k4SCq^f`m%r3@qR_u7bWusByYH(sDDv1Z@`c@3_$aS8`1BR+=TW62cpk0Z^qBb zCvL%2#J8f)LkFS%zjYh>`-8Wm?c-pyeH?bDt1Z*o0sA2Gfv@`!OLZ^?Le(VSF_w2zO5gp$p7Bb&<6hk|@2yI87Lfg@&(ROq(+KxVhwxiGD%=mMDKJDld z4d(^9-(M(N#(dk4rEEVZ@?wa+&za8rmx^9yzT-Sdyu4@y@f!C36?DAlRXm7t&2;9! zR`fdCSru8S;d~&|R~4-$w*5fP-y7k4c--tqs6W=A^~YM48^Hav4y{Mm<7Dd5w{S4i z-)8%*qwf@LAa*}>4%6R7-$&nw53qlma0b4IPvHBw7&nLg`Jm`SVvj?;9v`LRE%+kw zRz9ay^y8v!#C{I4-=7wJ64w8;=riUYAKk8DzHyuA=SBZ-JN^apZO6Yv+wq-Yefs}s zJN|WuzbX2j`Cf-_*$%(|7h*qm-}E2C^dF0UN_`%3UVkq7h1lz}&t1g+|JSc!{%=Kp z5__D#qu1*X^m^@^zB@JjuhjHCVZFbL{^j#lMgGxne93rk(SNBJ`TXjlNOAJI?lVek zUQnah^L0RR&En*Jg2c6oYZH6jk@HcvxDGDGdd21i2WlvvNM3MI@xjH(yZ}R9P@nZ} zZw^7r%b{pHa~Rsr9FDdxN3gtk!I5ZQa8z-!Jv^G&_ND=v7c@lkf<|aw&=}1NnxJ_> zQ#3C~L-T@k^!Z%|`ur{vEw5SV?@MK4X#eq6rstyNHxDhp`RqsQXhCryvDa6JGrb7? zAFE>Yf2>N--{C4n%XJKG*UM7JQI46BisECK?sn96y&2lBH%IS-7U+G@61@*vq4&YD zXgNO)E&r|2a?*zFwu&BKd;+oCMan_j;uBM`Mkzlhh3k1r@yS>ta!PS~mODP$PQ!Y} zZK55D|8L&VskmdY?R=-=E?g(CV`ua_65IY4cO&+Co`zmeVy2&7d=9@`yAthZ$I-kZ zf#wxeXkIZA%`5IizwbH<9lscjj$hn`j$e#H$1ldB;}_%5@r%3B@r&{3_{9XQIc`$% zM65kwQt^Y-9|NoIDW06FKalZ@DaH4uVr2Z{zT*2+F*1Jffa`_xiHu)NEq<8kO~*Z? zVLFEKi)rZi#dLK1Vg@>XF%uoXcmy54n1zmC%tpsA=Ah#jkD}ujkD=oibJ6jO$Isd7KdJfIImY{jp z^Jw1n0-AR%Mf0u~(Y$LJns>c~=3Ou2fW-3RS2;hu+$NIvymSl)cf<*es6hkEOS;t$!5?GUouN5xx+T@FLuwUyiEYW zOpiwX4Clq;XMaLH{1;je?_s$`t9kzqZO8s$yRD=D7Vjl?|1f@B^uOZjRIHA3L`stF zRJ0@#KQ>yU3?NFT(_p@%vfy5r4dY$T};)Bq3>R`6pDq6qf z5MsBB9LHfLhlceJD>;JsEu)8Pm~Y%7dSuD}n~xpMeDkpeXg=03tWW!o=3|XR+@vI( z`Cgx$cBaV#iVP(7Y@^ELTucOziO%qSvzs zy`KA~m!zhbrl!ZjdSxXQeD119xrY5o#>bR2OU1~3G%smE>~-H~OJeh~R?Lq^jx9N^ zBzYepaqE&c#Fhu-yqr*SJTAo(OT6FPYAC-*UUpK+$tB6W3`1Ua3hUdRw?oTOdkp=5 z4E=w!{qD%}=4GAGysR_F<2XeZV%zhsXkK<2nwND$^Rm;?yzC4#FYAuxWoM#!Sr4?_ zo`sg%o@}>u^z4#e#9lX~+@4c%ZYoyuwe!$%n)A`|mq2xqrZ+ksa}n!19&<4^ zja*W4DbwAqIv&%9>5j)-hK(bamt2vWujX}EqIum_XkK?Un%7-}e%`gL=XtmeGb4RV z`Z3+@t9jk^XkK>%^N)@8FBy=UuO7#Z=zVq*dY=tM@3WiH`|K94sA zDtdd#U}8THDPKcMhNfaQ-y0Un$?%dpLirkAQps{Hqa!q|XWSwhFG-|gb=<289rqfE zj(a8FKO0>#s>Hl)bjcXXh2`chwA>IgeQe3y#Fn3NX!#*#`uLIw#Fir@51d#siS1f$ zkootNOisl}9yq1szOY~SYS>RC4}75H{;>Q5B~!!v2Q|z`w*OEG`Cu4#+LsqjE8%|{ zSO0JPXa>uf7tUn5dEq1I@6pV{dsuEZ`hPBS&^+-`bp6NBd~YtA?>&y@kMq#H?+NsG zZsy~r#DbD!-uI-2`)^;~x2PnU_dUgaRL7q#SzMCL`;ffvnUZHql6fD7-#2*<&Fhw+ zdEN79p7sKor!7VEju+9qV;P!vyoBZ*FQa+Kay0LF1NA~B}uz&6k^TYl1J9>Zp!E&Q1hkxQV zxErl6{|f8B_|#?7L8|9|aiHS=vxBc;jqG+OHZ(Emr<(*u}p zyH_(zuT@%`*!|pR9b((1y3CJ84lJ!#nmo@)d{F7Z#2yFIE*(-@AD7}`rM63lYB&$* z^Z(K#N>k7Oi8ph+N3y>4%Teg@AC1;44bXa}AzGg_V)^j=A8nVKlqT!rro`4SX&9dW zV|f0Lwo934JCud~K65tq;=JadzeA9V7Zc~9=Q|%g-vwy9P>8k*MQFQFjJ9tj=MUN@{zy0hMrOivN4_lPB;`luNmgw;lGyT}o*2JEN zg^b}FUbq@JTb3*+%!_+0DLu1?3(@OaKwH{8f_r>B-b1O2{GcifaXvou*h z_Rvrc_SKI)OOy5E*=)Bu-mCPS(q#RJ)Q{(uo>!WzA2B>%KOgU<|8)V{ue%UWdV=;J z?WbOZ_ERrL`>B_p{nSg*erg}IpL!YEPrV%Nr(S_I$6Zx=CDxvBRp||s+ksVAmtK=9 zw@5$r+S2P%G15=%TiP!bBmLCtT`wFT(ogMQdLz@DjvJt1I);AgO=v%LAlgs88SS6m zg7!~uMf<0N(EjOdX#ezfw0}An?Vk=o`=>+E{^>BZe|iVnP7Fuei4kZ!QHiz_akQOC zpzTBz+D?o_+lf2Tc48FTPK-v|iM!BtVhq|&j78gtacDbnH`-2&N85=BXge_xZ6_w- zfW$qeQ#dcZ%*;RJ@_%p+b(QF+l5cqzIpnm#MX=3(RSf8v|acdZ5MX1+%eHFN_P@>sQOaFc`|;T ze|4&!sY4#@n&V@IT7qp6{LX{_h@Y>b}ICg}NWik?sAH=4F8J(itXE+e&EW@@>t)N;&c|8iovEbnt` zZCaTh%fn_^z;d29Wd90d#o_!EX*fT~@};qouzYEZ_LB1#(=Z>y`@!Y0WcyaZ=T*m# zi8YHQ+c%_rYaVM6OSW$q##>vW^>!Q>+SYvz1;z=w@*du?T%=@-3hI?JL7;vm)L1B>+P-@>MNw) z?iM?P=|d8yYnYCq-tLap+h@j-^>z